Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2648 Thanks!
[Music]
welcome back to lightning session three
ladies and gentle
beings form not mentioned
feel um there were still so many people
who still wanted to do a lightning talk
that we decided to do another one uh and
since we already late uh we will
immediately start is the first Speaker
here there was someone oh yeah all
right let's see I also have my little
list uh lightning talks scheduled day
three okay so you are X socks about the
bu body friend cool
cool then the stage is yours go there's
a microphone thank you I will be
referring to my phone for notes
so please bear with
me hello I would like to introduce you
all beautiful beings to the concept of
bug Bounty triage now okay who knows
what bug Bounty is
like we have some hands that are not
raised so I'll give you the too long
didn't read didn't listen um it's
basically Outsourcing your software bug
hunting to outside
beings and paying them as long as they
stay within your
guidelines um a lot lot of Corps
basically rely on bigger platforms to do
the signing up processes etc etc rules
for
you um and you know basic uh goal is to
improve security and it often
does
often um so triage part is basically
what I'm working with right now um
it's
the customer support sort
of portion of um bug Bounty I'm I'm the
lady behind the counter that bug Hunters
submit their reports to basically and I
take a look at the report and I
categorize it by is this valid in the
first place is this going to the right
place and is this the right sort of
severity for what has been submitted
and a lot of those are Fields basically
submitted by the hackers themselves like
this is going to such and such domain I
merely need to check whether that is
within our scope within the rule set of
yes we will accept these sorts of
reports and we will pay for them or if I
need to politely tell them to um please
like submit this to a another sort of
program which is also within scope but
may not be paid like with monetary
benefits Etc because we want all the
bugs we just might not be able to
compensate for all of them I happen to
work for a big company with a lot of
small moving
parts so for scoping
easy
uh
for well domain goes into scope and
scope also consists of what you have
done so fishing employees for
credentials does not count as a bug
report I'm sorry to tell anybody who may
have had the uh right idea to do
that and these are like things that we
have ruled out as like we do not need
these sorts of reports in order to
encourage people to not tried to hack us
just find bugs that we can use to
improve our security
overall and in terms of severity now
here here's the difficult part
determining severity is very particular
to the company and the dev team so I
basically need to take a look and
just glance
over the um the report and see if Okay
so this has been subed as like an
exceptional bug does it count as an
exceptional on corporate level does it
affect an exceptional number of
employees for
example does it take exceptionally
little uh effort to be vulnerable to
this such as
um uh SQL
injections long story short worst case
scenario you can expose like the entire
database that that is an accept well
that is a critical at at minimum it
might be exceptional we have our
corporate criteria with
that and after I have like initially
like glanced over seeing if it's the
right sort of severity I let the hacker
know that yes we will pass this on
or submit it
elsewhere and um then I go to the dev
team and I'm like hey we have such and
such report do you think this rating
matches and the dev team is usually yeah
okay if if it's a critical they'll be
like oh shoot we need to take a look at
this right away to determine whether we
need to fix it now or if we can like
take a short breath like calm down it's
not that
critical and usually the dev teams are
either in agreeance or consider the
reported issue to be lower than
initially submitted very rarely does
severity get like upgraded from the um
initial like submission it can happen it
has
happened
and
sometimes my intuition
like I I I go to the dev team and be
like okay so we have this medium bug it
looks like a low to me and they're like
no no it's that's okay it's a medium
it's a medium and I'm
really I don't have to like ask for
reasonings for it's staying medium so
don't ask don't tell sort of deal but
usually for low wearing severities we
like to give we like to give hackers
reasons for lowering
stuff
[Music]
yes
sorry so in terms of initially like when
I got to this job I hadn't done any bug
Bounty like submissions triaging at all
how do you
determine what is what we have like a
small guideline line of such is such
like open
redirects um you plug in a URL and then
SL I don't know google.com and then
suddenly that URL directs to google.com
we consider in my like line of work
those as low and I know this because we
have like a small list of guidelines
that appear on our bug hunting platform
as well and using those and Consulting
with colleagues who have also done this
before you I hate to say this but
there's like no general rules you just
sort of get an intuition for it and if I
had any slides this is the part where
I'd have the image of that guy in the
The Matrix movie being like blonde
brunette etc
etc you just sort of get a feeling for
it so in terms of in case any of you
guys are interested in starting
submissions I have some helpful
guidelines to make my job a little bit
easier for
um like determining
triaging what sort of report you've
submission uh submitted so POC proof of
concept basically uh reproduction steps
we love those we like those sometimes it
just needs to be a link where the bug is
shown to the person judging it and
sometimes it needs to have images we
love videos saves us a lot of
work um
sometimes sometimes like submissions are
made in a
hurry just this
one uh and that's understandable like
bug bounties are sometimes a rat race of
who finds the first bug and who submits
it and the rest are categorized as hey
we've already gotten this before so we
won't pay you unfortunate I always hate
giving the
news so we understand that there might
be details lacking just be ready to
provide anything in case the triager
asks and
just closing out if you're wondering
whether you should submit a bug report
yes
always like three bug reports that are
not in
scope not on the right domain not even
belonging to our corporations we don't
care we're just happy to have
submissions it it keeps me busy and we
would rather have all the false
positives in instead of one false
negative thank
you thank you very
much all right uh next one on my list ah
USB yeah all
right oh for those of you who are
annoyed by getting rig rolled by the
stereo uh device we have a headphone
station where you can directly get the
audio from stage streamed to your
headphones you want the dark one it will
be bad on this I make both
choose it's exactly the
same okay you have the keys and the
yep the micone there you go 10 minutes y
hello um I'll talk about the uh some of
my pains with lip word and what I've
done to solve it so lip bir has this
kind of
dialogue with the in W man at least
um where can select a few different
network types and it has bridge and Mac
uh uh VAB device and and and the net and
so on it Al also a few others that you
can select if you going to create a new
network uh Concept in it but I don't
really want to use that I'd rather have
it uh with a specific network uh
interface per virtual machine and not
all this briding [ __ ] thing so uh in
order to accomplish that uh I found this
met data field in the XML that uh is
already used for oos
information um but that uh can also be
used for a lot of other
stuff uh and uh as long as you have a
XML name space it's possible to just
make an extension and uh then uh use a
hook to uh get called once um uh the
virtual machine is is getting started up
and when the tap device has been
defined uh and then uh by using a lot of
X path queries it's possible to pass
this XML uh in um uh in in a shell
script um in a more San way than reg
Exel um and then um by uh using this
information uh about the configuration
uh you can configure the forwarding of
the network stack uh in um a way that
doesn't involve this bridge Hills and
other weird
stuff um so it looks like this XML so
this is the metadata part of it it's
split up so it fits better on the
slides um and basically just you have
multiple interfaces you just have to
specify the magas of the interface so it
knows which interface which Gateway
belongs to and the Gateway um Noe in
this XML is just directly transferred
over to a IP address add command and the
host is
just transfer to a route uh and it's
also possible to add router uh uh so you
can route a subject into a virtual
machine um but by doing it
uh in this way uh then you also end up
using this special type ethernet
interface where instead of this um
normal thing it's called Network or
something like that uh but then it has
this bridge type um um elements under it
and here it just has the most basic noes
uh underneath the interface
element uh but the important thing is to
change it to
ethernet and then take the magress from
there and use it uh in this
XML um and then uh it ends up uh just
creating it as one sub the same subet
you can have on multiple different
virtual machines but then you have a
sl32 device
route which means that it knows that
that is the most
specific uh route for that uh IP address
and therefore it only asks for app on
that address and then by also using
reverse uh route
filtering uh it also ensures that only
that interface is allowed to use that
address uh so blood traffic if some
other work Machin try to claim an
address that doesn't have permissions
for um and then you can also have enter
uh inter VM reachability even if they on
two different VM hosts uh if you have
these
S2s um propagated through some routing
demon like bird or uh um be a free-
range routing or whatever you want to
use as routing demon
um um and then because also uses proxy
up it the machines can see each other
even though that they are in two
separate layer
twos then uh it uh it's possible um
for them to reach each other because the
proxy up means that the um that when the
we host these the app request for IP
address that uh it knows that it has a
better route to on another interface
then it just claims to be that address
and then the traffic gets routed um
between
them um yeah and and some of the future
stuff left for this is uh some stuff
like the trying to uh get word installed
to make this custom XML metadata it has
some options for them but they had quite
a lot of options you need to add and a
bit Club of something to do but uh yeah
it would be nice to have some rber for
that uh and it would also be nice to
have a word manager integration so that
uh it's more user
friendly um but
uh uh wordman is a little bit difficult
in that it doesn't there's no way of
detecting which which which hooks are
installed on the server
so and I know there's no options to set
that this server has these extra
capabilities um so that part is missing
in man and therefore that's a bit a
bigger
task um yeah and otherwise uh try and
check it out it's a small easily
readable shell script uh easily uh split
up into a lot of different subfunctions
to keep it uh nice and
tidy yeah I've have originally prepared
this for 5 minute uh slot at B hack a
week ago but yeah yeah all right thank
you very
[Applause]
much uh yeah all right you post it and
address uh if you can't see it here
remember the stream is recorded you can
just check out the video later and type
in uh theed uh the
address our next speaker is Astro right
all right welcome and BR
good
hello ah hello I'm Astro I really like
decentralized technology and and I
really enjoy social networking so even
back then I used identica and diaspora
and I hacked on body cloud and we asked
ourselves how would Global uh Discovery
work in um decentralized social
networking and do didn't take us long we
just looked at the open web and there
are search engines which uh fulfill this
task and everyone uses them right so
I've been using Mastodon for like 5
years now and last year here it really
took up and we decided to open our own
very small instance and when I migrated
from chaos social to our own 10 user
server i f pretty much left out because
there's no big Federated timeline
hashtag search gets less useful
and we we spent some thought on it and
took a look at the mtoon API whatever
mtoon uh already
offers and it did didn't take us long to
write a little spider that uh yeah just
cross my totem
instances and then we just uh counted
hashtags and created a site called
f.b and you can even filter by language
and if you look at the German
language can I
zoom there's the CCC cam trending
oh oh it was 5 minutes ago my is very
active so you can see uh whatever is
trending now uh in the left column you
can see what is trending last 4 hours in
the middle column what is trending in
last 24 hours and in the right column
what is trending uh in the last week
compared to the last month and it's uh
pretty full of soccer so that was a very
entertaining to build and of course we
we don't get your private messages we
see even less than Google Sees and we
store no uh content data we only count
hashtags but of course we want to use
proper mtoon we don't want to watch
there we want to use the hashtag search
and once we run our own instance we
discovered the admin settings in
Mastodon and mtoon intends to uh
integrate so-called activity PB relays
that allow you to swep all the content
with other instances but if we use this
content from thousands of mtoon servers
our mtoon server will be pretty
overwhelmed that's why you can find at
the uh bottom of this
page the link to a very uh specialized
relay the fatty bus
relay
oh and that contains some uh little
instructions and then you can add a
so-called activity pu relay buy hashtag
for
example
okay if you want to subscribe to # CCC
cam23 that's the URL you have to put
into the muston uh relay settings and
then you will get lots of specific
interesting content to your mtoon
instance as it turns out this can also
be used by ordinary users but it's
actually intended for mol on admin
and in uh in the meanwhile I we started
this like 9 months ago there's like
1,500 individual subscribers so people
really like it and they find it useful
and it enhan their moton experience
greatly but the motan developers decided
to shut down the apis for use I don't
know why um so that brings us uh
problems uh in fact they didn't uh
precisely shut down the API they made it
uh authentication only so only their uh
registered users can get the public
timeline which is public
data so if you go back to my faty boss
to the main page you can
um ah you can hit the uh link up in the
uh right corner and there you can enter
your masteron instance and donate an API
token for us so we still can consume the
public Federated timeline nothing of
your private messages but but please let
me add um don't use muston for private
messaging it is really not enter and
encrypted and it's not properly
separated from the uh Activity Part
which is about publishing so your direct
messages in mtoon will be uh directed
statuses it's not enter encrypted at
all so uh have fun following hashtags
and if you want please support the
service thanks a lot and thank you for
the chip with direct messages I was
actually also not aware of
that cool we are we're getting along
um uh the next speaker is Pierre is he
here
I
e
all right there you go 10
minutes H okay hi everyone uh I'd like
to present uh scooting do app um it's a
mobile first app to organize a secure
transparent election so it's a tool to
organize a digital election how does
that compare with physical election
because we don't we want all the useful
properties of uh physic real
election um so yeah what do we actually
want we want our votes to remain
confidential at all cost uh that's one
of the main priority and we also want uh
the execution of the election to remain
um fully auditable and
transparent and uh we want the result to
be proven correct so no one can really
contest uh the result at the end of the
election so uh cryptographers and the
researcher uh inventing the concept of
endtoend verifiable election to do
exactly that so in this kind of system
your vote um you can verify that your
vote i' be aced or for so that your
voice has been heard in the election and
you can also verify that the election
like the result of the election is
actually the result of all the encrypted
vote so how does that works we use um so
your vot is encrypted and um we use
homomorphic encryption to toally all the
V together and then only the result is
um is
decrypted um so along with every vote
because it's encrypted we to answer with
a valid vote there is some zero
knowledge proof to to verify that you
only vote for example for one candidate
and uh you only add one vot one voice
and not more uh
so uh this kind of system can also use
the mixnet at um as an alternative or
complementary to homomorphic encryption
um so mixnet act as a Ballot Box
basically the voter can be mixed so you
cannot know who has voted what and then
you just decrypt all the votes but you
don't know from whom it's from it's like
really like a Ballot Box uh to we use
excellent bellenus library from IA which
is formally verified and um do all the
as all those great cryptographic
operation uh check it out if you
interested on top of that
um uh scand up app is compatible with
the centralized storage and U the
centralized authentication that means
that non entities that don't trust each
other can still co-organize an election
and uh don't have to fully manage all
the voting list uh they can manage all
the voters separately but still make
consensus over the result of the
election
um so yeah we think these tools can have
um great potential to make voting much
easier cheaper and accessible and we can
organize a lot more of election and
polls to um have a lot more democratic
um
tools um and you can also use uh more
complex um voting scheme um like cond
and um candidate ranking so you can have
some
um uh rules that maybe be more fair and
have more chance to do consensus than
just voting for one candidate you can
make something more complicated because
the machine will compute the results so
you you don't have to do it
manually um
yeah uh word map
[Music]
um
so yeah uh we need we actually we have a
demo you can check out um but we only
have a basic uh implementation with
basic uh voting system and we want to
implement alternative voting like say
um and also this um decentralize
identity because authentication is a big
um part of making sure everyone only
voted once so that's a big part of
online voting
systems cool thank you very
[Applause]
much