x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

Chaos Computer Club - recent audio-only feed

Der Chaos Computer Club ist die größte europäische Hackervereinigung, und seit über 25 Jahren Vermittler im Spannungsfeld technischer und sozialer Entwicklungen.

technology

All Episodes

01:17:48

Barrierefreiheit: Das Internet ist für alle da (dgna)

Chaos Computer Club - recent audio-only feed ·

2025/11/27

Digitale Dienstleistungen und Angebote sind aus dem Alltag nicht mehr wegzudenken. Von reiner Informationsvermittlung bis zur KI-Interaktion: Das Web ist unser ständiger Begleiter. Was aber tun all jene Menschen, die aufgrund von körperlichen oder geistigen Beeinträchtigungen nur bedingt oder im schlimmsten Fall gar nicht am Netz teilhaben können? Die Stiftung «Zugang für Alle» beschäftigt sich seit 25 Jahren mit genau dieser Frage und gilt als Kompetenzzentrum für Fragen rund um Barrierefreiheit

00:04:06

Closing (god2025)

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

00:22:36

News from the Juice Shop ecosystem (god2025)

Chaos Computer Club - recent audio-only feed ·

2025/11/26

OWASP Juice Shop went through some significant renovation and enhancements over the last year in order to keep current with the underlying Node.js and Angular frameworks. MultiJuicer was entirely rewritten in GoLang and is now faster and more reliable than ever before. All Juice Shop side-projects have been migrated to TypeScript and brought to a common stack for testing and code linting. But the team did not only clean up and refactor behind the scenes. There are also lots of exciting new features

00:11:10

OWASP Top 10:2025: Aktuelle Informationen und...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Der Kurzvortrag stellt den aktuellen Stand der OWASP Top 10:2025 vor, mit etwas Glück haben wir bis dahin schon mehr... Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

00:21:12

Der Cyber Resilience Act: Wie OWASP für die...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Der Cyber Resilience Act, kurz CRA, ist eine neue Verordnung der EU und tritt im Dezember 2027 vollständig in Kraft. Das Kernelement der Verordnung ist die Softwaresicherheit für alle so genannten „Produkte mit digitalen Elementen“, die auf dem EU-Markt kommerziell angeboten werden. Diese umfassen sowohl vernetzte Hardware-Produkte, in denen Firmwares laufen, als auch reine Softwareprodukte. Die Anforderungen an die Software-Hersteller erstrecken sich von grundsätzlichem „Security by Design“ und

00:22:08

YuraScanner: Leveraging LLMs for Task-driven Web App...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Web application scanners are popular and effective black-box testing tools, automating the detection of vulnerabilities by exploring and interacting with user interfaces. Despite their effectiveness, these scanners struggle with discovering deeper states in modern web applications due to their limited understanding of workflows. This study addresses this limitation by introducing YuraScanner, a task-driven web application scanner that leverages large-language models (LLMs) to autonomously execute

00:42:22

A CISO's Adventures in AI Wonderland (god2025)

Chaos Computer Club - recent audio-only feed ·

2025/11/26

As a CISO (or any other security expert) in the area of AI, you can find yourself in increasingly challenging and sometimes bizarre AI-related situations not unlike Alice's adventures in Wonderland. Depending on whom you speak to, people either have high (inflated?) expectations about the (magic?) benefits of AI for security efforts, or try to explain why "AI security Armageddon" is looming... and that is just the security part of the story. All other areas in your organization are heavily using or

00:43:05

The Trust Trap - Security von Coding Assistants...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Coding Assistants wie Github Copilot, Cursor oder Claude versprechen einen Effizienzboost für die Softwareentwicklung. Doch welchen Einfluss hat die Nutzung dieser Tools auf die Software Security? Dieser Vortrag analysiert die Vor- und Nachteile von Coding Assistants in Hinblick auf die Sicherheit des entstehenden Codes. Er gibt einen Überblick über die aktuelle Studienlage und die Benchmarks zu den verschiedenen Modellen und diskutiert die Ergebnisse. Neben der Bedeutung von eingebrachten

00:24:28

How we hacked Y Combinator companies' AI agents...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

We hacked 7 of the16 publicly-accessible YC X25 AI agents. This allowed us to leak user data, execute code remotely, and take over databases. All within 30 minutes each. In this session, we'll walk through the common mistakes these companies made and how you can mitigate these security concerns before your agents put your business at risk. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://c3voc.de

00:24:42

"I have no idea how to make it safer": Security and...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Browser extensions are a powerful part of the Web ecosystem as they extend browser functionality and let users personalize their online experience. But with higher privileges than regular web apps, extensions bring unique security and privacy risks. Much like web applications, vulnerabilities often creep in, not just through poor implementation, but also through gaps in developer awareness and ecosystem support. In this talk, we share insights from a recent study in which we interviewed and observed

00:24:37

Extract: A PHP Foot-Gun Case Study (god2025)

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Do you always read the documentation before using a function in your languages' standard library? This talk explores the attack surface of a special feature in PHP which is easy to misuse with unforseen consequences. The `extract` function allows to replace the value of local variables named after the keys in an array. Calling it with user-controlled input allows the attacker to change arbitrary variables in the program. The documentation warns against the dangers of using it with untrusted data,

00:24:38

MCP security hot potato: how to stay secure...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Model Context Protocol (MCP) is the latest hot topic in cybersecurity. Business wants it (AI is the new mantra), developers are excited (new toys, new code), and security teams are left to make it safe—often with already packed schedules. Let's treat it like just another Tuesday. Like many shiny new technologies (remember the early days of cloud?), MCP is being built with a “features first, security later” mindset. As a fresh piece of tech, it blends novel vulnerabilities with familiar, well-known

00:40:58

Pwn My Ride: Jailbreaking Cars with CarPlay (god2025)

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Apple CarPlay is a widely known protocol that connects smartphones to car multimedia systems. Based on AirPlay, CarPlay is installed in millions of cars, as it is supported by hundreds of car models from dozens of different manufacturers across the globe. In our talk, we will share how we managed to exploit all devices running CarPlay using a single vulnerability we discovered in the AirPlay SDK. We'll take you through our entire exploit development process from identifying the vulnerability, to

00:39:58

The Automation Illusion? What Machines Can't Do in...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Threat modeling stands at a critical juncture. While essential for creating secure systems, it remains mostly manual, handcrafted, and often too slow for today's development cycles. At the same time, automation and AI offer new levels of speed and scalability— but how much can we rely on them? This talk explores the tension between automation and human expertise in threat modeling. We'll dissect the traditional threat modeling process—scoping, modeling, threat identification, risk analysis, and

00:19:24

Phishing for Passkeys: An Analysis of WebAuthn and...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

WebAuthn was supposed to replace swords on the web: uniform, secure, manageable authentication for everyone! One of its unique selling points was supposed to be the impossibility of phishing attacks. When passkeys were introduced, some of WebAuthn's security principles were watered down in order to achieve some usability improvements and thus reach more widespread adoption. This presentation discusses the security of passkeys against phishing attacks. It explains the

00:26:08

OWASP Cumulus: Threat Modeling the Ops of DevOps...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

In this presentation, we will highlight how threat modeling, as a proactive measure, can increase security in DevOps projects. We will introduce OWASP Cumulus, a threat modeling card game designed for threat modeling the Ops part of DevOps processes. This game (in combination with similar games like Elevation of Privilege or OWASP Cornucopia) enables DevOps teams to take the security responsibility for their project in a lightweight and engaging way. Licensed to the public under

00:22:18

Introducing Passkeys - Strategies and Challenges for...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

The future of authentication is passwordless - Passkeys are the key technology. This talk supports developers in implementing Passkeys in their organizations and helps with the decision between in-house development, SDK, or Passkey-as-a-Service solutions. You will learn how to design recovery flows and fallback mechanisms in a user-friendly way, how Passkeys can be securely shared across devices and platforms, and what level of security they offer compared to traditional methods. Practical user

00:24:21

Continuous Vulnerability Scanning with OWASP...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

The OWASP secureCodeBox project aims to provide a unified way to run and automate open-source scanning tools like nmap, nuclei, zap, ssh-audit, and sslyze to continuously scan the code and infrastructure of entire organizations. This allows setting up automated scans that will regularly scan internal networks and internet-facing systems for vulnerabilities. The SCB also allows defining rules to automatically start more in-depth scans based on previous findings, e.g., to start a specialized SSH scan

00:34:16

All the WAF power to the devs - why it reduces...

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Web application firewalls are often seen as a hindrance when going live, as perimeter WAFs can clash with GitOps-driven platforms. Empowering development teams with an application-centric WAF setup allows them to run and tune the WAF throughout the entire development lifecycle. It also enables full integration into any CI/CD pipeline or GitOps approach, reducing late surprises during deployment. In this talk, we demonstrate the application-centric approach with Envoy Proxy, OWASP Coraza, and the

00:29:24

LangSec for AppSec folks (god2025)

Chaos Computer Club - recent audio-only feed ·

2025/11/26

Die von LangSec beschrieben grundlegenden Sicherheitsprinzipien erklären die Hauptursachen vieler Sicherheitslücken und wie man diese beheben kann. LangSec sieht die anhaltende Schwachstellen-Epidemie in Software als eine Folge der ad-hock Entwicklung von Code, der Ein- und Ausgaben verarbeitet. Gemäß LangSec besteht der Schlüssel zur Entwicklung vertrauenswürdiger Software, die mit potenziell bösartigen Eingaben korrekt umgeht, darin alle gültigen oder erwarteten Eingaben und Ausgaben als formale

2,782 results

Similar Podcasts

Lead With AI

Tamara Nall

Linux in the Ham Shack

Black Sparrow Media

Data Engineering Podcast

Tobias Macey

Eye On A.I.

Craig S. Smith

Reflections

Livewire Labs