Human microservices at the Dutch Railways: modern architecture, ancient hardware? @ Zero
2025-12-29 23:00 - 2025-12-30 00:00 (Europe/Berlin) | Zero @ 39C3 (de-en)
Filedrop has data for this session!
https://rescheduled.c3lingo.org/conferences/39c3/sessions/f894f246-6bd4-5750-a66b-d073e37b7acd

Assignees: kaste, cv, Teal

Speakers: Maarten W

The Dutch railways have been operating an increasingly complicated network of trains for over 80 years. The task of overseeing it is far too complex for a single human. As such, a network of specifically scoped humans has been connected. Over time, computers and software have been introduced into the system, but today there is still a significant role for humans.

This talk describes the network of "human microservices" that is involved in the Dutch Railways' day to day operation from the eyes of a software developer.
When a train breaks down in the Netherlands, a system of interconnected humans is shifted into gear. The current state of that system has been developed for over 80 years and as such should be seen as an architectural marvel. Even though there is nowadays a significant amount of software involved in the process, the people involved are still very much necessary.

This talk describes the processes and roles involved in the Dutch railway day to day operations. We will start at a broken down train on a busy track and work our way towards solutions including dragging the train, evacuating travelers and redirecting other trains on that trajectory. We will explore this from a software developer's perspective. We will consider the people involved as an ancient form of hardware, and the protocols between them as software. We will also go over the more modern additions to the system: phone lines and software running on actual computers.

After our investigation you will have a new understanding of the complexity of running a railway network. And we will ask ourselves: is this an outdated system that needs to be digitized? Or is this actually a modern system with microservices and a "human in the loop"?

Security of Cardiac Implantable Electronic Devices @ One
2025-12-30 12:50 - 13:30 | One @ 39C3 (de-en)
Assignees: MrBronze, kaste

Speakers: dilucide

Cardiac Implantable Electronic Devices (CIED), such as cardiac pacemakers and defibrillators, are a fairly niche target for security researchers, in part due to a lack of manufacturer cooperation and device accessibility. This talk aims to provide insights into the challenges in device development and methods with which to research device security. Data accessibility to patients will be touched upon.
CIEDs may adversely affect patients implanted with such devices should their security be compromised. Although some efforts to secure these devices can be noted, it has quite often been lacking and may thus enable patient harm or data confidentiality compromise by malicious actors. Given the vast consequences of security vulnerabilities within this industry, the author aims to provide insight into the challenges associated with designing security architectures for such platforms, as well as possible methodology of researching these devices safely even when lacking manufacturer cooperation and access to device programmers.

Data collected by CIEDs and transmitted through remote monitoring is an additional concern for patients. Whilst research has shown that most manufacturers do respond in a timely and comprehensive fashion to GDPR requests, immediate data access is not yet possible and requires the patient to reach out to their doctors to obtain the requisite (event) data. A proposed solution is presented on how a patient communicator may be designed to allow patients interested in their autonomy to perform limited device interrogation in a safe and secure manner.

[CANDIDATE] Race conditions, transactions and free parking @ Zero
2025-12-29 21:05 - 21:45 | Zero @ 39C3 (de-en)
Filedrop has data for this session!
https://rescheduled.c3lingo.org/conferences/39c3/sessions/28fc102e-a38e-51b2-a48b-530b0d0e49a9

🤔 CANDIDATE SESSION - You've expressed interest in this session

Current Assignees: cv, 42triangles

Other Candidates: phmy, cv, flo_h, YETI, Stormwind, 42triangles, oskar, pinkdispatcher, Beni

Speakers: Benjamin W. Broersma

ORM's and/or developers don't understand databases, transactions, or concurrency.
After the Air France-KLM dataleak I kept repeating this was not a real hack, and confessed I always wanted to hack a system based on triggering race conditions because the lack of proper transactions.
This was way easier than expected. In this talk I will show how just adding $ seq 0 9 | xargs -I@ -P10 .. can break some systems, and how to write safe database transactions that prevent abuse.

In this talk I will explain what race conditions are. Many examples of how and why code will fail. How to properly create a database transaction. The result of abusing this in real life (e.g. free parking).
