Keynotes

2024 is election year for a number of countries including the US, the EU, Moldova and India. This presentation will provide an analysis and feedback on the cyber threats targeting this year's electoral processes, based on the report "Guarding Democracy: Assessing Cyber Threats to 2024 Worldwide Elections" from Sekoia Threat Intelligence & Research (TDR). We will focus in particular on influence campaigns affecting elections, and deep-dive with our investigation on the DoppelGänger group.

Residential IP Proxies (RESIPs) enable proxying requests through large networks of residential devices used concurrently by genuine users. These proxies are attractive to malicious actors because of their advantages in automated campaigns, including access to reputable residential IPs and integrated services like automated CAPTCHA solving. In this talk, we will showcase various types of attacks that exploit these proxies and introduce new methods to detect and prevent their activity on the server side. We will present successful results from applying these techniques in both semi-controlled and real-world environments. Additionally, we will offer new insights into the inner working and modus operandi of RESIPs, derived from our data collections.

The worldwide cost of cyberattacks now reaches an estimated $10 trillion per year. Memory safety issues continue to be the main source of cyber security problems and have consistently represented ~70% of vulnerabilities over the past 20 years. Therefore, there is a strong and increasing interest in CHERI (Capability Hardware Enhanced RISC Instructions), a technology that mitigates memory safety vulnerabilities by design. It provides security features at the hardware level that can be leveraged by the software to provide more robust security. It has been developed by University of Cambridge and other research labs, and after 14 years of improvement and tuning, it is now ready to go into products. However, getting the industry to adopt a new security technology requiring new hardware, is not something that will happen without a proactive and coordinated effort. This is the goal of the CHERI Alliance, a non-profit organisation created to accelerate the adoption of the technology. This talk provides an overview of the CHERI technology: the benefits it provide, an overview of how it works, and the constraints associated with its integration. It also introduces the CHERI Alliance: its objectives, its means and its roadmap.

Modern computers are equipped with a significant amount of low-level software, commonly known as firmware, which often initializes before the processor and operating system. This presentation will focus on the UEFI boot firmware, a frequent target for sophisticated cyberattacks. We will explore real-world threats that exploit vulnerabilities in the boot process and discuss the security measures and mitigations designed to defend against these evolving risks.

We will present our latest research on a next-generation MIFARE Classic compatible card manufactured by Shanghai Fudan Microelectronics, designed to resist all known card-only attacks. We uncovered several critical vulnerabilities, including a hardware backdoor that enables unauthorized key authentication and user key cracking within minutes. Our findings reveal that a common backdoor key is shared among all FM11RF08S cards, entirely compromising their security. These troubling findings do not stop there, as we also identified similar backdoors in other Fudan and legacy cards, raising further questions.

The work presented in this talk reveals a side-channel vulnerability in the cryptographic library of Infineon Technologies, one of the biggest secure element manufacturers. This vulnerability – that went unnoticed for 14 years and about 80 highest-level Common Criteria certification evaluations – is due to a non constant-time modular inversion. Moreover it is shown to be exploitable in practice on a widespread 2FA FIDO security keys: the Yubikey 5 Series. The full technical details of this work were made public on September 3rd 2024 (https://ninjalab.io/eucleak/), we will go over them and what they can tell us about the current state of secure elements and security certifications.

This keynote will focus on ANSSI’s preparation for the Paris 2024 Olympics, covering key milestones since 2018 and the agency's approach to securing such a major event. It will also address how ANSSI has mobilized a diverse ecosystem, including competition venues, event organizers, and private sector actors, to improve cyber maturity and readiness. Finally, the presentation will provide an overview of incidents and events during the Games, sharing important lessons learned to enhance future cybersecurity strategies.

This presentation will provide the audience with key statistics and an overview of cybercrime, with a particular focus on the domain of cyberattacks. A concrete case study on the Lockbit gang, which was targeted in a major anti-ransomware operation to which the Gendarmerie contributed, will also be discussed. The presentation will conclude with an analysis of emerging trends in the field of cybercrime.