Welcome coffee for participants
This workshop is a hands-on training in designing secure architectures. Through guided exercises, then group work, you will draw architectures and compare your experience with the good practices of the French national cybersecurity agency (ANSSI). Built on the experience ANSSI gained while supporting secure architecture projects, the workshop introduces the job of cyber architect. Several use cases let you progressively try out its different aspects, from the way of thinking and sharing ideas to
Legacy operating systems, real-time operating systems, black box devices using special protocols, no EDR available, system logs that are difficult to collect… Monitoring the security of OT devices can prove challenging for most security tools on the market. Find out how Suricata helped detect malicious activity, particularly on medical devices.
After last year’s “In bed with QubesOS, tips and tricks exchange party” workshop, which explored how QubesOS is used, this session changes perspective. If QubesOS promises security through compartmentalization, what happens when you try to break it? The workshop explores the realistic attack surface of QubesOS: what its isolation model actually protects, where its limits lie, and how vulnerabilities or plain misconfigurations can turn a “secure by design” system toxic. It confronts real Xen vuln
Lunch break
Welcome coffee for participants
The Microsoft Entra Connect server is one of the most critical components of a hybrid infrastructure: it holds both DCSync rights on the on-premises Active Directory and the access keys to the cloud identity. Yet its credential protection mechanisms have deeply changed over the versions, from cleartext in the registry to the DPAPI Credential Vault, up to the gMSA service account whose password rotates automatically. The workshop reviews the state of the art of attacks on Entra Connect, with a fo
A hands-on workshop on hacking Bluetooth Low Energy connected devices with the WHAD framework. The goal is to discover WHAD through Python scripting exercises, working on connected devices from the simplest to the toughest. Some exercises will run on a brand new connected device emulation platform, which avoids the usual environment issues (a hundred BLE devices in a conference room, radio noise and interference…). Others will be done on real hardware brought for the occasion. The workshop also
A hands-on workshop on Git.
A hands-on two-hour workshop covering applied transformer-based NLP for cybersecurity using the HuggingFace Transformers library. Participants build a complete threat intelligence pipeline from scratch (entity extraction, classification, summarization, and semantic ATT&CK mapping) using only open-source models running locally. Participants learn to choose the right model architecture for the right problem. The session closes with a live demonstration showing how individual components combine int
Welcome coffee for participants
Opening of the conferences
Les standards SPF, DKIM et DMARC sont aujourd’hui largement déployés et les outils d’audit concluent souvent à des configurations « conformes ». Pourtant, sur le terrain, ces mêmes environnements restent régulièrement exploitables. Entre forwarding abusif, mutualisation des infrastructures SMTP, relais ouvert ou dépendances excessives à des services tiers, de nombreux scénarios d’attaque passent sous le radar des outils classiques. Ce talk propose une approche différente : partir de configuratio
La reconnaissance est l’étape la moins chère d’une attaque : quelques millisecondes par cible. Honeyswamp renverse cette asymétrie. Inspiré de portspoof mais pensé à l’ère des IA, il orchestre les attaques afin d’identifier les connexions illégitimes et y répond pour monopoliser le temps et les ressources que l’attaquant y consacre. Approche moins conventionnelle, plutôt que de couper tous les flux réseaux : on a décider de tout ouvrir (ou pas).
Your cloud environment has privilege escalation paths you haven’t found yet. Static tools dump tables of misconfigurations, but they don’t show you how those misconfigurations chain together into full attack paths or which ones an attacker would actually find first. Security teams need to see the shape of their exposure, rather than searching through spreadsheets of individual findings stitched together by guesswork. PathQuarry is a visualization engine that lets you watch a reinforcement learni
Start of the afternoon session
SPOT - Spear-Phishing Overwatching Tool
« Y a-t-il un expert DFIR dans la salle ? » : Chronique d’une réponse à incident bretonne
Backport Kernel sans se noyer : la sécurité Linux à l’ère de l’IA
Break
Stop Injecting, Start Blending : une approche KISS du développement de malwares
Mentir à la chaîne : la persistance des scam centers en Asie du Sud-est
Rumps sessions / Lightning Talks
Conclusion
