Cyber in Sophia Antipolis 2023 - Program

Keynotes

Davide Balzarotti (EURECOM) — Slides

Title: Memory Forensics: Current Practices and Future Directions

Abstract:
The forensics field relies on a collection of best practices and a multitude of dedicated tools, without a proper scientific and theoretical foundation. In this talk I will discuss the current approach for Memory forensics, its limitations, and possible solutions. The talk will not be a tutorial on memory forensics, but it will focus instead on the research conducted in the field, by using some of our recent contributions in this area to discuss open challenges and future directions.

Biography:
Davide Balzarotti is a full Professor and head of the Digital Security department at EURECOM. He received his Ph.D. from Politecnico di Milano in 2006 and his research interests include most aspects of system security and in particular the areas of binary and malware analysis, reverse engineering, embedded system security, computer forensics, and web security. Davide authored more than 100 publications in leading conferences and journals. He has been the Program Chair of Usenix 2023, ACSAC 2017, RAID 2012, and Eurosec 2014. In 2017 Davide received an ERC Consolidator Grant for his research in the analysis of compromised systems. Davide is also member of the “Order of the Overflow” with whom he organized the DEF CON CTF competition between 2018 and 2021.

Olivier Thomas (Texplained)

Title: All you want to know about integrated circuit reverse-engineering

Abstract:
“All you wanted to know about Integrated Circuit Reverse-Engineering for security” is a lecture which aims at giving a precise description of the topic from the use case to the actual process and potential results that such an analysis can bring. As such, it will demonstrate how offensive and defensive applications do not aim at the same results and will discuss the current state of security design and evaluation as well as on-chip counter-measures and their efficiency when it comes to the very potent reverse-engineering based invasive attacks. In this context, the different steps of the IC Reverse Engineering involved will be discussed including the sample preparation in the lab, the netlist reconstruction, non-volatile memory dump and counter-measure bypasses. As the field has to progress in parallel to the Integrated-Circuit manufacturing techniques, future improvements to the Reverse-Engineering process will be briefly introduced as well. This way, the lecture will conclude on what could make Integrated-Circuit security better and how Integrated-Circuit Reverse-Engineering will be beneficial in the future in even more use cases.

Biography:
Olivier THOMAS studied Electrical Engineering (EE) and subsequently worked for a major semiconductor manufacturer designing analog circuits. Then, Olivier began to work in the field of Integrated Circuit (IC) security as the head of one of the world’s leading IC Analysis Labs. The lab primarily focused on securing future generation devices as well as developing countermeasures for current generation devices to combat piracy and counterfeiting. During this time Olivier helped develop many new and novel techniques for semi- and fully-invasive IC analysis. He has an extensive background in all the Failure Analysis techniques and equipment necessary for accessing vulnerable logic on a target device. Combined with his experience as an IC design engineer, Olivier continues to develop techniques for automating the analysis process. These techniques are not only applicable to lower-complexity devices such as smartcards, which are the traditional targets for IC analysis, but they are applicable to modern semiconductor devices with millions of gates, such as modern System-on-Chips (SoCs). Olivier is the creator of ChipJuice, a software toolchain that efficiently operates the recovery of hardware designs, independently from their technology node, architecture

Mathy Vanhoef (KU Leuven) — Slides

Title: Recent Wi-Fi attacks and defenses: general lessons learned and open problems

Abstract:
This presentation explains the core ideas behind recent Wi-Fi attacks and how they might also apply to buggy implementations of other protocols. I will also discuss newly standardized Wi-Fi defenses as well as open challenges.

First, I will give a recap of the key reinstallation attack (KRACK) against WPA2, where flaws in the state machine allow an adversary to induce nonce reuse. Second, side-channel flaws in WPA3 are described, where I will also explain a technique to exploit timing side-channels with a high accuracy even over a noisy wired or wireless network. Third, I will briefly touch upon weaknesses on how fragmented frames are processed in encrypted Wi-Fi networks.

I will then discuss four recently standardized defenses: beacon protection, operating channel validation, opportunistic encryption in public Wi-Fi networks, and the new SAE-PK protocol where the Wi-Fi password encodes a fingerprint of the network’s public key. The goal of these defenses will be explained, as well as how these goals are achieved, and I will touch upon some limitations of these defenses. The presentation concludes with open challenges in Wi-Fi security.

Biography:
Mathy Vanhoef is an Assistant Professor at KU Leuven University in Belgium. He’s interested in network and software security, where he studies the security of the full network stack, with a focus on Wi-Fi security and applied cryptography. In this area, he tries to bridge the gap between real-world code and theory. He previously discovered the KRACK attack against WPA2 and the Dragonblood attack against WPA3. He also collaborated with the industry to design and standardize two new Wi-Fi defenses. One of these defenses, called beacon protection, will become mandatory in Wi-Fi 7.

Sébastien Bardin (CEA) — Slides

Title: Five shades of symbolic execution for vulnerability hunting

Abstract: Symbolic Execution emerged in the mid-2000 and was rapidly adopted by the research community as a tool of choice for bug hunting and automated testing. Yet, security is not safety and, while still useful, a direct adaptation of safety-oriented program analysis to security scenarios remains limited in its scope. In this talk, we will focus on security concerns and binary-level vulnerability issues. We will show some challenges symbolic execution faces in this field of application, and report on several results and recent achievements in order to adapt Symbolic Execution to these challenges. We will first cover the basics of symbolic execution, how to adapt it and to optimize it for binary-level analysis. Then we will present some of the new challenges faced by formal methods and program analysis in the context of code-level security scenarios. Finally, we will discuss several security-oriented extensions of symbolic execution, such as relational symbolic execution (detection of leaks and side channel attacks), adversarial symbolic execution (considering an active code-level attacker) or robust symbolic execution (trying to define and find meaningful bugs) .

Biography: Sébastien Bardin is a senior researcher at CEA LIST, where he has initiated and now leads the binary-level security analysis group. His research interests lay at the crossroad of formal methods, program analysis, automated reasoning, software engineering and security. For a few years now, Sébastien has been interested in automating binary-level security analysis by lifting formal methods developed for the safety-critical industry, with applications to vulnerability analysis, reverse, deobfuscation and code protection. He particularly focuses on symbolic execution and he is the main designer of the (open-source) BINSEC platform for binary-level code analysis. Sébastien holds a PhD from Ecole Normale Supérieure de Cachan.

Daniel Gruss (Graz University of Technology)

Title: Microarchitectural Side-Channel and Fault Attacks

Abstract:
In this talk, we will learn about basic side-channel and fault attacks that can be mounted from software. We will show how these attacks facilitate significant information leakage and even full system compromises. We will then discuss methodological aspects of side-channel and fault attack research and their implications on future research in this area as well as on defenses. In the last part of the talk, we will discuss how defenses are constructed and what security promises they offer. This leads us to a new understanding of why our current approach to system security is not sustainable. We will conclude with a new perspective on security and systems in general, that will yield a more sustainable future for security.

Biography:
Daniel Gruss (@lavados) is an Associate Professor at Graz University of Technology. He has been teaching undergraduate courses since 2010. Daniel’s research focuses on side channels and transient execution attacks. He implemented the first remote fault attack running in a website, known as Rowhammer.js. His research team was one of the teams that found the Meltdown and Spectre bugs published in early 2018. He frequently speaks at top international venues.

Lectures

Noémie Véron, Marcel Moritz (Université de Lille, CERAPS) — Slides

Title: Legal issues in exploiting vulnerabilities. Example of intelligence services and the H2020 Exfiles project.

Abstract:
In just a few years, the protection of personal data has become a major issue. While the use of such data by organisations subject to the GDPR is regularly discussed, the processing of data for police and intelligence purposes is less frequently addressed. However, the 2016 “Police Justice” Directive and numerous recent examples (such as the Encrochat and SkyECC cases) highlight the importance of this issue for our rights and freedoms. In this talk, we will look at the broad legal framework applicable to the protection of personal data, before discussing the extraction of data from mobile phones and the collection of data by intelligence services. We will also provide an update on a new draft bill allowing remote access to phones and connected objects.

Biography: Marcel MORITZ is a senior public law lecturer at Lille University, member of CERAPS Lab (UMR 8026). He has been teaching IT law since 2004, including personal data law and leads the master degree in cyberspace law. Marcel also practices these subjects being a lawyer at the Lille Bar. He takes part to national and international conferences on a regular basis and is WP coordinator in several research projects (ANR, H2020, etc.).

Noémie Véron is public law lecturer at the University of Lille, France CERAPS UMR 8026. She joined the University in September 2022 and teaches mainly in public law, particularly administrative law. She is a specialist in personal data protection law and national security. Her PhD focuses on the protection of personal data and Intelligence, and has been distinguished with three PhD prizes.

Daniele Antonioli (EURECOM) — Slides

Title: Bluetooth security

Abstract:
In this lecture we cover an Introduction about Bluetooth security, its main transports (BC, BLE), procedures (discovery, connect) and logical entities (Host, Controller, HCI). Then we look at Bluetooth security architecture and the specificBC/BLE algorithms and protocols. We conclude by talking about state of the art attacks that we developed agains this protocols including KNOB, BIAS, and BLUR.

Biography:
Daniele Antonioli. I am an Assistant Professor at EURECOM with the software and system security (S3) group. I am doing research and teaching in applied system security and privacy with an emphasis on wireless communication, such as Bluetooth and Wi-Fi, embedded systems, such as cars and fitness trackers, mobile systems such as smartphones, and cyber-physical systems such as industrial control systems.

Pierre Laperdrix (CNRS)

Title: Online tracking and browser fingerprinting: current state and the years ahead

Abstract:
The ecosystem of online advertising is massive. On the Internet, an incredible number of servers track our every moves and while a lot of efforts are being made to improve online privacy, there is still a lot of work to be done. In this presentation, we will dive into the world of online tracking: how does it work? What are the mechanisms enabling the tracking of online users? What will be the impact to end third-party cookies on the web? In a second part, we will focus on a unique technique called browser fingerprinting and see how it evolved over the years.

Biography:
Pierre Laperdrix is currently a research scientist for CNRS in the Spirals team in the CRIStAL laboratory in Lille, France. Previously, he was a postdoctoral researcher in the PragSec lab at Stony Brook University and, after, in the Secure Web Applications Group at Cispa. His research interests span several areas of security and privacy with a strong focus on the web. One of his main goal is to understand what is happening on the web to ultimately design countermeasures to better protect users online.

Adrian Dabrowski (CISPA)

Title: Cellular network security

Abstract:
40 years of digital mobile (cellular) networks and four generations later (2G-5G), it is time to take a look at how attacks, tools, and security models changed. An analysis of over a hundred attacks shows that most attacks are enabled by just one of ten causes, grouped into four root causes. Some of these attacks will be discussed in greater detail. Cellular network research has never been as accessible as it is now. This lecture will also give an overview of the tools available and demonstrate a few of them. Furthermore, I will talk a little about the legal environment of such a work.

Biography:
Adrian Dabrowski is a postdoctoral researcher at CISPA, Germany and, before that, at the University of California, Irvine (UCI). He received his Ph.D. on the security of large infrastructures, including identifying fake base stations (“IMSI Catchers”) in cellular networks. Before his Ph.D., he was a founding member of two hackerspaces in Vienna, Austria, and on the board of one of them. He also served on the board of an experimental non-commercial metropolitan-sized access network (mostly Wi-Fi) named Funkfeuer.

Andrea Fioraldi (EURECOM) — Slides

Title: Unraveling the Challenges of Modern Fuzzing. Advancements in Research and Engineering

Abstract:
Fuzz testing has revolutionized software testing and vulnerability discovery, but it also presents substantial challenges in both research and engineering. In research, the constantly evolving software landscape and the increasing complexity of targets make it difficult to develop cutting-edge fuzzing strategies that can uncover bugs that current solutions miss. Researchers face the challenge of triggering complex invariant violations and logic bugs beyond the classic memory corrpution issues. Furthermore, the lack of standardized evaluation metrics and benchmarks hampers objective comparisons between different fuzzers.

In engineering, establishing and maintaining a robust fuzzing infrastructure is a demanding task. Despite the potential for high parallelization, fuzzing systems struggle to fully utilize modern CPUs, limiting their scalability. Additionally, the fragmented nature of the fuzzing ecosystem impedes the combination of orthogonal techniques and hinders the adoption of new prototype solutions by end users.

This presentation explores the latest challenges in modern fuzzing, bridging the gap between academic research and engineering. It delves into the complexities of developing effective fuzzing techniques while emphasizing the need for standardized evaluation methodologies. Furthermore, it addresses the engineering difficulties of building scalable and adaptable fuzzing infrastructure. Understanding and surmounting these challenges are pivotal for advancing the state-of-the-art in fuzzing and enhancing the security and reliability of software systems.

Biography:
Andrea Fioraldi is currently a Ph.D. student in the Software and Systems Security group of EURECOM under the supervision of Prof. Davide Balzarotti. He is working on new methodologies to improve the effectiveness of security vulnerability discovery techniques such as Fuzz Testing. He is part of the core development team of AFL++, one of the most used fuzzers in industry and academia, and lead developer of the LibAFL fuzzing framework, the future Rust backbone of AFL++.

Driss Aboulkassimi, Thomas Hiscock (CEA) — Slides

Title: How to exploit EMFI to bypass the SoC Secure-Boot?

Abstract:
EMFI or Electro-Magnetic Fault Injection is a technique used for the hardware security evaluation of sensitive electronic components. The objective for injecting faults intentionally on the target is to corrupt the operations of a system and obtain a behaviours modification of the target not anticipated by designers. This can be data flow or control flow modifications. EMFI it consists in injecting accurately an EM pulse in order to perturb the target during the execution of sensitive applications such as encryption or any authentication mechanism. The devices primarily targeted by the EMFI are small microcontrollers with limited resources; however, scaling up to complex device such us the SoC ( System-On-Chip) implementing multiples CPU, high frequency, etc., poses a significant challenge. The objective of this presentation is to demonstrate how to exploit the EMFI to address other types of targets that are more complex than what has been predominantly covered in the state of the art."

Biography:
Thomas HISCKOK : est ingénieur chercheur au CEA depuis 2014 dans le domaine de la sécurité des systèmes embarqués. Il travaille avec des partenaires industriels pour l’évaluation sécuritaire de produits en cours de développement. Il mène en parallèle des activités des recherches dans le domaine la sécurité des processeurs, les attaques micro-architecturales et l’analyse par canaux auxiliaires.

Driss ABOULKASSIMI : a rejoint en 2010 le laboratoire Architectures Sécurisées et Systèmes de l’Ecole Nationale Supérieure des Mines de St Etienne en tant qu’ingénieur de recherche en sécurité physique et caractérisation des systèmes embarqués, puis au CEA-leti pour se spécialiser dans la sécurité matérielle des dispositifs mobiles, notamment à travers plusieurs projets européens et nationaux.

Anil Kurmus (IBM Zurich)

Title: Automated kernel exploitation (title TBC)

Abstract:
Starting with a historical perspective on exploitation and a background on kernel exploitation, this talk surveys state-of-the-art techniques used to automate kernel exploitation across attacker models, vulnerability classes, exploitation steps, and analysis techniques (static analysis, fuzzing, symbolic execution, …).

Biography:
Anil Kurmus is a security researcher at the IBM Research Zurich laboratory. His interests are mainly on systems security, software security, operating systems as well as CPU microarchitecture, both in terms of offensive and defensive research. He holds a PhD degree (Dr.-Ing) from Technische Universitat Braunschweig (2014), and a Master’s degree (Diplome d’Ingenieur) from Telecom Paris (2009). Since 2019, he has been leading projects on the topic of systems security at IBM Research. His work has received an ACSAC best paper award and been published in major systems security conferences, where he has also been a member of the program committees (ACM CCS 21/23, IEEE S&P 22/23, USENIX Security 21/22, NDSS 23). He is also the author of several patents on systems security.

Labs

Romain Cayre, Aurélien Hernandez, Daniele Antonioli (EURECOM) — Slides

Title: KNOB attack on Bluetooth low energy

Abstract: See corresponding lecture above

Frédéric Recoules (CEA)

Title: Playing with BINSEC, a binary-level symbolic execution engine

Abstract:
BINSEC is a formal binary code analysis platform developed at CEA, with a particular focus on security analysis ( vulnerabilities, reverse) and the degree of guarantees provided. BINSEC offers original symbolic reasoning engines and multi-architecture support. Recent results have been obtained, for example, in automatic analysis of cryptographic primitives (resistance to covert channel attacks and micro-architectural attacks) or deobfuscation of advanced malware. However, this kind of analysis still suffers from scaling and usability issues. In this tutorial, we propose the participants to familiarize themselves with the use of the BINSEC symbolic execution engine. We will first consider standard reachability properties, playing with “crackme” challenges of increasing difficulties and then move to the formal verification of more advanced security properties (e.g. constant-time, control flow hijacking)

Biography:
Frédéric Recoules graduated from INSA and Université Toulouse Paul-Sabatier in 2016, then received a PhD in Computer Science from Université Grenoble-Alpes in 2021. His area of expertises spans formal methods, low-level programming, decompilation and reverse engineering. He notably obtained an ICSE distinguished paper award and a 2nd best GDR GPL PhD award (thematic: software engineering, formal methods and programming languages) for his work on formal verification of inline assembly code. He is currently Research Engineer at CEA where he is the main developer and maintainer of the binary-level program analysis platform BINSEC. His research addresses scalability issues in symbolic analysis at binary level, vulnerability analysis and reverse engineering for security.

Driss Aboulkassimi, Thomas Hiscock (CEA) — Slides — Lab

Title: A practical introduction to side-channel analysis

Abstract:
Side-channel analysis is a class of attacks that use physical information obtained on a system to recover secret materials. The two most popular approaches to obtain side-channel information is by measuring the power consumption of a device or its electromagnetic field. Although those attacks were discovered more than 20 years ago, the research domain remains very active. This talk will be interactive with small experiments in Jupyter notebooks. We will start with some basic side-channel analysis, showing some simple tools leakage analysis and “schoolbook” attacks. Then, we will introduce some of the challenges that arise when attempting those attacks on complex System-on-Chips such as those found on smartphones.

Biography:
Thomas HISCKOK : est ingénieur chercheur au CEA depuis 2014 dans le domaine de la sécurité des systèmes embarqués. Il travaille avec des partenaires industriels pour l’évaluation sécuritaire de produits en cours de développement. Il mène en parallèle des activités des recherches dans le domaine la sécurité des processeurs, les attaques micro-architecturales et l’analyse par canaux auxiliaires.

Driss ABOULKASSIMI : a rejoint en 2010 le laboratoire Architectures Sécurisées et Systèmes de l’Ecole Nationale Supérieure des Mines de St Etienne en tant qu’ingénieur de recherche en sécurité physique et caractérisation des systèmes embarqués, puis au CEA-leti pour se spécialiser dans la sécurité matérielle des dispositifs mobiles, notamment à travers plusieurs projets européens et nationaux.