dead1nfluence; Regular Talk
In this presentation we will evaluate the security of one of the most popular dash cams on Amazon, with the goal of answering the question, “Could we, as an unauthenticated attacker, disrupt the video communications in a temporary or permanent way?” Julian will take you through his journey of reverse engineering a high-end dash cam, the vulnerabilities he discovered along the way, and the surprising discovery that this research affects an unknown number of other popular dash cams. You will walk away from this presentation with a deeper understanding of hardware hacking, reverse engineering, and the risks posed by insecure consumer-grade devices.
Faan Rossouw; Workshop - 240 minutes
AI agents are arriving in defensive security faster than most teams planned for - and most practitioners are meeting them as a vendor product with a "buy" button, not as something they can build, open up, and bend to their own environment. Those are completely different skills. The teams who understand the architecture underneath - what the field now calls harness engineering - are the ones who can adapt agentic systems to their own tooling and threats instead of being locked into whatever capabilities a vendor decides to ship.
This hands-on workshop teaches you to build your own AI security agent from the ground up. Using threat hunting as the running example, you'll assemble a working, model-agnostic agent framework piece by piece: the immutable state core that makes a run traceable and auditable; an agnostic provider seam; the data–agent interface that shapes what the model actually sees; deliberate context-window management; the three ways to give an agent tools - inline functions, CLI wrappers, and MCP; and executable investigation skills, culminating in a detection skill you run against real telemetry from the scenario.
This is not a session about prompting a chatbot to read logs. It's about the engineering decisions behind systems that agents can do real defensive work inside - and you leave with the framework, yours to extend to detection engineering, incident response, vulnerability triage, or any security problem you face. Harness engineering is the kind of capability that compounds; the earlier you invest, the more leverage you carry as the field keeps moving.
Don Mallory; Regular Talk
CSPM is just a marketing term for configuration management aligned to standards-based controls validation of security baselines. As a result of the marketing hype, CSPM toolsets are often unreasonably priced, are limited in controls, scope, or flexibility.
We will explore the multitude of freely available tools for validation of various perspectives, align them to industry standard baselines such as those provided by CIS, CISA, ASD, and others against Microsoft cloud environments and discuss where they overlap or fail.
Attendees will leave with a toolkit of options based on real life testing in an enterprise environment. This will cover configuration drift, prioritise misconfigurations based on risk, options to automate evidence collection, and reporting without purchasing a dedicated CSPM platform.
Effective posture management is not about buying another dashboard, it is about treating cloud security as disciplined configuration management and continuously verifying that your environment remains aligned with established security baselines.
Samuel Dussault; Regular Talk
En 2026, les attaques contre la chaîne d’approvisionnement (ou supply chain attacks) se multiplient à une vitesse telle qu'il devient presque impossible de s'en protéger complètement. Installation de dépendance, lancement de script, exécution d’une GitHub Action, build d’un container ou intégration d’un agent à son IDE: toute action en apparence anodine peut maintenant devenir un vecteur d’attaque capable de transformer un agent de build en zombie, ou d’exfiltrer tous les secrets d’une machine de dev.
Dans ce talk orienté démos, nous passerons de la théorie à la pratique en reproduisant plusieurs scénarios d’attaque inspirés de cas réels. L’objectif : montrer comment ces attaques fonctionnent réellement, pourquoi elles passent souvent sous le radar, et quelles pratiques simples permettent de réduire le blast radius quand une dépendance, un outil ou un pipeline tombe aux mains d'un l'attaquant.
Ian Litschko; Regular Talk
This talk will explore Russia's GRU Information Operations Command through regionalization, looking at how monolithic groups such as Fancy Bear and Sandworm can be broken into subclusters. Leveraging open source information, we map out the GRU's cyber-enabled military units, attributed threat groups and capabilities to connect them to specific regions within Russia's Military Districts. The talk will draw on technical information, but humans, structure and geography have equal weight, as we explore the intersection of all these topics within the GRU.
The intent is to offer the audience the opportunity to reimagine how they consider the GRU's cyber-enabled capabilities and what that means for both attribution and their organizations. Understanding the ways organizational structure guides activity enables us as defenders to better mitigate the threat attackers pose. Attendees will leave with the knowledge that breaks through the hyperbole and approach Russian intrusions with new eyes.
Bee Mallory; Regular Talk
Where do you get your information about the world? How do you know that it is unbiased? What if it is created specifically for you? This talk explores how social media platforms turn user data into personalized streams of persuasive content that blur the line between information and manipulation. In a post-truth world where belief, opinion, and emotion outweigh evidence, targeted messaging doesn’t just spread—it adapts, embedding itself in how we think and feel and influencing how we behave. Moving between theory and real-world cases, this presentation reveals how social media sites shape political and social realities—and asks what happens as AI makes these conditions faster to create and harder to notice.
Kirils Solovjovs; Workshop - 180 minutes
Firmware of proprietary systems lies on the border of hardware and software. This talk follows up on last year's presentation "Breaking both wires: Reverse engineering builiding access control system for MITM attacks and spoofing", shifting focus from the physical and protocol layer to its embedded firmware, and exploring how behavior, timing, and security logic are implemented, and how they can be systematically uncovered. The talk is structured as a guided progression designed for audiences starting from zero, gradually building the skills and intuition needed to move from an opaque firmware image to a meaningful system-level understanding through iterative analysis, experimentation, and correction of early mistakes.
Damien Bancal; Regular Talk
Pendant deux ans, j’ai suivi des groupes de pirates informatiques dont certains membres avaient à peine 11 ans.
Français, Belges, Canadiens : plusieurs sont devenus les ennemis publics numéro un du web francophone. D’autres ont été arrêtés en avril et mai 2026.
Je vais vous montrer pourquoi ils agissent, comment ils opèrent, et comment certaines de leurs actions ont déjà mis en danger, sans exagérer, des gouvernements.
Ces trajectoires rappellent que l’addiction aux écrans peut aller bien au-delà du jeu vidéo ou des réseaux sociaux.
Éduquer les enfants, c’est aussi éduquer les parents… et vice versa.
Ravshan Rikhsiev; Regular Talk
Modern IoT firmware is a largely unexplored attack surface, and manual analysis doesn't scale. In this talk, we present a pipeline that combines core computer science fundamentals with large language models to automate vulnerability discovery in firmware binaries.
In this talk, we describe how we built a pipeline that combines computer science fundamentals with LLMs to find bugs in firmware. We use LLMs as an operator for detecting vulnerability patterns, a kind of "vuln smell", and walk through how we built the pipeline using control flow graphs, Ghidra internals to extract pseudo-C code, and build taint analyzes pipeline, and how crafting the right prompts with the right context lets even Gemini Flash detect bugs or at least give meaningful hints, and of course our pitfalls, and why LLMs better than fuzzing in case of firmware and MORE.
Attendees will leave with a practical understanding of how to build LLM-assisted binary analysis pipelines and how prompt engineering decisions directly impact bug-finding accuracy.
Julien Turcot; Regular Talk
A compromised mailbox.
One fake invoice.
One Teams message.
One trusted supplier.
60 seconds later:
$25,000 is gone.
Welcome to cybercrime in 2026.
This talk dives into the industrialization of Business Email Compromise (BEC) and modern financially motivated threat actors like ShinyHunters, showing how attackers evolved from “hackers” into highly efficient cyber businesses.
The scary part?
Most attacks no longer rely on advanced malware or zero-days.
They rely on:
- trust
- weak processes
- social engineering
- MFA fatigue
- Shadow AI
- overprivileged accounts
- and humans moving too fast
We’ll break down real-world attack chains used today against organizations of all sizes:
from mailbox compromise to vendor impersonation, internal fraud, data theft and payment diversion.
We’ll also explore how modern threat actors weaponize:
- leaked credentials
- infostealers
- cloud identities
- AI-generated phishing
- session hijacking
- and trusted collaboration tools like Teams, Slack and SharePoint
And while everyone is chasing “next-gen AI security”…
many organizations still use weak passwords, lack MFA coverage, have no tested recovery process, and trust email far more than they should.
This is no longer cybercrime.
It’s operationalized digital fraud at scale.
Participants will leave with:
- A better understanding of modern BEC tradecraft
- Why attackers target finance and operations teams first
- How ShinyHunters-style operations scale so efficiently
- The role AI and Shadow AI now play in fraud
- Practical ways to reduce exposure immediately
The future of cybercrime is fast, scalable and frighteningly human.
Guillaume Croteau; Regular Talk
SQL injection is dead. Local file inclusion is a relic. And that PDF generator surely can’t be used to pivot into an internal network… right?
Well, think again.
In this presentation, we will explore web application exploits that (surprisingly) still let me in. The kind that have great impact, that should have disappeared years ago, yet still show up in real-world engagements. Well, if you can get them to work. They might be buried in business logic or something else.
This is what you will get from this presentation; that with a bit of wit and know how, you can turn a seemingly not exploitable vulnerability into a critical finding, even those that should not be out there anymore.
Oh, and this is not just a theoretical talk, there will be demos, and there will be code analysis.
Audrey Shink; Regular Talk
Ce talk n’est pas une confession. C’est une autopsie.
Dans l’industrie des fournisseurs de services informatiques (MSP), on parle de sécurité, de techniques, de processus et encore. Mais on ignore l’essentiel : les décisions qui détruisent une business ne viennent pas des machines…
Elles viennent des humains.
“I Have Failed — MSP Edition” plonge dans les zones grises du métier : les ententes floues, les relations toxiques déguisées en opportunités, les promesses à moitié dites… et celles qu’on accepte quand même.
À travers des histoires vraies, brutes et anonymisées(-ish), cette conférence expose comment l’ingénierie sociale ne se limite pas aux attaques externes ou à la cyber. Elle s’infiltre dans les ventes, dans les partenariats et dans les décisions stratégiques.
Ici, y'a pas de héros ou d'héroïne. Pas de bon réflexe. Juste des choix… faits trop vite, pour les mauvaises raisons et leurs conséquences.
Je te parle de :
Comment des phrases anodines deviennent des pièges (aussi appelées bullsh*t)
Pourquoi les MSP rationalisent des décisions qu’ils savent déjà mauvaises
Comment les dynamiques humaines sabotent la rentabilité, la sécurité… et l’intégrité
Et surtout : comment éviter de répéter ces erreurs sans tomber dans le cynisme
En TI, en cyber ou en affaires, le plus grand risque n’est pas de se faire hacker. C’est de se faire convaincre.
Chris d'Eon; Regular Talk
The sun rises over Pyongyang, and a new shift begins for a global, remote IT workforce you likely employ. While the cybersecurity community tracks sophisticated state-sponsored actors, a quiet, effective army of North Korean IT workers has infiltrated Western organizations to evade sanctions and fund their state. They operate through a mix of purchased illicit accounts, stolen identities, and pirated software that leaves them uniquely susceptible to the very infostealers they utilize against others. We are currently observing a massive influx of these workers using sophisticated remote setups, fake resumes, and American collaborators. Are your hiring practices prepared to spot an applicant who isn't who they say they are? This talk pulls back the curtain on the DPRK IT worker playbook and operationalizes intelligence we’ve gathered by tracking their digital footprint.
Simon Nolet (Viper); Regular Talk
Retour d'expérience sur l'automatisation des opérations cyber avec l'IA. Ce qui fonctionne, ce qui marche pas, et les leçons apprises sur le terrain du scripts bash et agents IA autonomes
Dorota Kozlowska; Workshop - 240 minutes
Building relationships and understanding human behaviour
An introduction to the world of mind reading and social engineering
The importance of building relationships and making a positive first impression
Understanding human behaviour: psychology, neuroscience and sociology
The basics of body language: posture, facial expressions and non-verbal cues
Micro-expressions: what they are, how to recognise them and what they mean
Reading a person’s baseline: understanding their emotional state and motivation
Introduction to 'mind-reading techniques and mentalism
Techniques for extracting information: how to ask effective questions and gather information
Social engineering tactics: using persuasion, influence and manipulation to achieve your goals
Marc-André Beaulieu; Regular Talk
[Entreprise IA] : "Ce nouveau modèle a trouvé 5000 CVE !"
[Communauté infosec] : Proof ?
[Entreprise IA] : ¯_(ツ)_/¯
Pendant des années, on nous a présenté des "N vulnérabilités trouvées par l’IA", mais avec peu ou pas de détails sur la manière dont elles ont été découvertes, au point où cela ressemble davantage à des coups marketing qu’autre chose.
Cette présentation décrit en détail un design concret de système end-to-end utilisant des agents IA pour découvrir de manière entièrement autonome des vulnérabilités dans du code open source, ayant mené à des vrais CVE.
L’objectif n’est pas seulement de présenter le design lui-même, mais aussi comment chaque composant réduit les problèmes fréquents, notamment :
- Les boucles infinies d’agents qui oublient ce qu’ils ont déjà testé
- Les hallucinations de vulnérabilités
- Les impacts surrestimés
- Les agents qui trichent en introduisant volontairement des bugs dans le code source
- Le manque de profondeur et de créativité dans les vulnérabilités trouvées
La présentation couvrira les décisions de desing, notamment :
- Des processus conçus pour permettre la créativité et l’exploration tout en éliminant les faux positifs
- Un schéma de base de données structuré qui impose et encadre ces processus
- Des agents opinionnés avec des rôles, objectifs, outils et accès à la base de données explicitement définis
- Une exploitation end-to-end imposée dans des environnements isolés
Le résultat : un pipeline capable de fonctionner de manière entièrement autonome pendant 12h+ et de produire des vulnérabilités reproductibles à impact élevé, incluant des CVE publiées.
Finalement, on dirait bien que l’IA peut trouver de vrais bugs, il faut juste moins de prompt et plus d’engineering.
Clément Cruchet; Regular Talk
As a Cybersecurity Solution Consultant at Palo Alto Networks and ethical hacking professor at the University of Sherbrooke, Clément Cruchet is backed by deep experience in offensive security, network security, and incident response. This provides a holistic view of the full attack lifecycle. In this talk, he applies this expertise to cloud identity platforms, bridging the gap between theoretical OAuth RFC protocols and real-world exploitation, to show how attackers weaponize these implementations and how defenders can secure them.
Patricia Gagnon-Renaud; Regular Talk
Il y a deux ans, j’ai présenté les techniques de base de l’OSINT qui m’ont valu de paraître au téléjournal, en déverrouillant la porte d’entrée d’une propriétaire de commerce trop sûr d’elle-même. Pour ma deuxième conférence, je souhaite montrer des applications plus courantes de l’OSINT en pentest, accompagné de nouveaux exemples et techniques.
Dmitriy Beryoza; Regular Talk
The numbers of software vulnerabilities and misconfigurations keep growing year over year. Addressing them requires concerted efforts of "builders": software developers, QA, IT specialists. Unfortunately, too often the task of securing software falls to "breakers", such as pentesters and security researchers, who expose problems and push for improvements.
Widespread software weaknesses can be partially explained by the engineers' insufficient knowledge of secure software development. One of the most effective ways to improve it is to "gamify" the learning process. This will add rewards, healthy competition and stimulate the acquisition of practical skills.
Unfortunately "gamified" training is almost exclusively available to those on the "offensive" side. Security competitions, challenge sites, and hands-on security certifications all provide excellent opportunities for building practical attack security skills. There is a shortage of such opportunities for professionals on the "defensive" side.
In this talk, we will discuss this imbalance in greater depth and propose ways of making acquiring practical defensive security skills more effective.
We will also describe an open-source defence competition framework that we are releasing and share our experiences running defence-style competitions.
hoodoer; Workshop - 120 minutes
JS-Tap v3 moves beyond exploiting web applications to targeting the user’s endpoint itself. JavaScript is used heavily on desktops and in this hands-on workshop you'll deploy three new JS-Tap implant types against a Windows workstation on a simulated corporate network.
Start by installing a malicious browser extension that harvests sessions from every site the victim visits and injects payloads into specific application domains on command. We'll then add optional features that escape the browser sandbox for filesystem and shell access.
Next we'll patch a local Electron app for screenshots, keylogging, network interception, and message spoofing in a corporate chat platform. Then we'll instrument a Node.js CLI tool with a single environment variable to intercept its traffic and keystrokes.
Your operator system can't reach the internal corporate web applications directly. You'll use JS-Tap Conductor to pivot through an implant, demonstrating the full attack chain from session theft to authenticated access on an internal network.
All infrastructure is provided. Each participant gets a dedicated Windows victim machine and Linux operator box accessible via noVNC. Just bring a laptop with a browser and an ethernet adapter.
You'll leave with firsthand experience operating all three beacon types.
Hocine Mahtout, Joël HIEN; Regular Talk
ADWS (Active Directory Web Services) est une interface native de Windows Server, largement ignorée par les outils de détection; et pourtant exploitable pour énumérer un domaine AD de bout en bout, sans toucher à LDAP.
Dans ce talk, nous présentons Soaphound.py, un outil Python que nous avons développé pour collecter des données AD via ADWS et les injecter dans BloodHound. Nous montrerons comment un attaquant peut, depuis Linux, cartographier un domaine entier en passant sous les radars de la plupart des défenses traditionnelles.
Au-delà de la reconnaissance, nous montrerons qu'ADWS ne se limite pas à la lecture : des opérations d'écriture sur l'annuaire sont également possibles via ce canal, ouvrant la voie à des attaques offensives classiquement associées à LDAP telles que la modification d'attributs sensibles ou la manipulation des droits de délégations, le tout depuis Linux. Nous aborderons également la vision défensive : comment reconnaître du trafic ADWS suspect et construire des règles de détection dans un SIEM malgré l'absence de logs natifs dédiés.
Jérémy Viau-Trudel; Regular Talk
La conjoncture actuelle met à mal les équipes de cybersécurité. Déjà, l'usage massif de l'intelligence artificielle par les attaquants nous demande de relever le niveau de vigilance et de nombreuses équipes n'arrivent pas à suivre le rythme qui s'accélère. Qu'en sera-t-il lorsque les ordinateurs quantiques décupleront la puissance de frappe que devront contenir vos équipes de sécurité?
Dans cette présentation, nous passerons en revue ce que vous pouvez faire dès maintenant pour être prêt à l'ère Post-Quantique.
Mourad Sherif; Speed Talk
Rust reversing can, at times, prove quite painful. The compiler and standard library are updated every 6 weeks, there is no stable ABI, it has many exotic types, macros, etc. Fortunately for any reverser, there exists a common solution to this mess, that being strings! Participants will get a quick look at:
- The various forms of metadata that Rust packs into binaries;
- How to leverage this metadata to extract project structure, dependencies, the build process;
- Available tools to make Rust reversing easier and;
- Present and future outlook on the Rust reversing scene.
Kirils Solovjovs; Workshop - 120 minutes
Think you can bluff your way through a security talk with zero prep? Now is your chance! At Security Impress Karaoke¹, you'll be handed a totally random, security-themed slide deck you’ve never seen before - and have just 3 minutes to present it like a pro.
Kirils Solovjovs; Regular Talk
Privacy in Europe, and the wider Western world, is undergoing a structural shift toward proactive systems of identity verification, communication governance, environmental sensing, and data infrastructure control.
This talk examines four converging mechanisms driving this transition: age verification frameworks that bind access to verified identity; ongoing EU-level proposals around inspection of private encrypted communications under the guise of child safety; expansion of ubiquitous physical-world surveillance through biometric systems, and mobile inference; and the accelerating impact of AI systems that transform public data into inferential and generative models with limited provenance guarantees. Together, these developments suggest a move away from privacy as a default property of digital systems toward privacy as a conditional, regulated state contingent on compliance with layered technical and legal requirements. Using global trajectory as the primary case study, the talk argues that these mechanisms are not isolated policy choices but components of a broader convergence toward an "access-controlled internet," where identity, communication, and content are increasingly mediated by interoperable governance systems rather than open network principles.
Ian Litschko; Regular Talk
Exploring the hacktivist landscapes of Russia, Ukraine and Belarus, this talk will look at how the war in Ukraine has shaped the three diverging paths for each country's hacktivist landscape. It will explore novel approaches adopted by hacktivist personas across the three countries, and the differing circumstances for each country that have influenced these choices. The result is a novel framework through which to explore the broader global hacktivist landscape and how real world changes can significantly influence hacktivist activity.
The audience will leave this talk with a deeper understanding of hacktivism within Russia/Ukraine/Belarus, and a framework through which to consider hacktivism in a global context. For attendees, they can then apply this to their individual company threat landscapes and explore how the hacktivist landscape can change to inform leadership as the global environment changes.
Jocelyn Baril; Regular Talk
Chaque année, le cimetière des failles s'agrandit un peu plus : en 2025, près de 50 000 nouvelles vulnérabilités ont été exhumées, et les projections pour 2026 annoncent un chiffre encore plus funeste : jusqu'à 70 000 selon certaines estimations. Pendant ce temps, le délai entre la découverte d'une faille et son exploitation active continue de fondre comme une bougie dans une citrouille oubliée sur le perron, en partie à cause de l'IA qui accélère autant la découverte que l'exploitation.
Dans cette sinistre conférence, on lève le voile sur l'état réel de la gestion des vulnérabilités en 2026 : l'explosion du volume de CVE, l'essoufflement des modèles de pointage classiques, et l'arrivée d'une créature réglementaire bien vivante venue des États-Unis : BOD 26-04. Cette directive de CISA force désormais les agences fédérales civiles américaines à adopter une démarche décisionnelle basée sur le risque réel.
Que change concrètement cette directive? Pourquoi son influence dépasse-t-elle largement les frontières américaines? Qu'annonce-t-elle pour l'avenir de la priorisation des correctifs? Apportez votre lampe de poche et votre courage : on va éclairer les coins sombres de la gestion des vulnérabilités, sans jamais perdre le sourire, ni la tête (quoi que…).
Anastasiia Mytrofanovska; Speed Talk
Security investigations feel rigorous — but they're shaped by the same cognitive shortcuts that affect every high-stakes decision made under pressure. This talk explores how confirmation bias, anchoring, and automation bias play out in real investigations, and how AI tools amplify these patterns rather than fix them. Through real-world examples from the SOC, you'll walk away with a clearer understanding of how your brain works against you during investigations — and practical techniques to build in the checks.
Audrey Shink, Simon David Williams; Regular Talk
On le sait mais... les attaques ne se terminent pas quand vos systèmes tombent. Elles commencent quand vos données sont publiées.
Dans cette conférence, vous entrez directement dans l’environnement réel des groupes de cybercriminels : leurs sites, leurs publications, leurs victimes.
Des centaines de groupes actifs.
Des données volées.
Des entreprises exposées.
Simon David Williams et Audrey Shink vous amènent sur le Dark Web : pas pour observer, mais pour comprendre ce qui se passe après le point de non-retour.
Vous verrez :
Comment les données exfiltrées apparaissent en ligne… souvent avant même que les victimes réalisent ce qui arrive
Comment les groupes de ransomwares structurent leurs opérations, exposent les entreprises et monétisent leur chute
Comment naviguer ces espaces de façon sécuritaire, sans devenir une autre statistique
Et surtout, ...les potins et les histoires crunchy.
À travers l’histoire réelle du Groupe ISM et d’un cybercrime majeur, cette conférence plonge dans la phase la plus brutale d’une attaque : celle où il n’y a plus rien à négocier.
Parce qu’au final, les hackers ne cherchent pas seulement à entrer dans vos systèmes. Ils attendent le moment de vous afficher.