The new edition of one of the major cybersecurity events in Nouvelle-Aquitaine took place on Friday 12 May: Sthack 2023!
As last year, the talks were held at the Cité du Vin in Bordeaux, with speakers as fascinating as ever and nearly 250 attendees. For those who couldn’t make it, a live stream was available.
Sthack is no longer just a Bordeaux or regional event: it has become national, even international, with attendees coming from Switzerland and Belgium.
Sthack 2023 programme
Like previous editions, Sthack 2023 was split into two events:
- Talks
- Capture The Flag (CTF)
After breakfast and the opening keynote, the action began.
First up was a presentation of a bug in EDK II (the open-source UEFI implementation) by Gwaby. Next, JP Aumasson talked about quantum computers and the risks they pose to both old and new cryptographic algorithms. Right after that, Antoine Cervoise gave a talk on DMA (Direct Memory Access) attacks, which grant access to RAM: the hardware to choose depending on the available ports, and the ways to protect yourself (enabling the IOMMU in the BIOS while checking compatibility with your operating system).
12:15 pm: time for a break, brains on fire. Off to the riverside quays for lunch.
We came back in the afternoon, well fed, for five more talks. Things resumed with an overview of online violence by Laure Salmona. Then Eloïse Brocas et Benoît Forgette shared their experience of the Pwn2Own 2022 hacking contest, with tips and mistakes to avoid. After that, network engineer Pierre Besombes explained how he analyses and assesses the risks of various devices, why attackers target them, and so on. Finally, Nicolas Correia Vitorino presented the CLFS (Common Log File System) component and two CVEs discovered after an alert from their CrowdStrike EDR.
Rumps
Rump sessions are short slots for anyone with a topic to share, serious or less so, often with a touch of humour. Unlike the main talks, no registration is needed.
About ten people took the stage, but two rumps particularly caught my attention:
- Postmaniac: a new OSINT tool for Postman
- Pandora: an article on this topic is coming in the next few days.
Capture The Flag
As last year, the CTF took place in the reception rooms of Bordeaux City Hall, from 8 pm to 6 am. Teams had up to five members, and the event was in-person only.
Here is a look at the final scoreboard:
Sthack 2023: conclusion
Like previous years, this edition was a resounding success, which is probably why the event has been running since 2011. Worth noting this year: both ticket releases sold out at phenomenal speed!
If you’re interested, here is the event’s Discord server and their Twitter account.
And if you’d like to submit a talk, the contact email is: staff[at]sthack[dot]fr
Leave a Reply