Aurélien Francillon

Professor (full) of computer insecurity @s3eurecom. Can be seen sometimes procrastinating on Twitter.
@[email protected]
@aurelsec.bsky.social

[Aurélien Francillon @aurelsec]

"Screaming Channels" paper #CCS18/@BlackHatEvents is online https://t.co/q8Eep9Dl5c

Electromagnetic side channels from a CPU can leak to a radio transmitter. CPU and radio transmitters are often integrated (think WiFi, BlueTooth)
We recover an AES key from 10 meters on a BT chip

[Aurélien Francillon @aurelsec]

So with all the bug bounty programs closing we need to go back to no more free bugs ? And drop (or sell) without coordinating ?
Honest question...

[Emmanuel Macron @EmmanuelMacron]

Liberté de manifester. Quelles que soient les circonstances, chaque citoyen doit pouvoir exprimer ses convictions et revendications à l’abri de toute violence et de toute pression.

[Marlène Bouvet @marlene_bouvet]

🎯 Vuln researcher? Share your experience and views!

This is an anonymous sociological survey on vulnerability researchers — all profiles, all nationalities, no judgment. Co-designed with daily practitioners.

~15 min · Tor accessible · Funded by public research

[domas @xoreaxeaxeax]

New exploit: “xor dword [0xf80c2094], 1<<22”

Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.

https://t.co/sgAfneFSsf

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

"Insecurity of Cellular Basebands" analyzes prior work on vulnerability discovery and attack surfaces; presenting a taxonomy of vulnerabilities, review state-of-the-art analysis techniques, including static analysis, over-the-air testing, and emulation.
https://t.co/O0BNhXQa9r

[nSinus-R (@[email protected]) @nSinusR]

Amazing work by @henri2h and @aurelsec. Great to see SIMs and the SIM interface included in the attack surface. :)

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Your x86 CPU has a hidden mode that no OS can touch, no hypervisor can see, and no security tool can monitor. The security community spent 20 years asking: what could go wrong? Turns out: a lot.

[Patrick Breyer #JoinMastodon @echo_pbreyer]

#ChatControl 1.0 and 2.0 Explained: There is not one proposed “Chat Control” law — there are two, and they are moving through the EU institutions in parallel. This page untangles the two.
https://t.co/afiaVlKSq1

[sebastian roché @sebastianjroche]

Dans la recherche disponible tout indique qu’une telle loi ouvre la porte à un grave risque : celui de l’augmentation du nombre de décès et de blessés dans le cadre des interventions de police du quotidien. Signer ici https://t.co/0Ijob3iOxg

[EURECOM - Library @GwenComte]

Huge congratulations to Prof. @paolopapotti for being awarded an @ERC_Research Advanced Grant 2025 and for securing @EURECOM’s 8th ERC Advanced Grant with GENESIS, a remarkable achievement! #DataScientist https://t.co/JqcA459QlQ

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Submit a poster to any offensive security topics you'd like to discuss with or show to the WOOT audience! https://t.co/2ThxtVtAS7

[SynSec @synsec_ai]

📣 SynSec 2026 Cycle 2 is OPEN.
The Conference of Synthetic Security Research: AI agents do the research. AI agents do the peer review.
🗓 Deadline: July 23, 2026 (AoE)
What it is, and how to submit 🧵👇

[Steven Murdoch @sjmurdoch]

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their public signals. We decoded 12M messages: a 2011 flash where 31 of 32 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. https://t.co/xz3svmqiDa

[THConvention @ToulouseHacking]

We are starting to upload the videos of this year's talks.
And nothing better to start with than our two keynotes :
https://t.co/3jINfjcwNO and https://t.co/zSf5iRYoBF from @misc0110 and @aurelsec

[Alexandre Bartel @software_ses]

Our paper "CFIghter: Automated Control-Flow Integrity Enablement and Evaluation for Legacy C/C++ Systems" will be presented at the 2026 ACM Secure Development Conference (SecDev '26) in July.

[Brad Spengler @spendergrsec]

https://t.co/mYKLNUsZAU Xen advisory posted, should be a kernel fix here any minute now I assume

[Aurélien Francillon @aurelsec]

@OrenTirosh @OwenBrakes You can also expnoit phase :)
https://t.co/6dcUbzKfTS
But it is more difficult in this case :)

[Aurélien Francillon @aurelsec]

@OwenBrakes Let us (with @nSinusR @GioCamurati @poeplau ...) know if you have questions.
Follow up work, improved attack:
https://t.co/uPyHTEcaNW
on actual bluetooth protocol :
https://t.co/3HhXgbZBJg

[Aurélien Francillon @aurelsec]

@pwalshbuilds @OwenBrakes Because the key is used by the processor, a side channel (power consumption) couples to the radio transmitter. And then you can find the key (after a lot of packet collection and statistics) in the noise of the transmission.

[Aurélien Francillon @aurelsec]

@the_void_is_nil @OwenBrakes @kmcnam1 All those are related indeed. The difference with screaming channels is we show that these get amplified and transmitted further by a nearby (or integrated) radio transmitter. Rebroadcasting the side channel in a way.