What could one expect from the ANSSI incident report about the data theft of tax information that hit the French in the middle of summer? Not much in the way of revelations about the attacker’s modus operandi, but rather explanations of the kinds of gaps that allowed the hacker ZeroBytes to access roughly 678,000 tax data records, including nearly 393,000 individuals and 286,000 professionals.
Let’s start with the end: “the ANSSI concludes that the compromise was not the result of a sophisticated attack, but of classic weaknesses that attackers chained together.” So be it.
Its analysis is organized around three domains: identity, architecture and detection.
Cause No. 1: easy-to-steal and reusable credentials
The starting point was the theft of several dozen legitimate agent credentials. The ANSSI notes that there was no brute-force or credential-stuffing attack observed: the attacker already had the passwords.
The report attributes them most likely to spyware-type infostealers installed on computers not administered by the DGFiP. In the Agency’s view, these were personal devices used to access the ADER portal and equipment from third-party organizations for the APEX portal.
It explains that the attacker exploited weaknesses in three areas.
On the identity side, several dozen agent credentials, probably stolen by spyware on non‑DGFiP-managed machines, could be reused due to a lack of multifactor authentication on two portals, or because a second factor was insufficient.
On the architecture side, sensitive applications were accessible from the State Interministerial Network (RIE) without sufficient segmentation, which allowed the attacker to pivot from compromised infrastructures of the Ministry of National Education.
Finally for detection, the portal used to exfiltrate the data was not monitored and no mechanism correlated the suspicious signals. Result: none of the exfiltrations was detected, neither by the DGFiP nor by the ANSSI.
The ANSSI also judges the DGFiP’s usual response to be limited.
Its SOC resets passwords as soon as a compromise is reported, particularly by its monitoring provider. But a delay remains between the time of compromise and the reset, enough to access an application and begin exfiltration. The monitoring cannot cover all resale platforms either. Moreover, changing a password is ineffective if the infected device isn’t cleaned, something the DGFiP cannot guarantee for personal or external equipment.
The report provides an illustrative episode. On June 23 and 24, the password for the account used was indeed reset and access to the PIGP restricted, but exfiltration carried out via the RIE went unnoticed. The reset did not interrupt the ongoing session.
Cause No. 2: insufficient network segmentation
The attacker gained entry to the State Interministerial Network (RIE) by compromising infrastructures of the Ministry of National Education, which themselves connected to the RIE. He then reached the DGFiP’s ADER portal from addresses on that network.
For the ANSSI, sensitive DGFiP applications were accessible from the RIE without sufficient segmentation, increasing their exposure and enabling lateral movement from resources belonging to third-party organizations. Several illegitimate accesses came from locations with no apparent need to access DGFiP infrastructures. The conclusion: network segmentation was too permissive.
Interministerial coordination is also mentioned. On June 9, the National Education security center had shared technical attack markers with other ministries. The ANSSI believes the analysis and sharing delay should have been minimized, and blocking traffic at the RIE level could have limited exfiltrations if the legitimate flux had been better mapped.
Cause No. 3: defective detection
During the incident, the DGFiP’s SOC did not monitor the ADER portal, which was nevertheless used to exfiltrate data. No mechanism correlated the suspicious signals, which the ANSSI lists as:
- large data volumes (11 GB between June 22 and 25, 3 GB between July 21 and 23);
- a high number of requests, inherent to automated scraping, with no rate limiting;
- connections from VPNs, from India, and from IP addresses flagged as malicious;
- nocturnal connections.
Each signal alone would generate many false positives. But correlating them could have triggered alerts, according to the Agency.
The ANSSI also acknowledges its own limits. It did not have application-level monitoring in this scope, and its network monitoring could not spot legitimate accounts being misused. It nonetheless considers that the cumulative volume of requests should have triggered alerts.
An aggravating factor: broad access rights
The report did not study how user rights are allocated. It notes, however, that the exfiltration sessions were conducted from ordinary accounts, showing that those accounts could access a large volume of data.
The ANSSI indicates that this aspect could be examined later, as part of an audit of the DGFiP’s organization planned for a second phase.
The remedies proposed
How can a repeat of such a fiasco be avoided? In its role as the State’s Chief Information Security Officer, the ANSSI first advocates restricting access to business applications according to their use, whether internal, limited external, or public.
It calls for all applications to be placed under monitoring in a SIEM, with query quotas and blocks based on geolocation and IP reputation.
On the equipment side, the use of personal devices to access work resources should be prohibited, and professional devices must be hardened.
Multifactor authentication should be deployed across all applications, with a second factor capable of resisting compromise of the first: physical tokens or authenticator apps rather than a simple code sent by email.
The Agency also recommends tighter control of user rights, paired with consultation caps to limit the impact of unauthorized access.
Finally, every password reset should be accompanied by an analysis of the account’s activity since the suspected compromise, as well as the revocation of active sessions on all accessible portals.
