This is one of the issues.
This Thursday, December 1, opens the first phase of ticketing for the Paris 2024 Olympic Games, which represents three million tickets.
With the backdrop of a question: how to protect against fake tickets, and avoid a situation similar to that of the Champions League final, where many fake tickets had been generated?
Over the entire process, ten million tickets will be available for sale.
Concretely, the ticket office will be spread over time.
From this Thursday, December 1 and for two months (until January 31, 2023), people wishing to buy tickets will be able to register for a draw, without having to take out their bank card.
Then, the people drawn will receive, from the beginning of February 2023, an email giving them a 48-hour purchase window.
The user can then compose his own pack, with the possibility of buying up to 30 tickets.
Finally, at the end of 2023, a final phase of unit sales will begin.
Read alsoFiasco at the Stade de France: 40,000 fraudsters … or barely 3,000?
Le Figaro
reviewed the techniques implemented by the organizers and presented them to two cybersecurity experts.
Spread sales
These multi-stage sales aim to reduce users' waiting time at the online ticket office.
"
This avoids a peak of simultaneous connections
, specifies Damien Rajot, director of commercial operations on site within the organization of Paris 2024. "
At major events such as the Olympic Games, robots could buy several tickets for the resell on the black market
, warns Benoît Grunemwald, cybersecurity expert at ESET France.
Staggering is therefore a good idea
”.
Read alsoMultiplication of bank scams: tips to avoid being tricked
Second point, the issuance of the ticket to buyers.
"
The tickets will only be sent a few months or a few weeks
[the exact duration has not yet been decided by the organizers, editor's note]
before the event
", indicates Damien Rajot
.
"
The counterfeiters will have less time to organize themselves
,
"
he wants to believe.
If "
time is indeed in favor of the organizers
", this will not prevent malicious individuals from "
hacking
if they want to hack
"
,
nevertheless assures Benoît Grunemwald.
End of paper tickets
Paris 2024 has also chosen to no longer use paper tickets, barcodes that are more easily falsified.
“
These printed tickets can be photocopied or even photographed multiple times.
Security checks will stop duplicates, but a person who honestly bought their ticket from someone reselling it could find themselves blocked in front of the entrance
,
”
explains Damien Rajot.
Instead, the organizers are betting on a QR Code, these two-dimensional barcodes used in particular for the health pass during the Covid-19 epidemic,
“active”
or “
dynamic
”.
"
The various information it contains and its pictogram are mobile
"
,
explains Damien Rajot.
Read alsoA QR Code against domestic violence
Concretely, the QR Code or what it contains evolve over time, unlike more traditional QR Codes.
If Paris 2024 did not wish to communicate on the data which will vary, "
there are, for example, systems where an active QR Code would change according to the time
"
,
deciphers Thibaut Henin expert in cybersecurity and writer for the popularization site in cybersecurity
Les Arsouyes
.
Clearly, the QR code generated at 10:01 a.m. would no longer be valid at 10:02 a.m., since another would automatically replace the previous one, without the ticket holder having to do anything.
The two experts interviewed agree that this type of technology is much more secure than a paper ticket.
"
It started to spread around 2015
," says Thibaut Hénin.
For him, the democratization of the smartphone explains why this system is used more today.
According to INSEE, 77% of people over 15 owned a smartphone in France by 2021.
The human factor
Despite this, the organization recognizes that no system is impenetrable, no matter what precautions are taken.
In particular, the possible piracy of the media on which these tickets will be stored: the smartphone.
“
No matter what date the tickets are made available, that does not prevent hackers from preparing the ground
,
”
certifies cybersecurity expert Benoît Grunemwald.
Read alsoA QR Code against domestic violence
According to him, potential ticket buyers could receive an email pushing them to click on a link, from which malicious software would discreetly install itself.
Such a system, which mostly exists on Android smartphones, could film the phone screen or record typed text.
And therefore recover the access codes to the ticket office for example.
“
The organization can set up whatever it wants, if the user is vulnerable, the whole chain is vulnerable
,
”
summarizes Benoît Grunemwald.
Another challenge.