2024, Articles, Digital Security, News, Phishing

Google OAuth2 security flaw: How to Protect Yourself from Hackers

Posted on January 8, 2024January 10, 2024 by FMTAD

08
Jan

Hackers exploit OAuth2 flaw to bypass 2FA on Google accounts

Hackers exploit the Google OAuth2 security flaw to bypass 2FA and access your online services with persistent cookies. They exploit an undocumented OAuth2 endpoint to generate these cookies. PassCypher protects you by verifying the URL of connection to Google, alerting you of password corruption, and blocking redirection iframes attacks.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

January 17, 2026

Illustration du browser fingerprinting montrant une empreinte numérique de navigateur issue de métadonnées techniques utilisées pour la surveillance et le renseignement numérique

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

January 8, 2026

Infographie montrant la chaîne de risques de la faille Ledger 2026 : fuite Global-e, phishing SMS Chronopost, menaces de home-jacking et solutions de défense active NFC HSM.

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

January 7, 2026

OpenAI Mixpanel Breach Metadata illustrating a metadata leak, phishing risk and the need for sovereign security architectures without centralized databases

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

January 6, 2026

Silent Whisper, fictional WhatsApp and Signal espionage blocked by end-to-end encryption

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

January 5, 2026

Fuite données ministère interieur : illustration réaliste d’une cyberattaque via messageries compromises avec accès TAJ/FPR

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

January 5, 2026

Illustration réaliste montrant l’espionnage invisible d’un compte WhatsApp via une session persistante sur smartphone

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

December 21, 2025

Affiche de style cinéma représentant la fuite OpenAI Mixpanel, montrant un utilisateur devant un écran d’alerte de phishing et un nuage OpenAI, avec une ambiance numérique sombre évoquant les métadonnées et la cybersécurité

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

December 2, 2025

Google OAuth2 security flaw articles for in-depth analyses of threats and solutions. Stay updated by clicking on our scrolling topics.

Google OAuth2 security flaw written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

Google OAuth2 security flaw: Strategies Against Persistent Cookie Threats in Online Services

Google OAuth2 security flaw poses a serious threat that affects millions of users worldwide. However, hackers can exploit an undocumented OAuth2 endpoint to generate persistent cookies that allow them to access your online services, such as Gmail, Google Drive, YouTube, etc., without needing your password or 2FA code. Hackers can compromise your privacy, data, and identity using this flaw. How can you protect yourself from this attack? In this article, we will explain how this flaw works, how it has impacted many countries and organizations, and how you can use PassCypher, an innovative solution that verifies the URL of connection to Google, alerts you of password corruption, and blocks redirection iframes attacks.

Google OAuth2 Protocol: Ensuring Account Security and Comparing Different Methods

OAuth2 is an authorization protocol that facilitates user access to services like YouTube, Gmail, and Google Drive, allowing login with a Google account while avoiding password sharing. Specifically designed for ease and adaptability, this protocol comprehensively supports various applications, ranging from web and desktop platforms to mobile and living room devices. Consequently, when users engage with OAuth2, they authorize Google to share selective information, such as names and email addresses, with the connected service. Following this, Google issues an authentication token, effectively confirming the user’s identity to these services.

However, this protocol also has a security flaw, which was revealed by a hacker in October 2023. This flaw, known as the Google OAuth2 security flaw, allows hackers to create persistent cookies for Google accounts, which give them continuous access to Google services, even after the user resets their password. They exploit an undocumented Google Oauth endpoint named “MultiLogin”.

To protect themselves from this flaw, users can choose between different security methods, which require them to provide two pieces of evidence to log in to their account: their password and another factor. However, these methods have differences, advantages and disadvantages.

Google OAuth2 Multilogin Endpoint two-step verification (2SV)

This method uses the “MultiLogin” endpoint, which allows the user to log in to multiple Google services with a single authentication token. When the user logs in to their Google account, they receive a notification on their phone or computer, which they have to approve to validate their identity. This method is simple and fast, but it has a security risk. Indeed, it is vulnerable to the Google OAuth2 security flaw, which can compromise the user’s account.

One-time password two-factor authentication (2FA)

This method uses a one-time password based on time (TOTP) or on a counter (HOTP). This password is generated by an app or a physical device, which uses an algorithm and a secret shared with the Google account. When the user logs in to their Google account, they have to enter the one-time password displayed by the app or the device, in addition to their usual password. This method is more secure, because it does not depend on the Google Oauth endpoint. It resists phishing, replay or interception attacks. However, it requires access to the app or device, such as PassCypher NFC HSM1, that generates the one-time password. This can be inconvenient or impossible if you lose, damage or forget the app or device. Unless, of course, the app or device, like PassCypher, has an externalized OTP secret key backup system.

In conclusion, 2SV Google OAuth2 Multilogin Endpoint and 2FA one-time password are two security methods that offer different levels of protection. 2SV is simpler and faster, but it is vulnerable to the Google OAuth2 security flaw. 2FA is more secure, but it is more complex and dependent on an external factor. It is up to each user to choose the method that suits them best, depending on their needs and preferences.

Unveiling the Perils of PRISMA: A Deep Dive into Google OAuth2 Security Flaws

Google OAuth2 Security Flaw: A Critical Threat Exploiting Persistent Cookies

In October 2023, a critical Google OAuth2 security flaw was discovered in the Google OAuth2 protocol. This flaw, dubbed PRISMA, was a serious threat to the security of Google accounts. It allowed hackers to steal a wealth of sensitive data, including personal, financial, and professional information, as well as passwords and cookies.

Malware groups used the exploit widely. who integrated it into their infostealing tools. These tools were used to target millions of users worldwide, including government institutions, media organizations, NGOs, and businesses.

How the PRISMA Exploit Works: Exploiting an Undocumented Endpoint

Hackers took advantage of the PRISMA exploit, using an undocumented Google OAuth2 endpoint. This endpoint is typically used for legitimate purposes, such as providing limited access to Google accounts. However, the PRISMA exploit cleverly repurposed this endpoint to generate persistent cookies that remained valid even after a user changed their password or IP address.

To further understand how the PRISMA exploit worked, a security researcher from CloudSEK, Pavan Karthick M, analyzed it in depth in a report dated December 29, 2023. His findings revealed that the exploit worked by first obtaining the user’s Google account ID and refresh token. These credentials could be obtained through phishing attacks, malware infections, or other means.

Once the user’s credentials were obtained, the exploit used the undocumented endpoint to generate persistent cookies. Hackers then used these cookies to access the user’s Google account without needing 2FA.

The Impact of the PRISMA Exploit: Stealing Sensitive Data from Millions

The PRISMA exploit impacted a wide range of users. It was used to steal sensitive data from millions of users worldwide.

Government institutions, media organizations, NGOs, and businesses were all targeted by the exploit. Hackers stole sensitive data, such as personal information, financial records, and intellectual property, from these organizations.

The PRISMA exploit highlighted the ever-evolving nature of cyber threats. It showed that even the most secure protocols can be vulnerable to exploitation by determined hackers.

Securing Your Google Account from the PRISMA Exploit

The PRISMA exploit is a critical threat to Google account security. This exploit allows hackers to generate persistent Google cookies through token manipulation, enabling them to access Google services even after a user’s password is reset.

How to Protect Yourself from the PRISMA Exploit

Here are some key steps you can take to protect your Google account from the PRISMA exploit:

Enable two-factor authentication (2FA): 2FA is the most effective way to protect your Google account. It requires you to enter a code from your phone or other device, such as a hardware password manager, in addition to your password when you sign in.
Use a strong and unique password: Never reuse the same password for multiple accounts. If one account is compromised, all of your accounts are at risk. Choose a password that is long, complex, and difficult to guess. You can use a password generator or password manager to help you generate strong passwords.
Be cautious about clicking on links: Hackers often send phishing emails that contain links that will take you to malicious websites disguised as legitimate Google pages. Never click on links in emails or on websites unless you are sure they are from a trusted source.
Use a hardware password manager: PassCypher is an advanced hardware password manager that can help you protect your Google account from the PRISMA exploit. It is a versatile tool that can be used to manage your passwords on any storage device, including hard drives, SSDs, SD cards, USB drives, cloud storage, NAS devices, NFC devices, and mobile devices.

How the flaw works

Firstly, the flaw exploits an undocumented endpoint called the “multilogin” endpoint. Specifically, Google uses this endpoint to enable users to sign in to multiple Google accounts simultaneously. To exploit this flaw, attackers actively use the multilogin endpoint. They do this by generating persistent cookies for a victim’s Google account. Remarkably, the process involves using the victim’s email address and session ID.

Subsequently, the malware stores these cookies on the victim’s computer. Consequently, this action allows the attacker to access the victim’s Google account. Importantly, this access occurs without the need for the victim’s password. Moreover, this approach highlights a significant vulnerability in the account security process.

In essence, the attackers’ method of using the multiple sign-in endpoint is alarmingly effective. Notably, the generation and storage of cookies using the victim’s email and session ID underscore the flaw’s criticality. Ultimately, these actions enable attackers to bypass traditional security measures, accessing accounts undetected.

Below is the diagram which illustrates the technical method used to exploit the flaw.

The PRISMA exploit is a reminder that cyber threats are constantly evolving. By staying informed about the latest threats and taking proactive steps to protect your accounts, you can help to keep your data safe.

Analysis of the OAuth2 Flaw Affecting Google Account Security: A Statistical Outlook

The Growing Menace: Malware Exploiting Google Account Security Vulnerability

Significantly, Bitdefender’s study reveals a concerning trend. Between January and April 2023, they detected over 500,000 attempts to exploit the OAuth2 flaw, with a staggering 86% targeting Google Cloud accounts. Hackers have been using these accounts for resource-intensive activities, notably cryptocurrency mining, resulting in considerable costs for victims. This underscores the criticality of the Google account vulnerability, affecting millions worldwide.

The Extent of the Google Account Security Flaw Caused by OAuth2

The OAuth2 flaw exploited by malware has a wide impact. It affects not only individual users, but also major web platforms that use OAuth2 and OpenID for user authentication. Technology giants like Facebook, Google, LinkedIn, and Microsoft are notably impacted. Moreover, various infostealing tools have exploited this vulnerability to siphon off users’ personal, financial, and professional information. These tools include Lumma, Rhadamanthys, Stealc, Meduza, RisePro, and WhiteSnake, as well as Zloader, TrickBot, and Emotet.

Studying the Risks Posed by the Security Flaw

Furthermore, CloudSEK’s study emphasizes the widespread nature of this risk. Alarmingly, over 91% of European Cloud services, which frequently use OAuth2 for Google account connections, are at risk. Notably, a widely-used design application was found to be vulnerable to such attacks.

Disturbingly, Google’s data reveals that by 2024, only around 15% of Google account users had activated two-step verification. Consequently, this leaves a substantial 85% more exposed to the OAuth2 flaw and other security threats. Kaspersky’s survey indicates that 60% of users reuse passwords across multiple online accounts, exacerbating the risks of identity theft and account compromise. Moreover, RiskIQ’s analysis detected over 25,000 malicious applications on the Google Play Store in 2023, many of which contain infostealing tools exploiting the OAuth2 flaw.

Mitigating the Impact: Proactive Strategies Against OAuth2 Security Flaws in Google Accounts

In response to these risks, enabling two-step verification on Google accounts is crucial. Additionally, using reliable password managers is essential for enhanced security. It’s important to regularly monitor account activities, identifying and addressing suspicious behavior swiftly.

Exercising caution with untrusted links or attachments is vital. By taking this step, users can help avoid phishing attempts and other deceptive practices. Moreover, innovative solutions like PassCypher significantly enhance security. PassCypher verifies Google connection URLs and alerts users to password corruption. It effectively blocks iframe redirection attacks, adding an extra defense layer against sophisticated cyber threats.

By adopting these measures, users can significantly reduce vulnerability to the OAuth2 flaw. Staying vigilant and informed about security risks and solutions is key. This approach is essential for maintaining digital identities and assets’ integrity and safety in a connected world.

Recent Victims of Google’s OAuth2 Security Breach: A Global Overview

Malware has affected several countries and organizations, which have seen their Google accounts compromised and their data stolen. Among the victims, we can mention:

Greece, Moldova and Tunisia, which were targeted by a first hacking campaign in October 2023. Hackers used the exploit to access government institutions, media, NGOs, and businesses in these countries. Hackers stole sensitive information, such as official documents, diplomatic correspondence, financial data, etc.
Vietnam, which was targeted by a second hacking campaign in November 2023. The hackers used the exploit to access the Google accounts of ministries, press agencies, universities and businesses in this country, and stole strategic data, such as development plans, research reports, trade contracts, etc.
Pakistan, which was victim of a third hacking campaign in December 2023. The hackers used the exploit to access the Google accounts of authorities, media, NGOs and businesses in this country, and stole confidential data, such as military documents, secure communications, personal data, etc.
Several European countries, including France, Germany, Italy, Spain and the United Kingdom, which were targeted by a fourth hacking campaign in January 2024. The hackers used the exploit to access the Google accounts of European institutions, political parties, media, NGOs and businesses in these countries, and stole critical data, such as bills, investigation reports, electoral data, etc.

Voices of the targeted: Testimonies from Google’s OAuth2 Flaw Victims

The vulnerability severely damaged the victims, exposing their data, blocking their accounts, disrupting their services, and even ruining their finances. Here are some real testimonies of victims, collected by the website 20 Minutes and the website Aleteia:

Julien, 35, computer engineer, received an email that seemed to come from Google. It asked him to confirm his identity to access a service. He clicked on the link and entered his password. A few minutes later, he received another email from Google. It told him that his account had been hacked and that he had to change his password. But it was too late, he no longer had access to his account. The hackers used his account to send spam to his contacts, to access his photos, his documents, his bank accounts, etc. They even tried to blackmail him by threatening to publish his personal data on the Internet. He filed a complaint, but he did not get a response. He feels helpless and violated.
Léa, 28, school teacher, uses her Google account to log in to several online services, such as YouTube, Gmail, Google Drive, etc. Malware blocked her account, preventing her access to any of these services. She contacted Google support, who told her that her account had been compromised by malware and that she had to recover it by following a procedure. But Hackers changed her account’s security settings, causing the recovery procedure to fail. She lost all her files, her emails, her videos, etc. She had to create a new account and start over. It’s very frustrating and stressful for her.
Omar, 42, human rights activist, works for an NGO that defends human rights in the world. He uses his Google account to communicate with his colleagues, his partners, his sources, etc. One morning, he discovered that Hackers hacked his account and stole his data. Hackers sent defamatory messages, accessed confidential information, and compromised the security of his contacts using his account. They even tried to make him look like a spy. He was threatened, harassed, intimidated. He had to change his phone number, email address, pseudonym, etc. He fears for his life and for that of his loved ones.

How to protect yourself from the Google OAuth2 security flaw?

Google OAuth2 security flaw exposes users to this threat. It allows hackers to bypass 2FA and access online services with persistent cookies. They exploit an undocumented OAuth2 endpoint to generate these cookies. To protect yourself, use PassCypher. PassCypher is a hardware password manager that uses NFC technology to securely store and manage passwords. It can also detect and block phishing attacks and iframe redirection attacks. It is an innovative solution that verifies the URL of connection to Google, alerts you of password corruption, and blocks redirection iframes attacks.

Securing Your Google Account: Proactive Measures Against OAuth2 Exploits

Google tried to strengthen its fraud detection measures to counter the exploit, but the hackers adapted their method to bypass them. Therefore, there is no simple solution to protect yourself from the vulnerability. But you can adopt some good practices to secure your Google account:

Use a strong and unique password

Do not reuse the same password for multiple accounts. If one of them is compromised, the others will be too. Choose a long, complex and hard to guess password. You can use a password generator or a password manager to help you.

Enable two-step verification

It is an additional layer of security that asks for a code or a confirmation on your phone when you log in to your Google account. Thus, even if someone knows your password, they will not be able to access your account without your device. You can enable two-step verification in the settings of your Google account.

Check recent activities and connected devices

Google allows you to check the history of connections to your account, as well as the devices that have accessed it. If you notice any suspicious activity or unknown device, you can report it and remove it from your account. You can check recent activities and connected devices in the settings of your Google account.

Be careful of fraudulent emails and websites

Hackers may try to trick you by sending you emails or links that seem to come from Google, but are actually phishing attempts. Phishing is a technique that makes you believe that you need to provide your credentials or personal information to access a service or an offer. Do not click on dubious links or attachments, and always check the website address before entering your data. You can report fraudulent emails and websites to Google.

Log in regularly to your Google account

Starting from December 2023, Google will delete inactive accounts for more than two years. This measure aims to increase security and reduce the risks of compromise of abandoned accounts. To avoid losing your data, remember to log in to your Google account at least once every two years.

By following these tips, you can increase the security of your Google account and protect it from hackers. Do not forget to change your password regularly and keep your phone updated. For more information, visit Google’s security website.

PassCypher: A Leading-Edge Solution for Protecting Against Google OAuth2 Vulnerabilities

A leading-edge solution

The Google OAuth2 vulnerability is a critical security threat to Google accounts. Attackers can use this vulnerability to generate persistent cookies and access your Google account, even after you change your password or IP address.

PassCypher is a hardware password manager that can help protect your Google account from the Google OAuth2 vulnerability. PassCypher seamlessly integrates EviPass, EviOTP, EviCore NFC HSM, EviCore NFC HSM Browser Extension, and EviCore HSM OpenPGP technologies, as well as the NFC HSM devices from Freemindtronic. These technologies form the foundation of PassCypher’s comprehensive security features.

PassCypher uses post-quantum AES-256 robust encryption with segmented keys, which makes it impossible for attackers to decrypt your passwords, even with a quantum computer.

Advanced security features

In addition to its post-quantum encryption, PassCypher also offers a number of other advanced security features that can help protect your Google account.

Protection against iframe redirection: PassCypher blocks iframe redirection, preventing attackers from redirecting you to malicious websites without your knowledge.
Sandbox protection: PassCypher uses a sandbox protection mechanism to isolate each encrypted secret, preventing attackers from accessing or modifying your passwords or the original login URL.
Protection against SQL injection attacks: PassCypher does not store your passwords on a server or database. Instead, each password is encrypted individually and stored freely on one or more local or online or offline storage devices at the user’s choice, in lan and/or wan. This physically prevents attackers from accessing your encrypted passwords via SQL injection attacks.
Password corruption detection: PassCypher alerts you if it detects that a password has been corrupted, ensuring that your sensitive information remains secure.
State-of-the-art password generation: PassCypher uses a variety of algorithms to generate truly random and strong passwords greater than 256 bits, making them impossible to guess even to post-quantum attacks.

A versatile solution

PassCypher is a versatile tool that can be used to manage your passwords on any storage device, including:

Hard drives
SSDs
SD cards
USB drives
Cloud storage
NAS devices
NFC devices
Mobile devices

How to use PassCypher

To use PassCypher, you can install the free PassCypher HSM PGP extension for your Chromium or Firefox web browser. Once the extension is installed, you can easily access the following features:

Protection against iframe redirection
Password corruption detection
State-of-the-art password generation
Segmented key AES-256 OpenPGP encrypted password manager

To log in to your Google account using PassCypher, simply click on the PassCypher icon that appears in the Google login field. Once you click on the icon, PassCypher will automatically fill in your login credentials and submit them for you.

PassCypher HSM PGP is a free extension that provides basic password management features. PassCypher Engine, a paid add-on, adds additional features, such as automatic login in one second, password change in five seconds, fully automated secret usage management on multiple devices, and instant, fully automated encryption and decryption.

An effective solution

By using PassCypher, you can significantly improve the protection of your Google account against the Google OAuth2 vulnerability. PassCypher’s robust security features and ease of use make it a valuable tool for protecting your digital assets.

Conclusion: Safeguarding Against Google’s OAuth2 Security Flaws

We have seen how a clever hack allows cybercriminals to access Google accounts without passwords. We have also seen how this hack has affected many countries and organizations, and how he victims have testified about their distress. Finally, we have seen how to protect ourselves from this threat by adopting good security practices, and by using PassCypher, an innovative solution that verifies the URL of connection to Google, alerts in case of password corruption, and protects from redirection iframes attacks. The exploit reveals the complexity and stealthiness of modern cyber threats. The need for continuous monitoring of technical vulnerabilities and human intelligence sources to stay ahead of emerging threats.

2023, Articles, Cyberculture, EviCypher NFC HSM, News, Technologies

Telegram and the Information War in Ukraine

Posted on January 5, 2024March 25, 2024 by FMTAD

05
Jan

Telegram and the Information War in Ukraine written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

How Telegram Shapes the Information War in Ukraine

In this article, we explore how Telegram and Ukraine’s information warfare are intertwined. We look at how the messaging app is influencing the Russia-Ukraine conflict, and how it can be used for good or evil. We also discuss the benefits and risks of using Telegram, as well as how security and freedom of expression can be enhanced with EviCypher NFC HSM technology.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

January 17, 2026

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

January 8, 2026

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

January 7, 2026

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

January 6, 2026

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

January 5, 2026

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

January 5, 2026

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

December 21, 2025

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

December 2, 2025

How Telegram Influences the Conflict between Russia and Ukraine

Telegram and the information war in Ukraine are closely related. Telegram is a messaging app that offers users a secure and confidential way to communicate, thanks to its end-to-end encryption system. It has a large user base around the world, especially in Eastern Europe, where it plays a vital role in the information war between Russia and Ukraine.

Telegram’s Usage in Ukraine: Updated Statistics

Popularity and Download Trends

According to the report of the research company SimilarWeb, Telegram is the second most downloaded messaging app in Ukraine, after Viber, with 3.8 million downloads in 2021. It is also the fourth most used app in terms of time spent, with an average of 16 minutes per day. Telegram has about 10 million active users in Ukraine, which is almost a quarter of the country’s population.

Telegram’s Role in Ukrainian Media Landscape

Telegram is particularly appreciated by Ukrainians for its channel functionality, which allows to broadcast messages to a large audience. Some of these channels have become influential but controversial sources of information, as their owners and sources are often unknown. Among the most popular channels in Ukraine, we can mention:

@Zelenskyi, the official channel of President Volodymyr Zelensky, which has more than 2 million subscribers. It publishes announcements, speeches, interviews and videos of the head of state. It was created in 2019, during Zelensky’s election campaign, who was then an actor and a comedian.
@NashyGroshi, the channel of the journalistic project “Our Money”, which has more than 1.5 million subscribers. It publishes investigations, reports and analyses on corruption, abuse of power, political scandals and judicial cases in Ukraine. It was created in 2008, by journalist Denys Bihus, who received several awards for his work.
@Resident, the channel of blogger and activist Anatoliy Shariy, which has more than 1.3 million subscribers. It publishes comments, criticisms and sarcasms on the political and social news in Ukraine. He is known for his pro-Russian, anti-European and anti-government positions. He is currently in exile in Spain, where he is wanted by the Ukrainian justice for high treason and incitement to hatred.

These channels illustrate the diversity and complexity of the Ukrainian media landscape, which is marked by the conflict with Russia, the democratic transition, the fight against corruption and the polarization of society. They are also a reflection of the issues and challenges related to the use of Telegram, which can be both a tool of communication, information and manipulation.

Oleksiy Danilov’s Stance on Telegram’s Usage in Ukraine

Concerns Over National Security

Oleksiy Danilov is the secretary of the National Security and Defense Council of Ukraine, the body responsible for coordinating and controlling the activities of the executive bodies in the fields of national security and defense. He is also the head of cybersecurity of the country, and in this capacity, he expressed his reservations about the use of Telegram by Ukrainians. In February 2022, he stated that some anonymous and manipulative Telegram channels represented a threat to national security, and that they should be de-anonymized and regulated. He particularly targeted the channel @Resident, which broadcasts pro-Russian and anti-Ukrainian comments, and which is suspected of being linked to the Russian intelligence services. He also criticized the channel @Zelenskyi, which according to him, is not controlled by the Ukrainian president, but by advisers who seek to influence his policy.

Debating Telegram’s Influence in Ukraine

These statements provoked mixed reactions in Ukraine. Some supported Danilov’s position, believing that it was necessary to fight against misinformation and propaganda that undermine the sovereignty and democracy of the country. Others denounced an attempt at censorship and an attack on freedom of expression, recalling that Telegram was one of the few spaces where Ukrainians could access independent and diverse information.

How Telegram Influences the Information War in Ukraine

The Benefits and Risks of End-to-End Encryption

Telegram is a messaging app that lets you send messages, photos, videos, documents, and make voice and video calls. Its privacy policy is based on data encryption and non-cooperation with authorities. You can also create groups and channels that can reach thousands or millions of users.

End-to-end encryption is a technology that makes sure only the people in a conversation can read the messages, not even the service provider. Telegram has this option, but it is not on by default. You have to choose it for each chat, by switching to the “secret chat” mode. However, Telegram’s encryption is not based on standard protocols, and security experts have found some flaws.

Anonymous Channels and Their Impact on the Ukrainian Conflict

The channels are spaces where an administrator can send messages to a large audience. They can be public or private, and they can have millions of followers. Some channels are influential but controversial sources of information, as their owners and sources are often unknown. The channels can spread misinformation, propaganda, fake news, or violence.

Telegram and Russian propaganda have a strong connection, as many pro-Russian channels use the app to influence the public opinion in Ukraine and other countries. Telegram and the Ukrainian resistance also use the app to communicate and organize their actions against the Russian aggression.

Bots, Payment Services and Unique Usernames: A Double-Edged Sword

Bots are programs that interact with users. They offer services, information, or entertainment. Anyone can create them. They can be part of chats or channels. Bots can be helpful or harmful. They can collect personal data, send spam, or spread viruses.

Payment Services: Handy or Dishonest?

You can also use payment services via Telegram. These features use third-party platforms, such as Stripe or Apple Pay. They need bank or credit card information. Payment services can be handy or dishonest. They can steal sensitive data, scam users, or fund illegal activities.

Unique Usernames: Fun or Troublesome?

Another feature of Telegram is the unique usernames. They let users contact each other easily, without sharing their phone number. Users can create and change them at any time. Unique usernames can be fun or troublesome. They can enable harassment, identity theft, or account sale.

These features of Telegram raise issues of cybersecurity, privacy, end-to-end encryption, and application security. They can be used by bad actors, who want to harm Ukraine or its people. They can also be regulated by the authorities, who want to control the information or access the data of the users.

Telegram and the Information War in Ukraine: A Challenge

One of the main challenges of Telegram and the information war in Ukraine is to balance the freedom of expression and the protection of national security. Telegram and the Ukrainian conflict are closely intertwined. The app is used by both sides to communicate, inform, and influence. Telegram and Russian propaganda have a strong connection. Many pro-Russian channels use the app to sway the public opinion in Ukraine and other countries. Telegram and the Ukrainian resistance also use the app to coordinate and organize their actions against the Russian aggression. Telegram and cybersecurity in Ukraine are also crucial. The app can be a source of threats or a tool of defense.

Telegram VS Other Messaging Apps: A Comparative Analysis

WhatsApp: Popular but Questionable Confidentiality

WhatsApp is the most popular messaging app in the world, with more than 2 billion users. It offers end-to-end encryption by default for all conversations, which guarantees the protection of data. However, it belongs to Facebook, which has a dubious reputation in terms of respect for privacy, and which has raised fears about the sharing of data with other applications of the group. WhatsApp is also subject to the requests of the authorities, who can demand access to the metadata, such as the phone number, the IP address or the location of the users.

Signal: High Security but Limited User Base

Signal is a messaging app that claims to be the most secure and confidential on the market. It also offers end-to-end encryption by default for all conversations, and it does not collect any personal data. It is developed by a non-profit organization, which does not depend on advertising or investors. It is recommended by personalities such as Edward Snowden or Elon Musk. Signal is however less popular than WhatsApp or Telegram, with about 50 million users. It also offers fewer features, such as file sharing, information channels, bots or payment services.

Telegram: Innovative but Security Concerns

Telegram is between these two apps, offering more features than Signal, but less security than WhatsApp. Telegram allows users to choose the level of encryption and privacy they want, by opting for the “secret chat” mode or the “normal chat” mode. Telegram also allows users to enjoy innovative services, such as channels, bots, payments or unique usernames. However, Telegram also presents risks, such as fakes news, inappropriate content, privacy breaches or cyberattacks. Telegram is therefore an app that offers advantages and disadvantages, and that requires vigilance and discernment from users.

Telegram’s Global Perception and Regulation

Russia: Origin and Opposition

Russia is the country of origin of Telegram, but also its main adversary. The Kremlin tried to block the app in 2018, invoking reasons of national security and fight against terrorism. It demanded that Telegram provide it with the encryption keys to access the messages of the users, which Pavel Durov refused. It then ordered the telecom operators to block access to Telegram, but this measure proved ineffective, as Telegram used cloud servers to bypass the blocking. Many Russian users also use VPNs or proxies to access the app. In 2020, the Kremlin finally lifted the ban on Telegram, acknowledging its failure and stating that the app had cooperated with the authorities to remove extremist content. However, some observers suspect that Telegram made concessions to the Kremlin to lift the blocking, such as collaborating with the Russian services or censoring some channels.

France: Striving for Digital Regulation

France is a country that wants to be at the forefront of the regulation of digital platforms, especially in terms of fighting online hate. It adopted in 2020 a law that obliges the platforms to remove illegal content, such as incitement to violence, discrimination or terrorism, within 24 hours, under penalty of financial sanctions. This law also applies to messaging apps, such as Telegram, which must set up reporting and moderation mechanisms for content. France recognizes the right of users to privacy and end-to-end encryption, but it also asks the service providers to cooperate with the law enforcement to access the encrypted data when needed. France is also a country where Telegram is used by radical groups, such as jihadists or yellow vests, who take advantage of the app to organize, mobilize or defend themselves.

Ukraine: Balancing Utility and Risks

Ukraine is a country that has an ambivalent attitude towards Telegram, recognizing its usefulness, but also its dangers. On the one hand, Telegram is a source of information and a tool of resistance for many Ukrainians, who face the threat of Russian aggression and the challenges of democratic transition. On the other hand, Telegram is also a vector of misinformation and propaganda, which can undermine the sovereignty and stability of the country. Ukraine does not have a specific law to regulate Telegram, but it has some legal provisions to protect national security and public order, which can be used to restrict or block the app if necessary. Ukraine also cooperates with international organizations, such as the EU or NATO, to counter the cyber threats and the hybrid warfare that target the country.

EviCypher NFC HSM: Enhancing Telegram’s Security

The Role of Contactless Encryption Technology

One of the main challenges of using Telegram is to ensure the security and confidentiality of the data exchanged, especially in a context of information war. To meet this challenge, a possible solution consists of using EviCypher NFC HSM technology, which is a contactless encryption technology developed by Freemindtronic, an Andorran company specializing in the design of counter-espionage solutions implementing in particular contactless security with NFC technology. EviCypher NFC HSM uses two types of encryption algorithms for data:

Symmetric encryption in AES-256 for data such as texts (messages), thanks to its sub-technology EviCrypt. It uses a unique key, which is randomly generated and segmented into several parts. This key is used to encrypt and decrypt messages with the AES 256-bit algorithm.
Asymmetric encryption in RSA-4096 for symmetric encryption keys. It uses a pair of keys, which is generated and used from the NFC HSM device and which is based on the RSA 4096-bit algorithm. This pair of keys is used to share the symmetric key of at least 256 bits between the NFC HSM devices remotely, by encrypting the symmetric key with the public key of the recipient and decrypting the symmetric key with the private key of the recipient. The symmetric key is then stored and re-encrypted in the NFC HSM device of the recipient, with the trust criteria imposed by the sender if he has encapsulated them in the shared encryption key.

Practical Applications of EviCypher NFC HSM

EviCypher NFC HSM is a technology that uses hardware security modules (HSM) to store and use encrypted secrets. It allows contactless encryption with the NFC communication protocol. You can integrate the NFC HSM into various media, such as a card, a sticker, or a key ring. Then, you can pair it with an NFC phone, tablet, or computer. This way, you can encrypt everything before using any messaging service, including Telegram. EviCypher NFC HSM also has anti-cloning, anti-replay, and counterfeit detection mechanisms. It is part of the DataShielder product range, which offers serverless and databaseless encryption solutions.

Telegram and the Ukrainian conflict

EviCypher NFC HSM is compatible with Telegram, a messaging app that influences the information war between Russia and Ukraine. It offers more security and confidentiality than Telegram’s end-to-end encryption, which is not based on recognized standards. It also gives you more flexibility and control than Telegram’s secret chat mode, as you can choose the trust criteria for the encryption keys. Moreover, it is more convenient and simple than Telegram’s normal chat mode, as you can encrypt and decrypt messages with a simple gesture.

Telegram and cybersecurity in Ukraine

EviCypher NFC HSM is a useful technology with Telegram, as it enhances the security and confidentiality of the data exchanged, especially in a context of information war. It is also a universal technology, as you can use it with any other messaging app, such as WhatsApp, Signal, Messenger, etc. It is also an innovative technology, as it uses the NFC communication protocol to perform contactless encryption, without requiring any connection or installation.

Concluding Insights on Telegram’s Role in Ukraine

In this article, we have seen how Telegram plays a vital role in the information war between Russia and Ukraine, and what issues and challenges there are in using this messaging app. We have also seen how the technology EviCypher NFC HSM can be a useful solution to enhance the security and confidentiality of the data exchanged with Telegram. We hope that this article has been informative and interesting for you, and that it has helped you to better understand the situation of Telegram in Ukraine and in other countries. Thank you for reading.

Overview of Cited Sources

Here are the sources of the article, which are valid, reliable, relevant and if possible official links that allow to justify and verify the statements made in this article:

[Liga.net]: the news site that published the interview of Oleksiy Danilov on November 2, 2023, in which he expresses his concerns about Telegram.
[NV.ua]: the news site that reported the statement of Oleksiy Danilov, who alerted the nation to the critical vulnerabilities of Telegram, on November 2, 2023.
[RT – Pravda]: the Ukrainian news site that related the remarks of Oleksiy Danilov, who answered the questions of journalists during a press conference on November 3, 2023.
[Number of Telegram Users in 2023? 55 Telegram Stats (backlinko.com)]: an article that gives figures on the use of Telegram in the world and in Ukraine.
[NV.ua -NSDC]: the official website of the National Security and Defense Council of Ukraine, which published the press release of Oleksiy Danilov, who clarified his recent comments on Telegram, on November 15, 2023
[Ukrainians turn to encrypted messengers, offline maps and Twitter amid Russian invasion]: an article that describes how Ukrainians use Telegram and other digital tools to protect themselves and get informed in the face of the Russian aggression.
[Pravda – France 24]: the French news site that contains a video of the interview of Oleksiy Danilov with the journalist Gulliver Cragg, dated January 23, 2023.
[NFC HSM Technology – Freemindtronic]: an article that explains the NFC HSM technologies and how they work.
[EviCypher NFC HSM technology – Freemindtronic]: a page that contains articles and videos on the NFC HSM technologies.
[FAQ for the Technically Inclined – Telegram APIs]: a page that provides technical information about the Telegram APIs and the MTProto protocol.

2024, Articles, Digital Security

Kismet iPhone: How to protect your device from the most sophisticated spying attack?

Posted on January 2, 2024January 2, 2024 by FMTAD

02
Jan

Kismet iPhone and Pegasus written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

Kismet iPhone and Pegasus: a deadly combo

Hackers can use Kismet iPhone to install Pegasus spyware on your iPhone. This spyware can access your data, activity, and conversations.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

January 17, 2026

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

January 8, 2026

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

January 7, 2026

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

January 6, 2026

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

January 5, 2026

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

January 5, 2026

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

December 21, 2025

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

December 2, 2025

Kismet iPhone: How to protect your device from the most sophisticated spying attack using Pegasus spyware

Do you own an iPhone? Do you think it is safe and private? You might be wrong. Hackers have created a clever attack called Kismet iPhone that can infect your device with Pegasus, the world’s most powerful spyware, without you noticing. This spyware can steal your personal data, track your activity, and listen to your conversations. In this article, we will tell you how Kismet iPhone works, who is behind it, and how you can protect yourself from it.

What is Kismet iPhone?

Kismet iPhone is the name of the attack that hackers use to install Pegasus, the spyware, on iPhones. Kismet iPhone uses a technique called “watering hole”. It consists of infecting websites visited by the targeted users. These websites contain malicious code that detects if the user has an iPhone and which model. If so, the malicious code redirects the browser to a server that exploits zero-day flaws in iOS and Safari. These flaws allow to install Pegasus without the user noticing. Pegasus then runs in the background and communicates with a command and control server.

What is Pegasus?

Pegasus is the name of the spyware that Kismet iPhone installs on iPhones. Pegasus is one of the most powerful spyware in the world, developed by NSO Group, an Israeli company that sells spyware to governments and intelligence agencies. Pegasus can access almost everything on the infected iPhone, such as messages, photos, contacts, location, calls, passwords and even conversations near the microphone. Pegasus can also activate the camera and the microphone remotely, and record the screen. Pegasus can bypass encryption and security features of apps like WhatsApp, Signal, Telegram, and others.

Who is behind Kismet iPhone and Pegasus?

Kismet iPhone and Pegasus are the work of NSO Group, an Israeli company that sells spyware to governments and intelligence agencies. NSO Group claims that its products are only used for legitimate purposes, such as fighting terrorism and crime. However, investigations have revealed that NSO Group has also targeted journalists, activists, lawyers, politicians and dissidents, violating their privacy and rights. NSO Group has been accused of being involved in the murder of Jamal Khashoggi, a Saudi journalist, and the hacking of Jeff Bezos, the founder of Amazon.

Examples of victims of Kismet iPhone and Pegasus

According to a report by Citizen Lab, a research group at the University of Toronto, Kismet iPhone and Pegasus have been used to spy on at least nine Bahraini activists between June 2020 and February 2021. The activists were members of the Bahrain Center for Human Rights, the Bahrain Institute for Rights and Democracy, and the European Center for Constitutional and Human Rights. They received text messages containing malicious links that attempted to infect their iPhones with Pegasus.

Another report by Amnesty International and Forbidden Stories, a non-profit media organization, revealed that Kismet iPhone and Pegasus have been used to target more than 50,000 phone numbers of people from various countries and professions. Among them were journalists, human rights defenders, lawyers, politicians, business executives, religious leaders, and celebrities. Some of the prominent names on the list were French President Emmanuel Macron, Pakistani Prime Minister Imran Khan, Indian opposition leader Rahul Gandhi, Moroccan journalist Omar Radi, and Mexican journalist Cecilio Pineda Birto.

A third report by The Guardian, a British newspaper, exposed that Kismet iPhone and Pegasus have been used to spy on the civil rights movement in the United States. The report found that at least 15 people who were close to the Black Lives Matter activist DeRay Mckesson had their phones hacked with Pegasus in 2016. The report also found that Alaa Mahajna, a lawyer who represented the family of George Floyd, had his phone hacked with Pegasus in 2020.

These examples show that Kismet iPhone and Pegasus are not only used to spy on criminals and terrorists, but also on innocent people who exercise their rights to freedom of expression, association, and assembly.

How to protect yourself from Kismet iPhone and Pegasus?

To protect yourself from Kismet iPhone and Pegasus, you need to update your iPhone with the latest version of iOS. Apple fixed the zero-day flaws exploited by Kismet iPhone in September 2020, making the attack ineffective. You also need to avoid clicking on suspicious links or visiting unsecured websites, which could be infected by malicious code. You need to use a VPN (virtual private network) to encrypt your internet connection and prevent potential spies from seeing your online activity. You can check if your iPhone has been infected by Pegasus by using a tool developed by Amnesty International, called MVT (Mobile Verification Toolkit).

Sources and downloads

If you want to learn more about the zero-day flaws used by Kismet iPhone and Pegasus, and how Apple fixed them, you can check the following sources:

About iOS 15 updates – Apple Support: this site gives you the details of the iOS 15 updates, including the security patches provided by each version. You can also download the latest version of iOS 15 from this site, by going to “Settings” > “General” > “Software Update”.
iOS 17.0.1 and iPadOS 17.0.1 updates are released with security fixes – iphonology.fr: this site informs you of the latest news on iOS and iPadOS, and explains how to install the security updates on your device.
iOS 16 will offer security patches without updates to install – iphonesoft.fr: this site presents a new feature of iOS 16, which will allow Apple to remotely install security patches on your iPhone, without you having to do an update.

If you want to check if your iPhone has been infected by Pegasus, you can download the following application:

MVT (Mobile Verification Toolkit)MVT (Mobile Verification Toolkit): this open source software allows you to analyze your iPhone and detect traces of Pegasus. It is available for Windows, Mac and Linux, and requires some technical knowledge to use it. You can follow the user guide on the official project site.

Conclusion

Kismet iPhone and Pegasus are two of the most sophisticated and dangerous cyberattacks that target iPhone users. They can compromise your device and your data, without you being aware of it. To protect yourself from these attacks, you need to keep your iPhone updated, be careful with what you click and visit online, and use a VPN. You can also use a tool to detect if your iPhone has been infected by Pegasus. If you want to know more about Pegasus, the most powerful spyware in the world, you can read our dedicated article here: Pegasus: the cost of spying with one of the most powerful spyware in the world

However, you should know that the zero-day risk is always present, and that the economic stakes are huge for the companies that exploit these flaws to spy on their competitors or their adversaries. That is why Freemindtronic has specialized in counter-espionage tecnologiescounter-espionage tecnologies, which allow you to protect your data and your privacy against malicious intrusions. If you are interested in these solutions, you can visit our Freemindtronic website and discover the different technologies of counter espionage.

2023, Digital Security

5Ghoul: 5G NR Attacks on Mobile Devices

Posted on December 29, 2023July 27, 2024 by FMTAD

29
Dec

5Ghoul Attacks on Mobile Devices written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

5Ghoul: A Threat to 5G Security

5G has benefits, but also risks. 5Ghoul is a set of 5G NR flaws that affect Qualcomm and MediaTek modems, used by most 5G devices. 5Ghoul can disrupt or make unusable smartphones, routers and modems 5G. In this article, we will see what 5Ghoul is, how it compares to other 5G attacks, and how to protect yourself with contactless encryption, which uses NFC.

Why the NFC hardware wallet with credit card manager is PCI DSS compliant

2020 Legal information

Freemindtronic’s NFC hardware wallets with credit card management are PCI DSS compliant

December 20, 2020

Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing

November 8, 2023

Unitary Patent system European why some EU countries are not on board

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board

August 1, 2023

Andorran law

Llei 26/2014 del 30 d’octubre de patents

November 21, 2016

Realistic 16:9 illustration of Ledger Security Breaches featuring a broken digital chain surrounding compromised cryptocurrency data and hardware vulnerabilities.

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers

December 16, 2023

5Ghoul: How Contactless Encryption Can Secure Your 5G Communications from Modem Attacks

5Ghoul is a set of 5G NR vulnerabilities that affect Qualcomm and MediaTek modems. These flaws allow to launch denial-of-service attacks or degrade the quality of the 5G network.

What is 5Ghoul?

5Ghoul is a set of 14 5G NR (New Radio) vulnerabilities, the protocol that governs the communication between 5G devices and base stations (gNB). Among these vulnerabilities, 10 are public and 4 are still confidential. They were discovered by researchers from the Singapore University of Technology and DesignSingapore University of Technology and Design.

The 5Ghoul vulnerabilities exploit implementation errors in Qualcomm and MediaTek modems, which do not comply with the specifications of the 5G NR protocol. They allow an attacker to create a fake base station, which pretends to be a legitimate one, and send malicious messages to 5G devices that connect to it. These messages can cause errors, crashes or infinite loops in the modems, resulting in denial-of-service attacks or degradations of the quality of the 5G network.

Which devices are affected by 5Ghoul?

The researchers tested the 5Ghoul vulnerabilities on 714 models of 5G smartphones from 24 different brands, including Lenovo, Google, TCL, Microsoft, etc. They also tested routers and modems 5G from various manufacturers. They found that the 5Ghoul vulnerabilities affect all 5G devices equipped with Qualcomm and MediaTek modems, which account for more than 90% of the market.

What are the impacts of 5Ghoul?

The impacts of 5Ghoul depend on the vulnerability exploited and the type of device targeted. The researchers classified the 5Ghoul vulnerabilities into three categories, according to their severity:

Level 1 vulnerabilities

Level 1 vulnerabilities are the most severe. They allow to render 5G devices completely unusable, by locking them in a state where they can neither connect nor disconnect from the 5G network. These vulnerabilities require a manual reboot of the devices to be resolved. Among the level 1 vulnerabilities, there is for example the CVE-2023-33043, which causes a crash of the Qualcomm X55/X60 modem by sending an invalid MAC/RLC message.

Level 2 vulnerabilities

Level 2 vulnerabilities are less critical, but still harmful. They allow to degrade the quality of the 5G network, by reducing the throughput, latency or stability of the connection. These vulnerabilities can be resolved by reconnecting to the 5G network. Among the level 2 vulnerabilities, there is for example the CVE-2023-33044, which causes packet loss on the MediaTek T750 modem by sending an invalid RRC message.

Level 3 vulnerabilities

Level 3 vulnerabilities are the least dangerous. They allow to disrupt the normal functioning of 5G devices, by displaying error messages, modifying settings or triggering alerts. These vulnerabilities have no impact on the quality of the 5G network. Among the level 3 vulnerabilities, there is for example the CVE-2023-33045, which causes an error message on the Qualcomm X55/X60 modem by sending an invalid RRC message.

How to protect yourself from 5Ghoul?

The researchers informed the manufacturers of Qualcomm and MediaTek modems of the 5Ghoul vulnerabilities, as well as the 5G network operators and the 5G device manufacturers. They also published a demonstration kit of the 5Ghoul vulnerabilities on GitHub, to raise awareness among the public and the scientific community of the risks of 5G NR.

To protect yourself from 5Ghoul, 5G device users must update their modems with the latest security patches, as soon as they are available. They must also avoid connecting to unreliable or unknown 5G networks, which could be fake base stations. In case of doubt, they can disable 5G and use 4G or Wi-Fi.

How 5Ghoul compares to other 5G attacks?

5Ghoul is not the first security flaw that affects 5G. Other 5G attacks have been discovered in the past, exploiting weaknesses in the protocol or in the equipment. Here are some examples of 5G attacks and their differences with 5Ghoul:

ReVoLTE

ReVoLTE is an attack that allows to listen to voice calls 4G and 5G by exploiting a vulnerability in the encryption of data. This vulnerability is due to the fact that some base stations reuse the same encryption key for multiple communication sessions, which allows an attacker to decrypt the content of the calls by capturing the radio signals.

It is different from 5Ghoul because it does not target the 5G modem, but the encryption of data. ReVoLTE also requires that the attacker be close to the victim and have specialized equipment to intercept the radio signals. ReVoLTE does not cause denial of service or degradation of the network, but it compromises the confidentiality of communications.

ToRPEDO

ToRPEDO is an attack that allows to locate, track or harass mobile phone users 4G and 5G by exploiting a vulnerability in the paging protocol. This protocol is used to notify mobile devices of incoming calls or messages. By sending repeated messages to a phone number, an attacker can trigger paging messages on the network, and thus determine the position or identity of the target device.

It is different from 5Ghoul because it does not target the 5G modem, but the paging protocol. ToRPEDO also requires that the attacker knows the phone number of the victim and has access to the mobile network. ToRPEDO does not cause denial of service or degradation of the network, but it compromises the privacy of users.

IMP4GT

IMP4GT is an attack that allows to degrade the quality of the 5G network by exploiting a vulnerability in the security protocol. This protocol is used to authenticate and encrypt the communications between 5G devices and base stations. By modifying the messages exchanged between the two parties, an attacker can mislead the network and the device on the level of security required, and thus reduce the throughput or latency of the connection.

It is different from 5Ghoul because it does not target the 5G modem, but the security protocol. IMP4GT also requires that the attacker be close to the base station and have equipment capable of modifying the messages. IMP4GT does not cause denial of service or crash of the modem, but it degrades the quality of the network.

SS7

SS7 is a set of signaling protocols used by mobile operators to establish and manage calls and messages between different networks. SS7 has existed since the 1970s and has not evolved much since, making it vulnerable to hacking attacks. By exploiting the flaws of SS7, an attacker can intercept SMS and voice calls, locate and track users, bypass two-factor authentication, or subscribe subscribers to paid services without their consent.

It is different from 5Ghoul because it does not target the 5G modem, but the signaling protocol. SS7 affects all types of mobile networks, including 5G, because it still uses SS7 for some functions, such as mobility management or compatibility with 2G and 3G networks. SS7 requires that the attacker has access to the signaling network, which is not easy to obtain, but not impossible. SS7 does not cause denial of service or crash of the modem, but it compromises the confidentiality and integrity of communications.

How and why to encrypt SMS, MMS and RCS without contact?

Contactless encryption is a method of protecting mobile communications that uses NFC (Near Field Communication) technology to establish a secure connection between two devices. NFC is a wireless communication protocol that allows to exchange data by bringing two compatible devices within a few centimeters of each other.

Contactless encryption relies on the use of an external device called NFC HSM (Hardware Security Module), which is a hardware security module that stores and manages encryption keys. The NFC HSM comes in the form of a card, a keychain or a bracelet, that the user must bring close to his phone to activate the encryption. The NFC HSM communicates with the phone via NFC and transmits the encryption key needed to secure the messages.

The technologies EviCore NFC HSM and EviCypher NFC HSM are examples of contactless encryption solutions developed by the Andorran company Freemindtronic. EviCore NFC HSM is a hardware security module that allows to encrypt SMS, MMS and RCS (Rich Communication Services) end-to-end, meaning that only the recipients can read the messages. EviCypher NFC HSM is a hardware security module that allows to encrypt multimedia files (photos, videos, audio, etc.) and share them via SMS, MMS or RCS.

Contactless encryption has several advantages over conventional encryption of mobile communications:

It offers a higher level of security, because the encryption key is not stored on the phone, but on the NFC HSM, which is more difficult to hack or steal.

It is compatible with all types of mobile networks, including 5G, because it does not depend on the communication protocol used, but on NFC.

It is easy to use, because it is enough to bring the NFC HSM close to the phone to activate the encryption, without having to install a specific application or create an account.

It is transparent, because it does not change the appearance or functioning of the messages, which remain accessible from the native application of the phone.

Statistics on 5Ghoul

How widespread are 5Ghouls? What are the trends and impacts of these flaws? Some statistics on 5Ghoul, based on sources and data that are a priori reliable.

5Ghoul: a threat to 5G devices

5Ghoul is a set of 5G NR vulnerabilities that affect Qualcomm and MediaTek modems, which are used by most 5G devices on the market. According to the researchers who discovered 5Ghoul, these vulnerabilities can cause denial-of-service attacks or network degradations.

How many 5G devices are affected by 5Ghoul? According to a report by Counterpoint Research, Qualcomm and MediaTek accounted for 79% of the global smartphone chipset market in Q3 2020. Qualcomm had a 39% share, while MediaTek had a 40% share. Assuming that all Qualcomm and MediaTek chipsets are vulnerable to 5Ghoul, this means that nearly 8 out of 10 smartphones are potentially at risk.
How many 5G NR vulnerabilities are known? According to the CVE (Common Vulnerabilities and Exposures) database. There are 16 CVE entries related to 5G NR as of April 2021. Four of them are ZeroDay vulnerabilities that have not been publicly disclosed nor fixed by the manufacturers. These vulnerabilities are classified as level 1 or 2, meaning that they can cause denial-of-service attacks or network degradations.
How many 5G attacks have been reported? According to the SANS Internet Storm Center, there have been no reports of 5Ghoul attacks in the wild as of April 2021. However, this does not mean that 5Ghoul is not exploited by malicious actors. The researchers who discovered 5Ghoul have developed a proof-of-concept tool called 5Ghoul-Scanner, which can detect and exploit 5Ghoul vulnerabilities. They have also released a video demonstration of 5Ghoul attacks.

Conclusion

5Ghoul is a security flaw that affects 5G modems from Qualcomm and MediaTek, which are used by most 5G devices on the market. 5Ghoul allows an attacker to disrupt the functioning of smartphones, routers and modems 5G, or even make them unusable. 5Ghoul stands out from other 5G attacks known, such as ReVoLTE, ToRPEDO, IMP4GT or SS7, by the fact that it targets the 5G modem, that it does not require secret information or specialized equipment, and that it causes denial-of-service attacks or degradations of the network. To protect yourself from 5Ghoul, 5G device users must update their modems with the latest security patches, and avoid connecting to unreliable or unknown 5G networks.

2023, Articles, CyberStealth, legal, Legal information, News, Spying

The American Intelligence: How It Works

Posted on December 26, 2023December 26, 2023 by FMTAD

26
Dec

Learn more about the American Intelligence written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

The American intelligence: a paradox

The American intelligence is powerful and influential, but also faces limits and challenges. Discover how it works, what are its consequences, and how to protect yourself from it.

2020 Legal information

Freemindtronic’s NFC hardware wallets with credit card management are PCI DSS compliant

December 20, 2020

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing

November 8, 2023

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board

August 1, 2023

Andorran law

Llei 26/2014 del 30 d’octubre de patents

November 21, 2016

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers

December 16, 2023

The American Intelligence: How It Works, Its Limits and Consequences

The American intelligence is one of the most powerful and influential in the world. It has a vast network of agencies, resources, and allies that enable it to collect, analyze, and act on information of strategic interest. However, the American intelligence also faces challenges and criticisms, both internally and externally. In this article, we will explore how the American intelligence works, what are its limits, and what are the consequences of its actions for the global security and privacy.

How the American Intelligence Works

The American intelligence is composed of 18 agencies that form the Intelligence Community (IC). These agencies are divided into two categories: the civilian agencies, which are under the supervision of the Director of National Intelligence (DNI), and the military agencies, which are under the supervision of the Secretary of Defense.

The main civilian agencies are:

The Central Intelligence Agency (CIA), which is responsible for collecting, analyzing, and disseminating foreign intelligence, as well as conducting covert operations and paramilitary activities.
The National Security Agency (NSA), which is responsible for collecting, processing, and disseminating signals intelligence (SIGINT), as well as conducting cyber operations and protecting the US government’s communications and information systems.
The Federal Bureau of Investigation (FBI), which is responsible for collecting, analyzing, and disseminating domestic intelligence, as well as conducting counterintelligence, counterterrorism, and law enforcement activities.
The National Geospatial-Intelligence Agency (NGA), which is responsible for collecting, analyzing, and disseminating geospatial intelligence (GEOINT), which includes imagery, maps, and other geographic information.
The National Reconnaissance Office (NRO), which is responsible for designing, launching, and operating reconnaissance satellites and other space-based systems that provide intelligence to the IC and the Department of Defense (DoD).
The Office of the Director of National Intelligence (ODNI), which is responsible for overseeing, coordinating, and integrating the activities of the IC, as well as providing strategic guidance and support to the DNI.

The main military agencies are:

The Defense Intelligence Agency (DIA), which is responsible for providing military intelligence to the DoD and the IC, as well as conducting human intelligence (HUMINT), counterintelligence, and defense attaché activities.
The National Security Agency/Central Security Service (NSA/CSS), which is responsible for providing SIGINT and cyber support to the DoD and the IC, as well as conducting information assurance and cryptologic activities.
The National Geospatial-Intelligence Agency (NGA), which is responsible for providing GEOINT support to the DoD and the IC, as well as conducting geospatial analysis and mapping activities.
The National Reconnaissance Office (NRO), which is responsible for providing space-based intelligence support to the DoD and the IC, as well as conducting satellite reconnaissance and surveillance activities.
The Military Intelligence Corps (MI), which is responsible for providing tactical and operational intelligence to the Army and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
The Office of Naval Intelligence (ONI), which is responsible for providing maritime intelligence to the Navy and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
The Marine Corps Intelligence Activity (MCIA), which is responsible for providing intelligence to the Marine Corps and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
The Air Force Intelligence, Surveillance, and Reconnaissance Agency (AFISRA), which is responsible for providing intelligence to the Air Force and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.

The American intelligence works by collecting information from various sources, such as human sources, signals, images, open sources, and others. It then analyzes this information to produce intelligence products, such as reports, assessments, briefings, and forecasts. These products are then disseminated to the relevant consumers, such as the President, the Congress, the military, the policy makers, and the allies. The American intelligence also acts on the information it collects, by conducting operations, such as covert actions, cyber attacks, drone strikes, and special operations.

The Limits of the American Intelligence

The American intelligence, despite its capabilities and resources, is not omnipotent or infallible. It faces several limits and challenges, such as:

Legal and ethical limits: The American intelligence is bound by the laws and regulations of the US and the international community, as well as by the values and principles of the American democracy. It must respect the rights and liberties of the American citizens and the foreign nationals, as well as the sovereignty and interests of the other countries. It must also abide by the oversight and accountability mechanisms of the executive, the legislative, and the judicial branches, as well as the public opinion and the media. The American intelligence must balance its need for secrecy and effectiveness with its duty for transparency and legitimacy.
Technical and operational limits: The American intelligence is limited by the availability and reliability of the information it collects, as well as by the accuracy and timeliness of the analysis it produces. It must deal with the challenges of information overload, data quality, data security, data privacy, and data sharing. It must also cope with the threats and risks of cyber attacks, counterintelligence, deception, and denial. The American intelligence must balance its need for innovation and adaptation with its need for standardization and coordination.
Strategic and political limits: The American intelligence is limited by the complexity and uncertainty of the global environment, as well as by the diversity and dynamism of the actors and issues it faces. It must deal with the challenges of globalization, multipolarity, regionalization, and fragmentation. It must also cope with the threats and opportunities of terrorism, proliferation, rogue states, failed states, and emerging powers. The American intelligence must balance its need for anticipation and prevention with its need for reaction and intervention.

The Consequences of the American Intelligence

The American intelligence has significant consequences for the global security and privacy, both positive and negative, such as:

Positive consequences: The American intelligence contributes to the protection and promotion of the national security and interests of the US and its allies, as well as to the maintenance and enhancement of the international peace and stability. It provides valuable information and insights to the decision makers and the operators, as well as to the public and the media. It also conducts effective operations and actions to deter, disrupt, or defeat the adversaries and the threats. The American intelligence plays a key role in the global intelligence cooperation and coordination, as well as in the global governance and leadership.
Negative consequences: The American intelligence also poses risks and challenges to the security and privacy of the US and its allies, as well as to the international order and norms. It may collect, analyze, or disseminate information that is inaccurate, incomplete, or biased, leading to errors, failures, or controversies. It may also conduct operations or actions that are illegal, unethical, or counterproductive, leading to violations, scandals, or backlashes. The American intelligence may face competition or conflict with the other intelligence services or actors, as well as with the other stakeholders or interests.

Section 702 of FISA: A Surveillance Without Control

On July 17, 2008, the US Congress passed section 702 of the FISA (Foreign Intelligence Surveillance Act), which authorizes the US intelligence agencies to collect the electronic communications of non-Americans located abroad, without a warrant from the FISA judge.
On January 19, 2018, the US Congress extended section 702 of FISA until December 31, 2023, without making any substantial changes.
On March 22, 2023, the US Congress extended section 702 of FISA again until April 19, 2024, without making any significant changes.
On December 16, 2023, the US Congress approved the National Defense Authorization Act (NDAA), which included a four-month extension of section 702 of FISA, avoiding its expiration at the end of the year.

The Violation of the Right to Privacy

On June 5, 2013, the whistleblower Edward Snowden revealed the existence of the PRISM program, which allowed the US intelligence agencies to access the data of the users of the main electronic service providers, such as Google, Facebook, Microsoft or Apple.
On October 6, 2015, the Court of Justice of the European Union (CJEU) invalidated the Safe Harbor, an agreement that allowed the transfer of personal data between the European Union and the United States, considering that it did not offer an adequate level of protection.
On July 16, 2020, the CJEU invalidated the Privacy Shield, the successor of the Safe Harbor, for the same reasons, considering that the risk of interference by the US intelligence services in the transferred data was incompatible with the respect of the fundamental rights of the persons concerned.
On July 31, 2023, the CJEU issued a ruling that confirmed the invalidity of the Privacy Shield and imposed strict conditions for the transfer of personal data to third countries, especially the United States, under the standard contractual clauses (SCCs) or the binding corporate rules (BCRs).

The Legal and Political Consequences

On October 24, 2013, the European Parliament adopted a resolution that condemned the massive surveillance activities of the US intelligence services and called for the suspension of the cooperation agreements on security and counter-terrorism.
On October 23, 2015, the European Parliament adopted another resolution that requested the creation of an independent international tribunal to examine the complaints of the European citizens regarding the surveillance of the US intelligence services.
On September 14, 2018, the European Parliament adopted a third resolution that called for the suspension of the Privacy Shield, due to the non-compliance of the commitments made by the United States on the protection of personal data.
On August 31, 2023, the European Parliament adopted a fourth resolution that asked the European Commission to propose a new legislation on the protection of personal data in the context of cross-border data flows, which would guarantee a level of protection equivalent to that of the general data protection regulation (GDPR).

Sources:

Congress passes temporary extension of FISA Section 702 surveillance program – Axios:

The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield:

FISA Section 702: What it is and why Congress is debating it – NBC News

New technologies and products that limit the possibilities of intelligence

Facing the capabilities of collection and analysis of the American intelligence, which threaten the privacy and sovereignty of individuals and countries, there are new technologies and products that allow to limit the possibilities of intelligence. These technologies and products use techniques of encryption, cryptography, blockchain or NFC to protect personal data and electronic communications. They offer an alternative to traditional solutions, which are often vulnerable to attacks or interceptions by the American intelligence. Among these technologies and products, we can mention:

EviCypher NFC HSM and EviCypher HSM OpenPGP, which are patented technologies in the United States in the field of cybersecurity developed by Freemindtronic SL Andorra, used in counter-espionage products such as DataShielder Defense. They allow to encrypt and decrypt data without contact, thanks to hardware security modules that use NFC technology. They offer compatibility with OpenPGP standards, operating without server, without database, with a very high level of flexibility from different removable, fixed and online and offline storage media including NFC HSM.
DataShielder DefenseDataShielder Defense, which is a counter-espionage product developed by Freemindtronic SL Andorra, which uses EviCore NFC HSM and EviCore HSM OpenPGP technologies to encrypt and decrypt all types of data and communication services. This product protects sovereign communications, by preventing the American intelligence from accessing personal, professional or state secrets. It also guarantees the sovereignty of users, by making their data anonymous and inviolable.
Signal, which is an instant messaging application that uses the Signal protocol, which is an end-to-end encryption protocol that ensures the confidentiality and integrity of messages. This application allows to communicate anonymously and securely, by avoiding the surveillance or censorship of the American intelligence.
Tor, which is a decentralized network that uses volunteer relays to route Internet traffic anonymously and encrypted. This network allows to browse the web without leaving traces, by hiding the IP address and location of users. It also allows to access hidden websites, which are not indexed by search engines.

These technologies and products represent examples of innovative solutions that limit the possibilities of the American intelligence and preserve the individual and collective sovereignty. They also illustrate the issues and challenges related to the use of digital technologies in the field of intelligence.

Conclusion

The American intelligence is a complex and dynamic phenomenon that has a significant impact on the world. It has many strengths and weaknesses, as well as many opportunities and threats. It has many achievements and failures, as well as many benefits and costs. It is a source of both security and insecurity, both privacy and surveillance. It is a subject of both admiration and criticism, both cooperation and confrontation. The American intelligence is a paradox that requires a careful and balanced approach.

2023, Cyberculture

New EU Data Protection Regulation 2023/2854: What you need to know

Posted on December 25, 2023February 21, 2024 by FMTAD

25
Dec

Learn more about the new European Data Protection Regulation (2023/2854) written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

EU 2023/2854 Data Protection Rules: what you need to know

The EU has adopted a new regulation to protect personal data published in OJ L, 2023/2854 on 22.12.2023. How does this impact you and your business? Learn more in this article and discover why Freemindtronic innovations are already compliant.

2020 Legal information

Freemindtronic’s NFC hardware wallets with credit card management are PCI DSS compliant

December 20, 2020

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing

November 8, 2023

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board

August 1, 2023

Andorran law

Llei 26/2014 del 30 d’octubre de patents

November 21, 2016

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers

December 16, 2023

What you need to know about the new EU data protection regulation (2023/2854)

Personal data is a valuable asset in the digital age, but also a vulnerable asset. This is why the European Union has adopted a new regulation to protect the personal data of individuals in the EU. Data

Protection Regulation (EU) 2023/2854 supplements and updates the General Data Protection Regulation (GDPR), which has been in force since 2018. The new regulation introduces additional procedural rules for the application of the GDPR, particularly in cross-border cases. It also creates the European Data Protection Authority (EDPA), a new independent body that ensures the consistent application of EU data protection rules across the EU. The new regulation will come into force on November 26, 2024. In this article, we will explain the main provisions of the new regulation, its advantages and disadvantages, its international scope and its reactions and controversies.

We will also show you how some products and technologies from Freemindtronic, an Andorran company specialized in security and cybersecurity of computer and information systems, already comply with the new regulation, since they offer innovative and ecological solutions to protect the personal data without using servers, databases, online accounts or identifiers.

The main provisions of the EU data protection law

Several measures to ensure the security, confidentiality and integrity of personal data are introduced by the EU data protection law. These measures are:

Declaration of the activity and the processing practices. The controllers and the managers of the entities that process personal data must declare them to the national data protection authorities (NDPA) and to EDPA. The EDPA is a new independent body. It oversees the consistent application of the EU data protection rules across the EU. It also cooperates with the NDPA and the other EU institutions. The goal is to ensure the protection of personal data.
Implementation of technical and organizational measures. The controllers and the managers of the entities that process personal data must implement them to prevent the risks of damage or loss of data. For example, these measures include the encryption of data, the pseudonymization of data, the limitation of data access, the regular testing of data security, the notification of data breaches, and the appointment of a data protection officer.
Reinforcement of the rights of the persons concerned. They have reinforced rights, such as the right of access, the right of opposition, the right of erasure, the right to data portability and the right to restriction of processing. These rights allow the persons to obtain information about the processing of their data, to object to certain types of processing, to request the deletion of their data, to transfer their data to another entity, and to limit the processing of their data in certain cases.
Provision of administrative sanctions. The regulation provides them. They can reach up to 20 million euros or 4% of the annual global turnover, depending on the severity of the infringement. The NDPA or the EDPA, depending on the case, impose these sanctions. The national courts or the Court of Justice of the European Union can hear the appeals.

The advantages and disadvantages of the EU data protection reform

The EU data protection reform has pros and cons for different actors involved.

The benefits for the persons whose data are processed

The regulation offers a better protection of their rights and interests. They can control more the use of their data and benefit from a high level of security. Moreover, they have an easy and fast access to the information related to the processing of their data, as well as to the remedies in case of dispute. For instance, a person can request a copy of their data from an online platform. If they find any inaccurate or outdated data, they can ask for a correction or an update. They can also withdraw their consent to the processing of their data at any time, or ask for the deletion of their data if they no longer want to use the platform.

The drawbacks for the controllers and the managers of the entities that process personal data

The regulation imposes additional obligations and stricter constraints on them. They must comply with harmonized rules within the EU, while taking into account the national and regional specificities. Furthermore, they face more severe sanctions in case of non-compliance with the regulation. For example, an entity that processes personal data of persons located in the EU must declare its activity and its processing practices to the NDPA and the EDPA.

It must also obtain the prior consent of the persons for the processing of their data, unless there is a legal basis for the processing. The entity must process the data in a lawful, fair and transparent manner, and collect them for specific, explicit and legitimate purposes. It must also respect the principles of data minimization, data accuracy, data storage limitation, data integrity and data confidentiality.

The international scope of the EU data protection rules

The EU data protection rules have an international scope, as they apply to any entity that processes personal data of persons located in the EU, whether it is established or not in the EU. The regulation therefore requires foreign entities to respect the same rules as European entities, under penalty of sanctions. It aims to ensure an equivalent level of protection for personal data transferred outside the EU.

For this purpose, the regulation establishes different mechanisms to ensure the adequacy of the data protection in the third countries or the international organizations that receive the data. These mechanisms include, for example, the adoption of adequacy decisions by the European Commission, the use of standard contractual clauses, the adherence to binding corporate rules, or the certification by approved schemes.

The reactions and controversies of the EU data protection regulation

The EU data protection regulation has provoked diverse reactions, ranging from approval to contestation.

Positive reactions

Some actors have welcomed the interest of the regulation to strengthen the trust and to foster the technological evolution in the field of data protection. They have highlighted the innovative and ambitious character of the regulation, which places the EU at the forefront of the protection of personal data. For example, the European Data Protection Supervisor (EDPS), the independent advisor of the EU institutions on data protection issues, has praised the regulation as a “historic achievement” and a “major step forward” for the protection of the fundamental rights of the individuals in the digital age.

Negative reactions

Some actors have criticized the obligation to inform the NDPA and the EDPA about the activity and the processing practices of personal data. They have considered that it could infringe their national sovereignty or that it could create a risk of illegal or fraudulent exercise by some foreign entities. They have also expressed their concern about the complexity and the heaviness of the regulation, which could hinder the competitiveness and the growth of the entities that process personal data. For example, some member states, such as France, Germany, Italy or Spain, have raised objections or reservations about certain aspects of the regulation.

These aspects include the role and the powers of the EDPA, the criteria and the procedures for the adequacy decisions, or the level and the distribution of the sanctions.

How Freemindtronic products and technologies protect personal data

Freemindtronic is an Andorran company that specializes in security and cybersecurity of computer systems and information systems. It designs and develops green technology products and services under white label, based on contactless technology (NFC). Some of its products are PassCypher, DataShielder, SeedNFC or Cardokey, which use embedded technologies such as EviCore NFC HSM, EviCore HSM OpenPGP or EviCore NFC HSM Browser Extension.

These products and technologies have several advantages for the protection of personal data, compared to traditional solutions based on servers, databases, online accounts or identifiers. Indeed, they work without server, without database, anonymously from end to end, without the need to create an account on the internet or to identify themselves to use the products. Therefore, they reduce the risks of loss or damage of data, respect the rights of the persons concerned, and comply with the harmonized rules in the EU. These products and technologies of Freemindtronic are already compliant with the European regulation on data protection, because they respect the principles of security, confidentiality and integrity of data, as well as the rights of the persons concerned. They offer an innovative and ecological alternative to traditional solutions, which may present risks or constraints for data protection.

Conclusion

The regulation (EU) 2023/2854 is an important text for the protection of personal data in the EU. It introduces measures to ensure the security, confidentiality and integrity of data, as well as to reinforce the rights of the persons concerned. It applies to any entity that processes personal data of persons located in the EU, whether it is established or not in the EU. It was adopted within the legislative process on the fundamental rights in the EU, but it also provoked reactions and controversies between some member states. It will enter into force on November 26, 2024.

2026, Crypto Currency, Cryptocurrency, Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers

Posted on December 16, 2023January 9, 2026 by FMTAD

16
Dec

Ledger Security Breaches have become a major indicator of vulnerabilities in the global crypto ecosystem. Beyond isolated technical flaws, it is the systemic correlations — hardware attacks, software exploits, third‑party data leaks, phishing scenarios — that shape today’s threat landscape, affecting individual users, exchanges, and trust infrastructures alike. Exploited by cybercriminals, state actors, and hybrid players, these breaches enable profiling, targeting, and manipulation of investors without necessarily compromising their private keys directly. Encryption protects private keys, but not relational, logistical, and behavioral metadata. This chronicle analyzes the major breaches from 2017 to 2026, their immediate and long‑term impacts, and the conditions for achieving true digital sovereignty against supply‑chain threats and third‑party dependencies.

Executive Summary — Ledger Security Breaches

⮞ Reading Note

This executive summary can be read in ≈ 3 to 4 minutes. It provides immediate insight into the central issue without requiring the full technical and historical analysis.

⚠️ Note on Supply Chain Resilience

The 2026 Global-e leak highlights what the CISA (Cybersecurity & Infrastructure Security Agency) defines as critical supply chain risks. According to their official guidelines, hardware security is only as strong as its weakest third-party link.

⚡ Key Findings

Since 2017, Ledger has faced several major breaches: seed phrase and firmware attacks, PCB modification, the 2020 database leak, the 2023 Connect Kit compromise, and the 2026 Global‑e data leak. These incidents show that threats arise not only from internal flaws but also from external dependencies and phishing vectors.

✦ Immediate Impact

Massive customer data exposure (292K in 2020, Global‑e in 2026)
Targeted phishing and harassment using personal information
Transaction manipulation and private-key compromise in controlled 2018 attack scenarios
Fragility of software supply chains and third‑party partners

⚠ Strategic Message

The real shift is not just technical compromise, but the repetition of breaches and their systemic exploitation. The threat becomes structural: automated phishing, doxxing, erosion of trust, and increased reliance on third parties. The risk is no longer occasional, but persistent.

The Shift from Trust to Proof

The repetition of Ledger Security Breaches proves that trust in a brand is not enough. Sovereignty requires proof. By implementing Segmented Key Authentication (WO2018154258), Freemindtronic moves control over critical secrets (seed phrases, private keys, credentials) from the vendor ecosystem directly into the user’s physical possession. This eliminates dependency on third-party infrastructure (e-commerce, update servers, logistics partners) for the custody and transfer of critical secrets.

⎔ Sovereign Countermeasure

There is no miracle solution against security breaches. Sovereignty means reducing exploitable surfaces: minimizing exposed data, using independent cold wallets (NFC HSM), strictly separating identity from usage, and maintaining constant vigilance against fraudulent communications.

Reading Parameters

Executive Summary: ≈ 3–4 min
Advanced Summary: ≈ 5–6 min
Full Chronicle: ≈ 30–40 min
First publication: December 16, 2023
Last update: January 7, 2026
Complexity level: High — security, crypto, supply‑chain
Technical density: ≈ 70 %
Languages available: EN · FR
Core focus: Ledger Security Breaches, crypto wallets, phishing, digital sovereignty
Editorial type: Chronicle — Freemindtronic Digital Security
Risk level: 9.2 / 10 — financial, civil, and hybrid threats

Editorial Note — This chronicle is part of the Digital Security section. It explores Ledger Security Breaches as a revealing case of global crypto vulnerabilities, combining technical incidents, third‑party dependencies, and phishing threats. It extends analyses published on Digital Security. Content is written in accordance with the AI Transparency Declaration published by Freemindtronic Andorra — FM-AI-2025-11-SMD5.

Want to go further? The Advanced Summary places Ledger Security Breaches in a global dynamic — technological, regulatory, and societal — and prepares the reader for the full chronicle.

Infographic detailing the Ledger security breaches via Global-e in January 2026, showing exposed customer data vs. secure private keys.

Timeline and impact of the January 2026 Global-e breach: A new chapter in Ledger security breaches involving third-party e-commerce partners.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

Cyberattaque HubEE : rupture silencieuse de la confiance numérique. Cette attaque, qui a permis l’exfiltration [...]

17
Jan

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

Le browser fingerprinting constitue aujourd’hui l’un des instruments centraux du renseignement par métadonnées appliqué aux [...]

08
Jan

Cinematic cyber illustration showing a user authorizing a malicious OAuth app symbolizing the Persistent OAuth Flaw exploited by Tycoon 2FA, with PassCypher PGP as the Zero-Cloud defense solution.

2025 Digital Security

Persistent OAuth Flaw: How Tycoon 2FA Hijacks Cloud Access

Persistent OAuth Flaw — Tycoon 2FA Exploited — When a single consent becomes unlimited cloud [...]

23
Oct

Illustration montrant la faille Tycoon 2FA failles OAuth persistantes : une application OAuth malveillante obtenant un jeton d’accès persistant malgré la double authentification, symbolisée par un cloud vulnérable et un HSM souverain bloquant l’attaque.

2025 Digital Security

Tycoon 2FA failles OAuth persistantes dans le cloud | PassCypher HSM PGP

Faille OAuth persistante — Tycoon 2FA exploitée — Quand une simple autorisation devient un accès [...]

22
Oct

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

OpenAI fuite Mixpanel rappelle que même les géants de l’IA restent vulnérables dès qu’ils confient [...]

02
Dec

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

AI Mixpanel breach metadata is a blunt reminder of a simple rule: the moment sensitive [...]

06
Jan

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers

Ledger Security Breaches have become a major indicator of vulnerabilities in the global crypto ecosystem. [...]

16
Dec

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

Les failles de sécurité Ledger sont au cœur des préoccupations des investisseurs depuis 2017. Cette [...]

07
Jan

A woman looking at a computer screen displaying a fingerprint, the words 'Cookieless' and 'PassCypher Data Privacy Security', along with the date 'February 16, 2025', symbolizing Google's fingerprinting policy shift. The image highlights the importance of stopping browser fingerprinting and protecting online privacy

2025 Cyberculture Digital Security

Browser Fingerprinting Tracking: Metadata Surveillance in 2026

Browser Fingerprinting Tracking today represents one of the true cores of metadata intelligence. Far beyond [...]

02
Feb

bot telegram usersbox, affiche cyber-thriller sur le marché noir probiv russe et l’illusion de contrôle des données par l’État

2025 Digital Security

Bot Telegram Usersbox : l’illusion du contrôle russe

Le bot Telegram Usersbox n’était pas un simple outil d’OSINT « pratique » pour curieux [...]

29
Nov

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

Espionnage invisible WhatsApp n’est plus une hypothèse marginale, mais une réalité technique rendue possible par [...]

21
Dec

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

Fuite données ministère intérieur. L’information n’est pas arrivée par une fuite anonyme ni par un [...]

05
Jan

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

Silent Whisper espionnage WhatsApp Signal est présenté comme une méthode gratuite permettant d’espionner des communications [...]

05
Jan

Image of the Intersec Awards 2026 ceremony in Dubai. Large screen announcing PassCypher NFC HSM & HSM PGP (FREEMINDTRONIC) as a Best Cybersecurity Solution Finalist. Features Quantum-Resistant Passwordless Manager patented technology, designed in Andorra 🇦🇩 and France 🇫🇷.

2026 Awards Cyberculture Digital Security Distinction Excellence EviOTP NFC HSM Technology EviPass EviPass NFC HSM technology EviPass Technology finalists PassCypher PassCypher

Quantum-Resistant Passwordless Manager — PassCypher finalist, Intersec Awards 2026 (FIDO-free, RAM-only)

Quantum-Resistant Passwordless Manager 2026 (QRPM) — Best Cybersecurity Solution Finalist by PassCypher sets a new [...]

03
Nov

Illustration de CryptPeer messagerie P2P WebRTC montrant un appel vidéo sécurisé chiffré de bout en bout entre plusieurs utilisateurs.

2025 Cyberculture Cybersecurity Digital Security EviLink

CryptPeer messagerie P2P WebRTC : appels directs chiffrés de bout en bout

La messagerie P2P WebRTC sécurisée constitue le fondement technique et souverain de la communication directe [...]

14
Nov

Missatgeria P2P WebRTC segura amb CryptPeer, bombolla local de comunicació sobirana amb trucades de grup i compartició de fitxers xifrats de Freemindtronic

2025 CyptPeer Digital Security EviLink

Missatgeria P2P WebRTC segura — comunicació directa amb CryptPeer

Missatgeria P2P WebRTC segura al navegador és l’esquelet tècnic i sobirà de la comunicació directa [...]

28
Nov

2025 Digital Security

Russia Blocks WhatsApp: Max and the Sovereign Internet

Step by step, Russia blocks WhatsApp and now openly threatens to “completely block” the messaging [...]

29
Nov

typologique illustrant l’arnaque mobile WhatsApp Gold avec un smartphone doré et une silhouette menaçante en arrière-plan

2020 Digital Security

WhatsApp Gold arnaque mobile : typologie d’un faux APK espion

WhatsApp Gold arnaque mobile — clone frauduleux d’application mobile, ce stratagème repose sur une usurpation [...]

11
Nov

dark du spyware ClayRat Android se cachant dans un smartphone face à la défense matérielle DataShielder NFC HSM. Le hacker est éclairé en rouge, la protection est un bouclier bleu.

2025 Digital Security

Spyware ClayRat Android : faux WhatsApp espion mobile

Spyware ClayRat Android illustre la mutation du cyberespionnage : plus besoin de failles, il exploite [...]

14
Oct

Digital poster showing a hooded hacker holding a smartphone wrapped by a glowing red digital serpent with a bright eye, symbolizing ClayRat Android spyware. A blue NFC HSM shield glows on the right, representing sovereign hardware encryption.

2025 Digital Security

Android Spyware Threat Clayrat : 2025 Analysis and Exposure

Android Spyware Threat: ClayRat illustrates the new face of cyber-espionage — no exploits needed, just [...]

14
Oct

Diagram illustrating WhatsApp hacking techniques (Zero-Click exploit CVE-2025-55177 and QR Code hijack) countered by Sovereign Zero-DOM / HSM defense, showing data isolation and ephemeral RAM decryption.

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

WhatsApp hacking zero-click exploit (CVE-2025-55177) chained with Apple CVE-2025-43300 enables remote code execution via crafted [...]

18
Jan

Flat graphic poster illustrating SSH key breaches and defense through hardware-anchored SSH authentication using PassCypher HSM PGP, OpenPGP AES-256 encryption, and BLE-HID zero-trust workflows.

2025 Digital Security Technical News

Sovereign SSH Authentication with PassCypher HSM PGP — Zero Key in Clear

SSH Key PassCypher HSM PGP establishes a sovereign SSH authentication chain for zero-trust infrastructures, where [...]

11
Oct

Illustration cyber réaliste représentant SSH Key PassCypher HSM PGP, avec un ordinateur affichant un terminal SSH, un HSM USB et un environnement de serveurs OVHcloud en arrière-plan

2025 Digital Security Tech Fixes Security Solutions Technical News

SSH Key PassCypher HSM PGP — Sécuriser l’accès multi-OS à un VPS

SSH Key PassCypher HSM PGP fournit une chaîne souveraine : génération locale de clés SSH [...]

10
Oct

2025 Digital Security Technical News

Générateur de mots de passe souverain – PassCypher Secure Passgen WP

Générateur de mots de passe souverain PassCypher Secure Passgen WP pour WordPress — le premier [...]

06
Oct

Science-fiction movie style poster showing a quantum computer cryostat with 6,100 qubits. A researcher is observing the device. The title warns of a "MAJOR BREAKTHROUGH & CYBERSECURITY RISKS" related to the trapped neutral atoms. Blue laser beams (optical tweezers) are visible, highlighting the zone-based architecture.

2025 Digital Security Technical News

Quantum computer 6100 qubits ⮞ Historic 2025 breakthrough

A 6,100-qubit quantum computer marks a turning point in the history of computing, raising unprecedented [...]

03
Oct

Infographie illustrant un ordinateur quantique à atomes neutres piégés, montrant le saut d’échelle de 500 à 6100 qubits et ses implications pour le chiffrement et la sécurité

2025 Digital Security Technical News

Ordinateur quantique 6100 qubits ⮞ La percée historique 2025

Ordinateur quantique 6100 qubits marque un tournant dans l’histoire de l’informatique, soulevant des défis sans [...]

02
Oct

Schéma explicatif de l’Authentification Multifacteur illustrant les étapes 0FA, 1FA, 2FA et MFA sur fond blanc

2025 Cyberculture Digital Security

Authentification multifacteur : anatomie, OTP, risques

Authentification Multifacteur : Anatomie souveraine Explorez les fondements de l’authentification numérique à travers une typologie [...]

26
Sep

Póster estilo cine sobre clickjacking extensiones DOM, riesgos sistémicos, vulnerabilidades de gestores de contraseñas y wallets cripto, con contramedidas Zero DOM soberanas.

2025 Digital Security

Clickjacking Extensiones DOM — Riesgos y Defensa Zero-DOM

28
Aug

Cartell digital en català sobre el clickjacking d’extensions DOM amb PassCypher — contraatac sobirà Zero DOM

2025 Digital Security

Clickjacking extensions DOM: Vulnerabilitat crítica a DEF CON 33

DOM extension clickjacking — el clickjacking d’extensions basat en DOM, mitjançant iframes invisibles, manipulacions del [...]

23
Aug

Movie poster style illustration of DOM extension clickjacking unveiled at DEF CON 33, showing hidden iframes, Shadow DOM hijack, and sovereign Zero-DOM countermeasures

2025 Digital Security

DOM Extension Clickjacking — Risks, DEF CON 33 & Zero-DOM fixes

DOM extension clickjacking — a technical chronicle of DEF CON 33 demonstrations, their impact, and [...]

27
Aug

Affiche cyberpunk illustrant DOM Based Extension Clickjacking présenté au DEF CON 33 avec extraction de secrets du navigateur

2025 Digital Security

Clickjacking des extensions DOM : DEF CON 33 révèle 11 gestionnaires vulnérables

Clickjacking d’extensions DOM : DEF CON 33 révèle une faille critique et les contre-mesures Zero-DOM

23
Aug

Illustration vulnérabilité WhatsApp zero-click CVE-2025-55177 exploit DNG et CVE-2025-43300 Apple avec protection HSM NFC et PGP

2025 Digital Security

Vulnérabilité WhatsApp Zero-Click — Actions & Contremesures

Vulnérabilité WhatsApp zero-click (CVE-2025-55177) chaînée avec Apple CVE-2025-43300 permet l’exécution de code à distance via [...]

30
Sep

Chrome V8 zero-day CVE-2025-10585 — affiche cinématographique : œil de surveillance dans l’onglet Chrome, silhouette d’espion, lignes de code V8

2025 Digital Security

Chrome V8 Zero-Day CVE-2025-10585 — Ton navigateur était déjà espionné ?

Chrome V8 zero-day CVE-2025-10585 — Votre navigateur n’était pas vulnérable. Vous étiez déjà espionné !

19
Sep

Affiche de cinéma "La Bataille des Frontières des Métadonnées" illustrant un défenseur avec un bouclier DataShielder protégeant l'Europe numérique. Le bouclier est verrouillé, symbolisant la protection de la confidentialité des métadonnées e-mail contre la surveillance. Des icônes GDPR et des e-mails stylisés flottent, représentant les enjeux légaux et la fuite de données. Le fond montre une carte de l'Europe illuminée par des circuits numériques. Le texte principal alerte sur ce que les messageries et e-mails révèlent sans votre savoir, promu par Freemindtronic.

2025 Digital Security

Confidentialité métadonnées e-mail — Risques, lois européennes et contre-mesures souveraines

La confidentialité des métadonnées e-mail est au cœur de la souveraineté numérique en Europe : [...]

03
Sep

Cinematic poster-style artwork of “The Battle of Metadata Borders” showing a hooded figure with a glowing DataShielder shield, standing before a futuristic city skyline with neon data icons, symbolizing email and messaging privacy.

2025 Digital Security

Email Metadata Privacy: EU Laws & DataShielder

Email metadata privacy sits at the core of Europe’s digital sovereignty: understand the risks, the [...]

07
Sep

Chrome V8 confusió RCE — zero-day de tipus confusió amb execució remota drive-by; guia Zero-DOM i passos d’urgència per a Catalunya i Andorra

2025 Digital Security

Chrome V8 confusió RCE — Actualitza i postura Zero-DOM

Chrome V8 confusió RCE: aquesta edició exposa l’impacte global i les mesures immediates per reduir [...]

20
Sep

Cinematic poster style showing cyber espionage in a city night scene, symbolizing Chrome V8 confusion RCE zero-day vulnerability.

2025 Digital Security

Chrome V8 confusion RCE — Your browser was already spying

Chrome v8 confusion RCE: This edition addresses impacts and guidance relevant to major English-speaking markets [...]

20
Sep

Movie poster-style image of a cracked passkey and fishing hook. Main title: 'WebAuthn API Hijacking', with secondary phrases: 'Passkeys Vulnerability', 'DEF CON 33', and 'Why PassCypher Is Not Vulnerable'. Relevant for cybersecurity in Andorra.

2025 Digital Security

WebAuthn API Hijacking: A CISO’s Guide to Nullifying Passkey Phishing

29
Aug

Image type affiche de cinéma: passkey cassée sous hameçon de phishing. Textes: "Passkeys Faille Interception WebAuthn", "DEF CON 33 Révélation", "Pourquoi votre PassCypher n'est pas vulnérable API Hijacking". Contexte cybersécurité Andorre.

2025 Digital Security

Passkeys Faille Interception WebAuthn | DEF CON 33 & PassCypher

Conseil RSSI / CISO – Protection universelle & souveraine EviBITB (Embedded Browser‑In‑The‑Browser Protection) est une [...]

29
Aug

Visual composition illustrating coordinated cyber smear campaigns during geopolitical tensions

2025 Cyberculture Digital Security

Reputation Cyberattacks in Hybrid Conflicts — Anatomy of an Invisible Cyberwar

Synchronized APT leaks erode trust in tech, alliances, and legitimacy through narrative attacks timed with [...]

31
Jul

APT28 spear-phishing with NotDoor Outlook backdoor using VBA macros, DLL side-loading via OneDrive.exe, and Proton Mail covert exfiltration in European cyberattacks

2025 Digital Security

APT28 spear-phishing: Outlook backdoor NotDoor and evolving European cyber threats

Russian cyberattack on Microsoft by Midnight Blizzard (APT29) highlights the strategic risks to digital sovereignty. [...]

30
Apr

Cybersecurity theme with shield, padlock, and computer screen displaying warning signs, highlighting the Russian cyberattack on Microsoft.

2024 Cyberculture Digital Security

Russian Cyberattack Microsoft: An Unprecedented Threat

Russian cyberattack on Microsoft by Midnight Blizzard (APT29) highlights the strategic risks to digital sovereignty. [...]

01
Jul

Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 Digital Security

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

Midnight Blizzard Cyberattack against Microsoft and HPE: A detailed analysis of the facts, the impacts [...]

10
Mar

Illustration showing a strategic breach of certified eSIM mobile identity — eSIM Sovereignty Failure

2025 Digital Security

eSIM Sovereignty Failure: Certified Mobile Identity at Risk

Runtime Threats in Certified eSIMs: Four Strategic Blind Spots While geopolitical campaigns exploit the [...]

30
Jul

Comparative infographic contrasting ToolShell SharePoint zero-day with NFC HSM mitigation strategies

2025 Digital Security

ToolShell SharePoint vulnerability: NFC HSM mitigates token forgery & zero-day RCE

25
Jul

image illustrating the Chrome V8 Zero-Day exploit affecting password managers and browser security

2025 Digital Security

Chrome V8 Zero-Day: CVE-2025-6554 Actively Exploited

04
Jul

Illustration showing Atomic Stealer AMOS malware process on macOS with fake update, keychain access, and crypto exfiltration

2025 Digital Security

Atomic Stealer AMOS: The Mac Malware That Redefined Cyber Infiltration

08
Jul

Realistic visual representation of APT41 Cyberespionage and Cybercrime operations involving Chinese state-backed hackers, cloud abuse, and memory-only malware.

2025 Digital Security

APT41 Cyberespionage and Cybercrime Group – 2025 Global Analysis

05
Jul

Realistic image of APT29 deceiving a person to bypass 2FA using app passwords

2025 Digital Security

APT29 Exploits App Passwords to Bypass 2FA

A silent cyberweapon undermining digital trust Two-factor authentication (2FA) was supposed to be the cybersecurity [...]

25
Jun

Realistic photo of a hacker in a dark room in front of a computer, illustrating the darknet credentials breach and the protection by PassCypher

2015 Digital Security

Darknet Credentials Breach 2025 – 16+ Billion Identities Stolen

Underground Market: The New Gold Rush for Stolen Identities The massive leak of over 16 [...]

22
Jun

Illustration of Signal clone breached scenario involving TeleMessage with USA and Israel flags

2025 Digital Security

Signal Clone Breached: Critical Flaws in TeleMessage

TeleMessage: A Breach That Exposed Cloud Trust and National Security Risks TeleMessage, marketed as a [...]

22
May

Illustration of APT29 spear-phishing Europe with Russian flag

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

APT29 SpearPhishing Europe: A Stealthy LongTerm Threat APT29 spearphishing Europe campaigns highlight a persistent and [...]

30
Apr

APT36 SpearPhishing India header infographic showing phishing icon, map of India, and cyber threat symbols

2025 Digital Security

APT36 SpearPhishing India: Targeted Cyberespionage | Security

Understanding Targeted Attacks of APT36 SpearPhishing India APT36 cyberespionage campaigns against India represent a focused [...]

16
May

Microsoft Outlook Zero-Click vulnerability warning with encryption symbols and a secure lock icon in a professional workspace.

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

Microsoft Outlook Zero-Click Vulnerability: How to Protect Your Data Now A critical Zero-Click vulnerability (CVE-2025-21298) [...]

18
Jan

Illustration depicting the Microsoft MFA Security Flaw, highlighting a digital lock being bypassed with code streams in the background, symbolizing the vulnerability nicknamed AuthQuake.

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

24
Dec

Why Encrypt SMS? NFC card protecting encrypted SMS communications from espionage and corruption on Android NFC phone.

2024 Digital Security

Why Encrypt SMS? FBI and CISA Recommendations

<div> </article></div> <script type=”application/ld+json”> { “@context”: “https://schema.org”, “@type”: “Article”, “mainEntityOfPage”: { “@type”: “WebPage”, “@id”: “https://freemindtronic.com/why-encrypt-sms-fbi-and-cisa-recommendations/” [...]

16
Dec

A hyper-realistic digital illustration showing the severity of Microsoft vulnerabilities in 2025, with interconnected red warning signals, fragmented systems, and ominous shadows representing critical zero-day exploits and cybersecurity risks.

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

Microsoft: 159 Vulnerabilities Fixed in 2025 Microsoft has released a record-breaking security update in January [...]

21
Jan

Illustration of a Russian APT44 (Sandworm) cyber spy exploiting QR codes to infiltrate Signal, highlighting advanced phishing techniques and vulnerabilities in secure messaging platforms.

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

APT44 Sandworm: The Elite Russian Cyber Espionage Unit Unmasking Sandworm’s sophisticated cyber espionage strategies and [...]

24
Feb

Visual representation of BadPilot Cyber Attacks by APT44, showcasing global cyber-espionage targeting critical infrastructures with PassCypher and DataShielder defenses.

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

BadPilot Cyber Attacks: Sandworm’s New Weaponized Subgroup Understanding the rise of BadPilot and its impact [...]

25
Feb

Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon & Flax Typhoon: Cyber Espionage Threats Targeting Government Agencies

Salt Typhoon – The Cyber Threat Targeting Government Agencies Salt Typhoon and Flax Typhoon represent [...]

14
Nov

A visual representation of BitLocker Security featuring a central lock icon surrounded by elements representing Microsoft, TPM, and Windows security settings.

2024 Digital Security

BitLocker Security: Safeguarding Against Cyberattacks

Introduction to BitLocker Security If you use a Windows computer for data storage or processing, [...]

10
Feb

French Minister at G7 holding a hacked smartphone, with a Bahraini minister warning him about a cyberattack.

2024 Digital Security

French Minister Phone Hack: Jean-Noël Barrot’s G7 Breach

06
Dec

Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know

Cyberattack Exploits Backdoors: What You Need to Know In October 2024, a cyberattack exploited backdoors [...]

15
Oct

2021 Cyberculture Digital Security Phishing

Phishing Cyber victims caught between the hammer and the anvil

Phishing is a fraudulent technique that aims to deceive internet users and to steal their [...]

17
May

Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat

Sheets Malware: A Growing Cybersecurity Concern Google Sheets, a widely used collaboration tool, has shockingly [...]

03
Sep

Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed

Russian Espionage Hacking Tools: Discovery and Initial Findings Russian espionage hacking tools were uncovered by [...]

31
Aug

Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat

Understanding the Impact and Evolution of Side-Channel Attacks in Modern Cybersecurity Side-channel attacks, also known [...]

20
Aug

Digital Security Spying Technical News

Are fingerprint systems really secure? How to protect your data and identity against BrutePrint

Fingerprint Biometrics: An In-Depth Exploration of Security Mechanisms and Vulnerabilities It is a widely recognized [...]

23
Oct

Illustration of an Apple MacBook with a highlighted M-series chip vulnerability, surrounded by symbols of data security breach and a global impact background.

2024 Digital Security Technical News

Apple M chip vulnerability: A Breach in Data Security

Apple M chip vulnerability: uncovering a breach in data security Researchers at the Massachusetts Institute [...]

25
Mar

Digital Security Technical News

Brute Force Attacks: What They Are and How to Protect Yourself

Brute-force Attacks: A Comprehensive Guide to Understand and Prevent Them Brute Force: danger and protection [...]

01
Nov

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks

Critical OpenVPN Vulnerabilities Pose Global Security Risks OpenVPN security vulnerabilities have come to the forefront, [...]

12
Aug

Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers

How Hackers Exploited the Google Workspace Vulnerability Hackers found a way to bypass the email [...]

01
Aug

Predator Files How a Spyware Consortium Targeted Civil Society Politicians and Officials

2023 Digital Security

Predator Files: The Spyware Scandal That Shook the World

Predator Files: How a Spyware Consortium Targeted Civil Society, Politicians and Officials Cytrox: The maker [...]

19
Oct

BITB attacks Browser-In-The-Browser remove delete destroy by IRDR Ifram Redirect Detection Removal since EviCypher freeware web extension open-source from Freemindtronic in Andorra

2023 Digital Security Phishing

BITB Attacks: How to Avoid Phishing by iFrame

BITB Attacks: How to Avoid Phishing by iFrame We have all seen phishing attacks aren’t [...]

10
May

2023 Digital Security

5Ghoul: 5G NR Attacks on Mobile Devices

5Ghoul: How Contactless Encryption Can Secure Your 5G Communications from Modem Attacks 5Ghoul is a [...]

29
Dec

Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security

A Major Intrusion Unveiled In July 2024, the Leidos Holdings data breach came to light, [...]

25
Jul

RockYou2024 data breach with millions of passwords streaming on a dark screen, foreground displaying advanced cybersecurity measures and protective shields.

2024 Digital Security

RockYou2024: 10 Billion Reasons to Use Free PassCypher

RockYou2024: A Cybersecurity Earthquake The RockYou2024 data leak has shaken the very foundations of global [...]

08
Jul

Europol office showing a security breach alert on a computer screen, with agents discussing in the background.

2024 Digital Security

Europol Data Breach: A Detailed Analysis

May 2024: Europol Security Breach Highlights Vulnerabilities In May 2024, Europol, the European law enforcement [...]

16
May

2024 Digital Security

Dropbox Security Breach 2024: Phishing, Exploited Vulnerabilities

Phishing Tactics: The Bait and Switch in the Aftermath of the Dropbox Security Breach The [...]

17
May

NFC Hardware Wallet Credit Card Manager PCI DSS Compliant EviToken Technology working contactless by nfc phone online autofill payment from Freemindtronic Andorra

Digital Security EviToken Technology Technical News

EviCore NFC HSM Credit Cards Manager | Secure Your Standard and Contactless Credit Cards

EviCore NFC HSM Credit Cards Manager is a powerful solution designed to secure and manage [...]

14
Jun

Shadowy hacker with a laptop in front of a digital map of Russia highlighted in red, symbolizing the origin of Kapeka Malware.

2024 Digital Security

Kapeka Malware: Comprehensive Analysis of the Russian Cyber Espionage Tool

Kapeka Malware: The New Russian Intelligence Threat In the complex world of cybersecurity, a [...]

18
Apr

A modern cybersecurity control center with a diverse team monitoring national cyber threats during the Andorra National Cyberattack Simulation.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

Andorra Cybersecurity Simulation: A Vanguard of Digital Defense Andorra-la-Vieille, April 15, 2024 – Andorra is [...]

15
Apr

EviVault NFC HSM and EviCore NFC HSM Embedded ISO 15693 VS Flipper Zero

Articles Digital Security EviVault Technology NFC HSM technology Technical News

EviVault NFC HSM vs Flipper Zero: The duel of an NFC HSM and a Pentester

EviVault NFC HSM vs Flipper Zero: The duel of an NFC HSM and a Pentester [...]

04
Jul

Securing IEO STO ICO IDO INO the challenges and solutions EviCore NFC HSM by Freemindtronic

Articles Cryptocurrency Digital Security Technical News

Securing IEO STO ICO IDO and INO: The Challenges and Solutions

Securing IEO STO ICO IDO and INO: How to Protect Your Crypto Investments Cryptocurrencies are [...]

14
Jun

2023 Articles Digital Security Technical News

Remote activation of phones by the police: an analysis of its technical, legal and social aspects

What is the new bill on justice and why is it raising concerns about privacy? [...]

11
Jun

A man holding a resident card of a person in Andorra, wearing a badge of an identity card of a Spanish woman and surrounded by other identity cards of different countries including France and on his left a hacker in front of his computer with a phone

Articles Cyberculture Digital Security Technical News

Protect Meta Account Identity Theft with EviPass and EviOTP

Protecting Your Meta Account from Identity Theft Meta is a family of products that includes [...]

31
May

Digital world map with cybersecurity icons representing the Cybersecurity Breach at IMF.

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

Cybersecurity Breach at IMF: A Detailed Investigation Cybersecurity breaches are a growing concern worldwide. The [...]

15
Mar

2023 Articles Cyberculture Digital Security Technical News

Strong Passwords in the Quantum Computing Era

How to create strong passwords in the era of quantum computing? Quantum computing is a [...]

05
May

PrintListener technology concept with NFC security solutions.

2024 Digital Security

PrintListener: How to Betray Fingerprints

PrintListener: How this Technology can Betray your Fingerprints and How to Protect yourself PrintListener revolutionizes [...]

22
Feb

Digital shield by Freemindtronic repelling cyberattack against Microsoft Exchange

2024 Articles Digital Security News

How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts

How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts [...]

08
Feb

Woman holding a smartphone with a padlock icon on the screen, promoting protection from stalkerware.

2024 Articles Digital Security News Spying

How to protect yourself from stalkerware on any phone

What is Stalkerware and Why is it Dangerous? Stalkerware, including known programs like FlexiSpy, mSpy, [...]

26
Jan

Pegasus The Cost of Spying with the Most Powerful Spyware

2023 Articles DataShielder Digital Security Military spying News NFC HSM technology Spying

Pegasus: The cost of spying with one of the most powerful spyware in the world

Pegasus: The Cost of Spying with the Most Powerful Spyware in the World Pegasus is [...]

17
Oct

Digital representation of Ivanti Zero-Day Flaws threatening cybersecurity in a futuristic cityscape

2024 Digital Security Spying

Ivanti Zero-Day Flaws: Comprehensive Guide to Secure Your Systems Now

What are Zero-Day Flaws and Why are They Dangerous? A zero-day flaw is a previously [...]

05
Feb

2024 Articles Compagny spying Digital Security Industrial spying Military spying News Spying Zero trust

KingsPawn A Spyware Targeting Civil Society

QuaDream: KingsPawn spyware vendor shutting down in may 2023 QuaDream was a company that [...]

16
Apr

SSH handshake with Terrapin attack and EviKey NFC HSM

2024 Articles Digital Security EviKey NFC HSM EviPass News SSH

Terrapin attack: How to Protect Yourself from this New Threat to SSH Security

Protect Yourself from the Terrapin Attack: Shield Your SSH Security with Proven Strategies SSH is [...]

11
Jan

google account security flaw how to protect yourself from hackers digital artwork that conveys the concept of a security breach in online services due to persistent cookies attacks

2024 Articles Digital Security News Phishing

Google OAuth2 security flaw: How to Protect Yourself from Hackers

Google OAuth2 security flaw: Strategies Against Persistent Cookie Threats in Online Services Google OAuth2 security [...]

08
Jan

2024 Articles Digital Security

Kismet iPhone: How to protect your device from the most sophisticated spying attack?

Kismet iPhone: How to protect your device from the most sophisticated spying attack using Pegasus [...]

02
Jan

TETRA Security Vulnerabilities secured by EviPass or EviCypher NFC HSM Technologies from Freemindtronic-Andorra

Articles Digital Security EviCore NFC HSM Technology EviPass NFC HSM technology NFC HSM technology

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures from Cyberattacks TETRA (Terrestrial Trunked Radio) is [...]

27
Nov

2023 Articles DataShielder Digital Security EviCore NFC HSM Technology EviCypher NFC HSM EviCypher Technology NFC HSM technology

FormBook Malware: How to Protect Your Gmail and Other Data

How to Protect Your Gmail Account from FormBook Malware Introduction Imagine that you receive an [...]

23
Nov

Articles Digital Security

Chinese hackers Cisco routers: how to protect yourself?

How Chinese hackers infiltrate corporate networks via Cisco routers A Chinese-backed hacker group, known as [...]

04
Oct

The chronicles displayed above ↑ belong to the Digital Security section. They extend the analysis of sovereign architectures, data black markets, and surveillance tools. This selection complements the present chronicle dedicated to the **Ledger Security Breaches (2017–2026)** and the systemic risks linked to hardware vulnerabilities, supply‑chain compromises, and third‑party providers.

Advanced Summary

This advanced summary frames Ledger Security Breaches (2017–2026) through a systemic lens. It does not focus only on technical incidents, but analyzes the full dependency chain — firmware, software, partners, and customer data — and explains why certain architectures make these failures structural, not accidental.

A sequence of breaches that reveals a security-model problem

Since 2017, Ledger has faced a series of major incidents: seed phrase recovery attacks, firmware replacement, physical device modifications, application-level vulnerabilities (Monero), the massive 2020 customer database leak, the 2023 software supply-chain compromise, and the 2026 Global-e order-data leak. Taken separately, each event can be labeled an “incident.” Taken together, they reveal a security model problem.

The common denominator is not low-level cryptography, but the recurring necessity for critical secrets (seed phrases, private keys, identity-related metadata) to pass at some point through a non-sovereign environment: proprietary firmware, the host computer, connected applications, update servers, or an e-commerce partner.

From component security to ecosystem vulnerability

Ledger historically relied on the robustness of the hardware component itself. But from 2020 onward, the attack surface shifted to the peripheral ecosystem: customer databases, logistics services, software dependencies, user interfaces, notifications, and support channels.

The 2026 Global-e leak marks a turning point. Even without direct private-key compromise, exposure of delivery and order metadata turns users into persistent targets: ultra-targeted phishing, “delivery” social engineering, doxxing, and, in extreme cases, physical threats. Security is no longer only digital — it becomes civil and personal.

Why phishing and hybrid attacks become inevitable

Once a user’s real identity is correlated with crypto ownership, phishing stops being opportunistic. It becomes industrial and personalized.

BITB attacks, fake updates, fake delivery incidents, or “compliance” scams exploit less a technical bug than the human factor, made vulnerable by exposed metadata.

In this context, hardening firmware or adding software warnings is not sufficient. The problem is not cryptographic signing — it is that the secret or its holder becomes identifiable, traceable, or remotely reachable.

Paradigm shift: from trust to hardware proof

Facing these structural limits, some approaches do not attempt to strengthen transaction signing — they aim to remove critical secrets from any connected ecosystem. Freemindtronic’s sovereign alternatives follow the opposite logic: instead of securing a connected stack, they seek to radically reduce dependencies. NFC HSM devices are battery-less, cable-less, and network-port-less, requiring no account, no server, and no cloud synchronization.

This paradigm shift is embodied by air-gap secret sharing: critical secrets (seed phrases, private keys, credentials for hot wallets or proprietary systems) can be transferred hardware → hardware from one SeedNFC HSM to another, via an RSA-4096 encrypted QR code using the recipient’s public key — without blockchain, without server, and without any transaction-signing function.

A structural answer to the failures observed since 2017

Where Ledger failures rely on supply chains, updates, and commercial relationships, sovereign architectures remove these breaking points by design. There is nothing to hack remotely, nothing to divert in a cloud, and nothing to extract from a third-party server. Even if visually exposed, an encrypted QR code remains unusable without physical possession of the recipient HSM.

This model does not promise “magic” security. It imposes deliberate responsibility: irreversibility of transfers, physical control, and operational discipline. But it eliminates the systemic attack vectors that have repeatedly surfaced since 2017.

Ledger Security Breaches (2017–2026): How to Protect Your Cryptocurrencies

Have you ever questioned the real level of security protecting your digital assets?
If you use a Ledger device, you may assume your funds are safe from hackers. Ledger is a French company widely recognized for its role in cryptocurrency security, offering hardware wallets designed to isolate private keys from online threats.

However, since 2017, Ledger Security Breaches have repeatedly challenged this assumption. Over time, multiple vulnerabilities have emerged—some exposing personal data, others enabling private-key compromise only in specific, controlled attack scenarios (e.g., physical access or manipulated environments). These weaknesses have allowed attackers not only to steal funds, but also to exploit users through phishing, identity correlation, and targeted coercion.

This chronicle provides a structured analysis of the major Ledger security incidents from 2017 to 2026. It explains how each breach was exploited, what risks they introduced, and why certain architectural choices amplify systemic exposure. Most importantly, it outlines practical and strategic approaches to reduce attack surfaces and regain control over cryptographic sovereignty.

Rather than focusing on fear or isolated failures, this analysis aims to help users understand the evolving threat landscape—and to distinguish between trust-based security and proof-based, sovereign architectures.

Ledger security incidents: How Hackers Exploited Them and How to Stay Safe

Ledger security breaches have exposed logistical and relational metadata (delivery address, purchase history, identity correlation), and in specific historical attack scenarios, enabled the compromise of private keys under controlled conditions. Ledger is a French company that provides secure devices to store and manage your funds. But since 2017, hackers have targeted Ledger’s e-commerce and marketing database, as well as its software and hardware products. In this article, you will discover the different breaches, how hackers exploited them, what their consequences were, and how you can protect yourself from these threats.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

January 17, 2026

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

January 8, 2026

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

January 7, 2026

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

January 6, 2026

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

January 5, 2026

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

January 5, 2026

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

December 21, 2025

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

December 2, 2025

[/section]

Ledger Security Breaches (2017–2026): From Hardware Attacks to Systemic Supply-Chain Risk

Have you ever wondered how safe your cryptocurrencies are? If you are using a Ledger device, you might think that you are protected from hackers and thieves. Ledger is a French company that specializes in cryptocurrency security. It offers devices that allow you to store and manage your funds securely. These devices are called hardware wallets, and they are designed to protect your private keys from hackers and thieves.

However, since 2017, Ledger has been the target of multiple incidents that exposed logistical and relational metadata (delivery address, purchase history, identity correlation) and, in specific historical attack scenarios, enabled private-key compromise under controlled conditions. These breaches could allow hackers to steal your cryptocurrencies or harm you in other ways. In this article, we will show you the different breaches that were discovered, how they were exploited, what their consequences were, and how you can protect yourself from these threats.

Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018)

The seed phrase is a series of words that allows you to restore access to a cryptocurrency wallet. It must be kept secret and secure, as it gives full control over the funds. In February 2018, a security researcher named Saleem Rashid discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to recover the seed phrase using a side-channel attack.

How did hackers exploit the breach?

The attack consisted of using an oscilloscope to measure the voltage variations on the reset pin of the device. These variations reflected the operations performed by the secure processor of the Ledger Nano S, which generated the seed phrase. By analyzing these variations, the attacker could reconstruct the seed phrase and access the user’s funds.

Simplified diagram of the attack

Figure Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018) — Statistics on the breach

Number of potentially affected users: about 1 million
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: February 20, 2018
Author of the discovery of the breach: Saleem Rashid, a security researcher
Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to an oscilloscope and measure the voltage variations on the reset pin. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.
Scenario of remote access: The attacker needs to trick the user into installing a malicious software on their computer, which can communicate with the device and trigger the reset pin. The attacker then needs to capture the voltage variations remotely, either by using a wireless device or by compromising the oscilloscope. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.

Sources

¹: Breaking the Ledger Security Model – Saleem Rashid published on March 20, 2018.

²: Ledger Nano S: A Secure Hardware Wallet for Cryptocurrencies? – Saleem Rashid published on November 20, 2018.

Ledger Security Flaws: The Firmware Replacement Attack (March 2018)

The firmware is the software that controls the operation of the device. It must be digitally signed by Ledger to ensure its integrity. In March 2018, the same researcher discovered another breach in the Ledger Nano S, which allowed an attacker to replace the firmware of the device with a malicious firmware, capable of stealing the private keys or falsifying the transactions.

How did hackers exploit the Ledger Security Breaches?

The attack consisted of exploiting a vulnerability in the mechanism of verification of the firmware signature. The attacker could create a malicious firmware that passed the signature check, and that installed on the device. This malicious firmware could then send the user’s private keys to the attacker, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

Statistics on the breach

Number of potentially affected users: about 1 million
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: March 20, 2018
Author of the discovery of the breach: Saleem Rashid, a security researcher
Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to a computer and install the malicious firmware on it. The attacker can then use the device to access the user’s funds or falsify their transactions.
Scenario of remote access: The attacker needs to trick the user into installing the malicious firmware on their device, either by sending a fake notification, a phishing email, or a malicious link. The attacker then needs to communicate with the device and send the user’s private keys or modify their transactions.

Sources

Breaking the Ledger Security Model – Saleem Rashid published on March 20, 2018.
Ledger Nano S Firmware 1.4.1: What’s New? – Ledger Blog published on March 6, 2018.
Monero App Vulnerability Analysis – Ledger Donjon published on March 2019.

Ledger Security Incidents: The Printed Circuit Board Modification Attack (November 2018)

The printed circuit board is the hardware part of the device, which contains the electronic components. It must be protected against malicious modifications, which could compromise the security of the device. In November 2018, a security researcher named Dmitry Nedospasov discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to modify the printed circuit board and install a listening device, capable of capturing the private keys or modifying the transactions.

How did hackers exploit the breach?

The attack consisted of removing the case of the device, and soldering a microcontroller on the printed circuit board. This microcontroller could intercept the communications between the secure processor and the non-secure processor of the Ledger Nano S, and transmit them to the attacker via a wireless connection. The attacker could then access the user’s private keys, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

Statistics on the breach

Number of potentially affected users: unknown
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: November 7, 2019
Author of the discovery of the breach: Dmitry Nedospasov, a security researcher
Date of publication of the fix by Ledger: December 17, 2020

Scenarios of hacker attacks

Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to remove the case of the device and solder the microcontroller on the printed circuit board. The attacker can then use the wireless connection to access the user’s funds or modify their transactions.
Scenario of remote access: The attacker needs to compromise the wireless connection between the device and the microcontroller, either by using a jammer, a repeater, or a hacker device. The attacker can then intercept the communications between the secure processor and the non-secure processor, and access the user’s funds or modify their transactions.

Sources

[Breaking the Ledger Nano X – Dmitry Nedospasov] published on November 7, 2019.
[How to Verify the Authenticity of Your Ledger Device – Ledger Blog] published on December 17, 2020.

[/col] [/row]

Ledger Security Breaches: Monero Application Vulnerability (March 2019)

Not all cryptocurrencies interact with hardware wallets in the same way.
In March 2019, a critical vulnerability was discovered in the Monero (XMR) application for Ledger devices.
Unlike the 2018 physical attacks, this flaw was located in the communication protocol between the Ledger device and the Monero desktop client.

How Was the Vulnerability Exploited?

The flaw allowed a malicious or compromised Monero client to send manipulated transaction data to the Ledger device.

By exploiting a bug in the handling of change outputs, an attacker could:

redirect funds to an address under their control without the user noticing on the Ledger screen, or
under specific and controlled conditions, reconstruct the Monero private spend key by observing multiple device–host exchanges.

In this scenario, the hardware wallet signed cryptographically valid transactions based on manipulated inputs originating from the host software.

Infographic illustrating a Monero transaction hijack via a malicious GUI wallet despite the use of a Ledger hardware wallet.

Incident Summary

Potentially affected users: Monero (XMR) holders using Ledger Nano S or Nano X
Reported loss: One documented case of approximately 1,600 XMR (~USD 83,000 at the time)
Date of discovery: March 4, 2019
Discoverers: Monero community & Ledger Donjon
Patch released: March 6, 2019 (Monero app version 1.5.1)

Attack Scenarios

Compromised software: The user interacts with an infected or unofficial Monero GUI wallet. During a legitimate transaction, the client silently alters transaction parameters to drain funds.
Key reconstruction (controlled scenario): An attacker with malware on the host computer could theoretically reconstruct the Monero private spend key by intercepting and correlating multiple device–PC exchanges.

Important clarification: This incident did not involve a mass leak of private keys.
It demonstrated that, under specific conditions and with a compromised host environment, private key compromise was technically possible due to application-layer design flaws.

Blind Signing is not a temporary flaw nor a bug that can be patched with a firmware update.
It is a structural design limitation inherent to hardware wallets when confronted with the growing complexity of smart contracts.

As of 2026, it represents the #1 fund-theft vector in Web3, ahead of classic technical exploits.

Why Blind Signing Is Fundamentally Dangerous

A hardware wallet is supposed to enable conscious and verifiable validation of sensitive operations.
With Blind Signing, however, the device is unable to render the real intent of the contract being signed.

The user is typically presented with:

a generic “Data Present” message
unreadable hexadecimal strings
or a partial, non-human-interpretable description

The signature becomes an act of faith.
The user no longer validates a understood action, but complies with an opaque interface.

Diagram illustrating Blind Signing, showing a hardware wallet displaying 'Data Present' while a malicious smart contract drains funds. — Figure — Blind Signing: when the user signs a transaction whose real intent cannot be verified.

An Attack by Consent, Not by Circumvention

Unlike the 2018 Ledger incidents (seed recovery, firmware replacement, PCB modification),
Blind Signing does not attempt to break the hardware security.

It turns it against the user.

Everything is:

cryptographically valid
signed with the genuine private key
irreversible on the blockchain

There is no detectable malware, no key extraction, no firmware compromise.
The loss is legally and technically attributable to the signature itself.

Impact and Scope

Affected users: 100% of DeFi / NFT / Web3 users
Estimated losses: hundreds of millions of USD (cumulative)
Status: permanent and systemic risk
Root cause: inability to verify signed intent

Typical Attack Scenarios

Wallet drainers: a fake mint or airdrop leads to signing a contract that grants unlimited asset transfer rights.
Hidden infinite approvals: the user unknowingly signs a permanent authorization. The wallet is emptied later, without any further interaction.

Conclusion:
Blind Signing marks a critical rupture: the private key remains protected, but effective security disappears.

The question is no longer “Is my wallet secure?”, but:

“Am I able to prove what I am signing?”

Ledger Security Breaches: The Connect Kit Attack (December 2023)

The Connect Kit is a software that allows users to manage their cryptocurrencies from their computer or smartphone, by connecting to their Ledger device. It allows to check the balance, send and receive cryptocurrencies, and access services such as staking or swap.

The Connect Kit breach was discovered by the security teams of Ledger in December 2023. It was due to a vulnerability in a third-party component used by the Connect Kit. This component, called Electron, is a framework that allows to create desktop applications with web technologies. The version used by the Connect Kit was not up to date, and had a breach that allowed hackers to execute arbitrary code on the update server of the Connect Kit.

Technical validation: This type of supply chain attack is classified under CWE-494 (Download of Code Without Integrity Check). You can monitor similar hardware wallet vulnerabilities on the MITRE CVE Database.

How did hackers exploit the Ledger Security Breaches?

The hackers took advantage of this breach to inject malicious code into the update server of the Connect Kit. This malicious code was intended to be downloaded and executed by the users who updated their Connect Kit software. The malicious code aimed to steal the sensitive information of the users, such as their private keys, passwords, email addresses, or phone numbers.

Simplified diagram of the attack

Statistics on the breach

Number of potentially affected users: about 10,000
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: December 14, 2023
Author of the discovery of the breach: Pierre Noizat, director of security at Ledger
Date of publication of the fix by Ledger: December 15, 2023

Scenarios of hacker attacks

Scenario of remote access: The hacker needs to trick the user into updating their Connect Kit software, either by sending a fake notification, a phishing email, or a malicious link. The hacker then needs to download and execute the malicious code on the user’s device, either by exploiting a vulnerability or by asking the user’s permission. The hacker can then access the user’s information or funds.
Scenario of keyboard: The hacker needs to install a keylogger on the user’s device, either by using the malicious code or by another means. The keylogger can record the keystrokes of the user, and send them to the hacker. The hacker can then use the user’s passwords, PIN codes, or seed phrases to access their funds.
Scenario of screen: The hacker needs to install a screen recorder on the user’s device, either by using the malicious code or by another means. The screen recorder can capture the screen of the user, and send it to the hacker. The hacker can then use the user’s QR codes, addresses, or transaction confirmations to steal or modify their funds.

Sources

[https://thehackernews.com/2023/12/crypto-hardware-wallet-ledgers-supply.html] published on December 15, 2023.

Ledger Security Breaches: The Data Leak (December 2020)

The database is the system that stores the information of Ledger customers, such as their names, addresses, phone numbers and email addresses. It must be protected against unauthorized access, which could compromise the privacy of customers. In December 2020, Ledger revealed that a breach in its database had exposed the logistical and relational metadata (delivery address, purchase history, identity correlation) of 292,000 customers, including 9,500 in France.

How did hackers exploit the breach?

The breach had been exploited by a hacker in June 2020, who had managed to access the database via a poorly configured API key. The hacker had then published the stolen data on an online forum, making them accessible to everyone. Ledger customers were then victims of phishing attempts, harassment, or threats from other hackers, who sought to obtain their private keys or funds.

Simplified diagram of the attack :

Statistics on the breach

Number of affected users: 292,000, including 9,500 in France
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: June 25, 2020
Author of the discovery of the breach: Ledger, after being notified by a researcher
Date of publication of the fix by Ledger: July 14, 2020

Scenarios of hacker attacks

Scenario of phishing: The hacker sends an email or a text message to the user, pretending to be Ledger or another trusted entity. The hacker asks the user to click on a link, enter their credentials, or update their device. The hacker then steals the user’s information or funds.
Scenario of harassment: The hacker calls or visits the user, using their logistical and relational metadata (delivery address, purchase history, identity correlation) to intimidate them. The hacker threatens the user to reveal their identity, harm them, or steal their funds, unless they pay a ransom or give their private keys.
Scenario of threats: The hacker uses the user’s logistical and relational metadata (delivery address, purchase history, identity correlation) to find their social media accounts, family members, or friends. The hacker then sends messages or posts to the user or their contacts, threatening to harm them or expose their cryptocurrency activities, unless they comply with their demands.

Sources:

[1] Ledger Blog : Ledger Data Breach: A Cybersecurity Update (January 2021)

Ledger Security Breaches: The Global-e Data Leak (January 2026)

In January 2026, Ledger disclosed a new breach caused by its e-commerce partner Global-e.
Attackers compromised Global-e’s cloud systems, exposing customer names, email addresses, and delivery contact details used for online orders.

Unlike previous incidents, no seed phrases, private keys, or payment card data were compromised.
However, this leak significantly increased the risk of targeted phishing, doxxing, and long-term social engineering attacks against Ledger customers.

Infographic illustrating the Global-e Ledger data leak (January 2026) — Figure — Global-e 2026 breach: how exposed order data enables phishing, doxxing, and coercive targeting.

Active Defense: Mitigating Global-e Leak Risks

The SeedNFC HSM ecosystem, combined with PassCypher HSM PGP, provides a structural response by shifting security into the user’s physical control:

Reduced purchase metadata exposure: minimizing the collection and retention of identifiable data (name, address, phone) limits the long-term impact of e-commerce and logistics leaks such as 2020 and Global-e (2026).
Hardware-based intent validation: critical actions require a physical NFC interaction, rendering remote phishing and fake-support attacks ineffective after a data leak.
Anti-BITB & Anti-Iframe protection: blocks fake Ledger Live interfaces and credential-harvesting windows commonly used in post-leak phishing campaigns.
Compromised credential detection: checks whether emails or passwords have appeared in previous breaches, preventing reuse and account takeover.

Global-e Breach Statistics

Affected users: Not publicly disclosed (investigation ongoing as of January 2026).
Exposed data: Customer names, emails, and delivery contact information.
Impact on sensitive assets: None (private keys and funds remained secure).
Date of discovery: January 4, 2026.
Breach origin: Global-e cloud infrastructure.

⚠️ Critical Alert: Dark Web Resale & Persistent Targeting

A data breach is permanent. Once an identity is associated with a hardware wallet purchase,
the individual remains a high-value target for years.

Sovereign defense: By managing keys and credentials in a hardware-only environment such as SeedNFC HSM,
users can de-link their digital identity from centralized e-commerce databases and recurring leaks.

Official Sources & Expert References

[1] Ledger Support: Global-e Incident Report (January 2026)
[2] Europol (IOCTA): Stolen credential resale markets.
[3] ANSSI / Cybermalveillance: Official guidance on data-leak risks
[4] CoinDesk: Ledger warns of phishing risks after partner breach (January 2026).

Escalation of Threats: From Delivery Phishing to Physical Coercion

The Global-e delivery-data leak does not merely enable email scams.
It fuels hybrid attacks where digital exposure transitions into real-world coercion.

“Delivery” Phishing: Precision Social Engineering

Attackers exploit order history to send ultra-credible SMS or emails:

Scenario: Fake courier messages (customs issue, address error, delayed shipment).
Trap: A cloned Ledger interface requesting a recovery phrase to “unlock” delivery.
Why it works: The victim is already expecting a shipment or update.

Physical Extortion & Home-Targeting

When physical addresses are exposed, the threat extends beyond cybercrime:

Targeted home visits: Criminal groups identify where crypto holders live.
Coercion: Victims are forced to sign irreversible transfers under threat.
Family pressure: Attacks may involve relatives to break resistance.

“A leaked Ledger delivery address acts as a marker: it tells criminals where the vault is and who holds the key.” This reality forces a fundamental rethink of how security tools are purchased and how identity is exposed.

Official Statements and Expert Sources

[1] Ledger Support: Official Incident Report – Global-e (January 2026)
[2] Ledger Blog:Ledger Data Breach: A Cybersecurity Update (January 2021)
[3] Europol (IOCTA): Internet Organised Crime Threat Assessment – Resold credentials market
[4] ANSSI (France): Official guidance on data leaks and extortion risks
[5] CoinDesk: Ledger warns of phishing risks after partner hack (January 2026)
[6] FBI (IC3):Internet Crime Complaint Center – Warnings on data breach-enabled scams

Global Reactions: Trust Erosion, Legal Pressure, and Community Backlash

The January 2026 Global-e order-data breach triggered a strong and immediate reaction across the global crypto ecosystem. Unlike earlier technical exploits, this incident reinforced a growing perception that the primary risk no longer lies in cryptography or hardware components, but in ecosystem-level dependencies: e-commerce partners, logistics providers, and identity-linked metadata.

Across English-speaking communities (Reddit, X, Discord, Telegram), the dominant sentiment was not surprise, but fatigue. For many users, Global-e represented the third major reminder—after 2020 and 2023—that hardware security alone does not guarantee user safety.

Recurring Themes in Anglophone Communities

Collapse of “secure-by-brand” trust: Ledger’s hardware is still widely perceived as technically robust, but confidence in the surrounding commercial and data-handling ecosystem has eroded.
Metadata as the real vulnerability: Users increasingly recognize that names, emails, delivery addresses, and purchase history enable profiling, targeting, and coercion—even when private keys remain secure.
Phishing industrialization: Highly personalized scams (fake delivery notices, fake compliance alerts, fake support cases) are now viewed as an unavoidable consequence of large-scale data leaks.

From Cybersecurity to Legal and Regulatory Exposure

In the United States, United Kingdom, and European Union, discussions rapidly shifted toward legal accountability and consumer protection, backed by official frameworks:

Class action risk (US / UK): Law firms are examining collective lawsuits for negligence and failure of duty of care, citing precedents in data breach litigation.
Regulatory scrutiny: Data-protection authorities like the CNIL (EU) and the ICO (UK) have emphasized strict third-party dependency management under GDPR.
Law-enforcement alerts: Agencies like Cybermalveillance.gouv.fr and the FBI (IC3) emphasize that crypto-related leaks increasingly enable hybrid crime, combining cyber-fraud with real-world intimidation.

Hybrid Threat Escalation: From Phishing to Physical Coercion

The Global-e breach illustrates a broader evolution of crypto-crime: the transition from purely digital theft to hybrid attack models, a trend confirmed by the INTERPOL Global Cybercrime reports.

Precision Phishing at Global Scale

Attackers leverage order metadata to craft highly credible messages. As reported by The Block, these campaigns include:

Fake courier notifications (customs delay, address issues)
Cloned Ledger Live portals requesting recovery phrases
Social-engineering scripts tailored to purchase history

Physical Targeting and Extortion Risks

Once physical addresses are exposed, risks extend beyond cybercrime, aligning with the Chainalysis Crypto Crime evolution analysis:

Home targeting: Criminal groups identify where high-value crypto holders live.
Forced transactions: Victims are coerced into signing irreversible transfers via physical threats.
Family leverage: Threats may extend to relatives to break resistance.

“A leaked delivery address does not steal funds—but it identifies the vault and the person holding the key.”

This realization has driven a growing demand for identity-minimizing, hardware-sovereign security models built on privacy-by-design principles —such as those prioritizing “Privacy by Design” by erasing all digital purchase records—to decouple asset protection from centralized logistics vulnerabilities.

SeedNFC implements a fully air-gapped secret-sharing mechanism based on an
RSA-4096 encrypted QR code using the recipient’s public key.
The recipient must be another SeedNFC HSM, ensuring that only that device can decrypt and
import the secret directly into hardware.

The QR code is only an encrypted transport container. It can be displayed locally, sent as an image,
or even shown during a video call. Without physical possession of the recipient SeedNFC HSM,
the content remains mathematically unusable.

Offline asymmetric encryption: the secret is never exposed in plaintext inside the QR code.
Zero infrastructure: no server, no account, no database, no cloud.
Operational + logical air-gap: sharing remains possible without any network connectivity.

This mechanism includes no revocation, no delay, and no expiration: the transfer is permanent by design.
It enables direct hardware → hardware transfer of critical secrets (seed phrases, private keys, access credentials)
between isolated HSM devices, with no software intermediary and no blockchain involvement.

Clarification: secret transfer ≠ transaction signing

SeedNFC HSM is not presented here as a transaction signer. Its role is upstream: to generate, store, and transfer secrets (seed phrases, private keys) or authentication data (IDs/passwords, hot-wallet access, proprietary systems) within a sovereign hardware boundary.

It can also store encrypted seed phrases from third-party wallets (Ledger, Trezor, software hot wallets, etc.) and their associated private keys, without depending on the original vendor’s firmware, software, or infrastructure.

Depending on the use case, data can be injected in a controlled way into an application field through Bluetooth HID keyboard emulation (e.g., migration, restore, login).

Web complement: for browser workflows, equivalent controlled input can be triggered via the Freemindtronic browser extension (explicit field selection). This eliminates exposure via clipboard, temporary files, or cloud sync, and strongly reduces risk from classic software keyloggers, since the user does not type anything.

Scope note: like any input, data may still become observable at the display point or on a compromised host (screen capture, application malware). The goal is to remove “copy/paste + file” vectors and human typing—not to make an infected system “invulnerable”.

Important: transferring a private key transfers ownership (full control over the associated funds).This is relevant for backup, migration, inheritance, or off-chain ownership transfer, but must be used with strict operational discipline.

Why this matters after data leaks: even if metadata is exposed, secrets can remain isolated and transferable without re-entering a connected vendor ecosystem.

Comparison with other crypto wallets

Ledger is not the only solution to secure your cryptocurrencies. There are other options, such as other hardware wallets, software wallets, or exchanges. Each option has its advantages and disadvantages, depending on your needs and preferences.

Other Hardware Wallets

For example, other hardware wallets, such as Trezor, offer similar features and security levels as Ledger, but they may have different designs, interfaces, or prices.

Software Wallets

Software wallets, such as Exodus or Electrum, are more convenient and accessible, but they are less secure and more vulnerable to malware or hacking.

Exchanges

Exchanges, such as Coinbase or Binance, are more user-friendly and offer more services, such as trading or staking, but they are more centralized and risky, as they can be hacked, shut down, or regulated.

Security Vector	Traditional USB Wallet	Freemindtronic NFC HSM
Physical Attack Surface	High (USB ports, Battery, Screen)	Minimal (No ports, No battery)
Data Persistence	Risk of flash memory wear	High (EviCore long-term integrity)
Side-Channel Leakage	Possible (Power consumption analysis)	Immune (Passive induction)

Cold Wallet Alternatives

Another option is to use a cold wallet, such as SeedNFC HSM, which is a patented HSM that uses NFC technology to create, store, and transfer cryptographic secrets (seed phrases, private keys, credentials) in an offline, hardware-only environment, without any connection to the internet or a computer. It also allows you to create up to 100 cryptocurrency wallets and check the balances from this NFC HSM.

Internationally Patented Sovereign Technology

To address the structural flaws identified in traditional hardware wallets, Freemindtronic uses a unique architecture protected by international patents (WIPO). These technologies ensure that the user remains the sole master of their security environment.

Access Control System Patent WO2017129887
Guarantees physical-to-digital integrity by ensuring the HSM can only be triggered by a specific, intentional human action, preventing remote exploitation.
Segmented Key Authentication System Patent WO2018154258
Provides a defense-in-depth mechanism where secrets are fragmented. This prevents a “single point of failure,” making “Connect Kit” type attacks or firmware replacements ineffective.

Technological, Regulatory, and Societal Projections

The future of cryptocurrency security is uncertain and challenging. Many factors can affect Ledger and its users, such as technological, regulatory, or societal changes.

Technological changes

It changes could bring new threats, such as quantum computing, which could break the encryption of Ledger devices, or new solutions, such as biometric authentication or segmented key authentication patented by Freemindtronic, which could improve the security of Ledger devices.

Regulatory changes

New rules or restrictions could affect Cold Wallet and Hardware Wallet manufacturers and users, such as Ledger. For example, KYC (Know Your Customer) or AML (Anti-Money Laundering) requirements could compromise the privacy and anonymity of Ledger users. They could also ban or limit the use of cryptocurrencies, which could reduce the demand and value of Ledger devices. On the other hand, other manufacturers who have anticipated these new legal constraints could have an advantage over Ledger. Here are some examples of regulatory changes that could affect Ledger and other crypto wallets:

MiCA, the proposed EU regulation on crypto-asset markets, aims to create a harmonized framework for crypto-assets and crypto-asset service providers in the EU. It also seeks to address the risks and challenges posed by crypto-assets, such as consumer protection, market integrity, financial stability and money laundering.The Markets in Crypto-Assets (MiCA) regulation, specifically Title V on service provider obligations, is now the gold standard. Freemindtronic technologies are designed to align with the Official Regulation (EU) 2023/1114, ensuring privacy while meeting compliance needs.
U.S. interagency report on stablecoins recommends that Congress consider new legislation to ensure that stablecoins and stablecoin arrangements are subject to a federal prudential framework. It also proposes additional features, such as limiting issuers to insured depository institutions, subjecting entities conducting stablecoin activities (e.g., digital wallets) to federal oversight, and limiting affiliations between issuers and commercial entities.
Revised guidance from the Financial Action Task Force (FATF) on virtual assets and virtual asset service providers (VASPs) clarifies the application of FATF standards to virtual assets and VASPs. It also introduces new obligations and recommendations for PSAVs, such as the implementation of the travel rule, licensing and registration of PSAVs, and supervision and enforcement of PSAVs.

These regulatory changes could have significant implications for Ledger and other crypto wallets. They could require them to comply with new rules and standards, to obtain new licenses or registrations, to implement new systems and processes, and to face new supervisory and enforcement actions.

Societal changes

Societal changes could influence the perception and adoption of Ledger and cryptocurrencies, such as increased awareness and education, which could increase the trust and popularity of Ledger devices, or increased competition and innovation, which could challenge the position and performance of Ledger devices. For example, the EviSeed NFC HSM technology allows the creation of up to 100 cryptocurrency wallets on 5 different blockchains chosen freely by the user.

Technological Alternatives for Absolute Sovereignty

The persistence of Ledger Security Breaches demonstrates that relying on a single centralized manufacturer creates a systemic risk. Today, decentralized alternatives developed by Freemindtronic in Andorra offer a paradigm shift: security based on hardware proof and physical intent, rather than brand trust.

Technologies such as EviCore NFC HSM and EviSeed NFC HSM are not just wallets; they are contactless cybersecurity ecosystems. Unlike Ledger, these devices are battery-less and cable-less, eliminating physical ports (USB/Bluetooth) as attack vectors.

Internationally Patented Security

Freemindtronic’s architecture is anchored by two fundamental international patents (WIPO) that solve the structural flaws found in traditional hardware wallets:

Segmented Key Authentication System (WO2018154258): Prevents the compromise of the whole seed or private key, even if the environment is attacked.
Access Control System (WO2017129887): Ensures that the HSM can only be triggered by the user’s physical intent via NFC, neutralizing remote software threats.

Unified Security: Hardware-Based Password Management

One of the most innovative features of the SeedNFC HSM is its integration of the EviPass NFC HSM technology. This addresses the “human factor” exploited in phishing scams.

Decentralized & Passwordless: Manage non-morphic passwords without ever storing them on a computer.
Physical Entropy: Immunity to keyloggers and screen recorders used in the Connect Kit attacks.
Contactless Convenience: Secure auto-fill by simply tapping your device.

Universal Access: Smartphone & Desktop Integration

On Android: Use native NFC for instant, battery-free hardware security.

On Desktop: Secure authentication directly in your browser via the Freemindtronic Extension.

Download: Chrome Web Store | Microsoft Edge Addons

Advanced “Air-Gap” Input: Keyboard Emulation

To bypass compromised clipboards, Fullsecure with Inputstick enables hardware-level data injection.

How it works: Your smartphone acts as a Bluetooth HID Keyboard, “typing” secrets directly into any device.

No Clipboard Exposure: Secrets never pass through the computer’s buffer.
Hardware Injection: Neutralizes software-based keyloggers relying on human keystroke capture.

Important clarification: transferring a private key is not a transaction. It is an off-chain transfer of ownership, granting full control over the associated assets.

Explore Fullsecure & Inputstick →

Active Defense: Neutralizing BITB & Redirection Attacks

The SeedNFC HSM ecosystem, when paired with the free PassCypher HSM PGP version and the browser extension, provides a unique multi-layered shield against modern web threats:

- Anti-BITB (Browser-In-The-Browser): The extension features a dedicated anti-iframe system. It detects and blocks malicious windows that simulate fake login screens—a common tactic used to steal Ledger credentials.
- Automated Corruption Check: Integrated with Have I Been Pwned, the system automatically checks if your IDs or passwords have been compromised in historical leaks, ensuring you never use “vulnerable” credentials.
- End-to-End Encrypted Auto-fill: Sensitive data is encrypted directly within the SeedNFC HSM on your Android device. It is only decrypted at the final millisecond of injection into the browser, ensuring that no plain-text data ever resides in the computer’s memory.

How to use: Open the Freemindtronic Android App (where SeedNFC is embedded), tap your HSM to your phone, and let the secure bridge handle the encrypted injection directly into your Chrome or Edge browser.

Best Practices to Protect Yourself

Never share your seed phrase or private keys — no support, update, delivery, or compliance process ever requires them.
Assume all inbound communication is hostile by default — (email, SMS, phone, social media). Always verify via official, manually accessed channels.
Strictly separate identity from asset ownership — use a dedicated email, avoid real-name linkage, and minimize purchase metadata exposure.
Avoid blind signing whenever possible — never sign transactions or approvals you cannot fully interpret and verify.
Prefer sovereign, hardware-only cold storage — (e.g., patented NFC HSM architectures) that do not rely on vendor servers, firmware updates, or e-commerce ecosystems.
Keep secrets out of connected environments — avoid clipboards, cloud sync, screenshots, password files, and shared devices.
Use hardware-enforced authentication and password management — to neutralize phishing, BITB, and credential reuse.
Plan for irreversible scenarios — define secure procedures for backup, migration, inheritance, and off-chain ownership transfer.
Accept operational responsibility — sovereignty implies discipline, physical control, and acceptance that some actions cannot be undone.

Securing the Future: From Vulnerability to Digital Sovereignty

Since 2017, the trajectory of Ledger Security Breaches has served as a critical case study for the entire crypto ecosystem. While Ledger remains a pioneer in hardware security, the recurring incidents—ranging from early physical exploits to the massive 2026 Global‑e data leak—demonstrate that a “secure device” is no longer enough. The threat has shifted from the chip itself to the systemic supply chain and the exposure of relational data.

The January 2026 incident confirms a persistent reality: even when private keys remain shielded, the leak of customer metadata (names, emails, and order history) creates a permanent risk of targeted phishing, doxxing, and social engineering. This highlights the inherent danger of centralized e‑commerce databases and the fragility of relying on third‑party partners for a product whose core promise is absolute security.

The Sovereign Alternative: Security by Design

To break this cycle of dependency, the paradigm must shift toward decentralized hardware security. This is where patented technologies developed by Freemindtronic in Andorra provide a structural response:

Physical Intent & Access Control (WO2017129887): Eliminates the remote attack surface by requiring a physical, contactless validation that cannot be spoofed by malicious software updates.
Segmented Key Authentication (WO2018154258): Protects against systemic breaches (like the Connect Kit attack) by ensuring that secrets are never centralized or fully exposed, even in a compromised environment.

This model does not promise convenience. It requires strict operational discipline, physical control, and acceptance of irreversibility.

For Ledger users, vigilance remains the primary line of defense. Respecting strict digital hygiene—verifying every communication via the official Ledger help center and using dedicated, non‑identifiable contact info for purchases—is essential. However, for those seeking to eliminate the “third‑party risk” entirely, transitioning to battery‑less, contactless, and patented NFC HSM solutions represents the next step in achieving true digital sovereignty.

As the crypto landscape evolves through 2026 and beyond, the lesson is clear: Don’t just trust the brand—trust the architecture.

Technical Reference: The EviCore and SeedNFC architectures are based on WO2017129887 and WO2018154258 patents. Developed by Freemindtronic Andorra for absolute digital sovereignty.

Uncategorized

LitterDrifter: A USB Worm for Cyberespionage

Posted on November 28, 2023November 28, 2023 by FMTAD

28
Nov

LitterDrifter by Jacques Gascuel: This article will be updated with any new information on the topic.

LitterDrifter: USB Worm Threat and Safeguarding

Explore the LitterDrifter USB worm threat and effective safeguards. Learn to protect against this cyber threat and enhance data security.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

January 17, 2026

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

January 8, 2026

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

January 7, 2026

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

January 6, 2026

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

January 5, 2026

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

January 5, 2026

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

December 21, 2025

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

December 2, 2025

LitterDrifter: A USB Worm for Cyberespionage and Its Threats to Data Security

LitterDrifter is a computer worm that spreads through USB drives and is utilized by a Russian cyber espionage group known as Gamaredon. This group, active since at least 2013, primarily targets Ukraine but has also infected systems in other countries. LitterDrifter enables Gamaredon to gather sensitive information, execute remote commands, and download other malicious software. In this article, we will explore how this worm functions, methods to safeguard against it, and the motivations behind its creators.

Understanding Gamaredon

Gamaredon is a cyber espionage group suspected to have ties to Russia’s Federal Security Service (FSB). It conducts intelligence and sabotage operations against strategic targets in Ukraine, including government institutions, law enforcement, media, political organizations, and dissidents. Gamaredon plays a part in the hybrid warfare between Russia and Ukraine that emerged in 2014 following the annexation of Crimea and the armed conflict in Donbass.

Gamaredon employs a diverse range of cyberattack techniques, including phishing, disinformation, sabotage, and espionage. The group possesses several malicious tools such as Pterodo, Outlook Forms, VBA Macros, LNK Spreader, and, of course, LitterDrifter. Gamaredon is considered a group that learns from its experiences and adapts its tactics based on responses from its adversaries. It also serves as a training ground for Russia, observing the potential of cyber warfare in contemporary conflicts.

How LitterDrifter Works

LitterDrifter is a computer worm initially discovered in October 2021 by cybersecurity company Check Point Research. It is written in VBS and consists of two main modules: a propagation module and a communication module.

LitterDrifter’s Propagation

The propagation module is responsible for copying the worm to USB drives connected to the infected computer. It creates an autorun.inf file that allows the worm to launch automatically upon inserting an infected drive. Additionally, it generates an LNK file that serves as bait, featuring a random name to entice the user to click on it. The worm’s name is derived from the initial file name, “trash.dll,” which means “garbage” in English.

LitterDrifter’s Communication

The communication module establishes contact with the worm’s authors’ command and control (C2) server. It uses domains as markers for the actual IP addresses of the C2 servers. It can also connect to a C2 server extracted from a Telegram channel, a technique employed by Gamaredon since early 2021. The communication module allows the worm to collect information about the infected system, such as the computer name, username, IP address, operating system, process list, files on the hard drive, and USB drives. It can also execute remote commands, download and install other malicious software, and delete files or partitions.

How LitterDrifter Propagates

LitterDrifter is primarily intended to target Ukraine but has also been detected in other countries, including Latvia, Lithuania, Poland, Romania, Turkey, Germany, France, the United Kingdom, the United States, Canada, India, Japan, and Australia. The worm appears to spread opportunistically, taking advantage of USB exchanges and movements among individuals and organizations. Some of the victims may be secondary targets infected inadvertently, while others could be potential targets awaiting activation.

LitterDrifter Statistics

LitterDrifter is a rapidly spreading worm that affects a large number of systems. According to data from Check Point Research, the worm has been submitted to VirusTotal more than 1,000 times since October 2021, originating from 14 different countries. The majority of submissions come from Ukraine (58%), followed by the United States (12%) and Vietnam (7%). Other countries each represent less than 5% of submissions.

The worm also uses a large number of domains as markers for C2 servers. Check Point Research has identified over 200 different domains used by the worm, with most being free or expired domains. Some domains have been used by Gamaredon for a long time, while others are created or modified recently. The worm also uses Telegram channels to extract C2 server IP addresses, making their blocking or tracking more challenging.

The worm is capable of downloading and installing other malicious software on infected systems. Among the malicious software detected by Check Point Research are remote control tools, spyware, screen capture software, password stealers, file encryption software, and data destruction software. Some of these malicious software are specific to Gamaredon, while others are generic or open-source tools.

Uncontrolled Expansion and Real Consequences of LitterDrifter

LitterDrifter is a worm with uncontrolled expansion, meaning it spreads opportunistically by taking advantage of the movement and exchange of USB drives among individuals and organizations. It doesn’t have a specific target but can infect systems in various countries, without regard to the industry sector or security level. Consequently, it can affect critical systems, including infrastructure, public services, or government institutions.

The real consequences of LitterDrifter are manifold and severe. It can compromise the confidentiality, integrity, and availability of data. Moreover, it can serve as a gateway for more sophisticated attacks, such as deploying ransomware, spyware, or destructive software. Additionally, it can enable the worm’s authors to access sensitive information, including confidential documents, passwords, personal data, or industrial secrets.

LitterDrifter can have serious repercussions for victims, including damage to reputation, financial costs, data loss, disruption of operations, or legal liability. It can also impact national security, political stability, or the sovereignty of targeted countries. It is part of the context of a hybrid war waged by Russia against Ukraine, aiming to weaken and destabilize its neighbor through military, political, economic, media, and cyber means.

LitterDrifter’s Attack Methods

Understanding the attack methods employed by LitterDrifter is crucial in safeguarding your systems. This USB worm leverages various techniques to infiltrate systems and establish contact with its command and control (C2) servers. Below, we delve into the primary attack methods used by LitterDrifter:

Attack Method	Description	Example
Vulnerability Exploitation	Exploiting known vulnerabilities in software and network protocols, such as SMB, RDP, FTP, HTTP, SSH, etc. It employs tools like Metasploit, Nmap, and Mimikatz to scan systems, execute malicious code, steal credentials, and propagate.	Utilizing the EternalBlue vulnerability to infect Windows systems via the SMB protocol and install a backdoor.
Phishing	Sending fraudulent emails containing malicious attachments or links that entice users to open or click. Attachments or links trigger the download and execution of LitterDrifter.	Sending an email pretending to be an invoice from a supplier but containing a malicious Word file that exploits the CVE-2017-0199 vulnerability to execute LitterDrifter.
Identity Spoofing	Impersonating legitimate services or applications through similar names, icons, or interfaces. This deceives users or administrators into granting privileges, access, or sensitive information.	Using the name and icon of TeamViewer, a remote control software, to blend into the process list and establish a connection with C2 servers.
USB Propagation	Copying itself to USB drives connected to infected computers, automatically running upon insertion. It also creates random-named LNK files as bait, encouraging users to click.	When a user inserts an infected USB drive into their computer, the worm copies itself to the hard drive and executes. It also creates an LNK file named “Holiday Photos.lnk” pointing to the worm.
Domain Marker Usage	Using domains as markers for actual C2 server IP addresses. It generates a random subdomain of a hardcoded domain (e.g., 4fj3k2h5.example.com from example.com) and resolves its IP address through a DNS query. It then uses this IP address for communication with the C2 server.	Generating the subdomain 4fj3k2h5.example.com from the hardcoded domain example.com, resolving its IP address through a DNS query (e.g., 192.168.1.100), and using it to send data to the C2 server.

LitterDrifter’s Malicious Actions

LitterDrifter is a worm that can cause significant damage to infected systems. It not only collects sensitive information but can also execute remote commands, download and install other malicious software, and delete files or partitions. Here’s a table summarizing LitterDrifter’s main malicious actions:

Action	Description	Example
Information Collection	The worm gathers information about the infected system, including computer name, username, IP address, OS, process list, files on the hard drive, and USB drives.	The worm sends the collected information to the C2 server via an HTTP POST request.
Remote Command Execution	The worm can receive remote commands from the C2 server, such as launching a process, creating a file, modifying the registry, opening a URL, etc.	The worm can execute a command like `cmd.exe /c del /f /s /q c:\.` to erase all files on the C drive.
Download and Malware Installation	The worm can download and install other malicious software on the infected system, such as remote control tools, spyware, screen capture software, password stealers, file encryption software, and data destruction software.	The worm can download and install the Pterodo malware, allowing Gamaredon to take control of the infected system.
File or Partition Deletion	The worm can delete files or partitions on the infected system, potentially leading to data loss, system corruption, or boot failure.	The worm can erase the EFI partition, which contains system boot information.

Protecting Against LitterDrifter

Safeguarding your systems against LitterDrifter and similar threats is essential in today’s interconnected digital landscape. Here are some steps you can take to enhance your cybersecurity posture:

Keep Software Updated: Regularly update your operating system, software, and antivirus programs to patch known vulnerabilities that malware like LitterDrifter exploits.
Exercise Caution with Email Attachments and Links: Be cautious when opening email attachments or clicking on links, especially if the sender is unknown or the email seems suspicious. Verify the legitimacy of the sender before taking any action.
Use Reliable Security Software: Install reputable security software that can detect and block malware. Ensure that it is regularly updated to recognize new threats effectively.
Employ Network Segmentation: Implement network segmentation to isolate critical systems and data from potentially compromised parts of your network.
Educate Employees: Train your employees to recognize phishing attempts and the importance of safe browsing and email practices.
USB Drive Security: Disable autorun features on computers and use endpoint security solutions to scan USB drives for malware upon insertion.
Network Monitoring: Implement network monitoring tools to detect unusual activities and unauthorized access promptly.
Encryption and Authentication: Use encryption for sensitive data and multi-factor authentication to secure critical accounts.

Enhancing Data Security with HSM Technologies

In addition to the steps mentioned above, organizations can enhance data security by leveraging NFC HSM (Near Field Communication and Hardware Security Module). These specialized devices provide secure storage and processing of cryptographic keys, protecting sensitive data from unauthorized access.

HSMs offer several advantages, including tamper resistance, hardware-based encryption, and secure key management. By integrating HSMs into your cybersecurity strategy, you can further safeguard your organization against threats like LitterDrifter.

Leveraging NFC HSM Technologies Made in Andorra by Freemindtronic

To take your data security to the next level, consider utilizing NFC HSM technologies manufactured in Andorra by Freemindtronic. These state-of-the-art devices are designed to meet the highest security standards, ensuring the confidentiality and integrity of your cryptographic keys.

Freemindtronic innovates, manufactures white-label NFC HSM technologies, including PassCypher NFC HSM and DataShielder Defense NFC HSM. These solutions, like EviPass, EviOTP, EviCypher, and EviKey, effectively combat LitterDrifter. They enhance data security, protecting against unauthorized access and decryption, even in the era of quantum computing.

With HSMs from Freemindtronic, you benefit from:

Tamper Resistance: HSMs are built to withstand physical tampering attempts, providing an added layer of protection against unauthorized access.
Hardware-Based Encryption: Enjoy the benefits of hardware-based encryption, which is more secure than software-based solutions and less susceptible to vulnerabilities.
Secure Key Management: HSMs enable secure generation, storage, and management of cryptographic keys, reducing the risk of key compromise.

By integrating HSMs into your organization’s security infrastructure, you can establish a robust defense against threats like LitterDrifter and ensure the confidentiality and integrity of your sensitive data.

Conclusion

Staying One Step Ahead of LitterDrifter

LitterDrifter, the USB worm associated with the Gamaredon cyber espionage group, poses a significant threat to cybersecurity. Its ability to infiltrate systems, collect sensitive data, and execute malicious actions underscores the importance of proactive protection.

By understanding LitterDrifter’s origins, functionality, and impact, as well as implementing robust cybersecurity measures, you can shield your organization from this perilous threat. Additionally, NFC HSM technologies offer an extra layer of security to safeguard your data and secrets.

Stay vigilant, stay informed, and stay ahead of LitterDrifter and the ever-evolving landscape of cyber threats.

Articles, Digital Security, EviCore NFC HSM Technology, EviPass NFC HSM technology, NFC HSM technology

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures

Posted on November 27, 2023November 28, 2023 by FMTAD

27
Nov

TETRA Security Vulnerabilities by Jacques Gascuel: This article will be updated with any new information on the topic.

TETRA Security Vulnerabilities

Tetra is a radio communication standard used by critical sectors worldwide. But it has five security flaws that could expose its encryption and authentication. How can you protect your Tetra system from hackers? Read this article TETRA Security Vulnerabilities to find out the best practices and tips.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

January 17, 2026

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

January 8, 2026

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

January 7, 2026

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

January 6, 2026

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

January 5, 2026

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

January 5, 2026

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

December 21, 2025

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

December 2, 2025

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures from Cyberattacks

TETRA (Terrestrial Trunked Radio) is a radio technology that is used worldwide for critical communications and data, especially in the sectors of security, energy, transport and defense. But this technology, which has been kept secret for more than 25 years, hides serious security vulnerabilities, including a backdoor that could allow devastating cyberattacks.

What is TETRA?

TETRA is a European radio standard that was developed in the 1990s to meet the needs of professional mobile services, such as police, firefighters, emergency services, military, prison staff, etc. TETRA allows to transmit data and voice encrypted on frequencies ranging from 380 to 470 MHz, with a range of several kilometers.

TETRA is used by more than 2000 networks in more than 150 countries, according to the TETRA and Critical Communications Association (TCCA), which brings together the manufacturers, operators and users of this technology. Among the main manufacturers of TETRA radios, we find Motorola Solutions, Hytera, Airbus, Sepura and Rohill.

TETRA offers several advantages over other radio technologies, such as:

better sound quality
greater transmission capacity
greater security thanks to encryption
greater flexibility thanks to the possibility of creating communication groups
greater interoperability thanks to the compatibility of equipment

Source french: TETRA digital mode & F4HXZ – Blog radioamateur

What are the vulnerabilities of TETRA?

Despite its strengths, TETRA also has weaknesses, which have been revealed by a group of Dutch researchers from Radboud University Nijmegen. These researchers conducted a thorough analysis of the TETRA standard and its encryption algorithms, which were until then kept secret by the manufacturers and authorities.

The researchers discovered two types of major vulnerabilities in TETRA:

A backdoor in the encryption algorithm TEA1, which is used in radios sold for sensitive equipment, such as pipelines, railways, power grid, public transport or freight trains. This backdoor allows an attacker to decrypt the communications and data transmitted by these radios, and possibly to modify or block them. The backdoor exists since the creation of the algorithm TEA1, in 1998, and cannot be corrected by a simple software update. The researchers managed to extract the secret key of the backdoor by analyzing the binary code of the radios.
A weakness in the encryption algorithm TEA2, which is used in radios intended for professional mobile services, such as police, firefighters, emergency services, military or prison staff. This weakness allows an attacker to reduce the number of possible keys to test to decrypt the communications and data transmitted by these radios. The researchers estimated that it would take about 10 minutes to find the right key with a standard computer. This weakness was corrected by the manufacturers in 2016, but the radios that have not been updated remain vulnerable.

To find the backdoor in the TEA1 algorithm, the researchers used a technique called “differential analysis”, which consists of comparing the outputs of the algorithm for slightly different inputs. By observing the differences, they were able to identify a part of the code that was not normally used, but that was activated by a special condition. This condition was the presence of a secret key of 64 bits, which was hidden in the binary code of the radios. By analyzing the code, they were able to extract the secret key and test it on encrypted communications with the TEA1 algorithm. They were thus able to confirm that the secret key allowed to decrypt the communications without knowing the normal key of 80 bits. The researchers published their official report and the source code of the TETRA encryption algorithms on their website.

Source: https://cs.ru.nl/~cmeijer/publications/All_cops_are_broadcasting_TETRA_under_scrutiny.pdf

What are the risks for critical infrastructures?

The vulnerabilities identified in TETRA represent a danger for the critical infrastructures that use this technology, because they could be exploited by cybercriminals, terrorists or spies to disrupt or damage these infrastructures.

For example, an attacker could:

listen to the communications and confidential data of the security or defense services
impersonate an operator or a manager to give false instructions or orders
modify or erase data or commands that control vital equipment, such as valves, switches, signals or brakes
cause failures, accidents, fires or explosions

These scenarios could have dramatic consequences on the security, health, economy or environment of the countries concerned.

How to protect yourself from cyberattacks on TETRA?

The users of TETRA must be aware of the vulnerabilities of this technology and take measures to protect themselves from potential cyberattacks. Among the recommendations of the researchers, we can mention:

check if the radios used are affected by the vulnerabilities and ask the manufacturers for correction solutions
avoid using the algorithm TEA1, which contains the backdoor, and prefer safer algorithms, such as TEA3 or TEA4
use encryption keys that are long and complex enough, and change them regularly
set up verification and authentication procedures for communications and data
monitor the radio traffic and detect anomalies or intrusion attempts
raise awareness and train staff on cybersecurity and good practices

TETRA digital mode: how to transfer data via TETRA

TETRA (Terrestrial Trunked Radio) is a digital and secure radio communication standard used by emergency services, law enforcement, public transport and industries. TETRA uses a π/4-DQPSK phase modulation and a TDMA time division multiplexing to transmit voice and data on a bandwidth of 25 KHz per transmission channel. Each channel is divided into four timeslots, one of which is reserved for signaling in trunked mode (TMO).

TETRA allows file transfer via radio in two ways: by the packet data service (PDS) or by the circuit data service (CDS).

The PDS uses the IP protocol to transmit data packets on one or more timeslots. It offers a maximum throughput of 28.8 kbit/s per timeslot, or 86.4 kbit/s for three timeslots. The PDS can be used to send small files, such as images, text messages or forms.

The CDS uses the LAPD protocol to transmit data by circuit on a dedicated timeslot. It offers a constant throughput of 4.8 kbit/s per timeslot, or 19.2 kbit/s for four timeslots. The CDS can be used to send large files, such as documents, videos or maps.

The choice of the data service depends on the type of file, the size of the file, the quality of the radio link, the cost and the availability of radio resources. The PDS offers more flexibility and performance, but it requires a good signal quality and it can be more expensive in terms of battery consumption and spectrum occupation. The CDS offers more reliability and simplicity, but it requires a prior allocation of a timeslot and it can be slower and less efficient.

Securing TETRA file transfers with Freemindtronic’s EviCypher technology

However, both data services are subject to the TETRA security vulnerabilities that we have discussed in the previous sections. These vulnerabilities could allow an attacker to intercept, modify or corrupt the files transferred via TETRA, or to prevent their transmission altogether. Therefore, the users of TETRA must ensure the integrity and the confidentiality of the files they send or receive, by using encryption, verification and authentication methods. Freemindtronic’s EviCypher technology can be a valuable solution for encrypting data with post-quantum AES-256 from an NFC HSM with your own randomly generated keys before transferring them via TETRA. This way, even if an attacker corrupts the data transmitted by TETRA, they will not be able to decrypt the data encrypted by a product embedding

How to secure file transfers via TETRA with Freemindtronic’s EviCypher technology

La technologie EviCypher de Freemindtronic peut être une solution précieuse pour chiffrer les données avec AES-256 post-quantique à partir d’un HSM NFC avec vos propres clés générées aléatoirement avant de les transférer via TETRA. Ainsi, même si un attaquant corrompt les données transmises par TETRA, il ne pourra pas décrypter les données cryptées par un produit embarquant la technologie EviCypher NFC HSM technology, such as DataShielder NFC HSM or DataSielder Defense NFC HSM. These products are portable and autonomous devices that allow you to secure the access to computer systems, applications or online services, using the NFC as a means of authentication and encryption.

The management of encryption keys for TETRA

To use encryption on the TETRA network, you need an encryption key, which is a secret code of 80 bits, or 10 bytes. This key must be shared between the radios that want to communicate securely, and must be protected against theft, loss or compromise.

There are several methods to save and enter encryption keys for TETRA, depending on the type of radio and the level of security required. Here are some examples:

The manual method: it consists of entering the encryption key using the keyboard of the radio, by typing the 10 bytes in hexadecimal form. This method is simple, but impractical and unsafe, because it requires to know the key by heart or to write it down on a support, which increases the risk of disclosure or error. For example, a 80-bit key could be 3A4F9C7B12E8D6F0.
The automatic method: it consists of using an external device, such as a computer or a smart card, which generates and transfers the encryption key to the radio by a cable or a wireless link. This method is faster and more reliable, but it requires to have a compatible and secure device, and to connect it to the radio at each key change.
The EviPass method: it consists of using the EviPass NFC HSM technology which allows to generate, store and manage keys and secrets in a secure and independent NFC HSM device. This method is the most innovative and secure, because it allows to create keys higher than 80 bits randomly in hexadecimal base 16, 58, 64 or 85, to store them in a physical device protected by an access code and a robust AES-256 post-quantum encryption algorithm, and to transfer them by various contactless means, via a computer. This method does not require to know or write down the key, which reduces the risk of disclosure or error. For example, a 10-byte key of 80 bits could be 3F 8A 6B 4C 9D 1E 7F 2A 5B 0C.

The EviPass NFC HSM technology of Freemindtronic allows to create secure gateways between the NFC devices and the computer systems, using advanced encryption protocols, such as AES, RSA or ECC. The EviPass NFC HSM technology is embedded in the PassCyber NFC HSM product, which is a portable and autonomous device that allows to secure the access to computer systems, applications or online or offligne services, using the NFC as a means of authentication.

Conclusion

TETRA is a radio technology that was designed to offer secure and reliable communication to professional mobile services and critical infrastructures. But this technology, which has been kept secret for decades, presents vulnerabilities that could be exploited by cyberattackers to compromise these communications and infrastructures. The users of TETRA must be vigilant and take measures to protect themselves from these threats, by updating their equipment, choosing robust encryption algorithms, using strong keys, verifying and authenticating data and monitoring radio traffic. The EviPass NFC HSM technology of Freemindtronic can be an effective solution to strengthen the security of keys and secrets used for verification and authentication, by storing them in a secure and independent NFC device. The researchers who revealed the vulnerabilities of TETRA hope that their work will contribute to improve the security of communications in critical domains.

Articles, DataShielder, News

DataShielder Defense NFC HSM: Protect Your Sovereign Communications

Posted on November 24, 2023December 16, 2024 by FMTAD

24
Nov

DataShielder Defense NFC HSM – Jacques Gascuel: This article will be updated with any new information on the topic.

Why You Need DataShielder Defense NFC HSM

DataShielder Defense NFC HSM, a patented solution, ensures maximum confidentiality and anonymization of communications from sovereign entities. Using NFC technology, this HSM manages up to 200 secrets offline, contactless and shareable via any communication method, including email and SMS. A GreenTech innovation, it is interoperable, backward compatible and versatile, designed to immediately respond to various specific needs and customizable for enhanced secret security.

2026 Digital Security

Cyberattaque HubEE : Rupture silencieuse de la confiance numérique

January 17, 2026

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

January 8, 2026

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

January 7, 2026

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

January 6, 2026

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

January 5, 2026

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

January 5, 2026

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

December 21, 2025

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

December 2, 2025

DataShielder Defense NFC HSM: How to Protect Your Sovereign Communications with a Revolutionary Solution

The protection of sovereign entities and the enhancement of existing defense and intelligence systems are crucial challenges in today’s world. Sovereign communications, such as those between heads of state, diplomats, military personnel, or secret agents, are constantly exposed to threats of interception, hacking, or manipulation. These threats can compromise the security, integrity, and confidentiality of sensitive information, and have serious consequences for national and international security.

To address these challenges, a revolutionary solution has been developed by Freemindtronic, a andorran company specialized in data security and encryption. This solution is called DataShielder Defense NFC HSM, and it is the ultimate solution for protecting all forms of communications of sovereign entities. This innovative and cutting-edge solution, protected by two patents, guarantees an unparalleled level of confidentiality and trust among humans, without compromise. With DataShielder, your secrets and sensitive data remain inaccessible and indecipherable, even in case of compromise of the equipment and information and communication systems.

In this article, we will explain how DataShielder Defense NFC HSM works, what are its features and benefits, and how it can be customized to suit your specific needs. We will also show how this solution could have influenced several major events in the history of communication security, and how it has received international recognition and awards for its excellence.

How DataShielder Defense NFC HSM Works

DataShielder Defense NFC HSM is a device that uses Near Field Communication (NFC) technology to create, store, and use up to 200 different secrets in a single device. A secret can be anything that you want to protect, such as an encryption key, a password, a PIN code, a cryptocurrency key, a bank account information, or a message. DataShielder allows you to share your encrypted secrets via all the means of communication available in the world, such as postal mail, webcam, email, SMS, MMS, RCS, messaging, or directly between two NFC HSM devices.

To use DataShielder, you need an Android NFC phone or tablet, and the DataShielder app, which is available for free on the Google Play Store. You also need a DataShielder Defense NFC HSM device, which is a small and discreet card that can be customized to fit different formats and accessories. The device does not require any battery or external power source, as it uses the energy of the NFC signal of the phone to operate on demand.

To create a secret, you simply need to tap your phone on the device, and choose the type of secret you want to create. You can either generate a random secret, or import an existing one. You can also add specific trust criteria for each secret, such as BSSID, geographical area, password, fingerprint, QR code or barcode scan, and phone UID. The absence of any of these criteria makes the access to the secret impossible, ensuring maximum and personalized security.

To use a secret, you simply need to tap your phone on the device, and choose the secret you want to use. You can either use it directly on your phone, or send it to another device or person. You can also use the secret to unlock secure USB or SSD keys, to log in to your favorite websites, to make secure voice calls and SMS, to manage your banking information, to generate and use cryptocurrency wallets, and more.

To share a secret, you simply need to tap your phone on the device, and choose the secret you want to share. You can either share it directly with another NFC HSM device, or encrypt it with the RSA-4096 public key of the recipient, and send it via any means of communication. The recipient will need to decrypt the secret with their NFC HSM device, using the EviSCP HSM (ZKP) protocol, which is a patented technology that ensures a secure and confidential exchange of secrets.

Differentiating Benefits of DataShielder Defense NFC HSM

DataShielder Defense NFC HSM offers a complete and adaptable solution to your needs, thanks to the set of advanced and efficient features that it incorporates. These features are based on different technologies, each with a specific name and function. Here is a summary of the main features and benefits of DataShielder:

Feature	Technology	Function	Benefit
Random generation of symmetric and asymmetric encryption keys	EviCypher NFC HSM	Encrypt all types of data (texts, images, videos) in post-quantum AES-256. Use the RSA-4096 public key to exchange encrypted secrets between distant NFC devices.	Protect your data and secrets from unauthorized access and decryption, even in case of quantum computing attacks.
Random generation of identifiers and passwords	EviPass NFC HSM	Generate automatically complex and complicated passwords up to 48 characters based on the 95 ASCII characters, or on bases 16, 58, 64 or 85. Import and store manually login identifiers, PIN codes, PUK, lock codes, TPM2.0 passwords, BitLocker… Log in automatically to your favorite websites.	Secure your online accounts and devices with strong and unique passwords. Save time and avoid typing errors with automatic login.
Create a segmented key	EviAuth NFC HSM	Divide your secret into two segments and store them on two different NFC HSM devices. Require the presence of two people to reconstitute the secret.	Increase the security and confidentiality of your secret by adding a human factor. Prevent the access to the secret by a single person or device.
Management of secret OTP keys	EviOTP NFC HSM	Store securely the secret OTP keys whose one-time passwords based on time (TOTP) or HMAC (HOTP) to generate a secondary authentication factor (2FA).	Enhance the security of your online accounts and services with a second factor of authentication. Avoid the risk of losing or compromising your OTP keys.
Secure voice calls and SMS	EviCall NFC HSM	Store your phone contacts and make a voice call from the NFC HSM without leaving any trace in the phone history.	Communicate securely and discreetly with your contacts. Avoid the interception and recording of your voice calls and SMS.
Secure management of banking information	EviPay NFC HSM	Store, manage and use securely the information related to credit cards and bank accounts.	Protect your financial information and transactions from fraud and theft. Access and use your banking information easily and securely.
Unlocking of secure USB or SSD keys without contact	EviKey NFC HSM	Manage the administrator, user and temporary user PIN codes to unlock the secure USB/SSD keys without contact.	Secure your external and internal storage with a contactless unlocking system. Manage the access rights and permissions of the USB/SSD keys.
Generation of cryptocurrency wallets	EviSeed NFC HSM	Automatically and directly create from a blockchain the secret BIP39 key, its derived key, its public key and the public address. The balance verification is done directly on the blockchain.	Create and use cryptocurrency wallets securely and conveniently. Store your cryptocurrency keys in an inviolable and encrypted manner. Verify your balance directly on the blockchain.
Automatic import of private keys	EviVault NFC HSM	Import derived private keys by scanning their QR codes from five blockchain platforms including Bitcoin, Ethereum, Polygon, Binance Smart Chain and IOTA. Create and save also the BIP39 PassPhrases.	Import and use private keys from different blockchain platforms easily and securely. Scan the QR codes and store the keys in an encrypted manner. Create and save also the BIP39 PassPhrases.
Management of authentication cards	EviCore NFC HSM	Scan and store the barcode or QR code of any type of card that uses this type of identification (access cards, loyalty cards sometimes linked to a payment system).	Store and use authentication cards securely and conveniently. Scan the barcode or QR code and store it in an encrypted manner.
NFC HSM pairing key manager	EviCore NFC HSM	Manage the NFC HSM fleet within a sovereign entity.	Manage and control the NFC HSM devices within your organization. Assign and revoke pairing keys for the devices.
Data encryption	EviCrypt NFC HSM	Encrypt your texts and files upstream before sending them to your recipients using your usual messaging services.	Encrypt your data before sending it via any means of communication. Ensure that only the intended recipients can decrypt and access your data.
Use on all computer systems	EviCore NFC HSM Browser Extension	Use your NFC HSM with the free Freemindtronic browser extension based on Chromium and Firefox. Find the DataShielder NFC HSM functions on all your computers.	Use your NFC HSM on any computer system.
Use of a virtual USB Bluetooth keyboard	EviKeyboard BLE	Use a virtual keyboard for secure and discreet input. Extend the use of secrets in HID mode on various computer systems, TPM2.0, BitLocker, Windows, Linux, Apple, proprietary software and web browsers.	Don’t touch the keyboard. Enter a free line of code up to 52 characters. Entering BIOS passwords. Easy to use

Stealth Customization Options

The manufacturer Freemindtronic offers a customization service specially designed for sovereign entities, combining discretion and functionality.

Discreet Formats: Modified standard PVC and PCB cards for effective camouflage.

Stealth Accessories: Labels, key rings, promotional pens, and cufflinks subtly integrating NFC HSM devices.

USB Dummy Keys: Mini USB keys functioning as secret containers for the NFC HSM devices.

NFC On/Off Card: PCB cards with switchable NFC antenna for increased stealth.

These options guarantee invisible security, ideal for special operations and covert missions.

Complementary Accessories

Secure NFC EviKey USB and SSD Keys: These devices offer secure external and internal storage, perfectly integrated with DataShielder NFC HSM for enhanced data protection.
Bluetooth Virtual Keyboard EviKeyboard BLE: An innovative keyboard for secure and discreet input, complementing the DataShielder NFC HSM by an additional layer of security in data entry.

International Distinctions and Awards

The EviCypher NFC HSM technology, essential to DataShielder, has received worldwide recognition, marked by several important awards.

Gold Medal 2021 of the Geneva Inventions: EviCypher Technology awarded among hundreds of international inventions.
Three Global InfoSec Awards 2021: Awarded for being the best data security solution by Cyber Defense Magazine “Next-Gen in Crypto Security”, “Most Innovative Hardware Password Manager”, “Next-Gen in Secrets Management”.
Two E&T Innovation Awards 2021: Distinguished for the best communication and IT solution, as well as for the best cybersecurity solution.
Two nominations for the National Cyber Awards 2021 of the United Kingdom: Finalist in two categories “The Innovation in Cyber Award 2021” and “The Cyber Defense Product of the Year 2021”.
Gold Globee Award 2022: Cyber Computer NFC winner of a Cyber Security Global Excellence Awards®.
Fortress Award 2023: Awarded for its excellence in encryption and privacy protection.

Conclusion

DataShielder Defense NFC HSM is a revolutionary solution for protecting your sovereign communications. It offers a high level of security, confidentiality, and trust, without compromise. It is compatible with all types of data and communication means, and can be customized to suit your specific needs. It is also environmentally friendly, durable, and interoperable. It has received international recognition and awards for its excellence and innovation. If you are looking for a solution that can protect your secrets and sensitive data from any threat, DataShielder Defense NFC HSM is the solution for you. Contact Freemindtronic today and get your DataShielder Defense NFC HSM device. You will not regret it.