Author Archives: FMTAD

2023, Digital Security

5Ghoul: 5G NR Attacks on Mobile Devices

Posted on by FMTAD
5Ghoul: 5G NR Attacks on Mobile Devices
29
Dec
5Ghoul Attacks on Mobile Devices written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

5Ghoul: A Threat to 5G Security

5G has benefits, but also risks. 5Ghoul is a set of 5G NR flaws that affect Qualcomm and MediaTek modems, used by most 5G devices. 5Ghoul can disrupt or make unusable smartphones, routers and modems 5G. In this article, we will see what 5Ghoul is, how it compares to other 5G attacks, and how to protect yourself with contactless encryption, which uses NFC.

Why the NFC hardware wallet with credit card manager is PCI DSS compliant

2020 Legal information

Freemindtronic’s NFC hardware wallets with credit card management are PCI DSS compliant
December 20, 2020
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing
November 8, 2023
Unitary Patent system European why some EU countries are not on board

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board
August 1, 2023

Andorran law

Llei 26/2014 del 30 d’octubre de patents
November 21, 2016
Realistic 16:9 illustration of Ledger Security Breaches featuring a broken digital chain surrounding compromised cryptocurrency data and hardware vulnerabilities.

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers
December 16, 2023

5Ghoul: How Contactless Encryption Can Secure Your 5G Communications from Modem Attacks

5Ghoul is a set of 5G NR vulnerabilities that affect Qualcomm and MediaTek modems. These flaws allow to launch denial-of-service attacks or degrade the quality of the 5G network.

What is 5Ghoul?

5Ghoul is a set of 14 5G NR (New Radio) vulnerabilities, the protocol that governs the communication between 5G devices and base stations (gNB). Among these vulnerabilities, 10 are public and 4 are still confidential. They were discovered by researchers from the Singapore University of Technology and DesignSingapore University of Technology and Design.

The 5Ghoul vulnerabilities exploit implementation errors in Qualcomm and MediaTek modems, which do not comply with the specifications of the 5G NR protocol. They allow an attacker to create a fake base station, which pretends to be a legitimate one, and send malicious messages to 5G devices that connect to it. These messages can cause errors, crashes or infinite loops in the modems, resulting in denial-of-service attacks or degradations of the quality of the 5G network.

Which devices are affected by 5Ghoul?

The researchers tested the 5Ghoul vulnerabilities on 714 models of 5G smartphones from 24 different brands, including Lenovo, Google, TCL, Microsoft, etc. They also tested routers and modems 5G from various manufacturers. They found that the 5Ghoul vulnerabilities affect all 5G devices equipped with Qualcomm and MediaTek modems, which account for more than 90% of the market.

What are the impacts of 5Ghoul?

The impacts of 5Ghoul depend on the vulnerability exploited and the type of device targeted. The researchers classified the 5Ghoul vulnerabilities into three categories, according to their severity:

Level 1 vulnerabilities

Level 1 vulnerabilities are the most severe. They allow to render 5G devices completely unusable, by locking them in a state where they can neither connect nor disconnect from the 5G network. These vulnerabilities require a manual reboot of the devices to be resolved. Among the level 1 vulnerabilities, there is for example the CVE-2023-33043, which causes a crash of the Qualcomm X55/X60 modem by sending an invalid MAC/RLC message.

Level 2 vulnerabilities

Level 2 vulnerabilities are less critical, but still harmful. They allow to degrade the quality of the 5G network, by reducing the throughput, latency or stability of the connection. These vulnerabilities can be resolved by reconnecting to the 5G network. Among the level 2 vulnerabilities, there is for example the CVE-2023-33044, which causes packet loss on the MediaTek T750 modem by sending an invalid RRC message.

Level 3 vulnerabilities

Level 3 vulnerabilities are the least dangerous. They allow to disrupt the normal functioning of 5G devices, by displaying error messages, modifying settings or triggering alerts. These vulnerabilities have no impact on the quality of the 5G network. Among the level 3 vulnerabilities, there is for example the CVE-2023-33045, which causes an error message on the Qualcomm X55/X60 modem by sending an invalid RRC message.

How to protect yourself from 5Ghoul?

The researchers informed the manufacturers of Qualcomm and MediaTek modems of the 5Ghoul vulnerabilities, as well as the 5G network operators and the 5G device manufacturers. They also published a demonstration kit of the 5Ghoul vulnerabilities on GitHub, to raise awareness among the public and the scientific community of the risks of 5G NR.

To protect yourself from 5Ghoul, 5G device users must update their modems with the latest security patches, as soon as they are available. They must also avoid connecting to unreliable or unknown 5G networks, which could be fake base stations. In case of doubt, they can disable 5G and use 4G or Wi-Fi.

How 5Ghoul compares to other 5G attacks?

5Ghoul is not the first security flaw that affects 5G. Other 5G attacks have been discovered in the past, exploiting weaknesses in the protocol or in the equipment. Here are some examples of 5G attacks and their differences with 5Ghoul:

ReVoLTE

ReVoLTE is an attack that allows to listen to voice calls 4G and 5G by exploiting a vulnerability in the encryption of data. This vulnerability is due to the fact that some base stations reuse the same encryption key for multiple communication sessions, which allows an attacker to decrypt the content of the calls by capturing the radio signals.

It is different from 5Ghoul because it does not target the 5G modem, but the encryption of data. ReVoLTE also requires that the attacker be close to the victim and have specialized equipment to intercept the radio signals. ReVoLTE does not cause denial of service or degradation of the network, but it compromises the confidentiality of communications.

ToRPEDO

ToRPEDO is an attack that allows to locate, track or harass mobile phone users 4G and 5G by exploiting a vulnerability in the paging protocol. This protocol is used to notify mobile devices of incoming calls or messages. By sending repeated messages to a phone number, an attacker can trigger paging messages on the network, and thus determine the position or identity of the target device.

It is different from 5Ghoul because it does not target the 5G modem, but the paging protocol. ToRPEDO also requires that the attacker knows the phone number of the victim and has access to the mobile network. ToRPEDO does not cause denial of service or degradation of the network, but it compromises the privacy of users.

IMP4GT

IMP4GT is an attack that allows to degrade the quality of the 5G network by exploiting a vulnerability in the security protocol. This protocol is used to authenticate and encrypt the communications between 5G devices and base stations. By modifying the messages exchanged between the two parties, an attacker can mislead the network and the device on the level of security required, and thus reduce the throughput or latency of the connection.

It is different from 5Ghoul because it does not target the 5G modem, but the security protocol. IMP4GT also requires that the attacker be close to the base station and have equipment capable of modifying the messages. IMP4GT does not cause denial of service or crash of the modem, but it degrades the quality of the network.

SS7

SS7 is a set of signaling protocols used by mobile operators to establish and manage calls and messages between different networks. SS7 has existed since the 1970s and has not evolved much since, making it vulnerable to hacking attacks. By exploiting the flaws of SS7, an attacker can intercept SMS and voice calls, locate and track users, bypass two-factor authentication, or subscribe subscribers to paid services without their consent.

It is different from 5Ghoul because it does not target the 5G modem, but the signaling protocol. SS7 affects all types of mobile networks, including 5G, because it still uses SS7 for some functions, such as mobility management or compatibility with 2G and 3G networks. SS7 requires that the attacker has access to the signaling network, which is not easy to obtain, but not impossible. SS7 does not cause denial of service or crash of the modem, but it compromises the confidentiality and integrity of communications.

How and why to encrypt SMS, MMS and RCS without contact?

Contactless encryption is a method of protecting mobile communications that uses NFC (Near Field Communication) technology to establish a secure connection between two devices. NFC is a wireless communication protocol that allows to exchange data by bringing two compatible devices within a few centimeters of each other.

Contactless encryption relies on the use of an external device called NFC HSM (Hardware Security Module), which is a hardware security module that stores and manages encryption keys. The NFC HSM comes in the form of a card, a keychain or a bracelet, that the user must bring close to his phone to activate the encryption. The NFC HSM communicates with the phone via NFC and transmits the encryption key needed to secure the messages.

The technologies EviCore NFC HSM and EviCypher NFC HSM are examples of contactless encryption solutions developed by the Andorran company Freemindtronic. EviCore NFC HSM is a hardware security module that allows to encrypt SMS, MMS and RCS (Rich Communication Services) end-to-end, meaning that only the recipients can read the messages. EviCypher NFC HSM is a hardware security module that allows to encrypt multimedia files (photos, videos, audio, etc.) and share them via SMS, MMS or RCS.

Contactless encryption has several advantages over conventional encryption of mobile communications:

It offers a higher level of security, because the encryption key is not stored on the phone, but on the NFC HSM, which is more difficult to hack or steal.

It is compatible with all types of mobile networks, including 5G, because it does not depend on the communication protocol used, but on NFC.

It is easy to use, because it is enough to bring the NFC HSM close to the phone to activate the encryption, without having to install a specific application or create an account.

It is transparent, because it does not change the appearance or functioning of the messages, which remain accessible from the native application of the phone.

Statistics on 5Ghoul

How widespread are 5Ghouls? What are the trends and impacts of these flaws? Some statistics on 5Ghoul, based on sources and data that are a priori reliable.

5Ghoul: a threat to 5G devices

5Ghoul is a set of 5G NR vulnerabilities that affect Qualcomm and MediaTek modems, which are used by most 5G devices on the market. According to the researchers who discovered 5Ghoul, these vulnerabilities can cause denial-of-service attacks or network degradations.

  • How many 5G devices are affected by 5Ghoul? According to a report by Counterpoint Research, Qualcomm and MediaTek accounted for 79% of the global smartphone chipset market in Q3 2020. Qualcomm had a 39% share, while MediaTek had a 40% share. Assuming that all Qualcomm and MediaTek chipsets are vulnerable to 5Ghoul, this means that nearly 8 out of 10 smartphones are potentially at risk.
  • How many 5G NR vulnerabilities are known? According to the CVE (Common Vulnerabilities and Exposures) database. There are 16 CVE entries related to 5G NR as of April 2021. Four of them are ZeroDay vulnerabilities that have not been publicly disclosed nor fixed by the manufacturers. These vulnerabilities are classified as level 1 or 2, meaning that they can cause denial-of-service attacks or network degradations.
  • How many 5G attacks have been reported? According to the SANS Internet Storm Center, there have been no reports of 5Ghoul attacks in the wild as of April 2021. However, this does not mean that 5Ghoul is not exploited by malicious actors. The researchers who discovered 5Ghoul have developed a proof-of-concept tool called 5Ghoul-Scanner, which can detect and exploit 5Ghoul vulnerabilities. They have also released a video demonstration of 5Ghoul attacks.

Conclusion

5Ghoul is a security flaw that affects 5G modems from Qualcomm and MediaTek, which are used by most 5G devices on the market. 5Ghoul allows an attacker to disrupt the functioning of smartphones, routers and modems 5G, or even make them unusable. 5Ghoul stands out from other 5G attacks known, such as ReVoLTE, ToRPEDO, IMP4GT or SS7, by the fact that it targets the 5G modem, that it does not require secret information or specialized equipment, and that it causes denial-of-service attacks or degradations of the network. To protect yourself from 5Ghoul, 5G device users must update their modems with the latest security patches, and avoid connecting to unreliable or unknown 5G networks.

2023, Articles, CyberStealth, legal, Legal information, News, Spying

The American Intelligence: How It Works

Posted on by FMTAD
The American Intelligence How It Works : Section 702
26
Dec
Learn more about the American Intelligence written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

The American intelligence: a paradox

The American intelligence is powerful and influential, but also faces limits and challenges. Discover how it works, what are its consequences, and how to protect yourself from it.

Why the NFC hardware wallet with credit card manager is PCI DSS compliant

2020 Legal information

Freemindtronic’s NFC hardware wallets with credit card management are PCI DSS compliant
December 20, 2020
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing
November 8, 2023
Unitary Patent system European why some EU countries are not on board

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board
August 1, 2023

Andorran law

Llei 26/2014 del 30 d’octubre de patents
November 21, 2016
Realistic 16:9 illustration of Ledger Security Breaches featuring a broken digital chain surrounding compromised cryptocurrency data and hardware vulnerabilities.

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers
December 16, 2023

The American Intelligence: How It Works, Its Limits and Consequences

The American intelligence is one of the most powerful and influential in the world. It has a vast network of agencies, resources, and allies that enable it to collect, analyze, and act on information of strategic interest. However, the American intelligence also faces challenges and criticisms, both internally and externally. In this article, we will explore how the American intelligence works, what are its limits, and what are the consequences of its actions for the global security and privacy.

How the American Intelligence Works

The American intelligence is composed of 18 agencies that form the Intelligence Community (IC). These agencies are divided into two categories: the civilian agencies, which are under the supervision of the Director of National Intelligence (DNI), and the military agencies, which are under the supervision of the Secretary of Defense.

The main civilian agencies are:

  • The Central Intelligence Agency (CIA), which is responsible for collecting, analyzing, and disseminating foreign intelligence, as well as conducting covert operations and paramilitary activities.
  • The National Security Agency (NSA), which is responsible for collecting, processing, and disseminating signals intelligence (SIGINT), as well as conducting cyber operations and protecting the US government’s communications and information systems.
  • The Federal Bureau of Investigation (FBI), which is responsible for collecting, analyzing, and disseminating domestic intelligence, as well as conducting counterintelligence, counterterrorism, and law enforcement activities.
  • The National Geospatial-Intelligence Agency (NGA), which is responsible for collecting, analyzing, and disseminating geospatial intelligence (GEOINT), which includes imagery, maps, and other geographic information.
  • The National Reconnaissance Office (NRO), which is responsible for designing, launching, and operating reconnaissance satellites and other space-based systems that provide intelligence to the IC and the Department of Defense (DoD).
  • The Office of the Director of National Intelligence (ODNI), which is responsible for overseeing, coordinating, and integrating the activities of the IC, as well as providing strategic guidance and support to the DNI.

The main military agencies are:

  • The Defense Intelligence Agency (DIA), which is responsible for providing military intelligence to the DoD and the IC, as well as conducting human intelligence (HUMINT), counterintelligence, and defense attaché activities.
  • The National Security Agency/Central Security Service (NSA/CSS), which is responsible for providing SIGINT and cyber support to the DoD and the IC, as well as conducting information assurance and cryptologic activities.
  • The National Geospatial-Intelligence Agency (NGA), which is responsible for providing GEOINT support to the DoD and the IC, as well as conducting geospatial analysis and mapping activities.
  • The National Reconnaissance Office (NRO), which is responsible for providing space-based intelligence support to the DoD and the IC, as well as conducting satellite reconnaissance and surveillance activities.
  • The Military Intelligence Corps (MI), which is responsible for providing tactical and operational intelligence to the Army and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
  • The Office of Naval Intelligence (ONI), which is responsible for providing maritime intelligence to the Navy and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
  • The Marine Corps Intelligence Activity (MCIA), which is responsible for providing intelligence to the Marine Corps and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
  • The Air Force Intelligence, Surveillance, and Reconnaissance Agency (AFISRA), which is responsible for providing intelligence to the Air Force and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.

The American intelligence works by collecting information from various sources, such as human sources, signals, images, open sources, and others. It then analyzes this information to produce intelligence products, such as reports, assessments, briefings, and forecasts. These products are then disseminated to the relevant consumers, such as the President, the Congress, the military, the policy makers, and the allies. The American intelligence also acts on the information it collects, by conducting operations, such as covert actions, cyber attacks, drone strikes, and special operations.

The Limits of the American Intelligence

The American intelligence, despite its capabilities and resources, is not omnipotent or infallible. It faces several limits and challenges, such as:

  • Legal and ethical limits: The American intelligence is bound by the laws and regulations of the US and the international community, as well as by the values and principles of the American democracy. It must respect the rights and liberties of the American citizens and the foreign nationals, as well as the sovereignty and interests of the other countries. It must also abide by the oversight and accountability mechanisms of the executive, the legislative, and the judicial branches, as well as the public opinion and the media. The American intelligence must balance its need for secrecy and effectiveness with its duty for transparency and legitimacy.
  • Technical and operational limits: The American intelligence is limited by the availability and reliability of the information it collects, as well as by the accuracy and timeliness of the analysis it produces. It must deal with the challenges of information overload, data quality, data security, data privacy, and data sharing. It must also cope with the threats and risks of cyber attacks, counterintelligence, deception, and denial. The American intelligence must balance its need for innovation and adaptation with its need for standardization and coordination.
  • Strategic and political limits: The American intelligence is limited by the complexity and uncertainty of the global environment, as well as by the diversity and dynamism of the actors and issues it faces. It must deal with the challenges of globalization, multipolarity, regionalization, and fragmentation. It must also cope with the threats and opportunities of terrorism, proliferation, rogue states, failed states, and emerging powers. The American intelligence must balance its need for anticipation and prevention with its need for reaction and intervention.

The Consequences of the American Intelligence

The American intelligence has significant consequences for the global security and privacy, both positive and negative, such as:

  • Positive consequences: The American intelligence contributes to the protection and promotion of the national security and interests of the US and its allies, as well as to the maintenance and enhancement of the international peace and stability. It provides valuable information and insights to the decision makers and the operators, as well as to the public and the media. It also conducts effective operations and actions to deter, disrupt, or defeat the adversaries and the threats. The American intelligence plays a key role in the global intelligence cooperation and coordination, as well as in the global governance and leadership.
  • Negative consequences: The American intelligence also poses risks and challenges to the security and privacy of the US and its allies, as well as to the international order and norms. It may collect, analyze, or disseminate information that is inaccurate, incomplete, or biased, leading to errors, failures, or controversies. It may also conduct operations or actions that are illegal, unethical, or counterproductive, leading to violations, scandals, or backlashes. The American intelligence may face competition or conflict with the other intelligence services or actors, as well as with the other stakeholders or interests.

Section 702 of FISA: A Surveillance Without Control

  • On July 17, 2008, the US Congress passed section 702 of the FISA (Foreign Intelligence Surveillance Act), which authorizes the US intelligence agencies to collect the electronic communications of non-Americans located abroad, without a warrant from the FISA judge.
  • On January 19, 2018, the US Congress extended section 702 of FISA until December 31, 2023, without making any substantial changes.
  • On March 22, 2023, the US Congress extended section 702 of FISA again until April 19, 2024, without making any significant changes.
  • On December 16, 2023, the US Congress approved the National Defense Authorization Act (NDAA), which included a four-month extension of section 702 of FISA, avoiding its expiration at the end of the year.

The Violation of the Right to Privacy

  • On June 5, 2013, the whistleblower Edward Snowden revealed the existence of the PRISM program, which allowed the US intelligence agencies to access the data of the users of the main electronic service providers, such as Google, Facebook, Microsoft or Apple.
  • On October 6, 2015, the Court of Justice of the European Union (CJEU) invalidated the Safe Harbor, an agreement that allowed the transfer of personal data between the European Union and the United States, considering that it did not offer an adequate level of protection.
  • On July 16, 2020, the CJEU invalidated the Privacy Shield, the successor of the Safe Harbor, for the same reasons, considering that the risk of interference by the US intelligence services in the transferred data was incompatible with the respect of the fundamental rights of the persons concerned.
  • On July 31, 2023, the CJEU issued a ruling that confirmed the invalidity of the Privacy Shield and imposed strict conditions for the transfer of personal data to third countries, especially the United States, under the standard contractual clauses (SCCs) or the binding corporate rules (BCRs).

The Legal and Political Consequences

  • On October 24, 2013, the European Parliament adopted a resolution that condemned the massive surveillance activities of the US intelligence services and called for the suspension of the cooperation agreements on security and counter-terrorism.
  • On October 23, 2015, the European Parliament adopted another resolution that requested the creation of an independent international tribunal to examine the complaints of the European citizens regarding the surveillance of the US intelligence services.
  • On September 14, 2018, the European Parliament adopted a third resolution that called for the suspension of the Privacy Shield, due to the non-compliance of the commitments made by the United States on the protection of personal data.
  • On August 31, 2023, the European Parliament adopted a fourth resolution that asked the European Commission to propose a new legislation on the protection of personal data in the context of cross-border data flows, which would guarantee a level of protection equivalent to that of the general data protection regulation (GDPR).

Sources:

Congress passes temporary extension of FISA Section 702 surveillance program – Axios:

The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield:

FISA Section 702: What it is and why Congress is debating it – NBC News

New technologies and products that limit the possibilities of intelligence

Facing the capabilities of collection and analysis of the American intelligence, which threaten the privacy and sovereignty of individuals and countries, there are new technologies and products that allow to limit the possibilities of intelligence. These technologies and products use techniques of encryption, cryptography, blockchain or NFC to protect personal data and electronic communications. They offer an alternative to traditional solutions, which are often vulnerable to attacks or interceptions by the American intelligence. Among these technologies and products, we can mention:

  • EviCypher NFC HSM and EviCypher HSM OpenPGP, which are patented technologies in the United States in the field of cybersecurity developed by Freemindtronic SL Andorra, used in counter-espionage products such as DataShielder Defense. They allow to encrypt and decrypt data without contact, thanks to hardware security modules that use NFC technology. They offer compatibility with OpenPGP standards, operating without server, without database, with a very high level of flexibility from different removable, fixed and online and offline storage media including NFC HSM.
  • DataShielder DefenseDataShielder Defense, which is a counter-espionage product developed by Freemindtronic SL Andorra, which uses EviCore NFC HSM and EviCore HSM OpenPGP technologies to encrypt and decrypt all types of data and communication services. This product protects sovereign communications, by preventing the American intelligence from accessing personal, professional or state secrets. It also guarantees the sovereignty of users, by making their data anonymous and inviolable.
  • Signal, which is an instant messaging application that uses the Signal protocol, which is an end-to-end encryption protocol that ensures the confidentiality and integrity of messages. This application allows to communicate anonymously and securely, by avoiding the surveillance or censorship of the American intelligence.
  • Tor, which is a decentralized network that uses volunteer relays to route Internet traffic anonymously and encrypted. This network allows to browse the web without leaving traces, by hiding the IP address and location of users. It also allows to access hidden websites, which are not indexed by search engines.

These technologies and products represent examples of innovative solutions that limit the possibilities of the American intelligence and preserve the individual and collective sovereignty. They also illustrate the issues and challenges related to the use of digital technologies in the field of intelligence.

Conclusion

The American intelligence is a complex and dynamic phenomenon that has a significant impact on the world. It has many strengths and weaknesses, as well as many opportunities and threats. It has many achievements and failures, as well as many benefits and costs. It is a source of both security and insecurity, both privacy and surveillance. It is a subject of both admiration and criticism, both cooperation and confrontation. The American intelligence is a paradox that requires a careful and balanced approach.

2023, Cyberculture

New EU Data Protection Regulation 2023/2854: What you need to know

Posted on by FMTAD
New EU Data Protection Regulation 2023/2854: What you need to know
25
Dec
Learn more about the new European Data Protection Regulation (2023/2854) written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

EU 2023/2854 Data Protection Rules: what you need to know

The EU has adopted a new regulation to protect personal data published in OJ L, 2023/2854 on 22.12.2023. How does this impact you and your business? Learn more in this article and discover why Freemindtronic innovations are already compliant.

Why the NFC hardware wallet with credit card manager is PCI DSS compliant

2020 Legal information

Freemindtronic’s NFC hardware wallets with credit card management are PCI DSS compliant
December 20, 2020
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing
November 8, 2023
Unitary Patent system European why some EU countries are not on board

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board
August 1, 2023

Andorran law

Llei 26/2014 del 30 d’octubre de patents
November 21, 2016
Realistic 16:9 illustration of Ledger Security Breaches featuring a broken digital chain surrounding compromised cryptocurrency data and hardware vulnerabilities.

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers
December 16, 2023

What you need to know about the new EU data protection regulation (2023/2854)

Personal data is a valuable asset in the digital age, but also a vulnerable asset. This is why the European Union has adopted a new regulation to protect the personal data of individuals in the EU. Data

Protection Regulation (EU) 2023/2854 supplements and updates the General Data Protection Regulation (GDPR), which has been in force since 2018. The new regulation introduces additional procedural rules for the application of the GDPR, particularly in cross-border cases. It also creates the European Data Protection Authority (EDPA), a new independent body that ensures the consistent application of EU data protection rules across the EU. The new regulation will come into force on November 26, 2024. In this article, we will explain the main provisions of the new regulation, its advantages and disadvantages, its international scope and its reactions and controversies.

We will also show you how some products and technologies from Freemindtronic, an Andorran company specialized in security and cybersecurity of computer and information systems, already comply with the new regulation, since they offer innovative and ecological solutions to protect the personal data without using servers, databases, online accounts or identifiers.

The main provisions of the EU data protection law

Several measures to ensure the security, confidentiality and integrity of personal data are introduced by the EU data protection law. These measures are:

  • Declaration of the activity and the processing practices. The controllers and the managers of the entities that process personal data must declare them to the national data protection authorities (NDPA) and to EDPA. The EDPA is a new independent body. It oversees the consistent application of the EU data protection rules across the EU. It also cooperates with the NDPA and the other EU institutions. The goal is to ensure the protection of personal data.
  • Implementation of technical and organizational measures. The controllers and the managers of the entities that process personal data must implement them to prevent the risks of damage or loss of data. For example, these measures include the encryption of data, the pseudonymization of data, the limitation of data access, the regular testing of data security, the notification of data breaches, and the appointment of a data protection officer.
  • Reinforcement of the rights of the persons concerned. They have reinforced rights, such as the right of access, the right of opposition, the right of erasure, the right to data portability and the right to restriction of processing. These rights allow the persons to obtain information about the processing of their data, to object to certain types of processing, to request the deletion of their data, to transfer their data to another entity, and to limit the processing of their data in certain cases.
  • Provision of administrative sanctions. The regulation provides them. They can reach up to 20 million euros or 4% of the annual global turnover, depending on the severity of the infringement. The NDPA or the EDPA, depending on the case, impose these sanctions. The national courts or the Court of Justice of the European Union can hear the appeals.

The advantages and disadvantages of the EU data protection reform

The EU data protection reform has pros and cons for different actors involved.

The benefits for the persons whose data are processed

The regulation offers a better protection of their rights and interests. They can control more the use of their data and benefit from a high level of security. Moreover, they have an easy and fast access to the information related to the processing of their data, as well as to the remedies in case of dispute. For instance, a person can request a copy of their data from an online platform. If they find any inaccurate or outdated data, they can ask for a correction or an update. They can also withdraw their consent to the processing of their data at any time, or ask for the deletion of their data if they no longer want to use the platform.

The drawbacks for the controllers and the managers of the entities that process personal data

The regulation imposes additional obligations and stricter constraints on them. They must comply with harmonized rules within the EU, while taking into account the national and regional specificities. Furthermore, they face more severe sanctions in case of non-compliance with the regulation. For example, an entity that processes personal data of persons located in the EU must declare its activity and its processing practices to the NDPA and the EDPA.

It must also obtain the prior consent of the persons for the processing of their data, unless there is a legal basis for the processing. The entity must process the data in a lawful, fair and transparent manner, and collect them for specific, explicit and legitimate purposes. It must also respect the principles of data minimization, data accuracy, data storage limitation, data integrity and data confidentiality.

The international scope of the EU data protection rules

The EU data protection rules have an international scope, as they apply to any entity that processes personal data of persons located in the EU, whether it is established or not in the EU. The regulation therefore requires foreign entities to respect the same rules as European entities, under penalty of sanctions. It aims to ensure an equivalent level of protection for personal data transferred outside the EU.

For this purpose, the regulation establishes different mechanisms to ensure the adequacy of the data protection in the third countries or the international organizations that receive the data. These mechanisms include, for example, the adoption of adequacy decisions by the European Commission, the use of standard contractual clauses, the adherence to binding corporate rules, or the certification by approved schemes.

The reactions and controversies of the EU data protection regulation

The EU data protection regulation has provoked diverse reactions, ranging from approval to contestation.

Positive reactions

Some actors have welcomed the interest of the regulation to strengthen the trust and to foster the technological evolution in the field of data protection. They have highlighted the innovative and ambitious character of the regulation, which places the EU at the forefront of the protection of personal data. For example, the European Data Protection Supervisor (EDPS), the independent advisor of the EU institutions on data protection issues, has praised the regulation as a “historic achievement” and a “major step forward” for the protection of the fundamental rights of the individuals in the digital age.

Negative reactions

Some actors have criticized the obligation to inform the NDPA and the EDPA about the activity and the processing practices of personal data. They have considered that it could infringe their national sovereignty or that it could create a risk of illegal or fraudulent exercise by some foreign entities. They have also expressed their concern about the complexity and the heaviness of the regulation, which could hinder the competitiveness and the growth of the entities that process personal data. For example, some member states, such as France, Germany, Italy or Spain, have raised objections or reservations about certain aspects of the regulation.

These aspects include the role and the powers of the EDPA, the criteria and the procedures for the adequacy decisions, or the level and the distribution of the sanctions.

How Freemindtronic products and technologies protect personal data

Freemindtronic is an Andorran company that specializes in security and cybersecurity of computer systems and information systems. It designs and develops green technology products and services under white label, based on contactless technology (NFC). Some of its products are PassCypher, DataShielder, SeedNFC or Cardokey, which use embedded technologies such as EviCore NFC HSM, EviCore HSM OpenPGP or EviCore NFC HSM Browser Extension.

These products and technologies have several advantages for the protection of personal data, compared to traditional solutions based on servers, databases, online accounts or identifiers. Indeed, they work without server, without database, anonymously from end to end, without the need to create an account on the internet or to identify themselves to use the products. Therefore, they reduce the risks of loss or damage of data, respect the rights of the persons concerned, and comply with the harmonized rules in the EU. These products and technologies of Freemindtronic are already compliant with the European regulation on data protection, because they respect the principles of security, confidentiality and integrity of data, as well as the rights of the persons concerned. They offer an innovative and ecological alternative to traditional solutions, which may present risks or constraints for data protection.

Conclusion

The regulation (EU) 2023/2854 is an important text for the protection of personal data in the EU. It introduces measures to ensure the security, confidentiality and integrity of data, as well as to reinforce the rights of the persons concerned. It applies to any entity that processes personal data of persons located in the EU, whether it is established or not in the EU. It was adopted within the legislative process on the fundamental rights in the EU, but it also provoked reactions and controversies between some member states. It will enter into force on November 26, 2024.

2026, Crypto Currency, Cryptocurrency, Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers

Posted on by FMTAD
Realistic 16:9 illustration of Ledger Security Breaches featuring a broken digital chain surrounding compromised cryptocurrency data and hardware vulnerabilities.
16
Dec

Ledger Security Breaches have become a major indicator of vulnerabilities in the global crypto ecosystem. Beyond isolated technical flaws, it is the systemic correlations — hardware attacks, software exploits, third‑party data leaks, phishing scenarios — that shape today’s threat landscape, affecting individual users, exchanges, and trust infrastructures alike. Exploited by cybercriminals, state actors, and hybrid players, these breaches enable profiling, targeting, and manipulation of investors without necessarily compromising their private keys directly. Encryption protects private keys, but not relational, logistical, and behavioral metadata. This chronicle analyzes the major breaches from 2017 to 2026, their immediate and long‑term impacts, and the conditions for achieving true digital sovereignty against supply‑chain threats and third‑party dependencies.

Executive Summary — Ledger Security Breaches

⮞ Reading Note

This executive summary can be read in ≈ 3 to 4 minutes. It provides immediate insight into the central issue without requiring the full technical and historical analysis.

⚠️ Note on Supply Chain Resilience

The 2026 Global-e leak highlights what the CISA (Cybersecurity & Infrastructure Security Agency) defines as critical supply chain risks. According to their official guidelines, hardware security is only as strong as its weakest third-party link.

⚡ Key Findings

Since 2017, Ledger has faced several major breaches: seed phrase and firmware attacks, PCB modification, the 2020 database leak, the 2023 Connect Kit compromise, and the 2026 Global‑e data leak. These incidents show that threats arise not only from internal flaws but also from external dependencies and phishing vectors.

✦ Immediate Impact

  • Massive customer data exposure (292K in 2020, Global‑e in 2026)
  • Targeted phishing and harassment using personal information
  • Transaction manipulation and private-key compromise in controlled 2018 attack scenarios
  • Fragility of software supply chains and third‑party partners

⚠ Strategic Message

The real shift is not just technical compromise, but the repetition of breaches and their systemic exploitation. The threat becomes structural: automated phishing, doxxing, erosion of trust, and increased reliance on third parties. The risk is no longer occasional, but persistent.

The Shift from Trust to Proof

The repetition of Ledger Security Breaches proves that trust in a brand is not enough. Sovereignty requires proof. By implementing Segmented Key Authentication (WO2018154258), Freemindtronic moves control over critical secrets (seed phrases, private keys, credentials) from the vendor ecosystem directly into the user’s physical possession. This eliminates dependency on third-party infrastructure (e-commerce, update servers, logistics partners) for the custody and transfer of critical secrets.

⎔ Sovereign Countermeasure

There is no miracle solution against security breaches. Sovereignty means reducing exploitable surfaces: minimizing exposed data, using independent cold wallets (NFC HSM), strictly separating identity from usage, and maintaining constant vigilance against fraudulent communications.

Reading Parameters

Executive Summary: ≈ 3–4 min
Advanced Summary: ≈ 5–6 min
 Full Chronicle: ≈ 30–40 min
First publication: December 16, 2023
Last update: January 7, 2026
Complexity level: High — security, crypto, supply‑chain
Technical density: ≈ 70 %
Languages available: EN · FR
Core focus: Ledger Security Breaches, crypto wallets, phishing, digital sovereignty
Editorial type: Chronicle — Freemindtronic Digital Security
Risk level: 9.2 / 10 — financial, civil, and hybrid threats

Editorial Note — This chronicle is part of the Digital Security section. It explores Ledger Security Breaches as a revealing case of global crypto vulnerabilities, combining technical incidents, third‑party dependencies, and phishing threats. It extends analyses published on Digital Security. Content is written in accordance with the AI Transparency Declaration published by Freemindtronic Andorra — FM-AI-2025-11-SMD5.
Want to go further? The Advanced Summary places Ledger Security Breaches in a global dynamic — technological, regulatory, and societal — and prepares the reader for the full chronicle.
Infographic detailing the Ledger security breaches via Global-e in January 2026, showing exposed customer data vs. secure private keys.
Timeline and impact of the January 2026 Global-e breach: A new chapter in Ledger security breaches involving third-party e-commerce partners.
Illustration du browser fingerprinting montrant une empreinte numérique de navigateur issue de métadonnées techniques utilisées pour la surveillance et le renseignement numérique

2026 Digital Security

Browser Fingerprinting : le renseignement par métadonnées en 2026

Le browser fingerprinting constitue aujourd’hui l’un des instruments centraux du renseignement par métadonnées appliqué aux [...]

08
Jan
Realistic 16:9 illustration of Ledger Security Breaches featuring a broken digital chain surrounding compromised cryptocurrency data and hardware vulnerabilities.

2026 Crypto Currency Cryptocurrency Digital Security

Ledger Security Breaches from 2017 to 2026: How to Protect Yourself from Hackers

Ledger Security Breaches have become a major indicator of vulnerabilities in the global crypto ecosystem. [...]

16
Dec
Affiche de style cinéma représentant la fuite OpenAI Mixpanel, montrant un utilisateur devant un écran d’alerte de phishing et un nuage OpenAI, avec une ambiance numérique sombre évoquant les métadonnées et la cybersécurité

2025 Digital Security

OpenAI fuite Mixpanel : métadonnées exposées, phishing et sécurité souveraine

OpenAI fuite Mixpanel rappelle que même les géants de l’IA restent vulnérables dès qu’ils confient [...]

02
Dec
Infographie montrant la chaîne de risques de la faille Ledger 2026 : fuite Global-e, phishing SMS Chronopost, menaces de home-jacking et solutions de défense active NFC HSM.

2026 Digital Security

Failles de sécurité Ledger : Analyse 2017-2026 & Protections

Les failles de sécurité Ledger sont au cœur des préoccupations des investisseurs depuis 2017. Cette [...]

07
Jan
A woman looking at a computer screen displaying a fingerprint, the words 'Cookieless' and 'PassCypher Data Privacy Security', along with the date 'February 16, 2025', symbolizing Google's fingerprinting policy shift. The image highlights the importance of stopping browser fingerprinting and protecting online privacy

2025 Cyberculture Digital Security

Browser Fingerprinting Tracking: Metadata Surveillance in 2026

Browser Fingerprinting Tracking today represents one of the true cores of metadata intelligence. Far beyond [...]

02
Feb
bot telegram usersbox, affiche cyber-thriller sur le marché noir probiv russe et l’illusion de contrôle des données par l’État

2025 Digital Security

Bot Telegram Usersbox : l’illusion du contrôle russe

Le bot Telegram Usersbox n’était pas un simple outil d’OSINT « pratique » pour curieux [...]

29
Nov
Illustration réaliste montrant l’espionnage invisible d’un compte WhatsApp via une session persistante sur smartphone

2025 Digital Security

Espionnage invisible WhatsApp : quand le piratage ne laisse aucune trace

Espionnage invisible WhatsApp n’est plus une hypothèse marginale, mais une réalité technique rendue possible par [...]

21
Dec
Fuite données ministère interieur : illustration réaliste d’une cyberattaque via messageries compromises avec accès TAJ/FPR

2025 Digital Security

Fuite données ministère interieur : messageries compromises et ligne rouge souveraine

Fuite données ministère intérieur. L’information n’est pas arrivée par une fuite anonyme ni par un [...]

05
Jan
Silent Whisper, fictional WhatsApp and Signal espionage blocked by end-to-end encryption

2026 Digital Security

Silent Whisper espionnage WhatsApp Signal : une illusion persistante

Silent Whisper espionnage WhatsApp Signal est présenté comme une méthode gratuite permettant d’espionner des communications [...]

05
Jan
OpenAI Mixpanel Breach Metadata illustrating a metadata leak, phishing risk and the need for sovereign security architectures without centralized databases

2025 Digital Security

OpenAI Mixpanel Breach Metadata – phishing risks and sovereign security with PassCypher

OpenAI Mixpanel breach metadata is a blunt reminder of a simple rule: the moment sensitive [...]

06
Jan
Image of the Intersec Awards 2026 ceremony in Dubai. Large screen announcing PassCypher NFC HSM & HSM PGP (FREEMINDTRONIC) as a Best Cybersecurity Solution Finalist. Features Quantum-Resistant Passwordless Manager patented technology, designed in Andorra 🇦🇩 and France 🇫🇷.

2026 Awards Cyberculture Digital Security Distinction Excellence EviOTP NFC HSM Technology EviPass EviPass NFC HSM technology EviPass Technology finalists PassCypher PassCypher

Quantum-Resistant Passwordless Manager — PassCypher finalist, Intersec Awards 2026 (FIDO-free, RAM-only)

Quantum-Resistant Passwordless Manager 2026 (QRPM) — Best Cybersecurity Solution Finalist by PassCypher sets a new [...]

03
Nov
Illustration de CryptPeer messagerie P2P WebRTC montrant un appel vidéo sécurisé chiffré de bout en bout entre plusieurs utilisateurs.

2025 Cyberculture Cybersecurity Digital Security EviLink

CryptPeer messagerie P2P WebRTC : appels directs chiffrés de bout en bout

La messagerie P2P WebRTC sécurisée constitue le fondement technique et souverain de la communication directe [...]

14
Nov
Missatgeria P2P WebRTC segura amb CryptPeer, bombolla local de comunicació sobirana amb trucades de grup i compartició de fitxers xifrats de Freemindtronic

2025 CyptPeer Digital Security EviLink

Missatgeria P2P WebRTC segura — comunicació directa amb CryptPeer

Missatgeria P2P WebRTC segura al navegador és l’esquelet tècnic i sobirà de la comunicació directa [...]

28
Nov
Movie-style poster for the English chronicle “Russia Blocks WhatsApp: Max and the Sovereign Internet”, with WhatsApp fading into the Max superapp over a split Russian digital map.

2025 Digital Security

Russia Blocks WhatsApp: Max and the Sovereign Internet

Step by step, Russia blocks WhatsApp and now openly threatens to “completely block” the messaging [...]

29
Nov
typologique illustrant l’arnaque mobile WhatsApp Gold avec un smartphone doré et une silhouette menaçante en arrière-plan

2020 Digital Security

WhatsApp Gold arnaque mobile : typologie d’un faux APK espion

WhatsApp Gold arnaque mobile — clone frauduleux d’application mobile, ce stratagème repose sur une usurpation [...]

11
Nov
Illustration montrant la faille Tycoon 2FA failles OAuth persistantes : une application OAuth malveillante obtenant un jeton d’accès persistant malgré la double authentification, symbolisée par un cloud vulnérable et un HSM souverain bloquant l’attaque.

2025 Digital Security

Tycoon 2FA failles OAuth persistantes dans le cloud | PassCypher HSM PGP

Faille OAuth persistante — Tycoon 2FA exploitée — Quand une simple autorisation devient un accès [...]

22
Oct
Cinematic cyber illustration showing a user authorizing a malicious OAuth app symbolizing the Persistent OAuth Flaw exploited by Tycoon 2FA, with PassCypher PGP as the Zero-Cloud defense solution.

2025 Digital Security

Persistent OAuth Flaw: How Tycoon 2FA Hijacks Cloud Access

Persistent OAuth Flaw — Tycoon 2FA Exploited — When a single consent becomes unlimited cloud [...]

23
Oct
dark du spyware ClayRat Android se cachant dans un smartphone face à la défense matérielle DataShielder NFC HSM. Le hacker est éclairé en rouge, la protection est un bouclier bleu.

2025 Digital Security

Spyware ClayRat Android : faux WhatsApp espion mobile

Spyware ClayRat Android illustre la mutation du cyberespionnage : plus besoin de failles, il exploite [...]

14
Oct
Digital poster showing a hooded hacker holding a smartphone wrapped by a glowing red digital serpent with a bright eye, symbolizing ClayRat Android spyware. A blue NFC HSM shield glows on the right, representing sovereign hardware encryption.

2025 Digital Security

Android Spyware Threat Clayrat : 2025 Analysis and Exposure

Android Spyware Threat: ClayRat illustrates the new face of cyber-espionage — no exploits needed, just [...]

14
Oct
Diagram illustrating WhatsApp hacking techniques (Zero-Click exploit CVE-2025-55177 and QR Code hijack) countered by Sovereign Zero-DOM / HSM defense, showing data isolation and ephemeral RAM decryption.

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

WhatsApp hacking zero-click exploit (CVE-2025-55177) chained with Apple CVE-2025-43300 enables remote code execution via crafted [...]

18
Jan
Flat graphic poster illustrating SSH key breaches and defense through hardware-anchored SSH authentication using PassCypher HSM PGP, OpenPGP AES-256 encryption, and BLE-HID zero-trust workflows.

2025 Digital Security Technical News

Sovereign SSH Authentication with PassCypher HSM PGP — Zero Key in Clear

SSH Key PassCypher HSM PGP establishes a sovereign SSH authentication chain for zero-trust infrastructures, where [...]

11
Oct
Illustration cyber réaliste représentant SSH Key PassCypher HSM PGP, avec un ordinateur affichant un terminal SSH, un HSM USB et un environnement de serveurs OVHcloud en arrière-plan

2025 Digital Security Tech Fixes Security Solutions Technical News

SSH Key PassCypher HSM PGP — Sécuriser l’accès multi-OS à un VPS

SSH Key PassCypher HSM PGP fournit une chaîne souveraine : génération locale de clés SSH [...]

10
Oct
Affiche réaliste du générateur de mots de passe souverain PassCypher Secure Passgen WP pour WordPress, illustrant la génération locale, éthique et cryptographique de mots de passe sans cloud.

2025 Digital Security Technical News

Générateur de mots de passe souverain – PassCypher Secure Passgen WP

Générateur de mots de passe souverain PassCypher Secure Passgen WP pour WordPress — le premier [...]

06
Oct
Science-fiction movie style poster showing a quantum computer cryostat with 6,100 qubits. A researcher is observing the device. The title warns of a "MAJOR BREAKTHROUGH & CYBERSECURITY RISKS" related to the trapped neutral atoms. Blue laser beams (optical tweezers) are visible, highlighting the zone-based architecture.

2025 Digital Security Technical News

Quantum computer 6100 qubits ⮞ Historic 2025 breakthrough

A 6,100-qubit quantum computer marks a turning point in the history of computing, raising unprecedented [...]

03
Oct
Infographie illustrant un ordinateur quantique à atomes neutres piégés, montrant le saut d’échelle de 500 à 6100 qubits et ses implications pour le chiffrement et la sécurité

2025 Digital Security Technical News

Ordinateur quantique 6100 qubits ⮞ La percée historique 2025

Ordinateur quantique 6100 qubits marque un tournant dans l’histoire de l’informatique, soulevant des défis sans [...]

02
Oct
Schéma explicatif de l’Authentification Multifacteur illustrant les étapes 0FA, 1FA, 2FA et MFA sur fond blanc

2025 Cyberculture Digital Security

Authentification multifacteur : anatomie, OTP, risques

Authentification Multifacteur : Anatomie souveraine Explorez les fondements de l’authentification numérique à travers une typologie [...]

26
Sep
Póster estilo cine sobre clickjacking extensiones DOM, riesgos sistémicos, vulnerabilidades de gestores de contraseñas y wallets cripto, con contramedidas Zero DOM soberanas.

2025 Digital Security

Clickjacking Extensiones DOM — Riesgos y Defensa Zero-DOM

28
Aug
Cartell digital en català sobre el clickjacking d’extensions DOM amb PassCypher — contraatac sobirà Zero DOM

2025 Digital Security

Clickjacking extensions DOM: Vulnerabilitat crítica a DEF CON 33

DOM extension clickjacking — el clickjacking d’extensions basat en DOM, mitjançant iframes invisibles, manipulacions del [...]

23
Aug
Movie poster style illustration of DOM extension clickjacking unveiled at DEF CON 33, showing hidden iframes, Shadow DOM hijack, and sovereign Zero-DOM countermeasures

2025 Digital Security

DOM Extension Clickjacking — Risks, DEF CON 33 & Zero-DOM fixes

DOM extension clickjacking — a technical chronicle of DEF CON 33 demonstrations, their impact, and [...]

27
Aug
Affiche cyberpunk illustrant DOM Based Extension Clickjacking présenté au DEF CON 33 avec extraction de secrets du navigateur

2025 Digital Security

Clickjacking des extensions DOM : DEF CON 33 révèle 11 gestionnaires vulnérables

Clickjacking d’extensions DOM : DEF CON 33 révèle une faille critique et les contre-mesures Zero-DOM

23
Aug
Illustration vulnérabilité WhatsApp zero-click CVE-2025-55177 exploit DNG et CVE-2025-43300 Apple avec protection HSM NFC et PGP

2025 Digital Security

Vulnérabilité WhatsApp Zero-Click — Actions & Contremesures

Vulnérabilité WhatsApp zero-click (CVE-2025-55177) chaînée avec Apple CVE-2025-43300 permet l’exécution de code à distance via [...]

30
Sep
Chrome V8 zero-day CVE-2025-10585 — affiche cinématographique : œil de surveillance dans l’onglet Chrome, silhouette d’espion, lignes de code V8

2025 Digital Security

Chrome V8 Zero-Day CVE-2025-10585 — Ton navigateur était déjà espionné ?

Chrome V8 zero-day CVE-2025-10585 — Votre navigateur n’était pas vulnérable. Vous étiez déjà espionné !

19
Sep
Affiche de cinéma "La Bataille des Frontières des Métadonnées" illustrant un défenseur avec un bouclier DataShielder protégeant l'Europe numérique. Le bouclier est verrouillé, symbolisant la protection de la confidentialité des métadonnées e-mail contre la surveillance. Des icônes GDPR et des e-mails stylisés flottent, représentant les enjeux légaux et la fuite de données. Le fond montre une carte de l'Europe illuminée par des circuits numériques. Le texte principal alerte sur ce que les messageries et e-mails révèlent sans votre savoir, promu par Freemindtronic.

2025 Digital Security

Confidentialité métadonnées e-mail — Risques, lois européennes et contre-mesures souveraines

La confidentialité des métadonnées e-mail est au cœur de la souveraineté numérique en Europe : [...]

03
Sep
Cinematic poster-style artwork of “The Battle of Metadata Borders” showing a hooded figure with a glowing DataShielder shield, standing before a futuristic city skyline with neon data icons, symbolizing email and messaging privacy.

2025 Digital Security

Email Metadata Privacy: EU Laws & DataShielder

Email metadata privacy sits at the core of Europe’s digital sovereignty: understand the risks, the [...]

07
Sep
Chrome V8 confusió RCE — zero-day de tipus confusió amb execució remota drive-by; guia Zero-DOM i passos d’urgència per a Catalunya i Andorra

2025 Digital Security

Chrome V8 confusió RCE — Actualitza i postura Zero-DOM

Chrome V8 confusió RCE: aquesta edició exposa l’impacte global i les mesures immediates per reduir [...]

20
Sep
Cinematic poster style showing cyber espionage in a city night scene, symbolizing Chrome V8 confusion RCE zero-day vulnerability.

2025 Digital Security

Chrome V8 confusion RCE — Your browser was already spying

Chrome v8 confusion RCE: This edition addresses impacts and guidance relevant to major English-speaking markets [...]

20
Sep
Movie poster-style image of a cracked passkey and fishing hook. Main title: 'WebAuthn API Hijacking', with secondary phrases: 'Passkeys Vulnerability', 'DEF CON 33', and 'Why PassCypher Is Not Vulnerable'. Relevant for cybersecurity in Andorra.

2025 Digital Security

WebAuthn API Hijacking: A CISO’s Guide to Nullifying Passkey Phishing

29
Aug
Image type affiche de cinéma: passkey cassée sous hameçon de phishing. Textes: "Passkeys Faille Interception WebAuthn", "DEF CON 33 Révélation", "Pourquoi votre PassCypher n'est pas vulnérable API Hijacking". Contexte cybersécurité Andorre.

2025 Digital Security

Passkeys Faille Interception WebAuthn | DEF CON 33 & PassCypher

Conseil RSSI / CISO – Protection universelle & souveraine EviBITB (Embedded Browser‑In‑The‑Browser Protection) est une [...]

29
Aug
Visual composition illustrating coordinated cyber smear campaigns during geopolitical tensions

2025 Cyberculture Digital Security

Reputation Cyberattacks in Hybrid Conflicts — Anatomy of an Invisible Cyberwar

Synchronized APT leaks erode trust in tech, alliances, and legitimacy through narrative attacks timed with [...]

31
Jul
APT28 spear-phishing with NotDoor Outlook backdoor using VBA macros, DLL side-loading via OneDrive.exe, and Proton Mail covert exfiltration in European cyberattacks

2025 Digital Security

APT28 spear-phishing: Outlook backdoor NotDoor and evolving European cyber threats

Russian cyberattack on Microsoft by Midnight Blizzard (APT29) highlights the strategic risks to digital sovereignty. [...]

30
Apr
Cybersecurity theme with shield, padlock, and computer screen displaying warning signs, highlighting the Russian cyberattack on Microsoft.

2024 Cyberculture Digital Security

Russian Cyberattack Microsoft: An Unprecedented Threat

Russian cyberattack on Microsoft by Midnight Blizzard (APT29) highlights the strategic risks to digital sovereignty. [...]

01
Jul
Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 Digital Security

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

Midnight Blizzard Cyberattack against Microsoft and HPE: A detailed analysis of the facts, the impacts [...]

10
Mar
Illustration showing a strategic breach of certified eSIM mobile identity — eSIM Sovereignty Failure

2025 Digital Security

eSIM Sovereignty Failure: Certified Mobile Identity at Risk

  Runtime Threats in Certified eSIMs: Four Strategic Blind Spots While geopolitical campaigns exploit the [...]

30
Jul
Comparative infographic contrasting ToolShell SharePoint zero-day with NFC HSM mitigation strategies

2025 Digital Security

ToolShell SharePoint vulnerability: NFC HSM mitigates token forgery & zero-day RCE

25
Jul
image illustrating the Chrome V8 Zero-Day exploit affecting password managers and browser security

2025 Digital Security

Chrome V8 Zero-Day: CVE-2025-6554 Actively Exploited

04
Jul
Illustration showing Atomic Stealer AMOS malware process on macOS with fake update, keychain access, and crypto exfiltration

2025 Digital Security

Atomic Stealer AMOS: The Mac Malware That Redefined Cyber Infiltration

08
Jul
Realistic visual representation of APT41 Cyberespionage and Cybercrime operations involving Chinese state-backed hackers, cloud abuse, and memory-only malware.

2025 Digital Security

APT41 Cyberespionage and Cybercrime Group – 2025 Global Analysis

05
Jul
Realistic image of APT29 deceiving a person to bypass 2FA using app passwords

2025 Digital Security

APT29 Exploits App Passwords to Bypass 2FA

A silent cyberweapon undermining digital trust Two-factor authentication (2FA) was supposed to be the cybersecurity [...]

25
Jun
Realistic photo of a hacker in a dark room in front of a computer, illustrating the darknet credentials breach and the protection by PassCypher

2015 Digital Security

Darknet Credentials Breach 2025 – 16+ Billion Identities Stolen

Underground Market: The New Gold Rush for Stolen Identities The massive leak of over 16 [...]

22
Jun
Illustration of Signal clone breached scenario involving TeleMessage with USA and Israel flags

2025 Digital Security

Signal Clone Breached: Critical Flaws in TeleMessage

TeleMessage: A Breach That Exposed Cloud Trust and National Security Risks TeleMessage, marketed as a [...]

22
May
Illustration of APT29 spear-phishing Europe with Russian flag

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

APT29 SpearPhishing Europe: A Stealthy LongTerm Threat APT29 spearphishing Europe campaigns highlight a persistent and [...]

30
Apr
APT36 SpearPhishing India header infographic showing phishing icon, map of India, and cyber threat symbols

2025 Digital Security

APT36 SpearPhishing India: Targeted Cyberespionage | Security

Understanding Targeted Attacks of APT36 SpearPhishing India APT36 cyberespionage campaigns against India represent a focused [...]

16
May
Microsoft Outlook Zero-Click vulnerability warning with encryption symbols and a secure lock icon in a professional workspace.

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

Microsoft Outlook Zero-Click Vulnerability: How to Protect Your Data Now A critical Zero-Click vulnerability (CVE-2025-21298) [...]

18
Jan
Illustration depicting the Microsoft MFA Security Flaw, highlighting a digital lock being bypassed with code streams in the background, symbolizing the vulnerability nicknamed AuthQuake.

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

24
Dec
Why Encrypt SMS? NFC card protecting encrypted SMS communications from espionage and corruption on Android NFC phone.

2024 Digital Security

Why Encrypt SMS? FBI and CISA Recommendations

<div> </article></div> <script type=”application/ld+json”> { “@context”: “https://schema.org”, “@type”: “Article”, “mainEntityOfPage”: { “@type”: “WebPage”, “@id”: “https://freemindtronic.com/why-encrypt-sms-fbi-and-cisa-recommendations/” [...]

16
Dec
A hyper-realistic digital illustration showing the severity of Microsoft vulnerabilities in 2025, with interconnected red warning signals, fragmented systems, and ominous shadows representing critical zero-day exploits and cybersecurity risks.

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

Microsoft: 159 Vulnerabilities Fixed in 2025 Microsoft has released a record-breaking security update in January [...]

21
Jan
Illustration of a Russian APT44 (Sandworm) cyber spy exploiting QR codes to infiltrate Signal, highlighting advanced phishing techniques and vulnerabilities in secure messaging platforms.

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

APT44 Sandworm: The Elite Russian Cyber Espionage Unit Unmasking Sandworm’s sophisticated cyber espionage strategies and [...]

24
Feb
Visual representation of BadPilot Cyber Attacks by APT44, showcasing global cyber-espionage targeting critical infrastructures with PassCypher and DataShielder defenses.

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

BadPilot Cyber Attacks: Sandworm’s New Weaponized Subgroup Understanding the rise of BadPilot and its impact [...]

25
Feb
Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon & Flax Typhoon: Cyber Espionage Threats Targeting Government Agencies

Salt Typhoon – The Cyber Threat Targeting Government Agencies Salt Typhoon and Flax Typhoon represent [...]

14
Nov
A visual representation of BitLocker Security featuring a central lock icon surrounded by elements representing Microsoft, TPM, and Windows security settings.

2024 Digital Security

BitLocker Security: Safeguarding Against Cyberattacks

Introduction to BitLocker Security If you use a Windows computer for data storage or processing, [...]

10
Feb
French Minister at G7 holding a hacked smartphone, with a Bahraini minister warning him about a cyberattack.

2024 Digital Security

French Minister Phone Hack: Jean-Noël Barrot’s G7 Breach

06
Dec
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know

Cyberattack Exploits Backdoors: What You Need to Know In October 2024, a cyberattack exploited backdoors [...]

15
Oct
Phishing: Cyber victims caught between the hammer and the anvil

2021 Cyberculture Digital Security Phishing

Phishing Cyber victims caught between the hammer and the anvil

Phishing is a fraudulent technique that aims to deceive internet users and to steal their [...]

17
May
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat

Sheets Malware: A Growing Cybersecurity Concern Google Sheets, a widely used collaboration tool, has shockingly [...]

03
Sep
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed

Russian Espionage Hacking Tools: Discovery and Initial Findings Russian espionage hacking tools were uncovered by [...]

31
Aug
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat

Understanding the Impact and Evolution of Side-Channel Attacks in Modern Cybersecurity Side-channel attacks, also known [...]

20
Aug
Fingerprint Systems Really Secure - How to Protect Your Data and Identity

Digital Security Spying Technical News

Are fingerprint systems really secure? How to protect your data and identity against BrutePrint

Fingerprint Biometrics: An In-Depth Exploration of Security Mechanisms and Vulnerabilities It is a widely recognized [...]

23
Oct
Illustration of an Apple MacBook with a highlighted M-series chip vulnerability, surrounded by symbols of data security breach and a global impact background.

2024 Digital Security Technical News

Apple M chip vulnerability: A Breach in Data Security

Apple M chip vulnerability: uncovering a breach in data security Researchers at the Massachusetts Institute [...]

25
Mar
Brute Force Attacks Cyber Attack Guide

Digital Security Technical News

Brute Force Attacks: What They Are and How to Protect Yourself

Brute-force Attacks: A Comprehensive Guide to Understand and Prevent Them Brute Force: danger and protection [...]

01
Nov
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks

Critical OpenVPN Vulnerabilities Pose Global Security Risks OpenVPN security vulnerabilities have come to the forefront, [...]

12
Aug
Hacker accessing a laptop displaying Google Workspace with a security breach notification.

2024 Digital Security

Google Workspace Vulnerability Exposes User Accounts to Hackers

How Hackers Exploited the Google Workspace Vulnerability Hackers found a way to bypass the email [...]

01
Aug
Predator Files How a Spyware Consortium Targeted Civil Society Politicians and Officials

2023 Digital Security

Predator Files: The Spyware Scandal That Shook the World

Predator Files: How a Spyware Consortium Targeted Civil Society, Politicians and Officials Cytrox: The maker [...]

19
Oct
BITB attacks Browser-In-The-Browser remove delete destroy by IRDR Ifram Redirect Detection Removal since EviCypher freeware web extension open-source from Freemindtronic in Andorra

2023 Digital Security Phishing

BITB Attacks: How to Avoid Phishing by iFrame

BITB Attacks: How to Avoid Phishing by iFrame We have all seen phishing attacks aren’t [...]

10
May
5Ghoul: 5G NR Attacks on Mobile Devices

2023 Digital Security

5Ghoul: 5G NR Attacks on Mobile Devices

5Ghoul: How Contactless Encryption Can Secure Your 5G Communications from Modem Attacks 5Ghoul is a [...]

29
Dec
Multiple computer screens displaying data breach alerts in a dark room, with the Pentagon in the background.

2024 Digital Security

Leidos Holdings Data Breach: A Significant Threat to National Security

A Major Intrusion Unveiled In July 2024, the Leidos Holdings data breach came to light, [...]

25
Jul
RockYou2024 data breach with millions of passwords streaming on a dark screen, foreground displaying advanced cybersecurity measures and protective shields.

2024 Digital Security

RockYou2024: 10 Billion Reasons to Use Free PassCypher

RockYou2024: A Cybersecurity Earthquake The RockYou2024 data leak has shaken the very foundations of global [...]

08
Jul
Europol office showing a security breach alert on a computer screen, with agents discussing in the background.

2024 Digital Security

Europol Data Breach: A Detailed Analysis

May 2024: Europol Security Breach Highlights Vulnerabilities In May 2024, Europol, the European law enforcement [...]

16
May
A realistic depiction of the 2024 Dropbox security breach, featuring a cracked Dropbox logo with compromised data such as emails, user credentials, and security tokens spilling out. The background includes red flashing alerts and warning symbols, highlighting the seriousness of the breach.

2024 Digital Security

Dropbox Security Breach 2024: Phishing, Exploited Vulnerabilities

Phishing Tactics: The Bait and Switch in the Aftermath of the Dropbox Security Breach The [...]

17
May
NFC Hardware Wallet Credit Card Manager PCI DSS Compliant EviToken Technology working contactless by nfc phone online autofill payment from Freemindtronic Andorra

Digital Security EviToken Technology Technical News

EviCore NFC HSM Credit Cards Manager | Secure Your Standard and Contactless Credit Cards

EviCore NFC HSM Credit Cards Manager is a powerful solution designed to secure and manage [...]

14
Jun
Shadowy hacker with a laptop in front of a digital map of Russia highlighted in red, symbolizing the origin of Kapeka Malware.

2024 Digital Security

Kapeka Malware: Comprehensive Analysis of the Russian Cyber Espionage Tool

Kapeka Malware: The New Russian Intelligence Threat   In the complex world of cybersecurity, a [...]

18
Apr
A modern cybersecurity control center with a diverse team monitoring national cyber threats during the Andorra National Cyberattack Simulation.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense

Andorra Cybersecurity Simulation: A Vanguard of Digital Defense Andorra-la-Vieille, April 15, 2024 – Andorra is [...]

15
Apr
EviVault NFC HSM and EviCore NFC HSM Embedded ISO 15693 VS Flipper Zero

Articles Digital Security EviVault Technology NFC HSM technology Technical News

EviVault NFC HSM vs Flipper Zero: The duel of an NFC HSM and a Pentester

EviVault NFC HSM vs Flipper Zero: The duel of an NFC HSM and a Pentester [...]

04
Jul
Securing IEO STO ICO IDO INO the challenges and solutions EviCore NFC HSM by Freemindtronic

Articles Cryptocurrency Digital Security Technical News

Securing IEO STO ICO IDO and INO: The Challenges and Solutions

Securing IEO STO ICO IDO and INO: How to Protect Your Crypto Investments Cryptocurrencies are [...]

14
Jun
Remote activation of phones by the police

2023 Articles Digital Security Technical News

Remote activation of phones by the police: an analysis of its technical, legal and social aspects

What is the new bill on justice and why is it raising concerns about privacy? [...]

11
Jun
A man holding a resident card of a person in Andorra, wearing a badge of an identity card of a Spanish woman and surrounded by other identity cards of different countries including France and on his left a hacker in front of his computer with a phone

Articles Cyberculture Digital Security Technical News

Protect Meta Account Identity Theft with EviPass and EviOTP

Protecting Your Meta Account from Identity Theft Meta is a family of products that includes [...]

31
May
Digital world map with cybersecurity icons representing the Cybersecurity Breach at IMF.

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation

Cybersecurity Breach at IMF: A Detailed Investigation Cybersecurity breaches are a growing concern worldwide. The [...]

15
Mar
Strong Passwords in the Quantum Computing

2023 Articles Cyberculture Digital Security Technical News

Strong Passwords in the Quantum Computing Era

How to create strong passwords in the era of quantum computing? Quantum computing is a [...]

05
May
PrintListener technology concept with NFC security solutions.

2024 Digital Security

PrintListener: How to Betray Fingerprints

PrintListener: How this Technology can Betray your Fingerprints and How to Protect yourself PrintListener revolutionizes [...]

22
Feb
Digital shield by Freemindtronic repelling cyberattack against Microsoft Exchange

2024 Articles Digital Security News

How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts

How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts [...]

08
Feb
Woman holding a smartphone with a padlock icon on the screen, promoting protection from stalkerware.

2024 Articles Digital Security News Spying

How to protect yourself from stalkerware on any phone

What is Stalkerware and Why is it Dangerous? Stalkerware, including known programs like FlexiSpy, mSpy, [...]

26
Jan
Pegasus The Cost of Spying with the Most Powerful Spyware

2023 Articles DataShielder Digital Security Military spying News NFC HSM technology Spying

Pegasus: The cost of spying with one of the most powerful spyware in the world

Pegasus: The Cost of Spying with the Most Powerful Spyware in the World Pegasus is [...]

17
Oct
Digital representation of Ivanti Zero-Day Flaws threatening cybersecurity in a futuristic cityscape

2024 Digital Security Spying

Ivanti Zero-Day Flaws: Comprehensive Guide to Secure Your Systems Now

What are Zero-Day Flaws and Why are They Dangerous? A zero-day flaw is a previously [...]

05
Feb
KingsPawn A Spyware

2024 Articles Compagny spying Digital Security Industrial spying Military spying News Spying Zero trust

KingsPawn A Spyware Targeting Civil Society

  QuaDream: KingsPawn spyware vendor shutting down in may 2023 QuaDream was a company that [...]

16
Apr
SSH handshake with Terrapin attack and EviKey NFC HSM

2024 Articles Digital Security EviKey NFC HSM EviPass News SSH

Terrapin attack: How to Protect Yourself from this New Threat to SSH Security

Protect Yourself from the Terrapin Attack: Shield Your SSH Security with Proven Strategies SSH is [...]

11
Jan
google account security flaw how to protect yourself from hackers digital artwork that conveys the concept of a security breach in online services due to persistent cookies attacks

2024 Articles Digital Security News Phishing

Google OAuth2 security flaw: How to Protect Yourself from Hackers

Google OAuth2 security flaw: Strategies Against Persistent Cookie Threats in Online Services Google OAuth2 security [...]

08
Jan

2024 Articles Digital Security

Kismet iPhone: How to protect your device from the most sophisticated spying attack?

Kismet iPhone: How to protect your device from the most sophisticated spying attack using Pegasus [...]

02
Jan
TETRA Security Vulnerabilities secured by EviPass or EviCypher NFC HSM Technologies from Freemindtronic-Andorra

Articles Digital Security EviCore NFC HSM Technology EviPass NFC HSM technology NFC HSM technology

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures from Cyberattacks TETRA (Terrestrial Trunked Radio) is [...]

27
Nov
FormBook Malware: how to protect your gmail and other data

2023 Articles DataShielder Digital Security EviCore NFC HSM Technology EviCypher NFC HSM EviCypher Technology NFC HSM technology

FormBook Malware: How to Protect Your Gmail and Other Data

How to Protect Your Gmail Account from FormBook Malware Introduction Imagine that you receive an [...]

23
Nov
Hackers Chinois Cisco Routers

Articles Digital Security

Chinese hackers Cisco routers: how to protect yourself?

How Chinese hackers infiltrate corporate networks via Cisco routers A Chinese-backed hacker group, known as [...]

04
Oct
ZenRAT The-malware-that hides in Bitwarden-and escapes antivirus-software edit by freemindtronic from Andorra

Articles Digital Security

ZenRAT: The malware that hides in Bitwarden and escapes antivirus software

How this malware hides in Bitwarden and escapes antivirus software to steal your information ZenRAT [...]

27
Sep

The chronicles displayed above ↑ belong to the Digital Security section. They extend the analysis of sovereign architectures, data black markets, and surveillance tools. This selection complements the present chronicle dedicated to the **Ledger Security Breaches (2017–2026)** and the systemic risks linked to hardware vulnerabilities, supply‑chain compromises, and third‑party providers.

Advanced Summary

This advanced summary frames Ledger Security Breaches (2017–2026) through a systemic lens. It does not focus only on technical incidents, but analyzes the full dependency chain — firmware, software, partners, and customer data — and explains why certain architectures make these failures structural, not accidental.

A sequence of breaches that reveals a security-model problem

Since 2017, Ledger has faced a series of major incidents: seed phrase recovery attacks, firmware replacement, physical device modifications, application-level vulnerabilities (Monero), the massive 2020 customer database leak, the 2023 software supply-chain compromise, and the 2026 Global-e order-data leak. Taken separately, each event can be labeled an “incident.” Taken together, they reveal a security model problem.

The common denominator is not low-level cryptography, but the recurring necessity for critical secrets (seed phrases, private keys, identity-related metadata) to pass at some point through a non-sovereign environment: proprietary firmware, the host computer, connected applications, update servers, or an e-commerce partner.

From component security to ecosystem vulnerability

Ledger historically relied on the robustness of the hardware component itself. But from 2020 onward, the attack surface shifted to the peripheral ecosystem: customer databases, logistics services, software dependencies, user interfaces, notifications, and support channels.

The 2026 Global-e leak marks a turning point. Even without direct private-key compromise, exposure of delivery and order metadata turns users into persistent targets: ultra-targeted phishing, “delivery” social engineering, doxxing, and, in extreme cases, physical threats. Security is no longer only digital — it becomes civil and personal.

Why phishing and hybrid attacks become inevitable

Once a user’s real identity is correlated with crypto ownership, phishing stops being opportunistic. It becomes industrial and personalized.

BITB attacks, fake updates, fake delivery incidents, or “compliance” scams exploit less a technical bug than the human factor, made vulnerable by exposed metadata.

In this context, hardening firmware or adding software warnings is not sufficient. The problem is not cryptographic signing — it is that the secret or its holder becomes identifiable, traceable, or remotely reachable.

Paradigm shift: from trust to hardware proof

Facing these structural limits, some approaches do not attempt to strengthen transaction signing — they aim to remove critical secrets from any connected ecosystem. Freemindtronic’s sovereign alternatives follow the opposite logic: instead of securing a connected stack, they seek to radically reduce dependencies. NFC HSM devices are battery-less, cable-less, and network-port-less, requiring no account, no server, and no cloud synchronization.

This paradigm shift is embodied by air-gap secret sharing: critical secrets (seed phrases, private keys, credentials for hot wallets or proprietary systems) can be transferred hardware → hardware from one SeedNFC HSM to another, via an RSA-4096 encrypted QR code using the recipient’s public key — without blockchain, without server, and without any transaction-signing function.

A structural answer to the failures observed since 2017

Where Ledger failures rely on supply chains, updates, and commercial relationships, sovereign architectures remove these breaking points by design. There is nothing to hack remotely, nothing to divert in a cloud, and nothing to extract from a third-party server. Even if visually exposed, an encrypted QR code remains unusable without physical possession of the recipient HSM.

This model does not promise “magic” security. It imposes deliberate responsibility: irreversibility of transfers, physical control, and operational discipline. But it eliminates the systemic attack vectors that have repeatedly surfaced since 2017.

Ledger Security Breaches (2017–2026): How to Protect Your Cryptocurrencies

Have you ever questioned the real level of security protecting your digital assets?
If you use a Ledger device, you may assume your funds are safe from hackers. Ledger is a French company widely recognized for its role in cryptocurrency security, offering hardware wallets designed to isolate private keys from online threats.

However, since 2017, Ledger Security Breaches have repeatedly challenged this assumption. Over time, multiple vulnerabilities have emerged—some exposing personal data, others enabling private-key compromise only in specific, controlled attack scenarios (e.g., physical access or manipulated environments). These weaknesses have allowed attackers not only to steal funds, but also to exploit users through phishing, identity correlation, and targeted coercion.

This chronicle provides a structured analysis of the major Ledger security incidents from 2017 to 2026. It explains how each breach was exploited, what risks they introduced, and why certain architectural choices amplify systemic exposure. Most importantly, it outlines practical and strategic approaches to reduce attack surfaces and regain control over cryptographic sovereignty.

Rather than focusing on fear or isolated failures, this analysis aims to help users understand the evolving threat landscape—and to distinguish between trust-based security and proof-based, sovereign architectures.

Ledger security incidents: How Hackers Exploited Them and How to Stay Safe

Ledger security breaches have exposed logistical and relational metadata (delivery address, purchase history, identity correlation), and in specific historical attack scenarios, enabled the compromise of private keys under controlled conditions. Ledger is a French company that provides secure devices to store and manage your funds. But since 2017, hackers have targeted Ledger’s e-commerce and marketing database, as well as its software and hardware products. In this article, you will discover the different breaches, how hackers exploited them, what their consequences were, and how you can protect yourself from these threats.

[/section]

Ledger Security Breaches (2017–2026): From Hardware Attacks to Systemic Supply-Chain Risk

Have you ever wondered how safe your cryptocurrencies are? If you are using a Ledger device, you might think that you are protected from hackers and thieves. Ledger is a French company that specializes in cryptocurrency security. It offers devices that allow you to store and manage your funds securely. These devices are called hardware wallets, and they are designed to protect your private keys from hackers and thieves.

However, since 2017, Ledger has been the target of multiple incidents that exposed logistical and relational metadata (delivery address, purchase history, identity correlation) and, in specific historical attack scenarios, enabled private-key compromise under controlled conditions. These breaches could allow hackers to steal your cryptocurrencies or harm you in other ways. In this article, we will show you the different breaches that were discovered, how they were exploited, what their consequences were, and how you can protect yourself from these threats.

Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018)

The seed phrase is a series of words that allows you to restore access to a cryptocurrency wallet. It must be kept secret and secure, as it gives full control over the funds. In February 2018, a security researcher named Saleem Rashid discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to recover the seed phrase using a side-channel attack.

How did hackers exploit the breach?

The attack consisted of using an oscilloscope to measure the voltage variations on the reset pin of the device. These variations reflected the operations performed by the secure processor of the Ledger Nano S, which generated the seed phrase. By analyzing these variations, the attacker could reconstruct the seed phrase and access the user’s funds.

Simplified diagram of the attack

Figure Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018)
Statistics on the breach
  • Number of potentially affected users: about 1 million
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: February 20, 2018
  • Author of the discovery of the breach: Saleem Rashid, a security researcher
  • Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

  • Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to an oscilloscope and measure the voltage variations on the reset pin. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.
  • Scenario of remote access: The attacker needs to trick the user into installing a malicious software on their computer, which can communicate with the device and trigger the reset pin. The attacker then needs to capture the voltage variations remotely, either by using a wireless device or by compromising the oscilloscope. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.

Sources

1: Breaking the Ledger Security Model – Saleem Rashid published on March 20, 2018.

2: Ledger Nano S: A Secure Hardware Wallet for Cryptocurrencies? – Saleem Rashid published on November 20, 2018.

Ledger Security Flaws: The Firmware Replacement Attack (March 2018)

The firmware is the software that controls the operation of the device. It must be digitally signed by Ledger to ensure its integrity. In March 2018, the same researcher discovered another breach in the Ledger Nano S, which allowed an attacker to replace the firmware of the device with a malicious firmware, capable of stealing the private keys or falsifying the transactions.

How did hackers exploit the Ledger Security Breaches?

The attack consisted of exploiting a vulnerability in the mechanism of verification of the firmware signature. The attacker could create a malicious firmware that passed the signature check, and that installed on the device. This malicious firmware could then send the user’s private keys to the attacker, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

Figure Ledger Security Flaws: The Firmware Replacement Attack (March 2018)

Statistics on the breach

  • Number of potentially affected users: about 1 million
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: March 20, 2018
  • Author of the discovery of the breach: Saleem Rashid, a security researcher
  • Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

  • Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to a computer and install the malicious firmware on it. The attacker can then use the device to access the user’s funds or falsify their transactions.
  • Scenario of remote access: The attacker needs to trick the user into installing the malicious firmware on their device, either by sending a fake notification, a phishing email, or a malicious link. The attacker then needs to communicate with the device and send the user’s private keys or modify their transactions.

Sources

Ledger Security Incidents: The Printed Circuit Board Modification Attack (November 2018)

The printed circuit board is the hardware part of the device, which contains the electronic components. It must be protected against malicious modifications, which could compromise the security of the device. In November 2018, a security researcher named Dmitry Nedospasov discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to modify the printed circuit board and install a listening device, capable of capturing the private keys or modifying the transactions.

How did hackers exploit the breach?

The attack consisted of removing the case of the device, and soldering a microcontroller on the printed circuit board. This microcontroller could intercept the communications between the secure processor and the non-secure processor of the Ledger Nano S, and transmit them to the attacker via a wireless connection. The attacker could then access the user’s private keys, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

figure Ledger Security Incidents: The Printed Circuit Board Modification Attack (November 2018)

Statistics on the breach

  • Number of potentially affected users: unknown
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: November 7, 2019
  • Author of the discovery of the breach: Dmitry Nedospasov, a security researcher
  • Date of publication of the fix by Ledger: December 17, 2020

Scenarios of hacker attacks

  • Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to remove the case of the device and solder the microcontroller on the printed circuit board. The attacker can then use the wireless connection to access the user’s funds or modify their transactions.
  • Scenario of remote access: The attacker needs to compromise the wireless connection between the device and the microcontroller, either by using a jammer, a repeater, or a hacker device. The attacker can then intercept the communications between the secure processor and the non-secure processor, and access the user’s funds or modify their transactions.

Sources

  • [Breaking the Ledger Nano X – Dmitry Nedospasov] published on November 7, 2019.
  • [How to Verify the Authenticity of Your Ledger Device – Ledger Blog] published on December 17, 2020.
[/col] [/row]

Ledger Security Breaches: Monero Application Vulnerability (March 2019)

Not all cryptocurrencies interact with hardware wallets in the same way.
In March 2019, a critical vulnerability was discovered in the Monero (XMR) application for Ledger devices.
Unlike the 2018 physical attacks, this flaw was located in the communication protocol between the Ledger device and the Monero desktop client.

How Was the Vulnerability Exploited?

The flaw allowed a malicious or compromised Monero client to send manipulated transaction data to the Ledger device.

By exploiting a bug in the handling of change outputs, an attacker could:

  • redirect funds to an address under their control without the user noticing on the Ledger screen, or
  • under specific and controlled conditions, reconstruct the Monero private spend key by observing multiple device–host exchanges.

In this scenario, the hardware wallet signed cryptographically valid transactions based on manipulated inputs originating from the host software.

Infographic illustrating a Monero transaction hijack via a malicious GUI wallet despite the use of a Ledger hardware wallet.

Incident Summary

  • Potentially affected users: Monero (XMR) holders using Ledger Nano S or Nano X
  • Reported loss: One documented case of approximately 1,600 XMR (~USD 83,000 at the time)
  • Date of discovery: March 4, 2019
  • Discoverers: Monero community & Ledger Donjon
  • Patch released: March 6, 2019 (Monero app version 1.5.1)

Attack Scenarios

  • Compromised software: The user interacts with an infected or unofficial Monero GUI wallet. During a legitimate transaction, the client silently alters transaction parameters to drain funds.
  • Key reconstruction (controlled scenario): An attacker with malware on the host computer could theoretically reconstruct the Monero private spend key by intercepting and correlating multiple device–PC exchanges.

Important clarification: This incident did not involve a mass leak of private keys.
It demonstrated that, under specific conditions and with a compromised host environment, private key compromise was technically possible due to application-layer design flaws.

Structural “Blind Signing” Vulnerability: Signing in the Dark by Design (Permanent)

Blind Signing is not a temporary flaw nor a bug that can be patched with a firmware update.
It is a structural design limitation inherent to hardware wallets when confronted with the growing complexity of smart contracts.


As of 2026, it represents the #1 fund-theft vector in Web3, ahead of classic technical exploits.

Why Blind Signing Is Fundamentally Dangerous

A hardware wallet is supposed to enable conscious and verifiable validation of sensitive operations.
With Blind Signing, however, the device is unable to render the real intent of the contract being signed.

The user is typically presented with:

  • a generic “Data Present” message
  • unreadable hexadecimal strings
  • or a partial, non-human-interpretable description

The signature becomes an act of faith.
The user no longer validates a understood action, but complies with an opaque interface.

Diagram illustrating Blind Signing, showing a hardware wallet displaying 'Data Present' while a malicious smart contract drains funds.

Figure — Blind Signing: when the user signs a transaction whose real intent cannot be verified.

An Attack by Consent, Not by Circumvention

Unlike the 2018 Ledger incidents (seed recovery, firmware replacement, PCB modification),
Blind Signing does not attempt to break the hardware security.

It turns it against the user.

Everything is:

  • cryptographically valid
  • signed with the genuine private key
  • irreversible on the blockchain

There is no detectable malware, no key extraction, no firmware compromise.
The loss is legally and technically attributable to the signature itself.

Impact and Scope

  • Affected users: 100% of DeFi / NFT / Web3 users
  • Estimated losses: hundreds of millions of USD (cumulative)
  • Status: permanent and systemic risk
  • Root cause: inability to verify signed intent

Typical Attack Scenarios

  • Wallet drainers: a fake mint or airdrop leads to signing a contract that grants unlimited asset transfer rights.
  • Hidden infinite approvals: the user unknowingly signs a permanent authorization. The wallet is emptied later, without any further interaction.

Conclusion:
Blind Signing marks a critical rupture: the private key remains protected, but effective security disappears.

The question is no longer “Is my wallet secure?”, but:

“Am I able to prove what I am signing?”

Ledger Security Breaches: The Connect Kit Attack (December 2023)

The Connect Kit is a software that allows users to manage their cryptocurrencies from their computer or smartphone, by connecting to their Ledger device. It allows to check the balance, send and receive cryptocurrencies, and access services such as staking or swap.

The Connect Kit breach was discovered by the security teams of Ledger in December 2023. It was due to a vulnerability in a third-party component used by the Connect Kit. This component, called Electron, is a framework that allows to create desktop applications with web technologies. The version used by the Connect Kit was not up to date, and had a breach that allowed hackers to execute arbitrary code on the update server of the Connect Kit.

Technical validation: This type of supply chain attack is classified under CWE-494 (Download of Code Without Integrity Check). You can monitor similar hardware wallet vulnerabilities on the MITRE CVE Database.

How did hackers exploit the Ledger Security Breaches?

The hackers took advantage of this breach to inject malicious code into the update server of the Connect Kit. This malicious code was intended to be downloaded and executed by the users who updated their Connect Kit software. The malicious code aimed to steal the sensitive information of the users, such as their private keys, passwords, email addresses, or phone numbers.

Simplified diagram of the attack

Figure Ledger Security Breaches The Connect Kit Attack (December 2023)

Statistics on the breach

  • Number of potentially affected users: about 10,000
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: December 14, 2023
  • Author of the discovery of the breach: Pierre Noizat, director of security at Ledger
  • Date of publication of the fix by Ledger: December 15, 2023

Scenarios of hacker attacks

  • Scenario of remote access: The hacker needs to trick the user into updating their Connect Kit software, either by sending a fake notification, a phishing email, or a malicious link. The hacker then needs to download and execute the malicious code on the user’s device, either by exploiting a vulnerability or by asking the user’s permission. The hacker can then access the user’s information or funds.
  • Scenario of keyboard: The hacker needs to install a keylogger on the user’s device, either by using the malicious code or by another means. The keylogger can record the keystrokes of the user, and send them to the hacker. The hacker can then use the user’s passwords, PIN codes, or seed phrases to access their funds.
  • Scenario of screen: The hacker needs to install a screen recorder on the user’s device, either by using the malicious code or by another means. The screen recorder can capture the screen of the user, and send it to the hacker. The hacker can then use the user’s QR codes, addresses, or transaction confirmations to steal or modify their funds.

Sources

Ledger Security Breaches: The Data Leak (December 2020)

The database is the system that stores the information of Ledger customers, such as their names, addresses, phone numbers and email addresses. It must be protected against unauthorized access, which could compromise the privacy of customers. In December 2020, Ledger revealed that a breach in its database had exposed the logistical and relational metadata (delivery address, purchase history, identity correlation) of 292,000 customers, including 9,500 in France.

How did hackers exploit the breach?

The breach had been exploited by a hacker in June 2020, who had managed to access the database via a poorly configured API key. The hacker had then published the stolen data on an online forum, making them accessible to everyone. Ledger customers were then victims of phishing attempts, harassment, or threats from other hackers, who sought to obtain their private keys or funds.

Simplified diagram of the attack :

Statistics on the breach

  • Number of affected users: 292,000, including 9,500 in France
  • Total amount of potentially stolen funds: unknown
  • Date of discovery of the breach by Ledger: June 25, 2020
  • Author of the discovery of the breach: Ledger, after being notified by a researcher
  • Date of publication of the fix by Ledger: July 14, 2020

Scenarios of hacker attacks

  • Scenario of phishing: The hacker sends an email or a text message to the user, pretending to be Ledger or another trusted entity. The hacker asks the user to click on a link, enter their credentials, or update their device. The hacker then steals the user’s information or funds.
  • Scenario of harassment: The hacker calls or visits the user, using their logistical and relational metadata (delivery address, purchase history, identity correlation) to intimidate them. The hacker threatens the user to reveal their identity, harm them, or steal their funds, unless they pay a ransom or give their private keys.
  • Scenario of threats: The hacker uses the user’s logistical and relational metadata (delivery address, purchase history, identity correlation) to find their social media accounts, family members, or friends. The hacker then sends messages or posts to the user or their contacts, threatening to harm them or expose their cryptocurrency activities, unless they comply with their demands.

Sources:

Ledger Security Breaches: The Global-e Data Leak (January 2026)

In January 2026, Ledger disclosed a new breach caused by its e-commerce partner Global-e.
Attackers compromised Global-e’s cloud systems, exposing customer names, email addresses, and delivery contact details used for online orders.

Unlike previous incidents, no seed phrases, private keys, or payment card data were compromised.
However, this leak significantly increased the risk of targeted phishing, doxxing, and long-term social engineering attacks against Ledger customers.

Infographic illustrating the Global-e Ledger data leak (January 2026)

Figure — Global-e 2026 breach: how exposed order data enables phishing, doxxing, and coercive targeting.
Active Defense: Mitigating Global-e Leak Risks

The SeedNFC HSM ecosystem, combined with PassCypher HSM PGP, provides a structural response by shifting security into the user’s physical control:

  • Reduced purchase metadata exposure: minimizing the collection and retention of identifiable data (name, address, phone) limits the long-term impact of e-commerce and logistics leaks such as 2020 and Global-e (2026).
  • Hardware-based intent validation: critical actions require a physical NFC interaction, rendering remote phishing and fake-support attacks ineffective after a data leak.
  • Anti-BITB & Anti-Iframe protection: blocks fake Ledger Live interfaces and credential-harvesting windows commonly used in post-leak phishing campaigns.
  • Compromised credential detection: checks whether emails or passwords have appeared in previous breaches, preventing reuse and account takeover.
Global-e Breach Statistics
  • Affected users: Not publicly disclosed (investigation ongoing as of January 2026).
  • Exposed data: Customer names, emails, and delivery contact information.
  • Impact on sensitive assets: None (private keys and funds remained secure).
  • Date of discovery: January 4, 2026.
  • Breach origin: Global-e cloud infrastructure.
⚠️ Critical Alert: Dark Web Resale & Persistent Targeting

A data breach is permanent. Once an identity is associated with a hardware wallet purchase,
the individual remains a high-value target for years.

Sovereign defense: By managing keys and credentials in a hardware-only environment such as SeedNFC HSM,
users can de-link their digital identity from centralized e-commerce databases and recurring leaks.

Official Sources & Expert References

Escalation of Threats: From Delivery Phishing to Physical Coercion

The Global-e delivery-data leak does not merely enable email scams.
It fuels hybrid attacks where digital exposure transitions into real-world coercion.

“Delivery” Phishing: Precision Social Engineering

Attackers exploit order history to send ultra-credible SMS or emails:

  • Scenario: Fake courier messages (customs issue, address error, delayed shipment).
  • Trap: A cloned Ledger interface requesting a recovery phrase to “unlock” delivery.
  • Why it works: The victim is already expecting a shipment or update.

Physical Extortion & Home-Targeting

When physical addresses are exposed, the threat extends beyond cybercrime:

  • Targeted home visits: Criminal groups identify where crypto holders live.
  • Coercion: Victims are forced to sign irreversible transfers under threat.
  • Family pressure: Attacks may involve relatives to break resistance.

“A leaked Ledger delivery address acts as a marker: it tells criminals where the vault is and who holds the key.” This reality forces a fundamental rethink of how security tools are purchased and how identity is exposed.

Official Statements and Expert Sources

Global Reactions: Trust Erosion, Legal Pressure, and Community Backlash

The January 2026 Global-e order-data breach triggered a strong and immediate reaction across the global crypto ecosystem. Unlike earlier technical exploits, this incident reinforced a growing perception that the primary risk no longer lies in cryptography or hardware components, but in ecosystem-level dependencies: e-commerce partners, logistics providers, and identity-linked metadata.

Across English-speaking communities (Reddit, X, Discord, Telegram), the dominant sentiment was not surprise, but fatigue. For many users, Global-e represented the third major reminder—after 2020 and 2023—that hardware security alone does not guarantee user safety.

Recurring Themes in Anglophone Communities

  • Collapse of “secure-by-brand” trust: Ledger’s hardware is still widely perceived as technically robust, but confidence in the surrounding commercial and data-handling ecosystem has eroded.
  • Metadata as the real vulnerability: Users increasingly recognize that names, emails, delivery addresses, and purchase history enable profiling, targeting, and coercion—even when private keys remain secure.
  • Phishing industrialization: Highly personalized scams (fake delivery notices, fake compliance alerts, fake support cases) are now viewed as an unavoidable consequence of large-scale data leaks.

From Cybersecurity to Legal and Regulatory Exposure

In the United States, United Kingdom, and European Union, discussions rapidly shifted toward legal accountability and consumer protection, backed by official frameworks:

  • Class action risk (US / UK): Law firms are examining collective lawsuits for negligence and failure of duty of care, citing precedents in data breach litigation.
  • Regulatory scrutiny: Data-protection authorities like the CNIL (EU) and the ICO (UK) have emphasized strict third-party dependency management under GDPR.
  • Law-enforcement alerts: Agencies like Cybermalveillance.gouv.fr and the FBI (IC3) emphasize that crypto-related leaks increasingly enable hybrid crime, combining cyber-fraud with real-world intimidation.

Hybrid Threat Escalation: From Phishing to Physical Coercion

The Global-e breach illustrates a broader evolution of crypto-crime: the transition from purely digital theft to hybrid attack models, a trend confirmed by the INTERPOL Global Cybercrime reports.

Precision Phishing at Global Scale

Attackers leverage order metadata to craft highly credible messages. As reported by The Block, these campaigns include:

  • Fake courier notifications (customs delay, address issues)
  • Cloned Ledger Live portals requesting recovery phrases
  • Social-engineering scripts tailored to purchase history

Physical Targeting and Extortion Risks

Once physical addresses are exposed, risks extend beyond cybercrime, aligning with the Chainalysis Crypto Crime evolution analysis:

  • Home targeting: Criminal groups identify where high-value crypto holders live.
  • Forced transactions: Victims are coerced into signing irreversible transfers via physical threats.
  • Family leverage: Threats may extend to relatives to break resistance.

“A leaked delivery address does not steal funds—but it identifies the vault and the person holding the key.”

This realization has driven a growing demand for identity-minimizing, hardware-sovereign security models built on privacy-by-design principles —such as those prioritizing “Privacy by Design” by erasing all digital purchase records—to decouple asset protection from centralized logistics vulnerabilities.

Permanent Air-Gapped Secret Sharing: RSA-4096 Encrypted QR Between SeedNFC HSM Devices

SeedNFC implements a fully air-gapped secret-sharing mechanism based on an
RSA-4096 encrypted QR code using the recipient’s public key.
The recipient must be another SeedNFC HSM, ensuring that only that device can decrypt and
import the secret directly into hardware.

The QR code is only an encrypted transport container. It can be displayed locally, sent as an image,
or even shown during a video call. Without physical possession of the recipient SeedNFC HSM,
the content remains mathematically unusable.

  • Offline asymmetric encryption: the secret is never exposed in plaintext inside the QR code.
  • Zero infrastructure: no server, no account, no database, no cloud.
  • Operational + logical air-gap: sharing remains possible without any network connectivity.

This mechanism includes no revocation, no delay, and no expiration: the transfer is permanent by design.
It enables direct hardware → hardware transfer of critical secrets (seed phrases, private keys, access credentials)
between isolated HSM devices, with no software intermediary and no blockchain involvement.

Clarification: secret transfer ≠ transaction signing

SeedNFC HSM is not presented here as a transaction signer. Its role is upstream: to generate, store, and transfer secrets (seed phrases, private keys) or authentication data (IDs/passwords, hot-wallet access, proprietary systems) within a sovereign hardware boundary.

It can also store encrypted seed phrases from third-party wallets (Ledger, Trezor, software hot wallets, etc.) and their associated private keys, without depending on the original vendor’s firmware, software, or infrastructure.

Depending on the use case, data can be injected in a controlled way into an application field through Bluetooth HID keyboard emulation (e.g., migration, restore, login).

Web complement: for browser workflows, equivalent controlled input can be triggered via the Freemindtronic browser extension (explicit field selection). This eliminates exposure via clipboard, temporary files, or cloud sync, and strongly reduces risk from classic software keyloggers, since the user does not type anything.

Scope note: like any input, data may still become observable at the display point or on a compromised host (screen capture, application malware). The goal is to remove “copy/paste + file” vectors and human typing—not to make an infected system “invulnerable”.

Important: transferring a private key transfers ownership (full control over the associated funds).This is relevant for backup, migration, inheritance, or off-chain ownership transfer, but must be used with strict operational discipline.

Why this matters after data leaks: even if metadata is exposed, secrets can remain isolated and transferable without re-entering a connected vendor ecosystem.

Comparison with other crypto wallets

Ledger is not the only solution to secure your cryptocurrencies. There are other options, such as other hardware wallets, software wallets, or exchanges. Each option has its advantages and disadvantages, depending on your needs and preferences.

Other Hardware Wallets

For example, other hardware wallets, such as Trezor, offer similar features and security levels as Ledger, but they may have different designs, interfaces, or prices.

Software Wallets

Software wallets, such as Exodus or Electrum, are more convenient and accessible, but they are less secure and more vulnerable to malware or hacking.

Exchanges

Exchanges, such as Coinbase or Binance, are more user-friendly and offer more services, such as trading or staking, but they are more centralized and risky, as they can be hacked, shut down, or regulated.

Security Vector Traditional USB Wallet Freemindtronic NFC HSM
Physical Attack Surface High (USB ports, Battery, Screen) Minimal (No ports, No battery)
Data Persistence Risk of flash memory wear High (EviCore long-term integrity)
Side-Channel Leakage Possible (Power consumption analysis) Immune (Passive induction)

Cold Wallet Alternatives

Another option is to use a cold wallet, such as SeedNFC HSM, which is a patented HSM that uses NFC technology to create, store, and transfer cryptographic secrets (seed phrases, private keys, credentials) in an offline, hardware-only environment, without any connection to the internet or a computer. It also allows you to create up to 100 cryptocurrency wallets and check the balances from this NFC HSM.

Internationally Patented Sovereign Technology

To address the structural flaws identified in traditional hardware wallets, Freemindtronic uses a unique architecture protected by international patents (WIPO). These technologies ensure that the user remains the sole master of their security environment.

  • Access Control System Patent WO2017129887
    Guarantees physical-to-digital integrity by ensuring the HSM can only be triggered by a specific, intentional human action, preventing remote exploitation.
  • Segmented Key Authentication System Patent WO2018154258
    Provides a defense-in-depth mechanism where secrets are fragmented. This prevents a “single point of failure,” making “Connect Kit” type attacks or firmware replacements ineffective.

Technological, Regulatory, and Societal Projections

The future of cryptocurrency security is uncertain and challenging. Many factors can affect Ledger and its users, such as technological, regulatory, or societal changes.

Technological changes

It changes could bring new threats, such as quantum computing, which could break the encryption of Ledger devices, or new solutions, such as biometric authentication or segmented key authentication patented by Freemindtronic, which could improve the security of Ledger devices.

Regulatory changes

New rules or restrictions could affect Cold Wallet and Hardware Wallet manufacturers and users, such as Ledger. For example, KYC (Know Your Customer) or AML (Anti-Money Laundering) requirements could compromise the privacy and anonymity of Ledger users. They could also ban or limit the use of cryptocurrencies, which could reduce the demand and value of Ledger devices. On the other hand, other manufacturers who have anticipated these new legal constraints could have an advantage over Ledger. Here are some examples of regulatory changes that could affect Ledger and other crypto wallets:

  • MiCA, the proposed EU regulation on crypto-asset markets, aims to create a harmonized framework for crypto-assets and crypto-asset service providers in the EU. It also seeks to address the risks and challenges posed by crypto-assets, such as consumer protection, market integrity, financial stability and money laundering.The Markets in Crypto-Assets (MiCA) regulation, specifically Title V on service provider obligations, is now the gold standard. Freemindtronic technologies are designed to align with the Official Regulation (EU) 2023/1114, ensuring privacy while meeting compliance needs.
  • U.S. interagency report on stablecoins recommends that Congress consider new legislation to ensure that stablecoins and stablecoin arrangements are subject to a federal prudential framework. It also proposes additional features, such as limiting issuers to insured depository institutions, subjecting entities conducting stablecoin activities (e.g., digital wallets) to federal oversight, and limiting affiliations between issuers and commercial entities.
  • Revised guidance from the Financial Action Task Force (FATF) on virtual assets and virtual asset service providers (VASPs) clarifies the application of FATF standards to virtual assets and VASPs. It also introduces new obligations and recommendations for PSAVs, such as the implementation of the travel rule, licensing and registration of PSAVs, and supervision and enforcement of PSAVs.

These regulatory changes could have significant implications for Ledger and other crypto wallets. They could require them to comply with new rules and standards, to obtain new licenses or registrations, to implement new systems and processes, and to face new supervisory and enforcement actions.

Societal changes

Societal changes could influence the perception and adoption of Ledger and cryptocurrencies, such as increased awareness and education, which could increase the trust and popularity of Ledger devices, or increased competition and innovation, which could challenge the position and performance of Ledger devices. For example, the EviSeed NFC HSM technology allows the creation of up to 100 cryptocurrency wallets on 5 different blockchains chosen freely by the user.

Technological Alternatives for Absolute Sovereignty

The persistence of Ledger Security Breaches demonstrates that relying on a single centralized manufacturer creates a systemic risk. Today, decentralized alternatives developed by Freemindtronic in Andorra offer a paradigm shift: security based on hardware proof and physical intent, rather than brand trust.

Technologies such as EviCore NFC HSM and EviSeed NFC HSM are not just wallets; they are contactless cybersecurity ecosystems. Unlike Ledger, these devices are battery-less and cable-less, eliminating physical ports (USB/Bluetooth) as attack vectors.

Internationally Patented Security

Freemindtronic’s architecture is anchored by two fundamental international patents (WIPO) that solve the structural flaws found in traditional hardware wallets:

  • Segmented Key Authentication System (WO2018154258): Prevents the compromise of the whole seed or private key, even if the environment is attacked.
  • Access Control System (WO2017129887): Ensures that the HSM can only be triggered by the user’s physical intent via NFC, neutralizing remote software threats.

Unified Security: Hardware-Based Password Management

One of the most innovative features of the SeedNFC HSM is its integration of the EviPass NFC HSM technology. This addresses the “human factor” exploited in phishing scams.

  • Decentralized & Passwordless: Manage non-morphic passwords without ever storing them on a computer.
  • Physical Entropy: Immunity to keyloggers and screen recorders used in the Connect Kit attacks.
  • Contactless Convenience: Secure auto-fill by simply tapping your device.

Universal Access: Smartphone & Desktop Integration

On Android: Use native NFC for instant, battery-free hardware security.
On Desktop: Secure authentication directly in your browser via the Freemindtronic Extension.

Advanced “Air-Gap” Input: Keyboard Emulation

To bypass compromised clipboards, Fullsecure with Inputstick enables hardware-level data injection.

How it works: Your smartphone acts as a Bluetooth HID Keyboard, “typing” secrets directly into any device.

  • No Clipboard Exposure: Secrets never pass through the computer’s buffer.
  • Hardware Injection: Neutralizes software-based keyloggers relying on human keystroke capture.

Important clarification: transferring a private key is not a transaction. It is an off-chain transfer of ownership, granting full control over the associated assets.

Explore Fullsecure & Inputstick →

Active Defense: Neutralizing BITB & Redirection Attacks

The SeedNFC HSM ecosystem, when paired with the free PassCypher HSM PGP version and the browser extension, provides a unique multi-layered shield against modern web threats:

    • Anti-BITB (Browser-In-The-Browser): The extension features a dedicated anti-iframe system. It detects and blocks malicious windows that simulate fake login screens—a common tactic used to steal Ledger credentials.
    • Automated Corruption Check: Integrated with Have I Been Pwned, the system automatically checks if your IDs or passwords have been compromised in historical leaks, ensuring you never use “vulnerable” credentials.
    • End-to-End Encrypted Auto-fill: Sensitive data is encrypted directly within the SeedNFC HSM on your Android device. It is only decrypted at the final millisecond of injection into the browser, ensuring that no plain-text data ever resides in the computer’s memory.

How to use: Open the Freemindtronic Android App (where SeedNFC is embedded), tap your HSM to your phone, and let the secure bridge handle the encrypted injection directly into your Chrome or Edge browser.

Best Practices to Protect Yourself

  • Never share your seed phrase or private keys — no support, update, delivery, or compliance process ever requires them.
  • Assume all inbound communication is hostile by default — (email, SMS, phone, social media). Always verify via official, manually accessed channels.
  • Strictly separate identity from asset ownership — use a dedicated email, avoid real-name linkage, and minimize purchase metadata exposure.
  • Avoid blind signing whenever possible — never sign transactions or approvals you cannot fully interpret and verify.
  • Prefer sovereign, hardware-only cold storage — (e.g., patented NFC HSM architectures) that do not rely on vendor servers, firmware updates, or e-commerce ecosystems.
  • Keep secrets out of connected environments — avoid clipboards, cloud sync, screenshots, password files, and shared devices.
  • Use hardware-enforced authentication and password management — to neutralize phishing, BITB, and credential reuse.
  • Plan for irreversible scenarios — define secure procedures for backup, migration, inheritance, and off-chain ownership transfer.
  • Accept operational responsibility — sovereignty implies discipline, physical control, and acceptance that some actions cannot be undone.

Securing the Future: From Vulnerability to Digital Sovereignty

Since 2017, the trajectory of Ledger Security Breaches has served as a critical case study for the entire crypto ecosystem. While Ledger remains a pioneer in hardware security, the recurring incidents—ranging from early physical exploits to the massive 2026 Global‑e data leak—demonstrate that a “secure device” is no longer enough. The threat has shifted from the chip itself to the systemic supply chain and the exposure of relational data.

The January 2026 incident confirms a persistent reality: even when private keys remain shielded, the leak of customer metadata (names, emails, and order history) creates a permanent risk of targeted phishing, doxxing, and social engineering. This highlights the inherent danger of centralized e‑commerce databases and the fragility of relying on third‑party partners for a product whose core promise is absolute security.

The Sovereign Alternative: Security by Design

To break this cycle of dependency, the paradigm must shift toward decentralized hardware security. This is where patented technologies developed by Freemindtronic in Andorra provide a structural response:

  • Physical Intent & Access Control (WO2017129887): Eliminates the remote attack surface by requiring a physical, contactless validation that cannot be spoofed by malicious software updates.
  • Segmented Key Authentication (WO2018154258): Protects against systemic breaches (like the Connect Kit attack) by ensuring that secrets are never centralized or fully exposed, even in a compromised environment.

This model does not promise convenience. It requires strict operational discipline, physical control, and acceptance of irreversibility.

For Ledger users, vigilance remains the primary line of defense. Respecting strict digital hygiene—verifying every communication via the official Ledger help center and using dedicated, non‑identifiable contact info for purchases—is essential. However, for those seeking to eliminate the “third‑party risk” entirely, transitioning to battery‑less, contactless, and patented NFC HSM solutions represents the next step in achieving true digital sovereignty.

As the crypto landscape evolves through 2026 and beyond, the lesson is clear: Don’t just trust the brand—trust the architecture.

Technical Reference: The EviCore and SeedNFC architectures are based on WO2017129887 and WO2018154258 patents. Developed by Freemindtronic Andorra for absolute digital sovereignty.

Uncategorized

LitterDrifter: A USB Worm for Cyberespionage

Posted on by FMTAD
LitterDrifter A USB Worm for Cyberespionage
28
Nov
LitterDrifter by Jacques Gascuel: This article will be updated with any new information on the topic.

LitterDrifter: USB Worm Threat and Safeguarding

Explore the LitterDrifter USB worm threat and effective safeguards. Learn to protect against this cyber threat and enhance data security.

LitterDrifter: A USB Worm for Cyberespionage and Its Threats to Data Security

LitterDrifter is a computer worm that spreads through USB drives and is utilized by a Russian cyber espionage group known as Gamaredon. This group, active since at least 2013, primarily targets Ukraine but has also infected systems in other countries. LitterDrifter enables Gamaredon to gather sensitive information, execute remote commands, and download other malicious software. In this article, we will explore how this worm functions, methods to safeguard against it, and the motivations behind its creators.

Understanding Gamaredon

Gamaredon is a cyber espionage group suspected to have ties to Russia’s Federal Security Service (FSB). It conducts intelligence and sabotage operations against strategic targets in Ukraine, including government institutions, law enforcement, media, political organizations, and dissidents. Gamaredon plays a part in the hybrid warfare between Russia and Ukraine that emerged in 2014 following the annexation of Crimea and the armed conflict in Donbass.

Gamaredon employs a diverse range of cyberattack techniques, including phishing, disinformation, sabotage, and espionage. The group possesses several malicious tools such as Pterodo, Outlook Forms, VBA Macros, LNK Spreader, and, of course, LitterDrifter. Gamaredon is considered a group that learns from its experiences and adapts its tactics based on responses from its adversaries. It also serves as a training ground for Russia, observing the potential of cyber warfare in contemporary conflicts.

How LitterDrifter Works

LitterDrifter is a computer worm initially discovered in October 2021 by cybersecurity company Check Point Research. It is written in VBS and consists of two main modules: a propagation module and a communication module.

LitterDrifter’s Propagation

The propagation module is responsible for copying the worm to USB drives connected to the infected computer. It creates an autorun.inf file that allows the worm to launch automatically upon inserting an infected drive. Additionally, it generates an LNK file that serves as bait, featuring a random name to entice the user to click on it. The worm’s name is derived from the initial file name, “trash.dll,” which means “garbage” in English.

LitterDrifter’s Communication

The communication module establishes contact with the worm’s authors’ command and control (C2) server. It uses domains as markers for the actual IP addresses of the C2 servers. It can also connect to a C2 server extracted from a Telegram channel, a technique employed by Gamaredon since early 2021. The communication module allows the worm to collect information about the infected system, such as the computer name, username, IP address, operating system, process list, files on the hard drive, and USB drives. It can also execute remote commands, download and install other malicious software, and delete files or partitions.

How LitterDrifter Propagates

LitterDrifter is primarily intended to target Ukraine but has also been detected in other countries, including Latvia, Lithuania, Poland, Romania, Turkey, Germany, France, the United Kingdom, the United States, Canada, India, Japan, and Australia. The worm appears to spread opportunistically, taking advantage of USB exchanges and movements among individuals and organizations. Some of the victims may be secondary targets infected inadvertently, while others could be potential targets awaiting activation.

LitterDrifter Statistics

LitterDrifter is a rapidly spreading worm that affects a large number of systems. According to data from Check Point Research, the worm has been submitted to VirusTotal more than 1,000 times since October 2021, originating from 14 different countries. The majority of submissions come from Ukraine (58%), followed by the United States (12%) and Vietnam (7%). Other countries each represent less than 5% of submissions.

The worm also uses a large number of domains as markers for C2 servers. Check Point Research has identified over 200 different domains used by the worm, with most being free or expired domains. Some domains have been used by Gamaredon for a long time, while others are created or modified recently. The worm also uses Telegram channels to extract C2 server IP addresses, making their blocking or tracking more challenging.

The worm is capable of downloading and installing other malicious software on infected systems. Among the malicious software detected by Check Point Research are remote control tools, spyware, screen capture software, password stealers, file encryption software, and data destruction software. Some of these malicious software are specific to Gamaredon, while others are generic or open-source tools.

Uncontrolled Expansion and Real Consequences of LitterDrifter

LitterDrifter is a worm with uncontrolled expansion, meaning it spreads opportunistically by taking advantage of the movement and exchange of USB drives among individuals and organizations. It doesn’t have a specific target but can infect systems in various countries, without regard to the industry sector or security level. Consequently, it can affect critical systems, including infrastructure, public services, or government institutions.

The real consequences of LitterDrifter are manifold and severe. It can compromise the confidentiality, integrity, and availability of data. Moreover, it can serve as a gateway for more sophisticated attacks, such as deploying ransomware, spyware, or destructive software. Additionally, it can enable the worm’s authors to access sensitive information, including confidential documents, passwords, personal data, or industrial secrets.

LitterDrifter can have serious repercussions for victims, including damage to reputation, financial costs, data loss, disruption of operations, or legal liability. It can also impact national security, political stability, or the sovereignty of targeted countries. It is part of the context of a hybrid war waged by Russia against Ukraine, aiming to weaken and destabilize its neighbor through military, political, economic, media, and cyber means.

LitterDrifter’s Attack Methods

Understanding the attack methods employed by LitterDrifter is crucial in safeguarding your systems. This USB worm leverages various techniques to infiltrate systems and establish contact with its command and control (C2) servers. Below, we delve into the primary attack methods used by LitterDrifter:

Attack Method Description Example
Vulnerability Exploitation Exploiting known vulnerabilities in software and network protocols, such as SMB, RDP, FTP, HTTP, SSH, etc. It employs tools like Metasploit, Nmap, and Mimikatz to scan systems, execute malicious code, steal credentials, and propagate. Utilizing the EternalBlue vulnerability to infect Windows systems via the SMB protocol and install a backdoor.
Phishing Sending fraudulent emails containing malicious attachments or links that entice users to open or click. Attachments or links trigger the download and execution of LitterDrifter. Sending an email pretending to be an invoice from a supplier but containing a malicious Word file that exploits the CVE-2017-0199 vulnerability to execute LitterDrifter.
Identity Spoofing Impersonating legitimate services or applications through similar names, icons, or interfaces. This deceives users or administrators into granting privileges, access, or sensitive information. Using the name and icon of TeamViewer, a remote control software, to blend into the process list and establish a connection with C2 servers.
USB Propagation Copying itself to USB drives connected to infected computers, automatically running upon insertion. It also creates random-named LNK files as bait, encouraging users to click. When a user inserts an infected USB drive into their computer, the worm copies itself to the hard drive and executes. It also creates an LNK file named “Holiday Photos.lnk” pointing to the worm.
Domain Marker Usage Using domains as markers for actual C2 server IP addresses. It generates a random subdomain of a hardcoded domain (e.g., 4fj3k2h5.example.com from example.com) and resolves its IP address through a DNS query. It then uses this IP address for communication with the C2 server. Generating the subdomain 4fj3k2h5.example.com from the hardcoded domain example.com, resolving its IP address through a DNS query (e.g., 192.168.1.100), and using it to send data to the C2 server.

LitterDrifter’s Malicious Actions

LitterDrifter is a worm that can cause significant damage to infected systems. It not only collects sensitive information but can also execute remote commands, download and install other malicious software, and delete files or partitions. Here’s a table summarizing LitterDrifter’s main malicious actions:

Action Description Example
Information Collection The worm gathers information about the infected system, including computer name, username, IP address, OS, process list, files on the hard drive, and USB drives. The worm sends the collected information to the C2 server via an HTTP POST request.
Remote Command Execution The worm can receive remote commands from the C2 server, such as launching a process, creating a file, modifying the registry, opening a URL, etc. The worm can execute a command like cmd.exe /c del /f /s /q c:\*.* to erase all files on the C drive.
Download and Malware Installation The worm can download and install other malicious software on the infected system, such as remote control tools, spyware, screen capture software, password stealers, file encryption software, and data destruction software. The worm can download and install the Pterodo malware, allowing Gamaredon to take control of the infected system.
File or Partition Deletion The worm can delete files or partitions on the infected system, potentially leading to data loss, system corruption, or boot failure. The worm can erase the EFI partition, which contains system boot information.

Protecting Against LitterDrifter

Safeguarding your systems against LitterDrifter and similar threats is essential in today’s interconnected digital landscape. Here are some steps you can take to enhance your cybersecurity posture:

  1. Keep Software Updated: Regularly update your operating system, software, and antivirus programs to patch known vulnerabilities that malware like LitterDrifter exploits.
  2. Exercise Caution with Email Attachments and Links: Be cautious when opening email attachments or clicking on links, especially if the sender is unknown or the email seems suspicious. Verify the legitimacy of the sender before taking any action.
  3. Use Reliable Security Software: Install reputable security software that can detect and block malware. Ensure that it is regularly updated to recognize new threats effectively.
  4. Employ Network Segmentation: Implement network segmentation to isolate critical systems and data from potentially compromised parts of your network.
  5. Educate Employees: Train your employees to recognize phishing attempts and the importance of safe browsing and email practices.
  6. USB Drive Security: Disable autorun features on computers and use endpoint security solutions to scan USB drives for malware upon insertion.
  7. Network Monitoring: Implement network monitoring tools to detect unusual activities and unauthorized access promptly.
  8. Encryption and Authentication: Use encryption for sensitive data and multi-factor authentication to secure critical accounts.

Enhancing Data Security with HSM Technologies

In addition to the steps mentioned above, organizations can enhance data security by leveraging NFC HSM (Near Field Communication and Hardware Security Module). These specialized devices provide secure storage and processing of cryptographic keys, protecting sensitive data from unauthorized access.

HSMs offer several advantages, including tamper resistance, hardware-based encryption, and secure key management. By integrating HSMs into your cybersecurity strategy, you can further safeguard your organization against threats like LitterDrifter.

Leveraging NFC HSM Technologies Made in Andorra by Freemindtronic

To take your data security to the next level, consider utilizing NFC HSM technologies manufactured in Andorra by Freemindtronic. These state-of-the-art devices are designed to meet the highest security standards, ensuring the confidentiality and integrity of your cryptographic keys.

Freemindtronic innovates, manufactures white-label NFC HSM technologies, including PassCypher NFC HSM and DataShielder Defense NFC HSM. These solutions, like EviPass, EviOTP, EviCypher, and EviKey, effectively combat LitterDrifter. They enhance data security, protecting against unauthorized access and decryption, even in the era of quantum computing.

With HSMs from Freemindtronic, you benefit from:

  • Tamper Resistance: HSMs are built to withstand physical tampering attempts, providing an added layer of protection against unauthorized access.
  • Hardware-Based Encryption: Enjoy the benefits of hardware-based encryption, which is more secure than software-based solutions and less susceptible to vulnerabilities.
  • Secure Key Management: HSMs enable secure generation, storage, and management of cryptographic keys, reducing the risk of key compromise.

By integrating HSMs into your organization’s security infrastructure, you can establish a robust defense against threats like LitterDrifter and ensure the confidentiality and integrity of your sensitive data.

Conclusion

Staying One Step Ahead of LitterDrifter

LitterDrifter, the USB worm associated with the Gamaredon cyber espionage group, poses a significant threat to cybersecurity. Its ability to infiltrate systems, collect sensitive data, and execute malicious actions underscores the importance of proactive protection.

By understanding LitterDrifter’s origins, functionality, and impact, as well as implementing robust cybersecurity measures, you can shield your organization from this perilous threat. Additionally, NFC HSM technologies offer an extra layer of security to safeguard your data and secrets.

Stay vigilant, stay informed, and stay ahead of LitterDrifter and the ever-evolving landscape of cyber threats.

Articles, Digital Security, EviCore NFC HSM Technology, EviPass NFC HSM technology, NFC HSM technology

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures

Posted on by FMTAD
TETRA Security Vulnerabilities secured by EviPass or EviCypher NFC HSM Technologies from Freemindtronic-Andorra
27
Nov
TETRA Security Vulnerabilities by Jacques Gascuel: This article will be updated with any new information on the topic.

TETRA Security Vulnerabilities

Tetra is a radio communication standard used by critical sectors worldwide. But it has five security flaws that could expose its encryption and authentication. How can you protect your Tetra system from hackers? Read this article TETRA Security Vulnerabilities to find out the best practices and tips.

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures from Cyberattacks

TETRA (Terrestrial Trunked Radio) is a radio technology that is used worldwide for critical communications and data, especially in the sectors of security, energy, transport and defense. But this technology, which has been kept secret for more than 25 years, hides serious security vulnerabilities, including a backdoor that could allow devastating cyberattacks.

What is TETRA?

TETRA is a European radio standard that was developed in the 1990s to meet the needs of professional mobile services, such as police, firefighters, emergency services, military, prison staff, etc. TETRA allows to transmit data and voice encrypted on frequencies ranging from 380 to 470 MHz, with a range of several kilometers.

TETRA is used by more than 2000 networks in more than 150 countries, according to the TETRA and Critical Communications Association (TCCA), which brings together the manufacturers, operators and users of this technology. Among the main manufacturers of TETRA radios, we find Motorola Solutions, Hytera, Airbus, Sepura and Rohill.

TETRA offers several advantages over other radio technologies, such as:

  • better sound quality
  • greater transmission capacity
  • greater security thanks to encryption
  • greater flexibility thanks to the possibility of creating communication groups
  • greater interoperability thanks to the compatibility of equipment

Source french: TETRA digital mode & F4HXZ – Blog radioamateur

What are the vulnerabilities of TETRA?

Despite its strengths, TETRA also has weaknesses, which have been revealed by a group of Dutch researchers from Radboud University Nijmegen. These researchers conducted a thorough analysis of the TETRA standard and its encryption algorithms, which were until then kept secret by the manufacturers and authorities.

The researchers discovered two types of major vulnerabilities in TETRA:

  • A backdoor in the encryption algorithm TEA1, which is used in radios sold for sensitive equipment, such as pipelines, railways, power grid, public transport or freight trains. This backdoor allows an attacker to decrypt the communications and data transmitted by these radios, and possibly to modify or block them. The backdoor exists since the creation of the algorithm TEA1, in 1998, and cannot be corrected by a simple software update. The researchers managed to extract the secret key of the backdoor by analyzing the binary code of the radios.
  • A weakness in the encryption algorithm TEA2, which is used in radios intended for professional mobile services, such as police, firefighters, emergency services, military or prison staff. This weakness allows an attacker to reduce the number of possible keys to test to decrypt the communications and data transmitted by these radios. The researchers estimated that it would take about 10 minutes to find the right key with a standard computer. This weakness was corrected by the manufacturers in 2016, but the radios that have not been updated remain vulnerable.

To find the backdoor in the TEA1 algorithm, the researchers used a technique called “differential analysis”, which consists of comparing the outputs of the algorithm for slightly different inputs. By observing the differences, they were able to identify a part of the code that was not normally used, but that was activated by a special condition. This condition was the presence of a secret key of 64 bits, which was hidden in the binary code of the radios. By analyzing the code, they were able to extract the secret key and test it on encrypted communications with the TEA1 algorithm. They were thus able to confirm that the secret key allowed to decrypt the communications without knowing the normal key of 80 bits. The researchers published their official report and the source code of the TETRA encryption algorithms on their website.

Source: https://cs.ru.nl/~cmeijer/publications/All_cops_are_broadcasting_TETRA_under_scrutiny.pdf

What are the risks for critical infrastructures?

The vulnerabilities identified in TETRA represent a danger for the critical infrastructures that use this technology, because they could be exploited by cybercriminals, terrorists or spies to disrupt or damage these infrastructures.

For example, an attacker could:

  • listen to the communications and confidential data of the security or defense services
  • impersonate an operator or a manager to give false instructions or orders
  • modify or erase data or commands that control vital equipment, such as valves, switches, signals or brakes
  • cause failures, accidents, fires or explosions

These scenarios could have dramatic consequences on the security, health, economy or environment of the countries concerned.

How to protect yourself from cyberattacks on TETRA?

The users of TETRA must be aware of the vulnerabilities of this technology and take measures to protect themselves from potential cyberattacks. Among the recommendations of the researchers, we can mention:

  • check if the radios used are affected by the vulnerabilities and ask the manufacturers for correction solutions
  • avoid using the algorithm TEA1, which contains the backdoor, and prefer safer algorithms, such as TEA3 or TEA4
  • use encryption keys that are long and complex enough, and change them regularly
  • set up verification and authentication procedures for communications and data
  • monitor the radio traffic and detect anomalies or intrusion attempts
  • raise awareness and train staff on cybersecurity and good practices

TETRA digital mode: how to transfer data via TETRA

TETRA (Terrestrial Trunked Radio) is a digital and secure radio communication standard used by emergency services, law enforcement, public transport and industries. TETRA uses a π/4-DQPSK phase modulation and a TDMA time division multiplexing to transmit voice and data on a bandwidth of 25 KHz per transmission channel. Each channel is divided into four timeslots, one of which is reserved for signaling in trunked mode (TMO).

TETRA allows file transfer via radio in two ways: by the packet data service (PDS) or by the circuit data service (CDS).

The PDS uses the IP protocol to transmit data packets on one or more timeslots. It offers a maximum throughput of 28.8 kbit/s per timeslot, or 86.4 kbit/s for three timeslots. The PDS can be used to send small files, such as images, text messages or forms.

The CDS uses the LAPD protocol to transmit data by circuit on a dedicated timeslot. It offers a constant throughput of 4.8 kbit/s per timeslot, or 19.2 kbit/s for four timeslots. The CDS can be used to send large files, such as documents, videos or maps.

The choice of the data service depends on the type of file, the size of the file, the quality of the radio link, the cost and the availability of radio resources. The PDS offers more flexibility and performance, but it requires a good signal quality and it can be more expensive in terms of battery consumption and spectrum occupation. The CDS offers more reliability and simplicity, but it requires a prior allocation of a timeslot and it can be slower and less efficient.

Securing TETRA file transfers with Freemindtronic’s EviCypher technology

However, both data services are subject to the TETRA security vulnerabilities that we have discussed in the previous sections. These vulnerabilities could allow an attacker to intercept, modify or corrupt the files transferred via TETRA, or to prevent their transmission altogether. Therefore, the users of TETRA must ensure the integrity and the confidentiality of the files they send or receive, by using encryption, verification and authentication methods. Freemindtronic’s EviCypher technology can be a valuable solution for encrypting data with post-quantum AES-256 from an NFC HSM with your own randomly generated keys before transferring them via TETRA. This way, even if an attacker corrupts the data transmitted by TETRA, they will not be able to decrypt the data encrypted by a product embedding

How to secure file transfers via TETRA with Freemindtronic’s EviCypher technology

La technologie EviCypher de Freemindtronic peut être une solution précieuse pour chiffrer les données avec AES-256 post-quantique à partir d’un HSM NFC avec vos propres clés générées aléatoirement avant de les transférer via TETRA. Ainsi, même si un attaquant corrompt les données transmises par TETRA, il ne pourra pas décrypter les données cryptées par un produit embarquant la technologie EviCypher NFC HSM technology, such as DataShielder NFC HSM or DataSielder Defense NFC HSM. These products are portable and autonomous devices that allow you to secure the access to computer systems, applications or online services, using the NFC as a means of authentication and encryption.

The management of encryption keys for TETRA

To use encryption on the TETRA network, you need an encryption key, which is a secret code of 80 bits, or 10 bytes. This key must be shared between the radios that want to communicate securely, and must be protected against theft, loss or compromise.

There are several methods to save and enter encryption keys for TETRA, depending on the type of radio and the level of security required. Here are some examples:

  • The manual method: it consists of entering the encryption key using the keyboard of the radio, by typing the 10 bytes in hexadecimal form. This method is simple, but impractical and unsafe, because it requires to know the key by heart or to write it down on a support, which increases the risk of disclosure or error. For example, a 80-bit key could be 3A4F9C7B12E8D6F0.
  • The automatic method: it consists of using an external device, such as a computer or a smart card, which generates and transfers the encryption key to the radio by a cable or a wireless link. This method is faster and more reliable, but it requires to have a compatible and secure device, and to connect it to the radio at each key change.
  • The EviPass method: it consists of using the EviPass NFC HSM technology which allows to generate, store and manage keys and secrets in a secure and independent NFC HSM device. This method is the most innovative and secure, because it allows to create keys higher than 80 bits randomly in hexadecimal base 16, 58, 64 or 85, to store them in a physical device protected by an access code and a robust AES-256 post-quantum encryption algorithm, and to transfer them by various contactless means, via a computer. This method does not require to know or write down the key, which reduces the risk of disclosure or error. For example, a 10-byte key of 80 bits could be 3F 8A 6B 4C 9D 1E 7F 2A 5B 0C.

The EviPass NFC HSM technology of Freemindtronic allows to create secure gateways between the NFC devices and the computer systems, using advanced encryption protocols, such as AES, RSA or ECC. The EviPass NFC HSM technology is embedded in the PassCyber NFC HSM product, which is a portable and autonomous device that allows to secure the access to computer systems, applications or online or offligne services, using the NFC as a means of authentication.

Conclusion

TETRA is a radio technology that was designed to offer secure and reliable communication to professional mobile services and critical infrastructures. But this technology, which has been kept secret for decades, presents vulnerabilities that could be exploited by cyberattackers to compromise these communications and infrastructures. The users of TETRA must be vigilant and take measures to protect themselves from these threats, by updating their equipment, choosing robust encryption algorithms, using strong keys, verifying and authenticating data and monitoring radio traffic. The EviPass NFC HSM technology of Freemindtronic can be an effective solution to strengthen the security of keys and secrets used for verification and authentication, by storing them in a secure and independent NFC device. The researchers who revealed the vulnerabilities of TETRA hope that their work will contribute to improve the security of communications in critical domains.

Articles, DataShielder, News

DataShielder Defense NFC HSM: Protect Your Sovereign Communications

Posted on by FMTAD
DataShielder Defense NFC HSM Protect your Sovereign Communications by Freemindtronic Andorra
24
Nov
DataShielder Defense NFC HSM – Jacques Gascuel: This article will be updated with any new information on the topic.

Why You Need DataShielder Defense NFC HSM

DataShielder Defense NFC HSM, a patented solution, ensures maximum confidentiality and anonymization of communications from sovereign entities. Using NFC technology, this HSM manages up to 200 secrets offline, contactless and shareable via any communication method, including email and SMS. A GreenTech innovation, it is interoperable, backward compatible and versatile, designed to immediately respond to various specific needs and customizable for enhanced secret security.

DataShielder Defense NFC HSM: How to Protect Your Sovereign Communications with a Revolutionary Solution

The protection of sovereign entities and the enhancement of existing defense and intelligence systems are crucial challenges in today’s world. Sovereign communications, such as those between heads of state, diplomats, military personnel, or secret agents, are constantly exposed to threats of interception, hacking, or manipulation. These threats can compromise the security, integrity, and confidentiality of sensitive information, and have serious consequences for national and international security.

To address these challenges, a revolutionary solution has been developed by Freemindtronic, a andorran company specialized in data security and encryption. This solution is called DataShielder Defense NFC HSM, and it is the ultimate solution for protecting all forms of communications of sovereign entities. This innovative and cutting-edge solution, protected by two patents, guarantees an unparalleled level of confidentiality and trust among humans, without compromise. With DataShielder, your secrets and sensitive data remain inaccessible and indecipherable, even in case of compromise of the equipment and information and communication systems.

In this article, we will explain how DataShielder Defense NFC HSM works, what are its features and benefits, and how it can be customized to suit your specific needs. We will also show how this solution could have influenced several major events in the history of communication security, and how it has received international recognition and awards for its excellence.

How DataShielder Defense NFC HSM Works

DataShielder Defense NFC HSM is a device that uses Near Field Communication (NFC) technology to create, store, and use up to 200 different secrets in a single device. A secret can be anything that you want to protect, such as an encryption key, a password, a PIN code, a cryptocurrency key, a bank account information, or a message. DataShielder allows you to share your encrypted secrets via all the means of communication available in the world, such as postal mail, webcam, email, SMS, MMS, RCS, messaging, or directly between two NFC HSM devices.

To use DataShielder, you need an Android NFC phone or tablet, and the DataShielder app, which is available for free on the Google Play Store. You also need a DataShielder Defense NFC HSM device, which is a small and discreet card that can be customized to fit different formats and accessories. The device does not require any battery or external power source, as it uses the energy of the NFC signal of the phone to operate on demand.

To create a secret, you simply need to tap your phone on the device, and choose the type of secret you want to create. You can either generate a random secret, or import an existing one. You can also add specific trust criteria for each secret, such as BSSID, geographical area, password, fingerprint, QR code or barcode scan, and phone UID. The absence of any of these criteria makes the access to the secret impossible, ensuring maximum and personalized security.

To use a secret, you simply need to tap your phone on the device, and choose the secret you want to use. You can either use it directly on your phone, or send it to another device or person. You can also use the secret to unlock secure USB or SSD keys, to log in to your favorite websites, to make secure voice calls and SMS, to manage your banking information, to generate and use cryptocurrency wallets, and more.

To share a secret, you simply need to tap your phone on the device, and choose the secret you want to share. You can either share it directly with another NFC HSM device, or encrypt it with the RSA-4096 public key of the recipient, and send it via any means of communication. The recipient will need to decrypt the secret with their NFC HSM device, using the EviSCP HSM (ZKP) protocol, which is a patented technology that ensures a secure and confidential exchange of secrets.

Differentiating Benefits of DataShielder Defense NFC HSM

DataShielder Defense NFC HSM offers a complete and adaptable solution to your needs, thanks to the set of advanced and efficient features that it incorporates. These features are based on different technologies, each with a specific name and function. Here is a summary of the main features and benefits of DataShielder:

 

Feature Technology Function Benefit
Random generation of symmetric and asymmetric encryption keys EviCypher NFC HSM Encrypt all types of data (texts, images, videos) in post-quantum AES-256. Use the RSA-4096 public key to exchange encrypted secrets between distant NFC devices. Protect your data and secrets from unauthorized access and decryption, even in case of quantum computing attacks.
Random generation of identifiers and passwords EviPass NFC HSM Generate automatically complex and complicated passwords up to 48 characters based on the 95 ASCII characters, or on bases 16, 58, 64 or 85. Import and store manually login identifiers, PIN codes, PUK, lock codes, TPM2.0 passwords, BitLocker… Log in automatically to your favorite websites. Secure your online accounts and devices with strong and unique passwords. Save time and avoid typing errors with automatic login.
Create a segmented key EviAuth NFC HSM Divide your secret into two segments and store them on two different NFC HSM devices. Require the presence of two people to reconstitute the secret. Increase the security and confidentiality of your secret by adding a human factor. Prevent the access to the secret by a single person or device.
Management of secret OTP keys EviOTP NFC HSM Store securely the secret OTP keys whose one-time passwords based on time (TOTP) or HMAC (HOTP) to generate a secondary authentication factor (2FA). Enhance the security of your online accounts and services with a second factor of authentication. Avoid the risk of losing or compromising your OTP keys.
Secure voice calls and SMS EviCall NFC HSM Store your phone contacts and make a voice call from the NFC HSM without leaving any trace in the phone history. Communicate securely and discreetly with your contacts. Avoid the interception and recording of your voice calls and SMS.
Secure management of banking information EviPay NFC HSM Store, manage and use securely the information related to credit cards and bank accounts. Protect your financial information and transactions from fraud and theft. Access and use your banking information easily and securely.
Unlocking of secure USB or SSD keys without contact EviKey NFC HSM Manage the administrator, user and temporary user PIN codes to unlock the secure USB/SSD keys without contact. Secure your external and internal storage with a contactless unlocking system. Manage the access rights and permissions of the USB/SSD keys.
Generation of cryptocurrency wallets EviSeed NFC HSM Automatically and directly create from a blockchain the secret BIP39 key, its derived key, its public key and the public address. The balance verification is done directly on the blockchain. Create and use cryptocurrency wallets securely and conveniently. Store your cryptocurrency keys in an inviolable and encrypted manner. Verify your balance directly on the blockchain.
Automatic import of private keys EviVault NFC HSM Import derived private keys by scanning their QR codes from five blockchain platforms including Bitcoin, Ethereum, Polygon, Binance Smart Chain and IOTA. Create and save also the BIP39 PassPhrases. Import and use private keys from different blockchain platforms easily and securely. Scan the QR codes and store the keys in an encrypted manner. Create and save also the BIP39 PassPhrases.
Management of authentication cards EviCore NFC HSM Scan and store the barcode or QR code of any type of card that uses this type of identification (access cards, loyalty cards sometimes linked to a payment system). Store and use authentication cards securely and conveniently. Scan the barcode or QR code and store it in an encrypted manner.
NFC HSM pairing key manager EviCore NFC HSM Manage the NFC HSM fleet within a sovereign entity. Manage and control the NFC HSM devices within your organization. Assign and revoke pairing keys for the devices.
Data encryption EviCrypt NFC HSM Encrypt your texts and files upstream before sending them to your recipients using your usual messaging services. Encrypt your data before sending it via any means of communication. Ensure that only the intended recipients can decrypt and access your data.
Use on all computer systems EviCore NFC HSM Browser Extension Use your NFC HSM with the free Freemindtronic browser extension based on Chromium and Firefox. Find the DataShielder NFC HSM functions on all your computers. Use your NFC HSM on any computer system.
Use of a virtual USB Bluetooth keyboard EviKeyboard BLE Use a virtual keyboard for secure and discreet input. Extend the use of secrets in HID mode on various computer systems, TPM2.0, BitLocker, Windows, Linux, Apple, proprietary software and web browsers. Don’t touch the keyboard. Enter a free line of code up to 52 characters. Entering BIOS passwords. Easy to use

Stealth Customization Options

The manufacturer Freemindtronic offers a customization service specially designed for sovereign entities, combining discretion and functionality.

Discreet Formats: Modified standard PVC and PCB cards for effective camouflage.

Stealth Accessories: Labels, key rings, promotional pens, and cufflinks subtly integrating NFC HSM devices.

USB Dummy Keys: Mini USB keys functioning as secret containers for the NFC HSM devices.

NFC On/Off Card: PCB cards with switchable NFC antenna for increased stealth.

These options guarantee invisible security, ideal for special operations and covert missions.

Complementary Accessories

  • Secure NFC EviKey USB and SSD Keys: These devices offer secure external and internal storage, perfectly integrated with DataShielder NFC HSM for enhanced data protection.
  • Bluetooth Virtual Keyboard EviKeyboard BLE: An innovative keyboard for secure and discreet input, complementing the DataShielder NFC HSM by an additional layer of security in data entry.

International Distinctions and Awards

The EviCypher NFC HSM technology, essential to DataShielder, has received worldwide recognition, marked by several important awards.

  • Gold Medal 2021 of the Geneva Inventions: EviCypher Technology awarded among hundreds of international inventions.
  • Three Global InfoSec Awards 2021: Awarded for being the best data security solution by Cyber Defense Magazine “Next-Gen in Crypto Security”, “Most Innovative Hardware Password Manager”, “Next-Gen in Secrets Management”.
  • Two E&T Innovation Awards 2021: Distinguished for the best communication and IT solution, as well as for the best cybersecurity solution.
  • Two nominations for the National Cyber Awards 2021 of the United Kingdom: Finalist in two categories “The Innovation in Cyber Award 2021” and “The Cyber Defense Product of the Year 2021”.
  • Gold Globee Award 2022: Cyber Computer NFC winner of a Cyber Security Global Excellence Awards®.
  • Fortress Award 2023: Awarded for its excellence in encryption and privacy protection.

Conclusion

DataShielder Defense NFC HSM is a revolutionary solution for protecting your sovereign communications. It offers a high level of security, confidentiality, and trust, without compromise. It is compatible with all types of data and communication means, and can be customized to suit your specific needs. It is also environmentally friendly, durable, and interoperable. It has received international recognition and awards for its excellence and innovation. If you are looking for a solution that can protect your secrets and sensitive data from any threat, DataShielder Defense NFC HSM is the solution for you. Contact Freemindtronic today and get your DataShielder Defense NFC HSM device. You will not regret it.

 
2023, Articles, DataShielder, Digital Security, EviCore NFC HSM Technology, EviCypher NFC HSM, EviCypher Technology, NFC HSM technology

FormBook Malware: How to Protect Your Gmail and Other Data

Posted on by FMTAD
FormBook Malware: how to protect your gmail and other data
23
Nov
Protect your Gmail Account FormBook malware – Jacques Gascuel: This article will be updated with any new information on the topic.

Secure Your Gmail from FormBook Attacks

FormBook is a malware that can steal your Gmail credentials, messages, and attachments. Learn how to use the Freemindtronic devices to encrypt your Gmail data and use passwordless and 2FA.

How to Protect Your Gmail Account from FormBook Malware

Introduction

Imagine that you receive an email from your bank, asking you to confirm your identity by clicking on a link. You open the link, and you find yourself on a page that looks like your bank’s website, but it is actually a fake. You enter your credentials, and you think you are done. But in reality, you have just given access to your bank account to hackers, who will use it to steal your money, or worse. This is what FormBook can do, a malware that can steal your sensitive data, and that Google cannot stop. In this article, we will explain what FormBook is, how it works, and how to protect yourself from this malware.

What is FormBook and why is it a threat?

FormBook is a malware that can record your keystrokes, take screenshots, and steal your passwords, cookies, and clipboard data. It can also download and execute other malicious files on your device.

FormBook is distributed through phishing emails that contain malicious attachments. These attachments are usually disguised as invoices, receipts, or shipping confirmations. When you open them, they ask you to enable macros or content. If you do, the malware will be installed on your device.

FormBook can target any web browser, but it has a special feature for Chrome. It can inject a fake Gmail login page into your browser, and trick you into entering your credentials. The malware will then send your Gmail username and password to a remote server controlled by the hackers.

FormBook is a threat because it can compromise your Gmail account and access your personal and professional information. It can also use your Gmail account to send spam or phishing emails to your contacts, or to access other online services that are linked to your Gmail account, such as Google Drive, Google Photos, or Google Pay.

How to protect yourself from FormBook?

Google has not yet found a way to detect and block FormBook. Therefore, you need to be extra careful when you use Gmail and other online services. Here are some tips to protect yourself from FormBook and other malware:

  • Do not open or download attachments from unknown or suspicious senders. If you are not sure about the legitimacy of an email, contact the sender directly or check the official website of the company or organization.
  • Do not enable macros or content in any document unless you trust the source. Macros are small programs that can run malicious code on your device.
  • Use a strong and unique password for your Gmail account and other online accounts. Do not reuse the same password for different services. Change your password regularly and use a password manager to store and generate your passwords.
  • Enable two-factor authentication (2FA) for your Gmail account and other online accounts. 2FA adds an extra layer of security by requiring a code or a device confirmation in addition to your password.
  • Use a reputable antivirus software and keep it updated. Antivirus software can scan your device for malware and remove it. You can also use a browser extension that can block malicious websites and pop-ups.

How to encrypt your Gmail messages and attachments with DataShielder NFC HSM

DataShielder NFC HSM is a device that allows you to encrypt and decrypt your Gmail messages and attachments with your own encryption keys that you create and store offline. It uses the EviCypher NFC HSM technology, which is a contactless hardware security module (NFC HSM) that won the Gold Medal for International Inventions in Geneva on March 2021.

With DataShielder NFC HSM, you can encrypt and decrypt your data with AES-256 keys that are randomly generated and stored in the NFC HSM. You can store up to 100 keys and one pair of RSA-4096 keys in the NFC HSM. You can also use different keys for the message and the attachment.

To encrypt your Gmail message and attachment, you need to use the EviCrypt and EviFile applications that are embedded in the DataShielder NFC HSM. These applications allow you to encrypt and decrypt your data with a simple tap of your NFC phone on the DataShielder NFC HSM. You can also share your encrypted data with other users who have the same device and the same key.

By using DataShielder NFC HSM, you can protect your Gmail messages and attachments from FormBook or any other malware that can access your Gmail account. Even if your Gmail account is hacked, your encrypted data will remain encrypted and unreadable by the hackers. Only you and the authorized recipients can decrypt your data with the DataShielder NFC HSM.

How to protect your web Gmail account with passwordless and 2FA using PassCypher NFC HSM

Do you want to manage your web accounts with complicated and complex passwords that you do not need to know, remember, or type? If yes, then you should try PassCypher NFC HSM. This device uses the EviPass NFC HSM technology, which is a contactless hardware password manager that won the Silver Medal for International Inventions in Geneva on March 2021.

With PassCypher NFC HSM, you can create and store your usernames and passwords of more than 256-bit in the NFC HSM. Moreover, you can store your OTP TOTP or HOTP secret keys in the NFC HSM to generate the 2FA code for your web accounts. The NFC HSM can store up to 100 web accounts and one pair of RSA-4096 keys.

To use PassCypher NFC HSM, you need to install the Freemindtronic extension for your web browser based on Chromium or Firefox. This extension uses the EviCore NFC HSM Browser technology, which allows you to communicate with the NFC HSM via your NFC phone. You also need to use the EviPass and EviOTP applications that are embedded in the PassCypher NFC HSM. These applications allow you to create, edit, and delete your web accounts and OTP secret keys with a simple tap of your NFC phone on the PassCypher NFC HSM.

By using PassCypher NFC HSM, you can secure your web accounts with passwordless and 2FA. You do not need to display, know, or type your username and password. You just need to tap your NFC phone on the PassCypher NFC HSM and the extension will autofill and auto login your web account. You also do not need to check for a typosquatting attack, since the extension will verify the URL of the website before logging in. And you do not need to use another device or application to generate the 2FA code, since the PassCypher NFC HSM will do it for you.

How to protect your Gmail account from FormBook with PassCypher NFC HSM

FormBook is a dangerous malware that can access your Gmail account and other sensitive data. Google has not yet found a solution to stop it. Therefore, you need to be vigilant and follow the best practices to protect yourself from cyberattacks. One of them is to use PassCypher NFC HSM to secure your Gmail account with passwordless and 2FA.

By using PassCypher NFC HSM, you can protect your Gmail account from FormBook or any other malware that can access your web browser. Even if your web browser is hacked, your usernames and passwords will remain encrypted and inaccessible by the hackers. Only you can decrypt your Gmail account with the PassCypher NFC HSM. And even if the hackers manage to steal your session cookies, they will not be able to log in to your Gmail account without the 2FA code that is generated by the PassCypher NFC HSM.

To use PassCypher NFC HSM with your Gmail account, you need to follow these steps:

  • Create a Gmail account in the EviPass application on the PassCypher NFC HSM. You can use the default username and password, or you can generate a random and complex password with the EviPass application.
  • Enable 2FA for your Gmail account on the Google website.
  • Choose the option to use an authenticator app, and scan the QR code with the EviOTP application on the PassCypher NFC HSM. This will store your OTP secret key in the NFC HSM.
  • Log in to your Gmail account with the Freemindtronic extension on your web browser. Tap your NFC phone on the PassCypher NFC HSM and the extension will autofill and auto login your Gmail account. You will also see a pop-up window with the 2FA code that you need to enter on the Google website.

By following these steps, you can use PassCypher NFC HSM to secure your Gmail account with passwordless and 2FA. You can also use PassCypher NFC HSM with other web accounts that support 2FA, such as Facebook, Twitter, or Amazon. This way, you can protect yourself from FormBook and other malware that can access your web browser.

Recent statistics on FormBook

FormBook is a malware that was first discovered in 2016, but it remains very active and dangerous. According to the Check Point report on cybersecurity in 2022, FormBook was the third most widespread malware in 2021, attacking 5% of enterprise networks. It was also the most prolific infostealer malware, accounting for 16% of attacks worldwide.

FormBook spreads mainly through phishing emails that contain malicious attachments. These attachments are often RAR self-extracting archives, which are compressed files that can run malicious code when opened. The RAR files contain a legitimate document, such as a PDF or a Word file, and a hidden executable file, which is the FormBook malware. When the user opens the RAR file, the document is displayed, but the malware is also installed in the background.

FormBook can also spread through other methods, such as drive-by downloads, malicious links, or removable media. The malware can infect any Windows device, from Windows XP to Windows 10. The malware can also evade detection and removal by using various techniques, such as encryption, obfuscation, or anti-analysis.

Here are some recent statistics on FormBook, based on the data from Check Point and ANY.RUN:

  • FormBook was the most popular malware in August 2021, affecting 4.5% of organizations worldwide, followed by Trickbot and Agent Tesla, affecting respectively 4% and 3% of organizations worldwide.
  • FormBook was the fourth most common malware in 2020, according to the ranking of malware families by ANY.RUN. It accounted for 8% of the samples analyzed by the online sandboxing service.
  • FormBook was used in many phishing campaigns targeting various industries, such as defense, aerospace, health, education, finance, retail, etc. It was also used to attack Ukrainian targets during the war between Russia and Ukraine in 2022.
  • FormBook has a successor called XLoader, which appeared in 2020 and which is able to infect macOS users. XLoader is sold on the dark web for $59 for a Windows license and $49 for a macOS license.

Danger level of FormBook compared to other malware

FormBook is a very dangerous malware, because it can steal sensitive information, such as credentials, passwords, credit card numbers, 2FA codes, etc. It can also download and execute other malware, such as ransomware, banking trojans, spyware, etc. It can also remotely control the infected device and perform various malicious actions, such as deleting browser cookies, taking screenshots, restarting or shutting down the system, etc.

FormBook is also hard to detect and remove, because it uses advanced evasion techniques, such as code injection, string obfuscation, data encryption, anti-analysis, etc. It also changes frequently its name, path, and file extension, and uses random Windows registry keys to maintain its persistence.

To compare the danger level of FormBook with other known malware in its category, we can use the following criteria:

  • The number of organizations affected worldwide
  • The type and amount of information stolen
  • The ability to download and execute other malware
  • The ability to remotely control the infected device
  • The evasion techniques used
  • The ease of detection and removal

Here is a table that compares FormBook with other popular infostealer malware, such as Trickbot, Agent Tesla, LokiBot, and Raccoon:

Malware Number of organizations affected Type and amount of information stolen Ability to download and execute other malware Ability to remotely control the infected device Evasion techniques used Ease of detection and removal
FormBook 4.5% in August 2021 Credentials, passwords, credit card numbers, 2FA codes, screenshots, keystrokes, etc. Yes Yes Code injection, string obfuscation, data encryption, anti-analysis, etc. Hard
Trickbot 4% in August 2021 Credentials, passwords, banking information, personal data, etc. Yes Yes Code injection, string obfuscation, data encryption, anti-analysis, etc. Hard
Agent Tesla 3% in August 2021 Credentials, passwords, banking information, personal data, screenshots, keystrokes, etc. No Yes String obfuscation, data encryption, anti-analysis, etc. Medium
LokiBot 1.5% in August 2021 Credentials, passwords, banking information, personal data, etc. No Yes String obfuscation, data encryption, anti-analysis, etc. Medium
Raccoon 0.8% in August 2021 Credentials, passwords, banking information, personal data, etc. No Yes String obfuscation, data encryption, anti-analysis, etc. Medium

From this table, we can see that FormBook is the most dangerous infostealer malware, because it affects the most organizations, steals the most types of information, and can download and execute other malware. It is also the hardest to detect and remove, because it uses more evasion techniques than the other malware.

Forms of attacks of FormBook

FormBook can be delivered through different forms of attacks, depending on the delivery mechanism chosen by the malicious actor. Here are some forms of attacks of FormBook:

  • Phishing: FormBook can be sent by email as a malicious attachment, such as a Word, Excel, PDF, or ZIP or RAR file. The email can have a misleading subject, such as an invoice, a receipt, a contract, a job offer, etc. When the user opens the attachment, the malware runs and infects the device.
  • Exploitation of vulnerabilities: FormBook can exploit vulnerabilities in popular software, such as Microsoft Office, Windows, Adobe Reader, etc. For example, FormBook used the vulnerability CVE-2017-8570 in Microsoft Office to run malicious code from a RTF file. FormBook also used the vulnerability CVE-2021-40444 in Microsoft MSHTML to run malicious code from a CAB file.
  • Drive-by downloads: FormBook can be downloaded without the user’s knowledge when they visit a compromised or malicious website. The website can use a script or an exploit kit to trigger the download and execution of the malware on the user’s device.
  • Removable media: FormBook can be copied to removable media, such as USB drives, external hard drives, memory cards, etc. When the user connects the removable media to their device, the malware runs automatically and infects the device.
  • Social media: FormBook can be spread by messages or posts on social media, such as Facebook, Twitter, Instagram, etc. These messages or posts can contain links or images that redirect to malicious websites or infected files. When the user clicks on the link or image, the malware is downloaded and executed on their device.

Here is a type of formbook malware attacks image:

Type of Formbook MalwareAttacks

How PassCypher NFC HSM and DataShielder NFC HSM can protect you from FormBook attacks

PassCypher NFC HSM and DataShielder NFC HSM are two devices that use the EviPass NFC HSM technology from Freemindtronic, which is a contactless hardware password manager that won the Silver Medal for International Inventions in Geneva on March 2021. These devices can help you protect your web accounts and your Gmail messages and attachments from FormBook attacks, by using passwordless, 2FA, and encryption.

PassCypher NFC HSM can create and store your usernames and passwords of more than 256-bit in the NFC HSM. It can also store your OTP TOTP or HOTP secret keys in the NFC HSM to generate the 2FA code for your web accounts. The NFC HSM can store up to 100 web accounts and one pair of RSA-4096 keys.

DataShielder NFC HSM can encrypt and decrypt your Gmail messages and attachments with your own encryption keys that you create and store offline. It uses the EviCypher NFC HSM technology, which is a contactless hardware security module (NFC HSM) that won the Gold Medal for International Inventions in Geneva on March 2021. It can store up to 100 keys and one pair of RSA-4096 keys in the NFC HSM.

To use PassCypher NFC HSM and DataShielder NFC HSM, you need to install the Freemindtronic extension for your web browser based on Chromium or Firefox. This extension uses the EviCore NFC HSM Browser technology, which allows you to communicate with the NFC HSM via your NFC phone. You also need to use the EviPass, EviOTP, EviCrypt, and EviFile applications that are embedded in the PassCypher NFC HSM and DataShielder NFC HSM. These applications allow you to create, edit, delete, encrypt, and decrypt your web accounts, OTP secret keys, messages, and attachments with a simple tap of your NFC phone on the PassCypher NFC HSM or DataShielder NFC HSM.

By using PassCypher NFC HSM and DataShielder NFC HSM, you can secure your web accounts and your Gmail messages and attachments with passwordless, 2FA, and encryption. You do not need to display, know, or type your username, password, or encryption key. You just need to tap your NFC phone on the PassCypher NFC HSM or DataShielder NFC HSM and the extension will autofill, auto login, encrypt, or decrypt your web account, message, or attachment. You also do not need to use another device or application to generate the 2FA code, since the PassCypher NFC HSM will do it for you.

Here is a table that shows how PassCypher NFC HSM and DataShielder NFC HSM can protect you from different FormBook attack vectors, such as keylogger, password stealer, file transfer, screenshot, etc. I used a check mark or a cross mark to show visually what PassCypher NFC HSM and DataShielder NFC HSM protect.

 

FormBook PassCypher DataShielder
Keylogger ✔️ ✔️
Password stealer ✔️ ✔️
File transfer ❌ ✔️
Screenshot ✔️ ✔️
Remote control ❌ ❌
Phishing ✔️ ✔️
Exploit kit ❌ ❌
Drive-by download ❌ ❌
Removable media ❌ ✔️
Social media ❌ ❌

This table shows that PassCypher NFC HSM and DataShielder NFC HSM can protect your web accounts from FormBook’s keylogger, password stealer, and phishing, by using passwordless and 2FA. They can also protect your Gmail messages and attachments from FormBook’s file transfer and screenshot, by using encryption and decryption. DataShielder NFC HSM can also protect your data stored in computers or removable media, by using encryption and decryption. However, neither device can protect your device from FormBook’s remote control, exploit kit, drive-by download, or unsecured social media, which can compromise your system and your data. Therefore, you should also use an antivirus software and a firewall to prevent FormBook from accessing your device.

Articles, EviCore NFC HSM Technology, legal, News, Training

Dual-Use Encryption Products: a regulated trade for security and human rights

Posted on by FMTAD
Dual-Use encryption products a regulated trade for security and human rights by Freemindtronic-from Andorra
17
Nov
Dual-use encryption products by Jacques Gascuel: This article will be updated with any new information on the topic.

Dual-use encryption products: a challenge for security and human rights

Encryption is a technique that protects data and communications. Encryption products are dual-use goods, which can have civilian and military uses. The export of these products is controlled by the EU and the international community, to prevent their misuse or diversion. This article explains the EU regime for the export of dual-use encryption products, and how it has been updated.

The international regulations on dual-use encryption products

The main international regulations that apply to dual-use encryption products are the Wassenaar Arrangement and the EU regime for the control of exports of dual-use goods.

The Wassenaar Arrangement

The Wassenaar Arrangement is a multilateral export control regime that aims to contribute to regional and international security and stability. It promotes transparency and responsibility in the transfers of conventional arms and dual-use goods and technologies. It was established in 1996 and currently has 42 participating states, including the United States, Canada, Japan, Australia, Russia, China and most of the EU member states.

The Wassenaar Arrangement maintains a list of dual-use goods and technologies that are subject to export control by the participating states. The list is divided into 10 categories, with subcategories and items. Category 5, part 2, covers information security, including encryption products. The list of encryption products includes, among others, the following items:

  • Cryptographic systems, equipment, components and software, using symmetric or asymmetric algorithms, with a key length exceeding 56 bits for symmetric algorithms or 512 bits for asymmetric algorithms, or specially designed for military or intelligence use.
  • Cryptanalytic systems, equipment, components and software, capable of recovering the plain text from the encrypted text, or of finding cryptographic keys or algorithms.
  • Cryptographic development systems, equipment, components and software, capable of generating, testing, modifying or evaluating cryptographic algorithms, keys or systems.
  • Non-cryptographic information security systems, equipment, components and software, using techniques such as steganography, watermarking, tamper resistance or authentication.
  • Technology for the development, production or use of the above items.

The participating states of the Wassenaar Arrangement are required to implement national export controls on the items listed in the arrangement, and to report annually their exports and denials of such items. However, the arrangement does not impose binding obligations on the participating states, and each state is free to decide whether to grant or refuse an export license, based on its own policies and national interests.

The EU regime for the control of exports of dual-use goods

The common legal framework of the EU for dual-use goods

The EU regime for the control of exports of dual-use goods is a common legal framework. It applies to all EU member states, and it has two main goals. First, it aims to ensure a consistent and effective implementation of the international obligations of export control. Second, it aims to protect the security and human rights of the EU and its partners. The regime is based on the Regulation (EU) 2021/821, which was adopted in May 2021 and entered into force in September 2021. This regulation replaces the previous Regulation (EC) No 428/2009.

The Regulation (EU) 2021/821: the principles and criteria of export control

The Regulation (EU) 2021/821 establishes a Union list of dual-use goods. These are goods that can have both civilian and military uses, such as software, equipment and technology. These goods are subject to an export authorization, which means that exporters need to obtain a permission from the competent authorities before exporting them. The Regulation also sets out a set of general principles and criteria for granting or refusing such authorization. The Union list of dual-use goods is based on the international export control regimes, including the Wassenaar Arrangement. It covers the same categories and items as the latter. However, the EU list also includes some additional items that are not covered by the international regimes. These are cyber-surveillance items that can be used for internal repression or human rights violations.

The Union list of dual-use goods: the categories and items subject to an export authorization

The Union list of dual-use goods consists of ten categories, which are:

  • Category 0: Nuclear materials, facilities and equipment
  • Category 1: Materials, chemicals, micro-organisms and toxins
  • Category 2: Materials processing
  • Category 3: Electronics
  • Category 4: Computers
  • Category 5: Telecommunications and information security
  • Category 6: Sensors and lasers
  • Category 7: Navigation and avionics
  • Category 8: Marine
  • Category 9: Aerospace and propulsion

Each category contains a number of items, which are identified by a code and a description. For example, the item 5A002 is “Information security systems, equipment and components”. The items are further divided into sub-items, which are identified by a letter and a number. For example, the sub-item 5A002.a.1 is “Cryptographic activation equipment or software designed or modified to activate cryptographic capability”.

The novelties of the Regulation (EU) 2021/821: the due diligence obligation, the catch-all clause, the human security approach and the transparency and information exchange mechanism

The Regulation (EU) 2021/821 also provides for different types of export authorizations. These are individual, global, general or ad hoc authorizations, depending on the nature, destination and end-use of the items. Moreover, the Regulation introduces some novelties, such as:

  • A due diligence obligation for exporters. This means that exporters have to verify the end-use and the end-user of the items, and to report any suspicious or irregular transaction.
  • A catch-all clause. This allows the competent authorities to impose an export authorization on items that are not listed, but that can be used for weapons of mass destruction, a military end-use, human rights violations or terrorism.
  • A human security approach. This requires the competent authorities to take into account the potential impact of the items on human rights, international humanitarian law, regional stability and sustainable development, especially for cyber-surveillance items.
  • A transparency and information exchange mechanism. This requires the competent authorities to share information on the authorizations, denials and consultations of export, and to publish annual reports on their export control activities.

The dual-use encryption products: sensitive goods for security and human rights

The dual-use encryption products are a specific type of dual-use goods that fall under the category 5 of the Union list. These are products that use cryptographic techniques to protect the confidentiality, integrity and authenticity of data and communications. These products can have both civilian and military uses, and they raise important issues for security and human rights.

The dual-use encryption products: a definition and examples

The dual-use encryption products are defined by the Regulation (EU) 2021/821 as “information security systems, equipment and components, and ‘software’ and ‘technology’ therefor, which use ‘cryptography’ or cryptanalytic functions”. The Regulation also provides a list of examples of such products, such as:

  • Cryptographic activation equipment or software
  • Cryptographic equipment for mobile cellular systems
  • Cryptographic equipment for radio communication systems
  • Cryptographic equipment for computer and network security
  • Cryptanalytic equipment and software
  • Quantum cryptography equipment and software

The dual-use encryption products: security issues

The dual-use encryption products can have a significant impact on the security of the EU and its partners. On the one hand, these products can enhance the security of the EU and its allies, by protecting their sensitive data and communications from unauthorized access, interception or manipulation. On the other hand, these products can also pose a threat to the security of the EU and its adversaries, by enabling the encryption of malicious or illegal activities, such as terrorism, espionage or cyberattacks. Therefore, the export of these products needs to be carefully controlled, to prevent their misuse or diversion to undesirable end-users or end-uses.

The dual-use encryption products: human rights issues

The dual-use encryption products can also have a significant impact on the human rights of the EU and its partners. On the one hand, these products can protect the human rights of the EU and its citizens, by safeguarding their privacy and freedom of expression on the internet. On the other hand, these products can also violate the human rights of the EU and its partners, by enabling the repression or surveillance of dissidents, activists or journalists by authoritarian regimes or non-state actors. Therefore, the export of these products needs to take into account the potential consequences of the items on human rights, international humanitarian law, regional stability and sustainable development, especially for cyber-surveillance items.

The modification of the Union list of dual-use goods by the Delegated Regulation (EU) 2022/1

The Union list of dual-use goods is not static, but dynamic. It is regularly updated to reflect the changes in the technological development and the international security environment. The latest update of the list was made by the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the Regulation (EU) 2021/821.

The changes made by the international export control regimes in 2020 and 2021

The Delegated Regulation (EU) 2022/1 reflects the changes made by the international export control regimes in 2020 and 2021. These are the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group and the Missile Technology Control Regime. These regimes are voluntary and informal arrangements of states that coordinate their national export control policies on dual-use goods. The EU is a member of these regimes, and it aligns its Union list of dual-use goods with their lists of controlled items. The changes made by these regimes include the addition, deletion or modification of some items, as well as the clarification or simplification of some definitions or technical parameters.

The new items added to the Union list of dual-use goods: the quantum technologies, the drones and the facial recognition systems or biometric identification systems

The Delegated Regulation (EU) 2022/1 also adds some new items to the Union list of dual-use goods. These are items that are not covered by the international export control regimes, but that are considered to be sensitive for the security and human rights of the EU and its partners. These items include:

  • Certain types of software and technology for the development, production or use of quantum computers or quantum cryptography. These are devices or techniques that use the principles of quantum physics to perform computations or communications that are faster or more secure than conventional methods.
  • Certain types of equipment, software and technology for the development, production or use of unmanned aerial vehicles (UAVs) or drones. These are aircraft or systems that can fly without a human pilot on board, and that can be used for various purposes, such as surveillance, reconnaissance, delivery or attack.
  • Certain types of equipment, software and technology for the development, production or use of facial recognition systems or biometric identification systems. These are systems or techniques that can identify or verify the identity of a person based on their facial features or other biological characteristics, such as fingerprints, iris or voice.

The entry into force and application of the Delegated Regulation (EU) 2022/1

The Delegated Regulation (EU) 2022/1 entered into force on 7 January 2022. It applies to all exports of dual-use goods from the EU from that date. The exporters of dual-use goods need to be aware of the changes and updates to the Union list of dual-use goods, and to comply with the export control rules and procedures established by the Regulation (EU) 2021/821. The competent authorities of the member states need to implement and enforce the new Union list of dual-use goods, and to cooperate and coordinate with each other and with the Commission. The Commission needs to monitor and evaluate the impact and effectiveness of the new Union list of dual-use goods, and to report to the European Parliament and the Council.

The national regulations on dual-use encryption products

How some countries have their own rules on dual-use encryption products

The case of the United States

Some countries have their own national regulations on dual-use encryption products, which may differ or complement the existing regimes. For example, the United States has a complex and strict export control system, based on the Export Administration Regulations (EAR). The EAR classify encryption products under category 5, part 2, of the Commerce Control List (CCL). The EAR require an export license for most encryption products, except for some exceptions, such as mass market products, publicly available products, or products intended for certain countries or end-users. The EAR also require that exporters submit annual self-classification reports, semi-annual sales reports, and encryption review requests for certain products.

The case of Andorra

Andorra is a small country between France and Spain. It is not an EU member, but it has a customs union with it. However, this customs union does not cover all products. It only covers those belonging to chapters 25 to 97 of the Harmonized System (HS), which are mainly industrial products. Agricultural products and products belonging to chapters 1 to 24 of the HS are free of import duties in the EU. But they are subject to the most-favored-nation (MFN) treatment in Andorra.

Andorra has adopted the EU list of dual-use goods. It requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. This regulation came into force on 9 September 2021 and replaced the previous Regulation (EC) No 428/2009. Andorra has also adopted the necessary customs provisions for the proper functioning of the customs union with the EU. These provisions are based on the Community Customs Code and its implementing provisions, by the Decision No 1/2003 of the Customs Cooperation Committee.

Andorra applies the EU regulation, as it is part of the internal market. Moreover, Andorra has adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods. This modification reflects the changes made by the international export control regimes in 2020 and 2021. It also adds some new items, such as software and technologies for quantum computing, drones or facial recognition. The Delegated Regulation (EU) 2022/1 came into force on 7 January 2022, and applies to all exports of dual-use goods from the EU from that date.

Andorra entered the security and defense sector for the first time by participating in Eurosatory 2022. This is the international reference exhibition for land and airland defense and security. Andorra became the 96th country with a security and defense industry on its territory. Among the exhibitors, an Andorran company, Freemindtronic, specialized in counter-espionage solutions, presented innovative products. For example, DataShielder Defense NFC HSM, a device to protect sensitive data against physical and logical attacks. It uses technologies such as EviCypher NFC HSM and EviCore NFC HSM, contactless hardware security modules (NFC HSM). The president of Coges events, a subsidiary of GICAT, identified these products as dual-use and military products. They need an export or transfer authorization, according to the Regulation (EU) 2021/821. Freemindtronic also showed its other security solutions, such as EviKey NFC HSM, a secure USB key, a security token. These products were displayed in the Discover Village, a space for start-ups and SMEs innovations.

Switzerland

Switzerland is not an EU member, but it has a free trade agreement with it. Switzerland has adopted the Regulation (EU) 2021/821 by the Ordinance of 5 May 2021 on the control of dual-use goods. Switzerland applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. Switzerland has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

Turkey

Turkey is not an EU member, but it has a customs union with it. Turkey has adopted the Regulation (EU) 2021/821 by the Presidential Decree No 3990 of 9 September 2021 on the control of exports of dual-use goods. Turkey applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. Turkey has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

United Kingdom

The United Kingdom left the EU on 31 January 2020. It has adopted the Regulation (EU) 2021/821 by the Dual-Use Items (Export Control) Regulations 2021, which came into force on 9 September 2021. The United Kingdom applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. The United Kingdom has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

The challenges and opportunities for the exporters of dual-use encryption products

The exporters of dual-use encryption products face several challenges and opportunities in the current context of export control regulations. Among the challenges, we can mention:

  • The complexity and diversity of the regulations, which may vary depending on the countries, the products, the destinations and the end-uses, and which require a deep knowledge and a constant monitoring from the exporters.
  • The costs and delays related to the administrative procedures, which can be high and unpredictable, and which can affect the competitiveness and profitability of the exporters, especially for small and medium enterprises (SMEs).
  • The legal and reputational risks, which can result from an involuntary or intentional violation of the regulations, or from a misuse or diversion of the products by the end-users, and which can lead to sanctions, prosecutions or damages to the image of the exporters.

Among the opportunities, we can mention:

  • The growing demand and innovation for encryption products, which are increasingly used in many sectors and domains, such as finance, health, education, defense, security, human rights, etc.
  • The contribution to the security and human rights of the exporters, their customers and the general public, by enabling the protection of data, privacy, freedom of expression, access to information and democratic participation, thanks to encryption products.
  • The cooperation with the competent authorities, the civil society and the international community, to ensure the compliance and accountability of the exporters, and to support the development and implementation of effective and balanced encryption policies and regulations, that respect the security and human rights of all stakeholders.

Conclusion

Dual-use encryption products can have both civil and military uses. They are subject to export control regulations at different levels: international, regional and national. These regulations aim to prevent the risks that these products can pose for security and human rights. At the same time, they allow the development and trade of these products. Therefore, the exporters of dual-use encryption products must comply with the regulations that apply to their products. They must also assess the impact of their products on security and human rights. The exporters of dual-use encryption products can benefit from the demand and innovation for these products. These products are essential for the digital economy and society. They can also enhance the security and human rights of the exporters, their customers and the public.

Freemindtronic Andorra is a company that specializes in dual-use encryption products. It offers secure and innovative solutions for data, communication and transaction protection. Freemindtronic Andorra respects the export control regulations that apply to its products. It is also committed to promoting and supporting the responsible and lawful use of its products. It follows the principles of security and human rights. Freemindtronic Andorra cooperates with the authorities, the civil society and the international community. It ensures the transparency and accountability of its activities. It also participates in the development and implementation of effective and balanced encryption policies and regulations. It respects the interests and needs of all stakeholders.

2023, Articles, EviCore HSM OpenPGP Technology, EviCore NFC HSM Technology, NFC HSM technology, Technical News, Technologies

Quantum computing RSA encryption: a threat and a solution

Posted on by FMTAD
Quantum computing RSA encryption
12
Nov
Quantum computing RSA encryption by Jacques Gascuel: This article will be updated with any new information on the topic.

Quantum computers RSA cryptography: how to secure your data

Quantum computers can break RSA encryption, which secures our online data. But there are solutions that are resistant to quantum attacks. One of them is Freemindtronic, an Andorran company that notably uses NFC HSM technology to share AES-256 keys using RSA-4096 encryption, which quantum computers cannot decipher.

Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2024 Articles Cardokey EviSwap NFC NDEF Technology GreenTech Technical News

NFC vCard Cardokey: Revolutionizing Digital Networking
March 25, 2024
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing
November 8, 2023

2023 Articles Cyberculture Eco-friendly Electronics GreenTech Technologies

The first wood transistor for green electronics
April 29, 2023
Hardware Secrets Manager, Eco-friendly, NFC devices, works contactless from Freemindtronic is sustainable technology respects the environment design & product made in Andorra

Eco-friendly GreenTech

Hardware secrets manager Eco-friendly
April 25, 2021

Quantum computing RSA encryption: a challenge and a solution

Quantum computing RSA encryption is a challenge for online security. Quantum computing is a new way of computing that uses quantum physics. It can do things that classical computers cannot or are too slow to do. One of these things is breaking RSA encryption, which secures data online. RSA encryption is based on the difficulty of factoring large numbers. Quantum computers can factor large numbers faster than classical computers. They use algorithms like Shor’s algorithm, which exploits quantum properties.

However, this threat is not imminent. Building and using quantum computers is still challenging and uncertain. Two recent announcements claimed to have cracked RSA encryption with quantum systems. But they have not been verified. The experts are skeptical and doubtful. They have not provided any evidence or details. They have made unrealistic or too good to be true claims. They have not been peer-reviewed or reproduced.

What is RSA encryption?

RSA encryption is a type of asymmetric encryption. It uses two keys: a public key and a private key. The public key can be shared with anyone, but the private key must be kept secret. They are mathematically related, but it is very hard to find the private key from the public key.

How does RSA encryption work?

RSA encryption uses large prime numbers to generate the keys. The public key and the private key are based on the product of two prime numbers. It is easy to multiply two prime numbers, but very hard to factor their product. For example, 17 x 23 = 391, but finding that 391 = 17 x 23 is much harder.

RSA encryption uses keys that are 2048 or 4096 bits long. These are numbers that have 2048 or 4096 binary digits (0 or 1). They are so large that it would take billions of years for a classical computer to factor them. Therefore, RSA encryption is very secure and widely used for online security.

What is quantum computing and how does it work?

Quantum computing is a new way of computing that uses quantum physics. It can do things that classical computers cannot or are too slow to do. Here is how it works:

  • Qubits: Quantum computers use quantum bits, or qubits. They can be 0 or 1, or both at the same time. This is called superposition. When we measure a qubit, it becomes either 0 or 1. This gives us more information than a classical bit, which is always 0 or 1.
  • Entanglement: Quantum computers can also use entanglement. This is when two qubits share a quantum state and affect each other, even if they are far apart. This allows us to manipulate multiple qubits at once and create complex quantum states.
  • Parallelism: Quantum computers can use these properties to perform parallel computations. This means they can do many calculations at the same time, using fewer qubits than classical bits. This can speed up some tasks that are hard for classical computers.

One of these tasks is breaking RSA encryption, which is based on factoring large numbers. Quantum computers can use a quantum algorithm, called Shor’s algorithm, to factor large numbers faster than classical computers. This can break RSA encryption by finding the private key from the public key. However, this requires a quantum computer with many qubits and low errors, which we do not have yet.

Quantum computing RSA encryption: a challenge and a solution

The ability to find an RSA private key from its public key by a quantum computer poses a serious threat to online security. However, this threat is not imminent, as there are still many challenges and uncertainties in building and using quantum computers. Two recent announcements have claimed to have cracked RSA encryption with quantum systems, but they have not been verified and have been met with skepticism and doubt from the experts. They have not provided any evidence or details of their work. They have made assumptions and claims that seem unrealistic or too good to be true. They have not been peer-reviewed or reproduced by other sources.

How quantum computers can break RSA encryption

RSA encryption is a type of asymmetric encryption. It uses two keys: a public key and a private key. The public key can be shared with anyone, but the private key must be kept secret. They are mathematically related, but it is very hard to find the private key from the public key.

RSA encryption uses large prime numbers to generate the keys. The public key and the private key are based on the product of two prime numbers. It is easy to multiply two prime numbers, but very hard to factor their product. For example, 17 x 23 = 391, but finding that 391 = 17 x 23 is much harder.

RSA encryption uses keys that are 2048 or 4096 bits long. These are numbers that have 2048 or 4096 binary digits (0 or 1). They are so large that it would take billions of years for a classical computer to factor them. Therefore, RSA encryption is very secure and widely used for online security.

Quantum computers can break RSA encryption by finding the prime factors of the composite number that is used to generate the public and private keys. Once the prime factors are known, the private key can be easily calculated from the public key, and the encrypted messages can be decrypted. Quantum computers can use a quantum algorithm, called Shor’s algorithm, to factor large numbers faster than classical computers. Shor’s algorithm can factor a large number in polynomial time, which means that the time it takes to factor a number grows relatively slowly as the number gets larger. In contrast, the best classical algorithms for factoring are exponential, which means that the time it takes to factor a number grows very fast as the number gets larger.

Two claims of breaking RSA encryption with quantum systems

Two recent announcements have raised concerns about quantum computing RSA encryption. One is from a team of Chinese researchers, who published a paper on arXiv in December 2022. They claim to have found a faster way to break RSA encryption with a quantum computer of 372 qubits. They combine a classical algorithm, called Schnorr’s algorithm, with a quantum algorithm, called QAOA (Quantum Approximate Optimization Algorithm). Schnorr’s algorithm is a method of factoring large numbers that uses a probabilistic approach and a lattice reduction technique. QAOA is a method of finding approximate solutions to optimization problems using a quantum computer.

The researchers say that by applying QAOA to the most computationally intensive step of Schnorr’s algorithm, they can reduce the number of qubits and the number of operations needed to factor a large number. They also say that they tested their method on a 10-qubit quantum computer and succeeded in factoring a 48-bit number. They extrapolate that their method can scale to factor a 2048-bit number, which is the standard for RSA encryption.

The other announcement is from a researcher named Ed Gerck, who posted on LinkedIn in November 2023. He claims to have decrypted RSA-2048 encryption, the most used public-key algorithm, with a quantum system implementable on a smartphone or a PC running Linux. He says that he developed a quantum algorithm that can calculate prime numbers faster than Shor’s algorithm and that he proved several mathematical conjectures, such as Goldbach’s conjecture. He published an excerpt of his work, but has not provided any proof or detail of his method.

Both announcements are not verified and have been met with skepticism and doubt from the experts. They have not provided any evidence or details of their work. They have made assumptions and claims that seem unrealistic or too good to be true. They have not been peer-reviewed or reproduced by other sources.

Quantum computing RSA encryption: possible solutions

How to protect RSA encryption from quantum attacks?

However, this announcement is not yet verified, and it raises many questions in the scientific community. It is therefore premature to draw hasty conclusions, and we must wait for the publication of the evidence of his work. It is also possible that RSA encryption can be adapted to resist quantum attacks, for example by increasing the length of the keys, or by using masking techniques. In addition, there are alternatives to RSA encryption, supposed to be more robust against quantum computing. These are post-quantum cryptography algorithms, based on other mathematical problems that are difficult to solve for quantum computers. Post-quantum cryptography is a very active field of research, which aims to anticipate the threats that quantum computers would pose to the security of communications. There are several potential candidates to replace RSA encryption, but they must be evaluated and compared in order to choose the most suitable ones for different needs and constraints. The NIST has launched an international competition to select and standardize the best post-quantum encryption algorithms, which should be ready by 2024.

What are the alternatives to RSA encryption?

Some of the alternatives to RSA encryption that are considered to be more resistant to quantum attacks are:

  • Lattice-based cryptography: This is based on the hardness of finding the shortest vector in a high-dimensional lattice, or the closest vector to a given point. Lattice-based cryptography has the advantage of being fast, versatile, and allowing for advanced features such as homomorphic encryption and digital signatures. Some examples of lattice-based algorithms are NTRU, BLISS, and NewHope.
  • Code-based cryptography: This is based on the hardness of decoding a general linear code, or finding the error vector in a noisy transmission. Code-based cryptography has the advantage of being simple, efficient, and having a long history of security analysis. Some examples of code-based algorithms are McEliece, Niederreiter, and BIKE.
  • Multivariate cryptography: This is based on the hardness of solving a system of multivariate polynomial equations over a finite field. Multivariate cryptography has the advantage of being compact, flexible, and allowing for various applications such as encryption, signatures, and identification. Some examples of multivariate algorithms are Rainbow, HFE, and GeMSS.
  • Hash-based cryptography: This is based on the hardness of finding collisions or preimages for a cryptographic hash function. Hash-based cryptography has the advantage of being simple, provably secure, and relying on minimal assumptions. Some examples of hash-based algorithms are XMSS, SPHINCS, and LMS.

How Freemindtronic protects data with RSA-4096 and NFC technology

Freemindtronic is an Andorran company that specializes in security and cybersecurity of information and computer systems. It designs and develops products and services based on NFC (Near Field Communication) technology, which allows wireless communication at short distance.

The HSM of Freemindtronic: devices that store and protect cryptographic keys

One of the products of Freemindtronic is the HSM (Hardware Security Module), which is a device that stores and protects cryptographic keys. The HSM of Freemindtronic uses two technologies: EviCore HSM OpenPGP and EviCore NFC HSM.

  • EviCore HSM OpenPGP is an implementation of the OpenPGP standard, an open standard for encryption and signature of data. It can manage symmetric and asymmetric encryption keys, both standard and OpenPGP. It can also create HSM on any type of storage device, such as key store, key chain, SD card, SSD, USB drive, NAS, cloud, etc. It can work in fixed, offline, or online mode (LAN/WAN).
  • EviCore NFC HSM is a technology that allows to share AES-256 standard keys using RSA-4096 standard encryption. It works without contact with NFC HSM, which use a pair of RSA-4096 keys for secret sharing (AES-256 encryption keys).

The AES-256 standard: a type of symmetric encryption with high level of security

The AES-256 standard is a type of symmetric encryption, which means that it uses the same key to encrypt and decrypt messages. The AES-256 standard offers a high level of security, as it uses keys that are 256 bits long, which are very hard to crack by brute force. The AES-256 standard is widely used for encrypting data and communications, such as files, emails, or messages.

The RSA-4096 encryption: a type of asymmetric encryption that protects the AES-256 keys from quantum attacks

However, the AES-256 standard requires that the key be securely transmitted between the sender and the receiver, without being intercepted, modified, or forged by an attacker. This is where the RSA-4096 encryption comes in, as it provides a way to protect the AES-256 keys from quantum attacks.

The RSA-4096 encryption is a type of asymmetric encryption, which means that it uses two different keys to encrypt and decrypt messages: a public key and a private key. The public key can be shared with anyone, while the private key must be kept secret. The RSA-4096 encryption uses keys that are 4096 bits long, which are out of reach of the current or future quantum computers. The RSA-4096 encryption can encrypt the AES-256 keys with the public key of the receiver, and decrypt them with the private key of the receiver. Thus, only the receiver can access the AES-256 keys, and use them to encrypt or decrypt the messages. The RSA-4096 encryption can also sign the AES-256 keys with the private key of the sender, and verify them with the public key of the sender. Thus, the receiver can ensure the identity of the sender, and the integrity of the AES-256 keys.

The RSA-4096 encryption is therefore an effective way to protect the AES-256 keys from quantum attacks, as it uses keys that are 4096 bits long, which are out of reach of the current or future quantum computers.

The RSA-4096 encryption is also a practical way to share the AES-256 keys between the HSM, as it uses the NFC technology, which allows wireless communication at short distance. The RSA-4096 encryption is therefore a major asset for the technologies of Freemindtronic, which offer an optimal security for the encryption of data.

Conclusion

Quantum computing is a new paradigm of computing that could break RSA encryption, the most common encryption method on the internet. With only 372 qubits, a quantum computer could break RSA encryption, exposing our online data and communications. However, there are solutions and alternatives that can resist quantum attacks. One of them is Freemindtronic, an Andorran company that uses NFC technology to share AES-256 standard keys using RSA-4096 standard encryption, which is beyond the reach of quantum computers. Freemindtronic’s technologies are based on the EviCore HSM OpenPGP and the EviCore NFC HSM, which are hardware devices that store and protect cryptographic keys. EviCore HSM OpenPGP transforms your smartphone, tablet or computer into a hardware security module compatible with the OpenPGP standard. EviCore NFC HSM allows you to store and use your crypto keys and secrets in a contactless NFC device, such as a card, a sticker, or a keychain. Both technologies offer features such as offline isolation, seamless integration, enhanced user experience, and multi-factor authentication. Therefore, Freemindtronic’s technologies are innovative and secure solutions for data and communication encryption, which can withstand quantum attacks and ensure the privacy and integrity of online activities.