2024, Articles, Digital Security, News, Phishing

Google OAuth2 security flaw: How to Protect Yourself from Hackers

Posted on January 8, 2024January 10, 2024 by FMTAD

08
Jan

Hackers exploit OAuth2 flaw to bypass 2FA on Google accounts

Hackers exploit the Google OAuth2 security flaw to bypass 2FA and access your online services with persistent cookies. They exploit an undocumented OAuth2 endpoint to generate these cookies. PassCypher protects you by verifying the URL of connection to Google, alerting you of password corruption, and blocking redirection iframes attacks.

Illustration of APT29 spear-phishing Europe with Russian flag

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

April 30, 2025

APT28 spear-phishing France: cyberattack warning on Russian APT threats targeting European and French institutions, shown on a laptop and smartphone.

2025 Digital Security

APT28 spear-phishing France: targeted attacks across Europe

April 30, 2025

Visual representation of BadPilot Cyber Attacks by APT44, showcasing global cyber-espionage targeting critical infrastructures with PassCypher and DataShielder defenses.

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

February 25, 2025

Illustration of a Russian APT44 (Sandworm) cyber spy exploiting QR codes to infiltrate Signal, highlighting advanced phishing techniques and vulnerabilities in secure messaging platforms.

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

February 24, 2025

A hyper-realistic digital illustration showing the severity of Microsoft vulnerabilities in 2025, with interconnected red warning signals, fragmented systems, and ominous shadows representing critical zero-day exploits and cybersecurity risks.

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

January 21, 2025

Microsoft Outlook Zero-Click vulnerability warning with encryption symbols and a secure lock icon in a professional workspace.

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

January 18, 2025

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

January 18, 2025

Illustration depicting the Microsoft MFA Security Flaw, highlighting a digital lock being bypassed with code streams in the background, symbolizing the vulnerability nicknamed AuthQuake.

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

December 24, 2024

Google OAuth2 security flaw articles for in-depth analyses of threats and solutions. Stay updated by clicking on our scrolling topics.

Google OAuth2 security flaw written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

Google OAuth2 security flaw: Strategies Against Persistent Cookie Threats in Online Services

Google OAuth2 security flaw poses a serious threat that affects millions of users worldwide. However, hackers can exploit an undocumented OAuth2 endpoint to generate persistent cookies that allow them to access your online services, such as Gmail, Google Drive, YouTube, etc., without needing your password or 2FA code. Hackers can compromise your privacy, data, and identity using this flaw. How can you protect yourself from this attack? In this article, we will explain how this flaw works, how it has impacted many countries and organizations, and how you can use PassCypher, an innovative solution that verifies the URL of connection to Google, alerts you of password corruption, and blocks redirection iframes attacks.

Google OAuth2 Protocol: Ensuring Account Security and Comparing Different Methods

OAuth2 is an authorization protocol that facilitates user access to services like YouTube, Gmail, and Google Drive, allowing login with a Google account while avoiding password sharing. Specifically designed for ease and adaptability, this protocol comprehensively supports various applications, ranging from web and desktop platforms to mobile and living room devices. Consequently, when users engage with OAuth2, they authorize Google to share selective information, such as names and email addresses, with the connected service. Following this, Google issues an authentication token, effectively confirming the user’s identity to these services.

However, this protocol also has a security flaw, which was revealed by a hacker in October 2023. This flaw, known as the Google OAuth2 security flaw, allows hackers to create persistent cookies for Google accounts, which give them continuous access to Google services, even after the user resets their password. They exploit an undocumented Google Oauth endpoint named “MultiLogin”.

To protect themselves from this flaw, users can choose between different security methods, which require them to provide two pieces of evidence to log in to their account: their password and another factor. However, these methods have differences, advantages and disadvantages.

Google OAuth2 Multilogin Endpoint two-step verification (2SV)

This method uses the “MultiLogin” endpoint, which allows the user to log in to multiple Google services with a single authentication token. When the user logs in to their Google account, they receive a notification on their phone or computer, which they have to approve to validate their identity. This method is simple and fast, but it has a security risk. Indeed, it is vulnerable to the Google OAuth2 security flaw, which can compromise the user’s account.

One-time password two-factor authentication (2FA)

This method uses a one-time password based on time (TOTP) or on a counter (HOTP). This password is generated by an app or a physical device, which uses an algorithm and a secret shared with the Google account. When the user logs in to their Google account, they have to enter the one-time password displayed by the app or the device, in addition to their usual password. This method is more secure, because it does not depend on the Google Oauth endpoint. It resists phishing, replay or interception attacks. However, it requires access to the app or device, such as PassCypher NFC HSM1, that generates the one-time password. This can be inconvenient or impossible if you lose, damage or forget the app or device. Unless, of course, the app or device, like PassCypher, has an externalized OTP secret key backup system.

In conclusion, 2SV Google OAuth2 Multilogin Endpoint and 2FA one-time password are two security methods that offer different levels of protection. 2SV is simpler and faster, but it is vulnerable to the Google OAuth2 security flaw. 2FA is more secure, but it is more complex and dependent on an external factor. It is up to each user to choose the method that suits them best, depending on their needs and preferences.

Unveiling the Perils of PRISMA: A Deep Dive into Google OAuth2 Security Flaws

Google OAuth2 Security Flaw: A Critical Threat Exploiting Persistent Cookies

In October 2023, a critical Google OAuth2 security flaw was discovered in the Google OAuth2 protocol. This flaw, dubbed PRISMA, was a serious threat to the security of Google accounts. It allowed hackers to steal a wealth of sensitive data, including personal, financial, and professional information, as well as passwords and cookies.

Malware groups used the exploit widely. who integrated it into their infostealing tools. These tools were used to target millions of users worldwide, including government institutions, media organizations, NGOs, and businesses.

How the PRISMA Exploit Works: Exploiting an Undocumented Endpoint

Hackers took advantage of the PRISMA exploit, using an undocumented Google OAuth2 endpoint. This endpoint is typically used for legitimate purposes, such as providing limited access to Google accounts. However, the PRISMA exploit cleverly repurposed this endpoint to generate persistent cookies that remained valid even after a user changed their password or IP address.

To further understand how the PRISMA exploit worked, a security researcher from CloudSEK, Pavan Karthick M, analyzed it in depth in a report dated December 29, 2023. His findings revealed that the exploit worked by first obtaining the user’s Google account ID and refresh token. These credentials could be obtained through phishing attacks, malware infections, or other means.

Once the user’s credentials were obtained, the exploit used the undocumented endpoint to generate persistent cookies. Hackers then used these cookies to access the user’s Google account without needing 2FA.

The Impact of the PRISMA Exploit: Stealing Sensitive Data from Millions

The PRISMA exploit impacted a wide range of users. It was used to steal sensitive data from millions of users worldwide.

Government institutions, media organizations, NGOs, and businesses were all targeted by the exploit. Hackers stole sensitive data, such as personal information, financial records, and intellectual property, from these organizations.

The PRISMA exploit highlighted the ever-evolving nature of cyber threats. It showed that even the most secure protocols can be vulnerable to exploitation by determined hackers.

Securing Your Google Account from the PRISMA Exploit

The PRISMA exploit is a critical threat to Google account security. This exploit allows hackers to generate persistent Google cookies through token manipulation, enabling them to access Google services even after a user’s password is reset.

How to Protect Yourself from the PRISMA Exploit

Here are some key steps you can take to protect your Google account from the PRISMA exploit:

Enable two-factor authentication (2FA): 2FA is the most effective way to protect your Google account. It requires you to enter a code from your phone or other device, such as a hardware password manager, in addition to your password when you sign in.
Use a strong and unique password: Never reuse the same password for multiple accounts. If one account is compromised, all of your accounts are at risk. Choose a password that is long, complex, and difficult to guess. You can use a password generator or password manager to help you generate strong passwords.
Be cautious about clicking on links: Hackers often send phishing emails that contain links that will take you to malicious websites disguised as legitimate Google pages. Never click on links in emails or on websites unless you are sure they are from a trusted source.
Use a hardware password manager: PassCypher is an advanced hardware password manager that can help you protect your Google account from the PRISMA exploit. It is a versatile tool that can be used to manage your passwords on any storage device, including hard drives, SSDs, SD cards, USB drives, cloud storage, NAS devices, NFC devices, and mobile devices.

How the flaw works

Firstly, the flaw exploits an undocumented endpoint called the “multilogin” endpoint. Specifically, Google uses this endpoint to enable users to sign in to multiple Google accounts simultaneously. To exploit this flaw, attackers actively use the multilogin endpoint. They do this by generating persistent cookies for a victim’s Google account. Remarkably, the process involves using the victim’s email address and session ID.

Subsequently, the malware stores these cookies on the victim’s computer. Consequently, this action allows the attacker to access the victim’s Google account. Importantly, this access occurs without the need for the victim’s password. Moreover, this approach highlights a significant vulnerability in the account security process.

In essence, the attackers’ method of using the multiple sign-in endpoint is alarmingly effective. Notably, the generation and storage of cookies using the victim’s email and session ID underscore the flaw’s criticality. Ultimately, these actions enable attackers to bypass traditional security measures, accessing accounts undetected.

Below is the diagram which illustrates the technical method used to exploit the flaw.

The PRISMA exploit is a reminder that cyber threats are constantly evolving. By staying informed about the latest threats and taking proactive steps to protect your accounts, you can help to keep your data safe.

Analysis of the OAuth2 Flaw Affecting Google Account Security: A Statistical Outlook

The Growing Menace: Malware Exploiting Google Account Security Vulnerability

Significantly, Bitdefender’s study reveals a concerning trend. Between January and April 2023, they detected over 500,000 attempts to exploit the OAuth2 flaw, with a staggering 86% targeting Google Cloud accounts. Hackers have been using these accounts for resource-intensive activities, notably cryptocurrency mining, resulting in considerable costs for victims. This underscores the criticality of the Google account vulnerability, affecting millions worldwide.

The Extent of the Google Account Security Flaw Caused by OAuth2

The OAuth2 flaw exploited by malware has a wide impact. It affects not only individual users, but also major web platforms that use OAuth2 and OpenID for user authentication. Technology giants like Facebook, Google, LinkedIn, and Microsoft are notably impacted. Moreover, various infostealing tools have exploited this vulnerability to siphon off users’ personal, financial, and professional information. These tools include Lumma, Rhadamanthys, Stealc, Meduza, RisePro, and WhiteSnake, as well as Zloader, TrickBot, and Emotet.

Studying the Risks Posed by the Security Flaw

Furthermore, CloudSEK’s study emphasizes the widespread nature of this risk. Alarmingly, over 91% of European Cloud services, which frequently use OAuth2 for Google account connections, are at risk. Notably, a widely-used design application was found to be vulnerable to such attacks.

Disturbingly, Google’s data reveals that by 2024, only around 15% of Google account users had activated two-step verification. Consequently, this leaves a substantial 85% more exposed to the OAuth2 flaw and other security threats. Kaspersky’s survey indicates that 60% of users reuse passwords across multiple online accounts, exacerbating the risks of identity theft and account compromise. Moreover, RiskIQ’s analysis detected over 25,000 malicious applications on the Google Play Store in 2023, many of which contain infostealing tools exploiting the OAuth2 flaw.

Mitigating the Impact: Proactive Strategies Against OAuth2 Security Flaws in Google Accounts

In response to these risks, enabling two-step verification on Google accounts is crucial. Additionally, using reliable password managers is essential for enhanced security. It’s important to regularly monitor account activities, identifying and addressing suspicious behavior swiftly.

Exercising caution with untrusted links or attachments is vital. By taking this step, users can help avoid phishing attempts and other deceptive practices. Moreover, innovative solutions like PassCypher significantly enhance security. PassCypher verifies Google connection URLs and alerts users to password corruption. It effectively blocks iframe redirection attacks, adding an extra defense layer against sophisticated cyber threats.

By adopting these measures, users can significantly reduce vulnerability to the OAuth2 flaw. Staying vigilant and informed about security risks and solutions is key. This approach is essential for maintaining digital identities and assets’ integrity and safety in a connected world.

Recent Victims of Google’s OAuth2 Security Breach: A Global Overview

Malware has affected several countries and organizations, which have seen their Google accounts compromised and their data stolen. Among the victims, we can mention:

Greece, Moldova and Tunisia, which were targeted by a first hacking campaign in October 2023. Hackers used the exploit to access government institutions, media, NGOs, and businesses in these countries. Hackers stole sensitive information, such as official documents, diplomatic correspondence, financial data, etc.
Vietnam, which was targeted by a second hacking campaign in November 2023. The hackers used the exploit to access the Google accounts of ministries, press agencies, universities and businesses in this country, and stole strategic data, such as development plans, research reports, trade contracts, etc.
Pakistan, which was victim of a third hacking campaign in December 2023. The hackers used the exploit to access the Google accounts of authorities, media, NGOs and businesses in this country, and stole confidential data, such as military documents, secure communications, personal data, etc.
Several European countries, including France, Germany, Italy, Spain and the United Kingdom, which were targeted by a fourth hacking campaign in January 2024. The hackers used the exploit to access the Google accounts of European institutions, political parties, media, NGOs and businesses in these countries, and stole critical data, such as bills, investigation reports, electoral data, etc.

Voices of the targeted: Testimonies from Google’s OAuth2 Flaw Victims

The vulnerability severely damaged the victims, exposing their data, blocking their accounts, disrupting their services, and even ruining their finances. Here are some real testimonies of victims, collected by the website 20 Minutes and the website Aleteia:

Julien, 35, computer engineer, received an email that seemed to come from Google. It asked him to confirm his identity to access a service. He clicked on the link and entered his password. A few minutes later, he received another email from Google. It told him that his account had been hacked and that he had to change his password. But it was too late, he no longer had access to his account. The hackers used his account to send spam to his contacts, to access his photos, his documents, his bank accounts, etc. They even tried to blackmail him by threatening to publish his personal data on the Internet. He filed a complaint, but he did not get a response. He feels helpless and violated.
Léa, 28, school teacher, uses her Google account to log in to several online services, such as YouTube, Gmail, Google Drive, etc. Malware blocked her account, preventing her access to any of these services. She contacted Google support, who told her that her account had been compromised by malware and that she had to recover it by following a procedure. But Hackers changed her account’s security settings, causing the recovery procedure to fail. She lost all her files, her emails, her videos, etc. She had to create a new account and start over. It’s very frustrating and stressful for her.
Omar, 42, human rights activist, works for an NGO that defends human rights in the world. He uses his Google account to communicate with his colleagues, his partners, his sources, etc. One morning, he discovered that Hackers hacked his account and stole his data. Hackers sent defamatory messages, accessed confidential information, and compromised the security of his contacts using his account. They even tried to make him look like a spy. He was threatened, harassed, intimidated. He had to change his phone number, email address, pseudonym, etc. He fears for his life and for that of his loved ones.

How to protect yourself from the Google OAuth2 security flaw?

Google OAuth2 security flaw exposes users to this threat. It allows hackers to bypass 2FA and access online services with persistent cookies. They exploit an undocumented OAuth2 endpoint to generate these cookies. To protect yourself, use PassCypher. PassCypher is a hardware password manager that uses NFC technology to securely store and manage passwords. It can also detect and block phishing attacks and iframe redirection attacks. It is an innovative solution that verifies the URL of connection to Google, alerts you of password corruption, and blocks redirection iframes attacks.

Securing Your Google Account: Proactive Measures Against OAuth2 Exploits

Google tried to strengthen its fraud detection measures to counter the exploit, but the hackers adapted their method to bypass them. Therefore, there is no simple solution to protect yourself from the vulnerability. But you can adopt some good practices to secure your Google account:

Use a strong and unique password

Do not reuse the same password for multiple accounts. If one of them is compromised, the others will be too. Choose a long, complex and hard to guess password. You can use a password generator or a password manager to help you.

Enable two-step verification

It is an additional layer of security that asks for a code or a confirmation on your phone when you log in to your Google account. Thus, even if someone knows your password, they will not be able to access your account without your device. You can enable two-step verification in the settings of your Google account.

Check recent activities and connected devices

Google allows you to check the history of connections to your account, as well as the devices that have accessed it. If you notice any suspicious activity or unknown device, you can report it and remove it from your account. You can check recent activities and connected devices in the settings of your Google account.

Be careful of fraudulent emails and websites

Hackers may try to trick you by sending you emails or links that seem to come from Google, but are actually phishing attempts. Phishing is a technique that makes you believe that you need to provide your credentials or personal information to access a service or an offer. Do not click on dubious links or attachments, and always check the website address before entering your data. You can report fraudulent emails and websites to Google.

Log in regularly to your Google account

Starting from December 2023, Google will delete inactive accounts for more than two years. This measure aims to increase security and reduce the risks of compromise of abandoned accounts. To avoid losing your data, remember to log in to your Google account at least once every two years.

By following these tips, you can increase the security of your Google account and protect it from hackers. Do not forget to change your password regularly and keep your phone updated. For more information, visit Google’s security website.

PassCypher: A Leading-Edge Solution for Protecting Against Google OAuth2 Vulnerabilities

A leading-edge solution

The Google OAuth2 vulnerability is a critical security threat to Google accounts. Attackers can use this vulnerability to generate persistent cookies and access your Google account, even after you change your password or IP address.

PassCypher is a hardware password manager that can help protect your Google account from the Google OAuth2 vulnerability. PassCypher seamlessly integrates EviPass, EviOTP, EviCore NFC HSM, EviCore NFC HSM Browser Extension, and EviCore HSM OpenPGP technologies, as well as the NFC HSM devices from Freemindtronic. These technologies form the foundation of PassCypher’s comprehensive security features.

PassCypher uses post-quantum AES-256 robust encryption with segmented keys, which makes it impossible for attackers to decrypt your passwords, even with a quantum computer.

Advanced security features

In addition to its post-quantum encryption, PassCypher also offers a number of other advanced security features that can help protect your Google account.

Protection against iframe redirection: PassCypher blocks iframe redirection, preventing attackers from redirecting you to malicious websites without your knowledge.
Sandbox protection: PassCypher uses a sandbox protection mechanism to isolate each encrypted secret, preventing attackers from accessing or modifying your passwords or the original login URL.
Protection against SQL injection attacks: PassCypher does not store your passwords on a server or database. Instead, each password is encrypted individually and stored freely on one or more local or online or offline storage devices at the user’s choice, in lan and/or wan. This physically prevents attackers from accessing your encrypted passwords via SQL injection attacks.
Password corruption detection: PassCypher alerts you if it detects that a password has been corrupted, ensuring that your sensitive information remains secure.
State-of-the-art password generation: PassCypher uses a variety of algorithms to generate truly random and strong passwords greater than 256 bits, making them impossible to guess even to post-quantum attacks.

A versatile solution

PassCypher is a versatile tool that can be used to manage your passwords on any storage device, including:

Hard drives
SSDs
SD cards
USB drives
Cloud storage
NAS devices
NFC devices
Mobile devices

How to use PassCypher

To use PassCypher, you can install the free PassCypher HSM PGP extension for your Chromium or Firefox web browser. Once the extension is installed, you can easily access the following features:

Protection against iframe redirection
Password corruption detection
State-of-the-art password generation
Segmented key AES-256 OpenPGP encrypted password manager

To log in to your Google account using PassCypher, simply click on the PassCypher icon that appears in the Google login field. Once you click on the icon, PassCypher will automatically fill in your login credentials and submit them for you.

PassCypher HSM PGP is a free extension that provides basic password management features. PassCypher Engine, a paid add-on, adds additional features, such as automatic login in one second, password change in five seconds, fully automated secret usage management on multiple devices, and instant, fully automated encryption and decryption.

An effective solution

By using PassCypher, you can significantly improve the protection of your Google account against the Google OAuth2 vulnerability. PassCypher’s robust security features and ease of use make it a valuable tool for protecting your digital assets.

Conclusion: Safeguarding Against Google’s OAuth2 Security Flaws

We have seen how a clever hack allows cybercriminals to access Google accounts without passwords. We have also seen how this hack has affected many countries and organizations, and how he victims have testified about their distress. Finally, we have seen how to protect ourselves from this threat by adopting good security practices, and by using PassCypher, an innovative solution that verifies the URL of connection to Google, alerts in case of password corruption, and protects from redirection iframes attacks. The exploit reveals the complexity and stealthiness of modern cyber threats. The need for continuous monitoring of technical vulnerabilities and human intelligence sources to stay ahead of emerging threats.

2023, Articles, Cyberculture, EviCypher NFC HSM, News, Technologies

Telegram and the Information War in Ukraine

Posted on January 5, 2024March 25, 2024 by FMTAD

05
Jan

Telegram and the Information War in Ukraine written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

How Telegram Shapes the Information War in Ukraine

In this article, we explore how Telegram and Ukraine’s information warfare are intertwined. We look at how the messaging app is influencing the Russia-Ukraine conflict, and how it can be used for good or evil. We also discuss the benefits and risks of using Telegram, as well as how security and freedom of expression can be enhanced with EviCypher NFC HSM technology.

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

April 30, 2025

2025 Digital Security

APT28 spear-phishing France: targeted attacks across Europe

April 30, 2025

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

February 25, 2025

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

February 24, 2025

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

January 21, 2025

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

January 18, 2025

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

January 18, 2025

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

December 24, 2024

How Telegram Influences the Conflict between Russia and Ukraine

Telegram and the information war in Ukraine are closely related. Telegram is a messaging app that offers users a secure and confidential way to communicate, thanks to its end-to-end encryption system. It has a large user base around the world, especially in Eastern Europe, where it plays a vital role in the information war between Russia and Ukraine.

Telegram’s Usage in Ukraine: Updated Statistics

Popularity and Download Trends

According to the report of the research company SimilarWeb, Telegram is the second most downloaded messaging app in Ukraine, after Viber, with 3.8 million downloads in 2021. It is also the fourth most used app in terms of time spent, with an average of 16 minutes per day. Telegram has about 10 million active users in Ukraine, which is almost a quarter of the country’s population.

Telegram’s Role in Ukrainian Media Landscape

Telegram is particularly appreciated by Ukrainians for its channel functionality, which allows to broadcast messages to a large audience. Some of these channels have become influential but controversial sources of information, as their owners and sources are often unknown. Among the most popular channels in Ukraine, we can mention:

@Zelenskyi, the official channel of President Volodymyr Zelensky, which has more than 2 million subscribers. It publishes announcements, speeches, interviews and videos of the head of state. It was created in 2019, during Zelensky’s election campaign, who was then an actor and a comedian.
@NashyGroshi, the channel of the journalistic project “Our Money”, which has more than 1.5 million subscribers. It publishes investigations, reports and analyses on corruption, abuse of power, political scandals and judicial cases in Ukraine. It was created in 2008, by journalist Denys Bihus, who received several awards for his work.
@Resident, the channel of blogger and activist Anatoliy Shariy, which has more than 1.3 million subscribers. It publishes comments, criticisms and sarcasms on the political and social news in Ukraine. He is known for his pro-Russian, anti-European and anti-government positions. He is currently in exile in Spain, where he is wanted by the Ukrainian justice for high treason and incitement to hatred.

These channels illustrate the diversity and complexity of the Ukrainian media landscape, which is marked by the conflict with Russia, the democratic transition, the fight against corruption and the polarization of society. They are also a reflection of the issues and challenges related to the use of Telegram, which can be both a tool of communication, information and manipulation.

Oleksiy Danilov’s Stance on Telegram’s Usage in Ukraine

Concerns Over National Security

Oleksiy Danilov is the secretary of the National Security and Defense Council of Ukraine, the body responsible for coordinating and controlling the activities of the executive bodies in the fields of national security and defense. He is also the head of cybersecurity of the country, and in this capacity, he expressed his reservations about the use of Telegram by Ukrainians. In February 2022, he stated that some anonymous and manipulative Telegram channels represented a threat to national security, and that they should be de-anonymized and regulated. He particularly targeted the channel @Resident, which broadcasts pro-Russian and anti-Ukrainian comments, and which is suspected of being linked to the Russian intelligence services. He also criticized the channel @Zelenskyi, which according to him, is not controlled by the Ukrainian president, but by advisers who seek to influence his policy.

Debating Telegram’s Influence in Ukraine

These statements provoked mixed reactions in Ukraine. Some supported Danilov’s position, believing that it was necessary to fight against misinformation and propaganda that undermine the sovereignty and democracy of the country. Others denounced an attempt at censorship and an attack on freedom of expression, recalling that Telegram was one of the few spaces where Ukrainians could access independent and diverse information.

How Telegram Influences the Information War in Ukraine

The Benefits and Risks of End-to-End Encryption

Telegram is a messaging app that lets you send messages, photos, videos, documents, and make voice and video calls. Its privacy policy is based on data encryption and non-cooperation with authorities. You can also create groups and channels that can reach thousands or millions of users.

End-to-end encryption is a technology that makes sure only the people in a conversation can read the messages, not even the service provider. Telegram has this option, but it is not on by default. You have to choose it for each chat, by switching to the “secret chat” mode. However, Telegram’s encryption is not based on standard protocols, and security experts have found some flaws.

Anonymous Channels and Their Impact on the Ukrainian Conflict

The channels are spaces where an administrator can send messages to a large audience. They can be public or private, and they can have millions of followers. Some channels are influential but controversial sources of information, as their owners and sources are often unknown. The channels can spread misinformation, propaganda, fake news, or violence.

Telegram and Russian propaganda have a strong connection, as many pro-Russian channels use the app to influence the public opinion in Ukraine and other countries. Telegram and the Ukrainian resistance also use the app to communicate and organize their actions against the Russian aggression.

Bots, Payment Services and Unique Usernames: A Double-Edged Sword

Bots are programs that interact with users. They offer services, information, or entertainment. Anyone can create them. They can be part of chats or channels. Bots can be helpful or harmful. They can collect personal data, send spam, or spread viruses.

Payment Services: Handy or Dishonest?

You can also use payment services via Telegram. These features use third-party platforms, such as Stripe or Apple Pay. They need bank or credit card information. Payment services can be handy or dishonest. They can steal sensitive data, scam users, or fund illegal activities.

Unique Usernames: Fun or Troublesome?

Another feature of Telegram is the unique usernames. They let users contact each other easily, without sharing their phone number. Users can create and change them at any time. Unique usernames can be fun or troublesome. They can enable harassment, identity theft, or account sale.

These features of Telegram raise issues of cybersecurity, privacy, end-to-end encryption, and application security. They can be used by bad actors, who want to harm Ukraine or its people. They can also be regulated by the authorities, who want to control the information or access the data of the users.

Telegram and the Information War in Ukraine: A Challenge

One of the main challenges of Telegram and the information war in Ukraine is to balance the freedom of expression and the protection of national security. Telegram and the Ukrainian conflict are closely intertwined. The app is used by both sides to communicate, inform, and influence. Telegram and Russian propaganda have a strong connection. Many pro-Russian channels use the app to sway the public opinion in Ukraine and other countries. Telegram and the Ukrainian resistance also use the app to coordinate and organize their actions against the Russian aggression. Telegram and cybersecurity in Ukraine are also crucial. The app can be a source of threats or a tool of defense.

Telegram VS Other Messaging Apps: A Comparative Analysis

WhatsApp: Popular but Questionable Confidentiality

WhatsApp is the most popular messaging app in the world, with more than 2 billion users. It offers end-to-end encryption by default for all conversations, which guarantees the protection of data. However, it belongs to Facebook, which has a dubious reputation in terms of respect for privacy, and which has raised fears about the sharing of data with other applications of the group. WhatsApp is also subject to the requests of the authorities, who can demand access to the metadata, such as the phone number, the IP address or the location of the users.

Signal: High Security but Limited User Base

Signal is a messaging app that claims to be the most secure and confidential on the market. It also offers end-to-end encryption by default for all conversations, and it does not collect any personal data. It is developed by a non-profit organization, which does not depend on advertising or investors. It is recommended by personalities such as Edward Snowden or Elon Musk. Signal is however less popular than WhatsApp or Telegram, with about 50 million users. It also offers fewer features, such as file sharing, information channels, bots or payment services.

Telegram: Innovative but Security Concerns

Telegram is between these two apps, offering more features than Signal, but less security than WhatsApp. Telegram allows users to choose the level of encryption and privacy they want, by opting for the “secret chat” mode or the “normal chat” mode. Telegram also allows users to enjoy innovative services, such as channels, bots, payments or unique usernames. However, Telegram also presents risks, such as fakes news, inappropriate content, privacy breaches or cyberattacks. Telegram is therefore an app that offers advantages and disadvantages, and that requires vigilance and discernment from users.

Telegram’s Global Perception and Regulation

Russia: Origin and Opposition

Russia is the country of origin of Telegram, but also its main adversary. The Kremlin tried to block the app in 2018, invoking reasons of national security and fight against terrorism. It demanded that Telegram provide it with the encryption keys to access the messages of the users, which Pavel Durov refused. It then ordered the telecom operators to block access to Telegram, but this measure proved ineffective, as Telegram used cloud servers to bypass the blocking. Many Russian users also use VPNs or proxies to access the app. In 2020, the Kremlin finally lifted the ban on Telegram, acknowledging its failure and stating that the app had cooperated with the authorities to remove extremist content. However, some observers suspect that Telegram made concessions to the Kremlin to lift the blocking, such as collaborating with the Russian services or censoring some channels.

France: Striving for Digital Regulation

France is a country that wants to be at the forefront of the regulation of digital platforms, especially in terms of fighting online hate. It adopted in 2020 a law that obliges the platforms to remove illegal content, such as incitement to violence, discrimination or terrorism, within 24 hours, under penalty of financial sanctions. This law also applies to messaging apps, such as Telegram, which must set up reporting and moderation mechanisms for content. France recognizes the right of users to privacy and end-to-end encryption, but it also asks the service providers to cooperate with the law enforcement to access the encrypted data when needed. France is also a country where Telegram is used by radical groups, such as jihadists or yellow vests, who take advantage of the app to organize, mobilize or defend themselves.

Ukraine: Balancing Utility and Risks

Ukraine is a country that has an ambivalent attitude towards Telegram, recognizing its usefulness, but also its dangers. On the one hand, Telegram is a source of information and a tool of resistance for many Ukrainians, who face the threat of Russian aggression and the challenges of democratic transition. On the other hand, Telegram is also a vector of misinformation and propaganda, which can undermine the sovereignty and stability of the country. Ukraine does not have a specific law to regulate Telegram, but it has some legal provisions to protect national security and public order, which can be used to restrict or block the app if necessary. Ukraine also cooperates with international organizations, such as the EU or NATO, to counter the cyber threats and the hybrid warfare that target the country.

EviCypher NFC HSM: Enhancing Telegram’s Security

The Role of Contactless Encryption Technology

One of the main challenges of using Telegram is to ensure the security and confidentiality of the data exchanged, especially in a context of information war. To meet this challenge, a possible solution consists of using EviCypher NFC HSM technology, which is a contactless encryption technology developed by Freemindtronic, an Andorran company specializing in the design of counter-espionage solutions implementing in particular contactless security with NFC technology. EviCypher NFC HSM uses two types of encryption algorithms for data:

Symmetric encryption in AES-256 for data such as texts (messages), thanks to its sub-technology EviCrypt. It uses a unique key, which is randomly generated and segmented into several parts. This key is used to encrypt and decrypt messages with the AES 256-bit algorithm.
Asymmetric encryption in RSA-4096 for symmetric encryption keys. It uses a pair of keys, which is generated and used from the NFC HSM device and which is based on the RSA 4096-bit algorithm. This pair of keys is used to share the symmetric key of at least 256 bits between the NFC HSM devices remotely, by encrypting the symmetric key with the public key of the recipient and decrypting the symmetric key with the private key of the recipient. The symmetric key is then stored and re-encrypted in the NFC HSM device of the recipient, with the trust criteria imposed by the sender if he has encapsulated them in the shared encryption key.

Practical Applications of EviCypher NFC HSM

EviCypher NFC HSM is a technology that uses hardware security modules (HSM) to store and use encrypted secrets. It allows contactless encryption with the NFC communication protocol. You can integrate the NFC HSM into various media, such as a card, a sticker, or a key ring. Then, you can pair it with an NFC phone, tablet, or computer. This way, you can encrypt everything before using any messaging service, including Telegram. EviCypher NFC HSM also has anti-cloning, anti-replay, and counterfeit detection mechanisms. It is part of the DataShielder product range, which offers serverless and databaseless encryption solutions.

Telegram and the Ukrainian conflict

EviCypher NFC HSM is compatible with Telegram, a messaging app that influences the information war between Russia and Ukraine. It offers more security and confidentiality than Telegram’s end-to-end encryption, which is not based on recognized standards. It also gives you more flexibility and control than Telegram’s secret chat mode, as you can choose the trust criteria for the encryption keys. Moreover, it is more convenient and simple than Telegram’s normal chat mode, as you can encrypt and decrypt messages with a simple gesture.

Telegram and cybersecurity in Ukraine

EviCypher NFC HSM is a useful technology with Telegram, as it enhances the security and confidentiality of the data exchanged, especially in a context of information war. It is also a universal technology, as you can use it with any other messaging app, such as WhatsApp, Signal, Messenger, etc. It is also an innovative technology, as it uses the NFC communication protocol to perform contactless encryption, without requiring any connection or installation.

Concluding Insights on Telegram’s Role in Ukraine

In this article, we have seen how Telegram plays a vital role in the information war between Russia and Ukraine, and what issues and challenges there are in using this messaging app. We have also seen how the technology EviCypher NFC HSM can be a useful solution to enhance the security and confidentiality of the data exchanged with Telegram. We hope that this article has been informative and interesting for you, and that it has helped you to better understand the situation of Telegram in Ukraine and in other countries. Thank you for reading.

Overview of Cited Sources

Here are the sources of the article, which are valid, reliable, relevant and if possible official links that allow to justify and verify the statements made in this article:

[Liga.net]: the news site that published the interview of Oleksiy Danilov on November 2, 2023, in which he expresses his concerns about Telegram.
[NV.ua]: the news site that reported the statement of Oleksiy Danilov, who alerted the nation to the critical vulnerabilities of Telegram, on November 2, 2023.
[RT – Pravda]: the Ukrainian news site that related the remarks of Oleksiy Danilov, who answered the questions of journalists during a press conference on November 3, 2023.
[Number of Telegram Users in 2023? 55 Telegram Stats (backlinko.com)]: an article that gives figures on the use of Telegram in the world and in Ukraine.
[NV.ua -NSDC]: the official website of the National Security and Defense Council of Ukraine, which published the press release of Oleksiy Danilov, who clarified his recent comments on Telegram, on November 15, 2023
[Ukrainians turn to encrypted messengers, offline maps and Twitter amid Russian invasion]: an article that describes how Ukrainians use Telegram and other digital tools to protect themselves and get informed in the face of the Russian aggression.
[Pravda – France 24]: the French news site that contains a video of the interview of Oleksiy Danilov with the journalist Gulliver Cragg, dated January 23, 2023.
[NFC HSM Technology – Freemindtronic]: an article that explains the NFC HSM technologies and how they work.
[EviCypher NFC HSM technology – Freemindtronic]: a page that contains articles and videos on the NFC HSM technologies.
[FAQ for the Technically Inclined – Telegram APIs]: a page that provides technical information about the Telegram APIs and the MTProto protocol.

2024, Articles, Digital Security

Kismet iPhone: How to protect your device from the most sophisticated spying attack?

Posted on January 2, 2024January 2, 2024 by FMTAD

02
Jan

Kismet iPhone and Pegasus written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

Kismet iPhone and Pegasus: a deadly combo

Hackers can use Kismet iPhone to install Pegasus spyware on your iPhone. This spyware can access your data, activity, and conversations.

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

April 30, 2025

2025 Digital Security

APT28 spear-phishing France: targeted attacks across Europe

April 30, 2025

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

February 25, 2025

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

February 24, 2025

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

January 21, 2025

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

January 18, 2025

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

January 18, 2025

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

December 24, 2024

Kismet iPhone: How to protect your device from the most sophisticated spying attack using Pegasus spyware

Do you own an iPhone? Do you think it is safe and private? You might be wrong. Hackers have created a clever attack called Kismet iPhone that can infect your device with Pegasus, the world’s most powerful spyware, without you noticing. This spyware can steal your personal data, track your activity, and listen to your conversations. In this article, we will tell you how Kismet iPhone works, who is behind it, and how you can protect yourself from it.

What is Kismet iPhone?

Kismet iPhone is the name of the attack that hackers use to install Pegasus, the spyware, on iPhones. Kismet iPhone uses a technique called “watering hole”. It consists of infecting websites visited by the targeted users. These websites contain malicious code that detects if the user has an iPhone and which model. If so, the malicious code redirects the browser to a server that exploits zero-day flaws in iOS and Safari. These flaws allow to install Pegasus without the user noticing. Pegasus then runs in the background and communicates with a command and control server.

What is Pegasus?

Pegasus is the name of the spyware that Kismet iPhone installs on iPhones. Pegasus is one of the most powerful spyware in the world, developed by NSO Group, an Israeli company that sells spyware to governments and intelligence agencies. Pegasus can access almost everything on the infected iPhone, such as messages, photos, contacts, location, calls, passwords and even conversations near the microphone. Pegasus can also activate the camera and the microphone remotely, and record the screen. Pegasus can bypass encryption and security features of apps like WhatsApp, Signal, Telegram, and others.

Who is behind Kismet iPhone and Pegasus?

Kismet iPhone and Pegasus are the work of NSO Group, an Israeli company that sells spyware to governments and intelligence agencies. NSO Group claims that its products are only used for legitimate purposes, such as fighting terrorism and crime. However, investigations have revealed that NSO Group has also targeted journalists, activists, lawyers, politicians and dissidents, violating their privacy and rights. NSO Group has been accused of being involved in the murder of Jamal Khashoggi, a Saudi journalist, and the hacking of Jeff Bezos, the founder of Amazon.

Examples of victims of Kismet iPhone and Pegasus

According to a report by Citizen Lab, a research group at the University of Toronto, Kismet iPhone and Pegasus have been used to spy on at least nine Bahraini activists between June 2020 and February 2021. The activists were members of the Bahrain Center for Human Rights, the Bahrain Institute for Rights and Democracy, and the European Center for Constitutional and Human Rights. They received text messages containing malicious links that attempted to infect their iPhones with Pegasus.

Another report by Amnesty International and Forbidden Stories, a non-profit media organization, revealed that Kismet iPhone and Pegasus have been used to target more than 50,000 phone numbers of people from various countries and professions. Among them were journalists, human rights defenders, lawyers, politicians, business executives, religious leaders, and celebrities. Some of the prominent names on the list were French President Emmanuel Macron, Pakistani Prime Minister Imran Khan, Indian opposition leader Rahul Gandhi, Moroccan journalist Omar Radi, and Mexican journalist Cecilio Pineda Birto.

A third report by The Guardian, a British newspaper, exposed that Kismet iPhone and Pegasus have been used to spy on the civil rights movement in the United States. The report found that at least 15 people who were close to the Black Lives Matter activist DeRay Mckesson had their phones hacked with Pegasus in 2016. The report also found that Alaa Mahajna, a lawyer who represented the family of George Floyd, had his phone hacked with Pegasus in 2020.

These examples show that Kismet iPhone and Pegasus are not only used to spy on criminals and terrorists, but also on innocent people who exercise their rights to freedom of expression, association, and assembly.

How to protect yourself from Kismet iPhone and Pegasus?

To protect yourself from Kismet iPhone and Pegasus, you need to update your iPhone with the latest version of iOS. Apple fixed the zero-day flaws exploited by Kismet iPhone in September 2020, making the attack ineffective. You also need to avoid clicking on suspicious links or visiting unsecured websites, which could be infected by malicious code. You need to use a VPN (virtual private network) to encrypt your internet connection and prevent potential spies from seeing your online activity. You can check if your iPhone has been infected by Pegasus by using a tool developed by Amnesty International, called MVT (Mobile Verification Toolkit).

Sources and downloads

If you want to learn more about the zero-day flaws used by Kismet iPhone and Pegasus, and how Apple fixed them, you can check the following sources:

About iOS 15 updates – Apple Support: this site gives you the details of the iOS 15 updates, including the security patches provided by each version. You can also download the latest version of iOS 15 from this site, by going to “Settings” > “General” > “Software Update”.
iOS 17.0.1 and iPadOS 17.0.1 updates are released with security fixes – iphonology.fr: this site informs you of the latest news on iOS and iPadOS, and explains how to install the security updates on your device.
iOS 16 will offer security patches without updates to install – iphonesoft.fr: this site presents a new feature of iOS 16, which will allow Apple to remotely install security patches on your iPhone, without you having to do an update.

If you want to check if your iPhone has been infected by Pegasus, you can download the following application:

MVT (Mobile Verification Toolkit)MVT (Mobile Verification Toolkit): this open source software allows you to analyze your iPhone and detect traces of Pegasus. It is available for Windows, Mac and Linux, and requires some technical knowledge to use it. You can follow the user guide on the official project site.

Conclusion

Kismet iPhone and Pegasus are two of the most sophisticated and dangerous cyberattacks that target iPhone users. They can compromise your device and your data, without you being aware of it. To protect yourself from these attacks, you need to keep your iPhone updated, be careful with what you click and visit online, and use a VPN. You can also use a tool to detect if your iPhone has been infected by Pegasus. If you want to know more about Pegasus, the most powerful spyware in the world, you can read our dedicated article here: Pegasus: the cost of spying with one of the most powerful spyware in the world

However, you should know that the zero-day risk is always present, and that the economic stakes are huge for the companies that exploit these flaws to spy on their competitors or their adversaries. That is why Freemindtronic has specialized in counter-espionage tecnologiescounter-espionage tecnologies, which allow you to protect your data and your privacy against malicious intrusions. If you are interested in these solutions, you can visit our Freemindtronic website and discover the different technologies of counter espionage.

2023, Articles, CyberStealth, legal, Legal information, News, Spying

The American Intelligence: How It Works

Posted on December 26, 2023December 26, 2023 by FMTAD

26
Dec

Learn more about the American Intelligence written by Jacques Gascuel, inventor of sensitive data safety and security systems, for Freemindtronic. This article may be updated on this subject.

The American intelligence: a paradox

The American intelligence is powerful and influential, but also faces limits and challenges. Discover how it works, what are its consequences, and how to protect yourself from it.

Why the NFC hardware wallet with credit card manager is PCI DSS compliant

2020 Legal information

Freemindtronic’s NFC hardware wallets with credit card management are PCI DSS compliant

December 20, 2020

Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing

November 8, 2023

Unitary Patent system European why some EU countries are not on board

2023 Articles Cyberculture EviCore HSM OpenPGP Technology EviCore NFC HSM Browser Extension EviCore NFC HSM Technology Legal information Licences Freemindtronic

Unitary patent system: why some EU countries are not on board

August 1, 2023

Andorran law

Llei 26/2014 del 30 d’octubre de patents

November 21, 2016

Articles Crypto Currency Cryptocurrency Digital Security EviPass Technology NFC HSM technology Phishing

Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers

December 16, 2023

The American Intelligence: How It Works, Its Limits and Consequences

The American intelligence is one of the most powerful and influential in the world. It has a vast network of agencies, resources, and allies that enable it to collect, analyze, and act on information of strategic interest. However, the American intelligence also faces challenges and criticisms, both internally and externally. In this article, we will explore how the American intelligence works, what are its limits, and what are the consequences of its actions for the global security and privacy.

How the American Intelligence Works

The American intelligence is composed of 18 agencies that form the Intelligence Community (IC). These agencies are divided into two categories: the civilian agencies, which are under the supervision of the Director of National Intelligence (DNI), and the military agencies, which are under the supervision of the Secretary of Defense.

The main civilian agencies are:

The Central Intelligence Agency (CIA), which is responsible for collecting, analyzing, and disseminating foreign intelligence, as well as conducting covert operations and paramilitary activities.
The National Security Agency (NSA), which is responsible for collecting, processing, and disseminating signals intelligence (SIGINT), as well as conducting cyber operations and protecting the US government’s communications and information systems.
The Federal Bureau of Investigation (FBI), which is responsible for collecting, analyzing, and disseminating domestic intelligence, as well as conducting counterintelligence, counterterrorism, and law enforcement activities.
The National Geospatial-Intelligence Agency (NGA), which is responsible for collecting, analyzing, and disseminating geospatial intelligence (GEOINT), which includes imagery, maps, and other geographic information.
The National Reconnaissance Office (NRO), which is responsible for designing, launching, and operating reconnaissance satellites and other space-based systems that provide intelligence to the IC and the Department of Defense (DoD).
The Office of the Director of National Intelligence (ODNI), which is responsible for overseeing, coordinating, and integrating the activities of the IC, as well as providing strategic guidance and support to the DNI.

The main military agencies are:

The Defense Intelligence Agency (DIA), which is responsible for providing military intelligence to the DoD and the IC, as well as conducting human intelligence (HUMINT), counterintelligence, and defense attaché activities.
The National Security Agency/Central Security Service (NSA/CSS), which is responsible for providing SIGINT and cyber support to the DoD and the IC, as well as conducting information assurance and cryptologic activities.
The National Geospatial-Intelligence Agency (NGA), which is responsible for providing GEOINT support to the DoD and the IC, as well as conducting geospatial analysis and mapping activities.
The National Reconnaissance Office (NRO), which is responsible for providing space-based intelligence support to the DoD and the IC, as well as conducting satellite reconnaissance and surveillance activities.
The Military Intelligence Corps (MI), which is responsible for providing tactical and operational intelligence to the Army and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
The Office of Naval Intelligence (ONI), which is responsible for providing maritime intelligence to the Navy and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
The Marine Corps Intelligence Activity (MCIA), which is responsible for providing intelligence to the Marine Corps and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.
The Air Force Intelligence, Surveillance, and Reconnaissance Agency (AFISRA), which is responsible for providing intelligence to the Air Force and the joint force, as well as conducting HUMINT, SIGINT, GEOINT, and counterintelligence activities.

The American intelligence works by collecting information from various sources, such as human sources, signals, images, open sources, and others. It then analyzes this information to produce intelligence products, such as reports, assessments, briefings, and forecasts. These products are then disseminated to the relevant consumers, such as the President, the Congress, the military, the policy makers, and the allies. The American intelligence also acts on the information it collects, by conducting operations, such as covert actions, cyber attacks, drone strikes, and special operations.

The Limits of the American Intelligence

The American intelligence, despite its capabilities and resources, is not omnipotent or infallible. It faces several limits and challenges, such as:

Legal and ethical limits: The American intelligence is bound by the laws and regulations of the US and the international community, as well as by the values and principles of the American democracy. It must respect the rights and liberties of the American citizens and the foreign nationals, as well as the sovereignty and interests of the other countries. It must also abide by the oversight and accountability mechanisms of the executive, the legislative, and the judicial branches, as well as the public opinion and the media. The American intelligence must balance its need for secrecy and effectiveness with its duty for transparency and legitimacy.
Technical and operational limits: The American intelligence is limited by the availability and reliability of the information it collects, as well as by the accuracy and timeliness of the analysis it produces. It must deal with the challenges of information overload, data quality, data security, data privacy, and data sharing. It must also cope with the threats and risks of cyber attacks, counterintelligence, deception, and denial. The American intelligence must balance its need for innovation and adaptation with its need for standardization and coordination.
Strategic and political limits: The American intelligence is limited by the complexity and uncertainty of the global environment, as well as by the diversity and dynamism of the actors and issues it faces. It must deal with the challenges of globalization, multipolarity, regionalization, and fragmentation. It must also cope with the threats and opportunities of terrorism, proliferation, rogue states, failed states, and emerging powers. The American intelligence must balance its need for anticipation and prevention with its need for reaction and intervention.

The Consequences of the American Intelligence

The American intelligence has significant consequences for the global security and privacy, both positive and negative, such as:

Positive consequences: The American intelligence contributes to the protection and promotion of the national security and interests of the US and its allies, as well as to the maintenance and enhancement of the international peace and stability. It provides valuable information and insights to the decision makers and the operators, as well as to the public and the media. It also conducts effective operations and actions to deter, disrupt, or defeat the adversaries and the threats. The American intelligence plays a key role in the global intelligence cooperation and coordination, as well as in the global governance and leadership.
Negative consequences: The American intelligence also poses risks and challenges to the security and privacy of the US and its allies, as well as to the international order and norms. It may collect, analyze, or disseminate information that is inaccurate, incomplete, or biased, leading to errors, failures, or controversies. It may also conduct operations or actions that are illegal, unethical, or counterproductive, leading to violations, scandals, or backlashes. The American intelligence may face competition or conflict with the other intelligence services or actors, as well as with the other stakeholders or interests.

Section 702 of FISA: A Surveillance Without Control

On July 17, 2008, the US Congress passed section 702 of the FISA (Foreign Intelligence Surveillance Act), which authorizes the US intelligence agencies to collect the electronic communications of non-Americans located abroad, without a warrant from the FISA judge.
On January 19, 2018, the US Congress extended section 702 of FISA until December 31, 2023, without making any substantial changes.
On March 22, 2023, the US Congress extended section 702 of FISA again until April 19, 2024, without making any significant changes.
On December 16, 2023, the US Congress approved the National Defense Authorization Act (NDAA), which included a four-month extension of section 702 of FISA, avoiding its expiration at the end of the year.

The Violation of the Right to Privacy

On June 5, 2013, the whistleblower Edward Snowden revealed the existence of the PRISM program, which allowed the US intelligence agencies to access the data of the users of the main electronic service providers, such as Google, Facebook, Microsoft or Apple.
On October 6, 2015, the Court of Justice of the European Union (CJEU) invalidated the Safe Harbor, an agreement that allowed the transfer of personal data between the European Union and the United States, considering that it did not offer an adequate level of protection.
On July 16, 2020, the CJEU invalidated the Privacy Shield, the successor of the Safe Harbor, for the same reasons, considering that the risk of interference by the US intelligence services in the transferred data was incompatible with the respect of the fundamental rights of the persons concerned.
On July 31, 2023, the CJEU issued a ruling that confirmed the invalidity of the Privacy Shield and imposed strict conditions for the transfer of personal data to third countries, especially the United States, under the standard contractual clauses (SCCs) or the binding corporate rules (BCRs).

The Legal and Political Consequences

On October 24, 2013, the European Parliament adopted a resolution that condemned the massive surveillance activities of the US intelligence services and called for the suspension of the cooperation agreements on security and counter-terrorism.
On October 23, 2015, the European Parliament adopted another resolution that requested the creation of an independent international tribunal to examine the complaints of the European citizens regarding the surveillance of the US intelligence services.
On September 14, 2018, the European Parliament adopted a third resolution that called for the suspension of the Privacy Shield, due to the non-compliance of the commitments made by the United States on the protection of personal data.
On August 31, 2023, the European Parliament adopted a fourth resolution that asked the European Commission to propose a new legislation on the protection of personal data in the context of cross-border data flows, which would guarantee a level of protection equivalent to that of the general data protection regulation (GDPR).

Sources:

Congress passes temporary extension of FISA Section 702 surveillance program – Axios:

The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield:

FISA Section 702: What it is and why Congress is debating it – NBC News

New technologies and products that limit the possibilities of intelligence

Facing the capabilities of collection and analysis of the American intelligence, which threaten the privacy and sovereignty of individuals and countries, there are new technologies and products that allow to limit the possibilities of intelligence. These technologies and products use techniques of encryption, cryptography, blockchain or NFC to protect personal data and electronic communications. They offer an alternative to traditional solutions, which are often vulnerable to attacks or interceptions by the American intelligence. Among these technologies and products, we can mention:

EviCypher NFC HSM and EviCypher HSM OpenPGP, which are patented technologies in the United States in the field of cybersecurity developed by Freemindtronic SL Andorra, used in counter-espionage products such as DataShielder Defense. They allow to encrypt and decrypt data without contact, thanks to hardware security modules that use NFC technology. They offer compatibility with OpenPGP standards, operating without server, without database, with a very high level of flexibility from different removable, fixed and online and offline storage media including NFC HSM.
DataShielder DefenseDataShielder Defense, which is a counter-espionage product developed by Freemindtronic SL Andorra, which uses EviCore NFC HSM and EviCore HSM OpenPGP technologies to encrypt and decrypt all types of data and communication services. This product protects sovereign communications, by preventing the American intelligence from accessing personal, professional or state secrets. It also guarantees the sovereignty of users, by making their data anonymous and inviolable.
Signal, which is an instant messaging application that uses the Signal protocol, which is an end-to-end encryption protocol that ensures the confidentiality and integrity of messages. This application allows to communicate anonymously and securely, by avoiding the surveillance or censorship of the American intelligence.
Tor, which is a decentralized network that uses volunteer relays to route Internet traffic anonymously and encrypted. This network allows to browse the web without leaving traces, by hiding the IP address and location of users. It also allows to access hidden websites, which are not indexed by search engines.

These technologies and products represent examples of innovative solutions that limit the possibilities of the American intelligence and preserve the individual and collective sovereignty. They also illustrate the issues and challenges related to the use of digital technologies in the field of intelligence.

Conclusion

The American intelligence is a complex and dynamic phenomenon that has a significant impact on the world. It has many strengths and weaknesses, as well as many opportunities and threats. It has many achievements and failures, as well as many benefits and costs. It is a source of both security and insecurity, both privacy and surveillance. It is a subject of both admiration and criticism, both cooperation and confrontation. The American intelligence is a paradox that requires a careful and balanced approach.

Articles, Crypto Currency, Cryptocurrency, Digital Security, EviPass Technology, NFC HSM technology, Phishing

Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers

Posted on December 16, 2023January 10, 2024 by FMTAD

16
Dec

Ledger security breaches written by Jacques Gascuel, inventor specializing in safety and security of sensitive data, for Freemindtronic. This article will be updated with any new information on the topic.

Ledger security incidents: How Hackers Exploited Them and How to Stay Safe

Ledger security breaches have exposed the personal data and private keys of many users. Ledger is a French company that provides secure devices to store and manage your funds. But since 2017, hackers have targeted Ledger’s e-commerce and marketing database, as well as its software and hardware products. In this article, you will discover the different breaches, how hackers exploited them, what their consequences were, and how you can protect yourself from these threats.

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

April 30, 2025

2025 Digital Security

APT28 spear-phishing France: targeted attacks across Europe

April 30, 2025

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

February 25, 2025

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

February 24, 2025

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

January 21, 2025

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

January 18, 2025

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

January 18, 2025

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

December 24, 2024

Ledger Security Breaches from 2017 to 2023: How to Protect Your Cryptocurrencies from Hackers

Have you ever wondered how safe your cryptocurrencies are? If you are using a Ledger device, you might think that you are protected from hackers and thieves. Ledger is a French company that specializes in cryptocurrency security. It offers devices that allow you to store and manage your funds securely. These devices are called hardware wallets, and they are designed to protect your private keys from hackers and thieves.

However, since 2017, Ledger has been victim of several security breaches, which have exposed the personal data and private keys of its users. These breaches could allow hackers to steal your cryptocurrencies or harm you in other ways. In this article, we will show you the different breaches that were discovered, how they were exploited, what their consequences were, and how you can protect yourself from these threats.

Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018)

The seed phrase is a series of words that allows you to restore access to a cryptocurrency wallet. It must be kept secret and secure, as it gives full control over the funds. In February 2018, a security researcher named Saleem Rashid discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to recover the seed phrase using a side-channel attack.

How did hackers exploit the breach?

The attack consisted of using an oscilloscope to measure the voltage variations on the reset pin of the device. These variations reflected the operations performed by the secure processor of the Ledger Nano S, which generated the seed phrase. By analyzing these variations, the attacker could reconstruct the seed phrase and access the user’s funds.

Simplified diagram of the attack

Figure Ledger Security Issues: The Seed Phrase Recovery Attack (February 2018) — Statistics on the breach

Number of potentially affected users: about 1 million
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: February 20, 2018
Author of the discovery of the breach: Saleem Rashid, a security researcher
Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to an oscilloscope and measure the voltage variations on the reset pin. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.
Scenario of remote access: The attacker needs to trick the user into installing a malicious software on their computer, which can communicate with the device and trigger the reset pin. The attacker then needs to capture the voltage variations remotely, either by using a wireless device or by compromising the oscilloscope. The attacker can then use a software tool to reconstruct the seed phrase from the measurements.

Sources

¹: Breaking the Ledger Security Model – Saleem Rashid published on March 20, 2018.

²: Ledger Nano S: A Secure Hardware Wallet for Cryptocurrencies? – Saleem Rashid published on November 20, 2018.

Ledger Security Flaws: The Firmware Replacement Attack (March 2018)

The firmware is the software that controls the operation of the device. It must be digitally signed by Ledger to ensure its integrity. In March 2018, the same researcher discovered another breach in the Ledger Nano S, which allowed an attacker to replace the firmware of the device with a malicious firmware, capable of stealing the private keys or falsifying the transactions.

How did hackers exploit the Ledger Security Breaches?

The attack consisted of exploiting a vulnerability in the mechanism of verification of the firmware signature. The attacker could create a malicious firmware that passed the signature check, and that installed on the device. This malicious firmware could then send the user’s private keys to the attacker, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

Statistics on the breach

Number of potentially affected users: about 1 million
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: March 20, 2018
Author of the discovery of the breach: Saleem Rashid, a security researcher
Date of publication of the fix by Ledger: April 3, 2018

Scenarios of hacker attacks

Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to connect the device to a computer and install the malicious firmware on it. The attacker can then use the device to access the user’s funds or falsify their transactions.
Scenario of remote access: The attacker needs to trick the user into installing the malicious firmware on their device, either by sending a fake notification, a phishing email, or a malicious link. The attacker then needs to communicate with the device and send the user’s private keys or modify their transactions.

Sources

: [Breaking the Ledger Security Model – Saleem Rashid] published on March 20, 2018.

: [Ledger Nano S Firmware 1.4.1: What’s New? – Ledger Blog] published on March 6, 2018.

Ledger Security Incidents: The Printed Circuit Board Modification Attack (November 2018)

The printed circuit board is the hardware part of the device, which contains the electronic components. It must be protected against malicious modifications, which could compromise the security of the device. In November 2018, a security researcher named Dmitry Nedospasov discovered a breach in the Ledger Nano S, which allowed an attacker with physical access to the device to modify the printed circuit board and install a listening device, capable of capturing the private keys or modifying the transactions.

How did hackers exploit the breach?

The attack consisted of removing the case of the device, and soldering a microcontroller on the printed circuit board. This microcontroller could intercept the communications between the secure processor and the non-secure processor of the Ledger Nano S, and transmit them to the attacker via a wireless connection. The attacker could then access the user’s private keys, or modify the transactions displayed on the device screen.

Simplified diagram of the attack

Statistics on the breach

Number of potentially affected users: unknown
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: November 7, 2019
Author of the discovery of the breach: Dmitry Nedospasov, a security researcher
Date of publication of the fix by Ledger: December 17, 2020

Scenarios of hacker attacks

Scenario of physical access: The attacker needs to have physical access to the device, either by stealing it, buying it second-hand, or intercepting it during delivery. The attacker then needs to remove the case of the device and solder the microcontroller on the printed circuit board. The attacker can then use the wireless connection to access the user’s funds or modify their transactions.
Scenario of remote access: The attacker needs to compromise the wireless connection between the device and the microcontroller, either by using a jammer, a repeater, or a hacker device. The attacker can then intercept the communications between the secure processor and the non-secure processor, and access the user’s funds or modify their transactions.

Sources

[Breaking the Ledger Nano X – Dmitry Nedospasov] published on November 7, 2019.
[How to Verify the Authenticity of Your Ledger Device – Ledger Blog] published on December 17, 2020.

Ledger Security Breaches: The Connect Kit Attack (December 2023)

The Connect Kit is a software that allows users to manage their cryptocurrencies from their computer or smartphone, by connecting to their Ledger device. It allows to check the balance, send and receive cryptocurrencies, and access services such as staking or swap.

The Connect Kit breach was discovered by the security teams of Ledger in December 2023. It was due to a vulnerability in a third-party component used by the Connect Kit. This component, called Electron, is a framework that allows to create desktop applications with web technologies. The version used by the Connect Kit was not up to date, and had a breach that allowed hackers to execute arbitrary code on the update server of the Connect Kit.

How did hackers exploit the Ledger Security Breaches?

The hackers took advantage of this breach to inject malicious code into the update server of the Connect Kit. This malicious code was intended to be downloaded and executed by the users who updated their Connect Kit software. The malicious code aimed to steal the sensitive information of the users, such as their private keys, passwords, email addresses, or phone numbers.

Simplified diagram of the attack

Statistics on the breach

Number of potentially affected users: about 10,000
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: December 14, 2023
Author of the discovery of the breach: Pierre Noizat, director of security at Ledger
Date of publication of the fix by Ledger: December 15, 2023

Scenarios of hacker attacks

Scenario of remote access: The hacker needs to trick the user into updating their Connect Kit software, either by sending a fake notification, a phishing email, or a malicious link. The hacker then needs to download and execute the malicious code on the user’s device, either by exploiting a vulnerability or by asking the user’s permission. The hacker can then access the user’s information or funds.
Scenario of keyboard: The hacker needs to install a keylogger on the user’s device, either by using the malicious code or by another means. The keylogger can record the keystrokes of the user, and send them to the hacker. The hacker can then use the user’s passwords, PIN codes, or seed phrases to access their funds.
Scenario of screen: The hacker needs to install a screen recorder on the user’s device, either by using the malicious code or by another means. The screen recorder can capture the screen of the user, and send it to the hacker. The hacker can then use the user’s QR codes, addresses, or transaction confirmations to steal or modify their funds.

Sources

[https://thehackernews.com/2023/12/crypto-hardware-wallet-ledgers-supply.html] published on December 15, 2023.

Ledger Security Breaches: The Data Leak (December 2020)

The database is the system that stores the information of Ledger customers, such as their names, addresses, phone numbers and email addresses. It must be protected against unauthorized access, which could compromise the privacy of customers. In December 2020, Ledger revealed that a breach in its database had exposed the personal data of 292,000 customers, including 9,500 in France.

How did hackers exploit the breach?

The breach had been exploited by a hacker in June 2020, who had managed to access the database via a poorly configured API key. The hacker had then published the stolen data on an online forum, making them accessible to everyone. Ledger customers were then victims of phishing attempts, harassment, or threats from other hackers, who sought to obtain their private keys or funds.

Simplified diagram of the attack :

Statistics on the breach

Number of affected users: 292,000, including 9,500 in France
Total amount of potentially stolen funds: unknown
Date of discovery of the breach by Ledger: June 25, 2020
Author of the discovery of the breach: Ledger, after being notified by a researcher
Date of publication of the fix by Ledger: July 14, 2020

Scenarios of hacker attacks

Scenario of phishing: The hacker sends an email or a text message to the user, pretending to be Ledger or another trusted entity. The hacker asks the user to click on a link, enter their credentials, or update their device. The hacker then steals the user’s information or funds.
Scenario of harassment: The hacker calls or visits the user, using their personal data to intimidate them. The hacker threatens the user to reveal their identity, harm them, or steal their funds, unless they pay a ransom or give their private keys.
Scenario of threats: The hacker uses the user’s personal data to find their social media accounts, family members, or friends. The hacker then sends messages or posts to the user or their contacts, threatening to harm them or expose their cryptocurrency activities, unless they comply with their demands.

Sources:
– [Ledger Data Breach: A Cybersecurity Update – Ledger Blog] published on January 29, 2021.

Comparison with other crypto wallets

Ledger is not the only solution to secure your cryptocurrencies. There are other options, such as other hardware wallets, software wallets, or exchanges. Each option has its advantages and disadvantages, depending on your needs and preferences. For example, other hardware wallets, such as Trezor or Keepser, offer similar features and security levels as Ledger, but they may have different designs, interfaces, or prices. Software wallets, such as Exodus or Electrum, are more convenient and accessible, but they are less secure and more vulnerable to malware or hacking. Exchanges, such as Coinbase or Binance, are more user-friendly and offer more services, such as trading or staking, but they are more centralized and risky, as they can be hacked, shut down, or regulated. Another option is to use a cold wallet, such as SeedNFC HSM, which is a patented HSM that uses NFC technology to store and manage your cryptocurrencies offline, without any connection to the internet or a computer. It also allows you to create up to 100 cryptocurrency wallets and check the balances from this NFC HSM.

Technological, Regulatory, and Societal Projections

The future of cryptocurrency security is uncertain and challenging. Many factors can affect Ledger and its users, such as technological, regulatory, or societal changes.

Technological changes

It changes could bring new threats, such as quantum computing, which could break the encryption of Ledger devices, or new solutions, such as biometric authentication or segmented key authentication patented by Freemindtronic, which could improve the security of Ledger devices.

Regulatory changes

New rules or restrictions could affect Cold Wallet and Hardware Wallet manufacturers and users, such as Ledger. For example, KYC (Know Your Customer) or AML (Anti-Money Laundering) requirements could compromise the privacy and anonymity of Ledger users. They could also ban or limit the use of cryptocurrencies, which could reduce the demand and value of Ledger devices. On the other hand, other manufacturers who have anticipated these new legal constraints could have an advantage over Ledger. Here are some examples of regulatory changes that could affect Ledger and other crypto wallets:

MiCA, the proposed EU regulation on crypto-asset markets, aims to create a harmonized framework for crypto-assets and crypto-asset service providers in the EU. It also seeks to address the risks and challenges posed by crypto-assets, such as consumer protection, market integrity, financial stability and money laundering.
U.S. interagency report on stablecoins recommends that Congress consider new legislation to ensure that stablecoins and stablecoin arrangements are subject to a federal prudential framework. It also proposes additional features, such as limiting issuers to insured depository institutions, subjecting entities conducting stablecoin activities (e.g., digital wallets) to federal oversight, and limiting affiliations between issuers and commercial entities.
Revised guidance from the Financial Action Task Force (FATF) on virtual assets and virtual asset service providers (VASPs) clarifies the application of FATF standards to virtual assets and VASPs. It also introduces new obligations and recommendations for PSAVs, such as the implementation of the travel rule, licensing and registration of PSAVs, and supervision and enforcement of PSAVs.

These regulatory changes could have significant implications for Ledger and other crypto wallets. They could require them to comply with new rules and standards, to obtain new licenses or registrations, to implement new systems and processes, and to face new supervisory and enforcement actions.

Societal changes

Societal changes could influence the perception and adoption of Ledger and cryptocurrencies, such as increased awareness and education, which could increase the trust and popularity of Ledger devices, or increased competition and innovation, which could challenge the position and performance of Ledger devices. For example, the EviSeed NFC HSM technology allows the creation of up to 100 cryptocurrency wallets on 5 different blockchains chosen freely by the user.

Technological alternatives

Technological alternatives are already available, such as EviCore NFC HSM, EviCore HSM OpenPGP, EviCore NFC HSM Browser Extension and the NFC HSM devices that work without contact, developed and manufactured by Freemindtronic in Andorra. These are new cyber security and safety technologies that use HSMs with or without NFC. They offer a wide range of security features to manage your cryptocurrencies and other digital assets. These technologies also offer the hardware management of complex and complicated passwords by EviPass NFC HSM, OTP (2FA) keys by EviOTP NFC HSM, Seed Phrases by EviSeed NFC HSM, and the creation of multiple cryptocurrency wallets on the same device.

Conclusion

Ledger, the French leader in cryptocurrency security, has faced several security breaches since 2017. As a result of these breaches, hackers could steal the private keys and funds of Ledger users. In response to these threats, Ledger reacted by publishing security updates, informing its users, and strengthening its protection measures. However, Ledger users must be vigilant and follow the recommendations of Ledger to protect themselves from these attacks. Despite these challenges, Ledger remains a reliable and secure device to manage cryptocurrencies, as long as the best practices of digital hygiene are respected. If you want to learn more about Ledger and its products, you can visit their official website or read their blog. Additionally, you can also check their security reports and their help center for more information.

Articles, Digital Security, EviCore NFC HSM Technology, EviPass NFC HSM technology, NFC HSM technology

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures

Posted on November 27, 2023November 28, 2023 by FMTAD

27
Nov

TETRA Security Vulnerabilities by Jacques Gascuel: This article will be updated with any new information on the topic.

TETRA Security Vulnerabilities

Tetra is a radio communication standard used by critical sectors worldwide. But it has five security flaws that could expose its encryption and authentication. How can you protect your Tetra system from hackers? Read this article TETRA Security Vulnerabilities to find out the best practices and tips.

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

April 30, 2025

2025 Digital Security

APT28 spear-phishing France: targeted attacks across Europe

April 30, 2025

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

February 25, 2025

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

February 24, 2025

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

January 21, 2025

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

January 18, 2025

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

January 18, 2025

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

December 24, 2024

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures from Cyberattacks

TETRA (Terrestrial Trunked Radio) is a radio technology that is used worldwide for critical communications and data, especially in the sectors of security, energy, transport and defense. But this technology, which has been kept secret for more than 25 years, hides serious security vulnerabilities, including a backdoor that could allow devastating cyberattacks.

What is TETRA?

TETRA is a European radio standard that was developed in the 1990s to meet the needs of professional mobile services, such as police, firefighters, emergency services, military, prison staff, etc. TETRA allows to transmit data and voice encrypted on frequencies ranging from 380 to 470 MHz, with a range of several kilometers.

TETRA is used by more than 2000 networks in more than 150 countries, according to the TETRA and Critical Communications Association (TCCA), which brings together the manufacturers, operators and users of this technology. Among the main manufacturers of TETRA radios, we find Motorola Solutions, Hytera, Airbus, Sepura and Rohill.

TETRA offers several advantages over other radio technologies, such as:

better sound quality
greater transmission capacity
greater security thanks to encryption
greater flexibility thanks to the possibility of creating communication groups
greater interoperability thanks to the compatibility of equipment

Source french: TETRA digital mode & F4HXZ – Blog radioamateur

What are the vulnerabilities of TETRA?

Despite its strengths, TETRA also has weaknesses, which have been revealed by a group of Dutch researchers from Radboud University Nijmegen. These researchers conducted a thorough analysis of the TETRA standard and its encryption algorithms, which were until then kept secret by the manufacturers and authorities.

The researchers discovered two types of major vulnerabilities in TETRA:

A backdoor in the encryption algorithm TEA1, which is used in radios sold for sensitive equipment, such as pipelines, railways, power grid, public transport or freight trains. This backdoor allows an attacker to decrypt the communications and data transmitted by these radios, and possibly to modify or block them. The backdoor exists since the creation of the algorithm TEA1, in 1998, and cannot be corrected by a simple software update. The researchers managed to extract the secret key of the backdoor by analyzing the binary code of the radios.
A weakness in the encryption algorithm TEA2, which is used in radios intended for professional mobile services, such as police, firefighters, emergency services, military or prison staff. This weakness allows an attacker to reduce the number of possible keys to test to decrypt the communications and data transmitted by these radios. The researchers estimated that it would take about 10 minutes to find the right key with a standard computer. This weakness was corrected by the manufacturers in 2016, but the radios that have not been updated remain vulnerable.

To find the backdoor in the TEA1 algorithm, the researchers used a technique called “differential analysis”, which consists of comparing the outputs of the algorithm for slightly different inputs. By observing the differences, they were able to identify a part of the code that was not normally used, but that was activated by a special condition. This condition was the presence of a secret key of 64 bits, which was hidden in the binary code of the radios. By analyzing the code, they were able to extract the secret key and test it on encrypted communications with the TEA1 algorithm. They were thus able to confirm that the secret key allowed to decrypt the communications without knowing the normal key of 80 bits. The researchers published their official report and the source code of the TETRA encryption algorithms on their website.

Source: https://cs.ru.nl/~cmeijer/publications/All_cops_are_broadcasting_TETRA_under_scrutiny.pdf

What are the risks for critical infrastructures?

The vulnerabilities identified in TETRA represent a danger for the critical infrastructures that use this technology, because they could be exploited by cybercriminals, terrorists or spies to disrupt or damage these infrastructures.

For example, an attacker could:

listen to the communications and confidential data of the security or defense services
impersonate an operator or a manager to give false instructions or orders
modify or erase data or commands that control vital equipment, such as valves, switches, signals or brakes
cause failures, accidents, fires or explosions

These scenarios could have dramatic consequences on the security, health, economy or environment of the countries concerned.

How to protect yourself from cyberattacks on TETRA?

The users of TETRA must be aware of the vulnerabilities of this technology and take measures to protect themselves from potential cyberattacks. Among the recommendations of the researchers, we can mention:

check if the radios used are affected by the vulnerabilities and ask the manufacturers for correction solutions
avoid using the algorithm TEA1, which contains the backdoor, and prefer safer algorithms, such as TEA3 or TEA4
use encryption keys that are long and complex enough, and change them regularly
set up verification and authentication procedures for communications and data
monitor the radio traffic and detect anomalies or intrusion attempts
raise awareness and train staff on cybersecurity and good practices

TETRA digital mode: how to transfer data via TETRA

TETRA (Terrestrial Trunked Radio) is a digital and secure radio communication standard used by emergency services, law enforcement, public transport and industries. TETRA uses a π/4-DQPSK phase modulation and a TDMA time division multiplexing to transmit voice and data on a bandwidth of 25 KHz per transmission channel. Each channel is divided into four timeslots, one of which is reserved for signaling in trunked mode (TMO).

TETRA allows file transfer via radio in two ways: by the packet data service (PDS) or by the circuit data service (CDS).

The PDS uses the IP protocol to transmit data packets on one or more timeslots. It offers a maximum throughput of 28.8 kbit/s per timeslot, or 86.4 kbit/s for three timeslots. The PDS can be used to send small files, such as images, text messages or forms.

The CDS uses the LAPD protocol to transmit data by circuit on a dedicated timeslot. It offers a constant throughput of 4.8 kbit/s per timeslot, or 19.2 kbit/s for four timeslots. The CDS can be used to send large files, such as documents, videos or maps.

The choice of the data service depends on the type of file, the size of the file, the quality of the radio link, the cost and the availability of radio resources. The PDS offers more flexibility and performance, but it requires a good signal quality and it can be more expensive in terms of battery consumption and spectrum occupation. The CDS offers more reliability and simplicity, but it requires a prior allocation of a timeslot and it can be slower and less efficient.

Securing TETRA file transfers with Freemindtronic’s EviCypher technology

However, both data services are subject to the TETRA security vulnerabilities that we have discussed in the previous sections. These vulnerabilities could allow an attacker to intercept, modify or corrupt the files transferred via TETRA, or to prevent their transmission altogether. Therefore, the users of TETRA must ensure the integrity and the confidentiality of the files they send or receive, by using encryption, verification and authentication methods. Freemindtronic’s EviCypher technology can be a valuable solution for encrypting data with post-quantum AES-256 from an NFC HSM with your own randomly generated keys before transferring them via TETRA. This way, even if an attacker corrupts the data transmitted by TETRA, they will not be able to decrypt the data encrypted by a product embedding

How to secure file transfers via TETRA with Freemindtronic’s EviCypher technology

La technologie EviCypher de Freemindtronic peut être une solution précieuse pour chiffrer les données avec AES-256 post-quantique à partir d’un HSM NFC avec vos propres clés générées aléatoirement avant de les transférer via TETRA. Ainsi, même si un attaquant corrompt les données transmises par TETRA, il ne pourra pas décrypter les données cryptées par un produit embarquant la technologie EviCypher NFC HSM technology, such as DataShielder NFC HSM or DataSielder Defense NFC HSM. These products are portable and autonomous devices that allow you to secure the access to computer systems, applications or online services, using the NFC as a means of authentication and encryption.

The management of encryption keys for TETRA

To use encryption on the TETRA network, you need an encryption key, which is a secret code of 80 bits, or 10 bytes. This key must be shared between the radios that want to communicate securely, and must be protected against theft, loss or compromise.

There are several methods to save and enter encryption keys for TETRA, depending on the type of radio and the level of security required. Here are some examples:

The manual method: it consists of entering the encryption key using the keyboard of the radio, by typing the 10 bytes in hexadecimal form. This method is simple, but impractical and unsafe, because it requires to know the key by heart or to write it down on a support, which increases the risk of disclosure or error. For example, a 80-bit key could be 3A4F9C7B12E8D6F0.
The automatic method: it consists of using an external device, such as a computer or a smart card, which generates and transfers the encryption key to the radio by a cable or a wireless link. This method is faster and more reliable, but it requires to have a compatible and secure device, and to connect it to the radio at each key change.
The EviPass method: it consists of using the EviPass NFC HSM technology which allows to generate, store and manage keys and secrets in a secure and independent NFC HSM device. This method is the most innovative and secure, because it allows to create keys higher than 80 bits randomly in hexadecimal base 16, 58, 64 or 85, to store them in a physical device protected by an access code and a robust AES-256 post-quantum encryption algorithm, and to transfer them by various contactless means, via a computer. This method does not require to know or write down the key, which reduces the risk of disclosure or error. For example, a 10-byte key of 80 bits could be 3F 8A 6B 4C 9D 1E 7F 2A 5B 0C.

The EviPass NFC HSM technology of Freemindtronic allows to create secure gateways between the NFC devices and the computer systems, using advanced encryption protocols, such as AES, RSA or ECC. The EviPass NFC HSM technology is embedded in the PassCyber NFC HSM product, which is a portable and autonomous device that allows to secure the access to computer systems, applications or online or offligne services, using the NFC as a means of authentication.

Conclusion

TETRA is a radio technology that was designed to offer secure and reliable communication to professional mobile services and critical infrastructures. But this technology, which has been kept secret for decades, presents vulnerabilities that could be exploited by cyberattackers to compromise these communications and infrastructures. The users of TETRA must be vigilant and take measures to protect themselves from these threats, by updating their equipment, choosing robust encryption algorithms, using strong keys, verifying and authenticating data and monitoring radio traffic. The EviPass NFC HSM technology of Freemindtronic can be an effective solution to strengthen the security of keys and secrets used for verification and authentication, by storing them in a secure and independent NFC device. The researchers who revealed the vulnerabilities of TETRA hope that their work will contribute to improve the security of communications in critical domains.

Articles, DataShielder, News

DataShielder Defense NFC HSM: Protect Your Sovereign Communications

Posted on November 24, 2023December 16, 2024 by FMTAD

24
Nov

DataShielder Defense NFC HSM – Jacques Gascuel: This article will be updated with any new information on the topic.

Why You Need DataShielder Defense NFC HSM

DataShielder Defense NFC HSM, a patented solution, ensures maximum confidentiality and anonymization of communications from sovereign entities. Using NFC technology, this HSM manages up to 200 secrets offline, contactless and shareable via any communication method, including email and SMS. A GreenTech innovation, it is interoperable, backward compatible and versatile, designed to immediately respond to various specific needs and customizable for enhanced secret security.

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

April 30, 2025

2025 Digital Security

APT28 spear-phishing France: targeted attacks across Europe

April 30, 2025

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

February 25, 2025

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

February 24, 2025

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

January 21, 2025

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

January 18, 2025

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

January 18, 2025

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

December 24, 2024

DataShielder Defense NFC HSM: How to Protect Your Sovereign Communications with a Revolutionary Solution

The protection of sovereign entities and the enhancement of existing defense and intelligence systems are crucial challenges in today’s world. Sovereign communications, such as those between heads of state, diplomats, military personnel, or secret agents, are constantly exposed to threats of interception, hacking, or manipulation. These threats can compromise the security, integrity, and confidentiality of sensitive information, and have serious consequences for national and international security.

To address these challenges, a revolutionary solution has been developed by Freemindtronic, a andorran company specialized in data security and encryption. This solution is called DataShielder Defense NFC HSM, and it is the ultimate solution for protecting all forms of communications of sovereign entities. This innovative and cutting-edge solution, protected by two patents, guarantees an unparalleled level of confidentiality and trust among humans, without compromise. With DataShielder, your secrets and sensitive data remain inaccessible and indecipherable, even in case of compromise of the equipment and information and communication systems.

In this article, we will explain how DataShielder Defense NFC HSM works, what are its features and benefits, and how it can be customized to suit your specific needs. We will also show how this solution could have influenced several major events in the history of communication security, and how it has received international recognition and awards for its excellence.

How DataShielder Defense NFC HSM Works

DataShielder Defense NFC HSM is a device that uses Near Field Communication (NFC) technology to create, store, and use up to 200 different secrets in a single device. A secret can be anything that you want to protect, such as an encryption key, a password, a PIN code, a cryptocurrency key, a bank account information, or a message. DataShielder allows you to share your encrypted secrets via all the means of communication available in the world, such as postal mail, webcam, email, SMS, MMS, RCS, messaging, or directly between two NFC HSM devices.

To use DataShielder, you need an Android NFC phone or tablet, and the DataShielder app, which is available for free on the Google Play Store. You also need a DataShielder Defense NFC HSM device, which is a small and discreet card that can be customized to fit different formats and accessories. The device does not require any battery or external power source, as it uses the energy of the NFC signal of the phone to operate on demand.

To create a secret, you simply need to tap your phone on the device, and choose the type of secret you want to create. You can either generate a random secret, or import an existing one. You can also add specific trust criteria for each secret, such as BSSID, geographical area, password, fingerprint, QR code or barcode scan, and phone UID. The absence of any of these criteria makes the access to the secret impossible, ensuring maximum and personalized security.

To use a secret, you simply need to tap your phone on the device, and choose the secret you want to use. You can either use it directly on your phone, or send it to another device or person. You can also use the secret to unlock secure USB or SSD keys, to log in to your favorite websites, to make secure voice calls and SMS, to manage your banking information, to generate and use cryptocurrency wallets, and more.

To share a secret, you simply need to tap your phone on the device, and choose the secret you want to share. You can either share it directly with another NFC HSM device, or encrypt it with the RSA-4096 public key of the recipient, and send it via any means of communication. The recipient will need to decrypt the secret with their NFC HSM device, using the EviSCP HSM (ZKP) protocol, which is a patented technology that ensures a secure and confidential exchange of secrets.

Differentiating Benefits of DataShielder Defense NFC HSM

DataShielder Defense NFC HSM offers a complete and adaptable solution to your needs, thanks to the set of advanced and efficient features that it incorporates. These features are based on different technologies, each with a specific name and function. Here is a summary of the main features and benefits of DataShielder:

Feature	Technology	Function	Benefit
Random generation of symmetric and asymmetric encryption keys	EviCypher NFC HSM	Encrypt all types of data (texts, images, videos) in post-quantum AES-256. Use the RSA-4096 public key to exchange encrypted secrets between distant NFC devices.	Protect your data and secrets from unauthorized access and decryption, even in case of quantum computing attacks.
Random generation of identifiers and passwords	EviPass NFC HSM	Generate automatically complex and complicated passwords up to 48 characters based on the 95 ASCII characters, or on bases 16, 58, 64 or 85. Import and store manually login identifiers, PIN codes, PUK, lock codes, TPM2.0 passwords, BitLocker… Log in automatically to your favorite websites.	Secure your online accounts and devices with strong and unique passwords. Save time and avoid typing errors with automatic login.
Create a segmented key	EviAuth NFC HSM	Divide your secret into two segments and store them on two different NFC HSM devices. Require the presence of two people to reconstitute the secret.	Increase the security and confidentiality of your secret by adding a human factor. Prevent the access to the secret by a single person or device.
Management of secret OTP keys	EviOTP NFC HSM	Store securely the secret OTP keys whose one-time passwords based on time (TOTP) or HMAC (HOTP) to generate a secondary authentication factor (2FA).	Enhance the security of your online accounts and services with a second factor of authentication. Avoid the risk of losing or compromising your OTP keys.
Secure voice calls and SMS	EviCall NFC HSM	Store your phone contacts and make a voice call from the NFC HSM without leaving any trace in the phone history.	Communicate securely and discreetly with your contacts. Avoid the interception and recording of your voice calls and SMS.
Secure management of banking information	EviPay NFC HSM	Store, manage and use securely the information related to credit cards and bank accounts.	Protect your financial information and transactions from fraud and theft. Access and use your banking information easily and securely.
Unlocking of secure USB or SSD keys without contact	EviKey NFC HSM	Manage the administrator, user and temporary user PIN codes to unlock the secure USB/SSD keys without contact.	Secure your external and internal storage with a contactless unlocking system. Manage the access rights and permissions of the USB/SSD keys.
Generation of cryptocurrency wallets	EviSeed NFC HSM	Automatically and directly create from a blockchain the secret BIP39 key, its derived key, its public key and the public address. The balance verification is done directly on the blockchain.	Create and use cryptocurrency wallets securely and conveniently. Store your cryptocurrency keys in an inviolable and encrypted manner. Verify your balance directly on the blockchain.
Automatic import of private keys	EviVault NFC HSM	Import derived private keys by scanning their QR codes from five blockchain platforms including Bitcoin, Ethereum, Polygon, Binance Smart Chain and IOTA. Create and save also the BIP39 PassPhrases.	Import and use private keys from different blockchain platforms easily and securely. Scan the QR codes and store the keys in an encrypted manner. Create and save also the BIP39 PassPhrases.
Management of authentication cards	EviCore NFC HSM	Scan and store the barcode or QR code of any type of card that uses this type of identification (access cards, loyalty cards sometimes linked to a payment system).	Store and use authentication cards securely and conveniently. Scan the barcode or QR code and store it in an encrypted manner.
NFC HSM pairing key manager	EviCore NFC HSM	Manage the NFC HSM fleet within a sovereign entity.	Manage and control the NFC HSM devices within your organization. Assign and revoke pairing keys for the devices.
Data encryption	EviCrypt NFC HSM	Encrypt your texts and files upstream before sending them to your recipients using your usual messaging services.	Encrypt your data before sending it via any means of communication. Ensure that only the intended recipients can decrypt and access your data.
Use on all computer systems	EviCore NFC HSM Browser Extension	Use your NFC HSM with the free Freemindtronic browser extension based on Chromium and Firefox. Find the DataShielder NFC HSM functions on all your computers.	Use your NFC HSM on any computer system.
Use of a virtual USB Bluetooth keyboard	EviKeyboard BLE	Use a virtual keyboard for secure and discreet input. Extend the use of secrets in HID mode on various computer systems, TPM2.0, BitLocker, Windows, Linux, Apple, proprietary software and web browsers.	Don’t touch the keyboard. Enter a free line of code up to 52 characters. Entering BIOS passwords. Easy to use

Stealth Customization Options

The manufacturer Freemindtronic offers a customization service specially designed for sovereign entities, combining discretion and functionality.

Discreet Formats: Modified standard PVC and PCB cards for effective camouflage.

Stealth Accessories: Labels, key rings, promotional pens, and cufflinks subtly integrating NFC HSM devices.

USB Dummy Keys: Mini USB keys functioning as secret containers for the NFC HSM devices.

NFC On/Off Card: PCB cards with switchable NFC antenna for increased stealth.

These options guarantee invisible security, ideal for special operations and covert missions.

Complementary Accessories

Secure NFC EviKey USB and SSD Keys: These devices offer secure external and internal storage, perfectly integrated with DataShielder NFC HSM for enhanced data protection.
Bluetooth Virtual Keyboard EviKeyboard BLE: An innovative keyboard for secure and discreet input, complementing the DataShielder NFC HSM by an additional layer of security in data entry.

International Distinctions and Awards

The EviCypher NFC HSM technology, essential to DataShielder, has received worldwide recognition, marked by several important awards.

Gold Medal 2021 of the Geneva Inventions: EviCypher Technology awarded among hundreds of international inventions.
Three Global InfoSec Awards 2021: Awarded for being the best data security solution by Cyber Defense Magazine “Next-Gen in Crypto Security”, “Most Innovative Hardware Password Manager”, “Next-Gen in Secrets Management”.
Two E&T Innovation Awards 2021: Distinguished for the best communication and IT solution, as well as for the best cybersecurity solution.
Two nominations for the National Cyber Awards 2021 of the United Kingdom: Finalist in two categories “The Innovation in Cyber Award 2021” and “The Cyber Defense Product of the Year 2021”.
Gold Globee Award 2022: Cyber Computer NFC winner of a Cyber Security Global Excellence Awards®.
Fortress Award 2023: Awarded for its excellence in encryption and privacy protection.

Conclusion

DataShielder Defense NFC HSM is a revolutionary solution for protecting your sovereign communications. It offers a high level of security, confidentiality, and trust, without compromise. It is compatible with all types of data and communication means, and can be customized to suit your specific needs. It is also environmentally friendly, durable, and interoperable. It has received international recognition and awards for its excellence and innovation. If you are looking for a solution that can protect your secrets and sensitive data from any threat, DataShielder Defense NFC HSM is the solution for you. Contact Freemindtronic today and get your DataShielder Defense NFC HSM device. You will not regret it.

2023, Articles, DataShielder, Digital Security, EviCore NFC HSM Technology, EviCypher NFC HSM, EviCypher Technology, NFC HSM technology

FormBook Malware: How to Protect Your Gmail and Other Data

Posted on November 23, 2023November 24, 2023 by FMTAD

23
Nov

Protect your Gmail Account FormBook malware – Jacques Gascuel: This article will be updated with any new information on the topic.

Secure Your Gmail from FormBook Attacks

FormBook is a malware that can steal your Gmail credentials, messages, and attachments. Learn how to use the Freemindtronic devices to encrypt your Gmail data and use passwordless and 2FA.

2025 Digital Security

APT29 Spear-Phishing Europe: Stealthy Russian Espionage

April 30, 2025

2025 Digital Security

APT28 spear-phishing France: targeted attacks across Europe

April 30, 2025

2025 Digital Security

BadPilot Cyber Attacks: Russia’s Threat to Critical Infrastructures

February 25, 2025

2025 Digital Security

APT44 QR Code Phishing: New Cyber Espionage Tactics

February 24, 2025

2025 Digital Security

Microsoft Vulnerabilities 2025: 159 Flaws Fixed in Record Update

January 21, 2025

2025 Digital Security

Microsoft Outlook Zero-Click Vulnerability: Secure Your Data Now

January 18, 2025

2023 Digital Security

WhatsApp Hacking: Prevention and Solutions

January 18, 2025

Digital Security

Microsoft MFA Flaw Exposed: A Critical Security Warning

December 24, 2024

How to Protect Your Gmail Account from FormBook Malware

Introduction

Imagine that you receive an email from your bank, asking you to confirm your identity by clicking on a link. You open the link, and you find yourself on a page that looks like your bank’s website, but it is actually a fake. You enter your credentials, and you think you are done. But in reality, you have just given access to your bank account to hackers, who will use it to steal your money, or worse. This is what FormBook can do, a malware that can steal your sensitive data, and that Google cannot stop. In this article, we will explain what FormBook is, how it works, and how to protect yourself from this malware.

What is FormBook and why is it a threat?

FormBook is a malware that can record your keystrokes, take screenshots, and steal your passwords, cookies, and clipboard data. It can also download and execute other malicious files on your device.

FormBook is distributed through phishing emails that contain malicious attachments. These attachments are usually disguised as invoices, receipts, or shipping confirmations. When you open them, they ask you to enable macros or content. If you do, the malware will be installed on your device.

FormBook can target any web browser, but it has a special feature for Chrome. It can inject a fake Gmail login page into your browser, and trick you into entering your credentials. The malware will then send your Gmail username and password to a remote server controlled by the hackers.

FormBook is a threat because it can compromise your Gmail account and access your personal and professional information. It can also use your Gmail account to send spam or phishing emails to your contacts, or to access other online services that are linked to your Gmail account, such as Google Drive, Google Photos, or Google Pay.

How to protect yourself from FormBook?

Google has not yet found a way to detect and block FormBook. Therefore, you need to be extra careful when you use Gmail and other online services. Here are some tips to protect yourself from FormBook and other malware:

Do not open or download attachments from unknown or suspicious senders. If you are not sure about the legitimacy of an email, contact the sender directly or check the official website of the company or organization.
Do not enable macros or content in any document unless you trust the source. Macros are small programs that can run malicious code on your device.
Use a strong and unique password for your Gmail account and other online accounts. Do not reuse the same password for different services. Change your password regularly and use a password manager to store and generate your passwords.
Enable two-factor authentication (2FA) for your Gmail account and other online accounts. 2FA adds an extra layer of security by requiring a code or a device confirmation in addition to your password.
Use a reputable antivirus software and keep it updated. Antivirus software can scan your device for malware and remove it. You can also use a browser extension that can block malicious websites and pop-ups.

How to encrypt your Gmail messages and attachments with DataShielder NFC HSM

DataShielder NFC HSM is a device that allows you to encrypt and decrypt your Gmail messages and attachments with your own encryption keys that you create and store offline. It uses the EviCypher NFC HSM technology, which is a contactless hardware security module (NFC HSM) that won the Gold Medal for International Inventions in Geneva on March 2021.

With DataShielder NFC HSM, you can encrypt and decrypt your data with AES-256 keys that are randomly generated and stored in the NFC HSM. You can store up to 100 keys and one pair of RSA-4096 keys in the NFC HSM. You can also use different keys for the message and the attachment.

To encrypt your Gmail message and attachment, you need to use the EviCrypt and EviFile applications that are embedded in the DataShielder NFC HSM. These applications allow you to encrypt and decrypt your data with a simple tap of your NFC phone on the DataShielder NFC HSM. You can also share your encrypted data with other users who have the same device and the same key.

By using DataShielder NFC HSM, you can protect your Gmail messages and attachments from FormBook or any other malware that can access your Gmail account. Even if your Gmail account is hacked, your encrypted data will remain encrypted and unreadable by the hackers. Only you and the authorized recipients can decrypt your data with the DataShielder NFC HSM.

How to protect your web Gmail account with passwordless and 2FA using PassCypher NFC HSM

Do you want to manage your web accounts with complicated and complex passwords that you do not need to know, remember, or type? If yes, then you should try PassCypher NFC HSM. This device uses the EviPass NFC HSM technology, which is a contactless hardware password manager that won the Silver Medal for International Inventions in Geneva on March 2021.

With PassCypher NFC HSM, you can create and store your usernames and passwords of more than 256-bit in the NFC HSM. Moreover, you can store your OTP TOTP or HOTP secret keys in the NFC HSM to generate the 2FA code for your web accounts. The NFC HSM can store up to 100 web accounts and one pair of RSA-4096 keys.

To use PassCypher NFC HSM, you need to install the Freemindtronic extension for your web browser based on Chromium or Firefox. This extension uses the EviCore NFC HSM Browser technology, which allows you to communicate with the NFC HSM via your NFC phone. You also need to use the EviPass and EviOTP applications that are embedded in the PassCypher NFC HSM. These applications allow you to create, edit, and delete your web accounts and OTP secret keys with a simple tap of your NFC phone on the PassCypher NFC HSM.

By using PassCypher NFC HSM, you can secure your web accounts with passwordless and 2FA. You do not need to display, know, or type your username and password. You just need to tap your NFC phone on the PassCypher NFC HSM and the extension will autofill and auto login your web account. You also do not need to check for a typosquatting attack, since the extension will verify the URL of the website before logging in. And you do not need to use another device or application to generate the 2FA code, since the PassCypher NFC HSM will do it for you.

How to protect your Gmail account from FormBook with PassCypher NFC HSM

FormBook is a dangerous malware that can access your Gmail account and other sensitive data. Google has not yet found a solution to stop it. Therefore, you need to be vigilant and follow the best practices to protect yourself from cyberattacks. One of them is to use PassCypher NFC HSM to secure your Gmail account with passwordless and 2FA.

By using PassCypher NFC HSM, you can protect your Gmail account from FormBook or any other malware that can access your web browser. Even if your web browser is hacked, your usernames and passwords will remain encrypted and inaccessible by the hackers. Only you can decrypt your Gmail account with the PassCypher NFC HSM. And even if the hackers manage to steal your session cookies, they will not be able to log in to your Gmail account without the 2FA code that is generated by the PassCypher NFC HSM.

To use PassCypher NFC HSM with your Gmail account, you need to follow these steps:

Create a Gmail account in the EviPass application on the PassCypher NFC HSM. You can use the default username and password, or you can generate a random and complex password with the EviPass application.
Enable 2FA for your Gmail account on the Google website.
Choose the option to use an authenticator app, and scan the QR code with the EviOTP application on the PassCypher NFC HSM. This will store your OTP secret key in the NFC HSM.
Log in to your Gmail account with the Freemindtronic extension on your web browser. Tap your NFC phone on the PassCypher NFC HSM and the extension will autofill and auto login your Gmail account. You will also see a pop-up window with the 2FA code that you need to enter on the Google website.

By following these steps, you can use PassCypher NFC HSM to secure your Gmail account with passwordless and 2FA. You can also use PassCypher NFC HSM with other web accounts that support 2FA, such as Facebook, Twitter, or Amazon. This way, you can protect yourself from FormBook and other malware that can access your web browser.

Recent statistics on FormBook

FormBook is a malware that was first discovered in 2016, but it remains very active and dangerous. According to the Check Point report on cybersecurity in 2022, FormBook was the third most widespread malware in 2021, attacking 5% of enterprise networks. It was also the most prolific infostealer malware, accounting for 16% of attacks worldwide.

FormBook spreads mainly through phishing emails that contain malicious attachments. These attachments are often RAR self-extracting archives, which are compressed files that can run malicious code when opened. The RAR files contain a legitimate document, such as a PDF or a Word file, and a hidden executable file, which is the FormBook malware. When the user opens the RAR file, the document is displayed, but the malware is also installed in the background.

FormBook can also spread through other methods, such as drive-by downloads, malicious links, or removable media. The malware can infect any Windows device, from Windows XP to Windows 10. The malware can also evade detection and removal by using various techniques, such as encryption, obfuscation, or anti-analysis.

Here are some recent statistics on FormBook, based on the data from Check Point and ANY.RUN:

FormBook was the most popular malware in August 2021, affecting 4.5% of organizations worldwide, followed by Trickbot and Agent Tesla, affecting respectively 4% and 3% of organizations worldwide.
FormBook was the fourth most common malware in 2020, according to the ranking of malware families by ANY.RUN. It accounted for 8% of the samples analyzed by the online sandboxing service.
FormBook was used in many phishing campaigns targeting various industries, such as defense, aerospace, health, education, finance, retail, etc. It was also used to attack Ukrainian targets during the war between Russia and Ukraine in 2022.
FormBook has a successor called XLoader, which appeared in 2020 and which is able to infect macOS users. XLoader is sold on the dark web for $59 for a Windows license and $49 for a macOS license.

Danger level of FormBook compared to other malware

FormBook is a very dangerous malware, because it can steal sensitive information, such as credentials, passwords, credit card numbers, 2FA codes, etc. It can also download and execute other malware, such as ransomware, banking trojans, spyware, etc. It can also remotely control the infected device and perform various malicious actions, such as deleting browser cookies, taking screenshots, restarting or shutting down the system, etc.

FormBook is also hard to detect and remove, because it uses advanced evasion techniques, such as code injection, string obfuscation, data encryption, anti-analysis, etc. It also changes frequently its name, path, and file extension, and uses random Windows registry keys to maintain its persistence.

To compare the danger level of FormBook with other known malware in its category, we can use the following criteria:

The number of organizations affected worldwide
The type and amount of information stolen
The ability to download and execute other malware
The ability to remotely control the infected device
The evasion techniques used
The ease of detection and removal

Here is a table that compares FormBook with other popular infostealer malware, such as Trickbot, Agent Tesla, LokiBot, and Raccoon:

Malware	Number of organizations affected	Type and amount of information stolen	Ability to download and execute other malware	Ability to remotely control the infected device	Evasion techniques used	Ease of detection and removal
FormBook	4.5% in August 2021	Credentials, passwords, credit card numbers, 2FA codes, screenshots, keystrokes, etc.	Yes	Yes	Code injection, string obfuscation, data encryption, anti-analysis, etc.	Hard
Trickbot	4% in August 2021	Credentials, passwords, banking information, personal data, etc.	Yes	Yes	Code injection, string obfuscation, data encryption, anti-analysis, etc.	Hard
Agent Tesla	3% in August 2021	Credentials, passwords, banking information, personal data, screenshots, keystrokes, etc.	No	Yes	String obfuscation, data encryption, anti-analysis, etc.	Medium
LokiBot	1.5% in August 2021	Credentials, passwords, banking information, personal data, etc.	No	Yes	String obfuscation, data encryption, anti-analysis, etc.	Medium
Raccoon	0.8% in August 2021	Credentials, passwords, banking information, personal data, etc.	No	Yes	String obfuscation, data encryption, anti-analysis, etc.	Medium

From this table, we can see that FormBook is the most dangerous infostealer malware, because it affects the most organizations, steals the most types of information, and can download and execute other malware. It is also the hardest to detect and remove, because it uses more evasion techniques than the other malware.

Forms of attacks of FormBook

FormBook can be delivered through different forms of attacks, depending on the delivery mechanism chosen by the malicious actor. Here are some forms of attacks of FormBook:

Phishing: FormBook can be sent by email as a malicious attachment, such as a Word, Excel, PDF, or ZIP or RAR file. The email can have a misleading subject, such as an invoice, a receipt, a contract, a job offer, etc. When the user opens the attachment, the malware runs and infects the device.
Exploitation of vulnerabilities: FormBook can exploit vulnerabilities in popular software, such as Microsoft Office, Windows, Adobe Reader, etc. For example, FormBook used the vulnerability CVE-2017-8570 in Microsoft Office to run malicious code from a RTF file. FormBook also used the vulnerability CVE-2021-40444 in Microsoft MSHTML to run malicious code from a CAB file.
Drive-by downloads: FormBook can be downloaded without the user’s knowledge when they visit a compromised or malicious website. The website can use a script or an exploit kit to trigger the download and execution of the malware on the user’s device.
Removable media: FormBook can be copied to removable media, such as USB drives, external hard drives, memory cards, etc. When the user connects the removable media to their device, the malware runs automatically and infects the device.
Social media: FormBook can be spread by messages or posts on social media, such as Facebook, Twitter, Instagram, etc. These messages or posts can contain links or images that redirect to malicious websites or infected files. When the user clicks on the link or image, the malware is downloaded and executed on their device.

Here is a type of formbook malware attacks image:

How PassCypher NFC HSM and DataShielder NFC HSM can protect you from FormBook attacks

PassCypher NFC HSM and DataShielder NFC HSM are two devices that use the EviPass NFC HSM technology from Freemindtronic, which is a contactless hardware password manager that won the Silver Medal for International Inventions in Geneva on March 2021. These devices can help you protect your web accounts and your Gmail messages and attachments from FormBook attacks, by using passwordless, 2FA, and encryption.

PassCypher NFC HSM can create and store your usernames and passwords of more than 256-bit in the NFC HSM. It can also store your OTP TOTP or HOTP secret keys in the NFC HSM to generate the 2FA code for your web accounts. The NFC HSM can store up to 100 web accounts and one pair of RSA-4096 keys.

DataShielder NFC HSM can encrypt and decrypt your Gmail messages and attachments with your own encryption keys that you create and store offline. It uses the EviCypher NFC HSM technology, which is a contactless hardware security module (NFC HSM) that won the Gold Medal for International Inventions in Geneva on March 2021. It can store up to 100 keys and one pair of RSA-4096 keys in the NFC HSM.

To use PassCypher NFC HSM and DataShielder NFC HSM, you need to install the Freemindtronic extension for your web browser based on Chromium or Firefox. This extension uses the EviCore NFC HSM Browser technology, which allows you to communicate with the NFC HSM via your NFC phone. You also need to use the EviPass, EviOTP, EviCrypt, and EviFile applications that are embedded in the PassCypher NFC HSM and DataShielder NFC HSM. These applications allow you to create, edit, delete, encrypt, and decrypt your web accounts, OTP secret keys, messages, and attachments with a simple tap of your NFC phone on the PassCypher NFC HSM or DataShielder NFC HSM.

By using PassCypher NFC HSM and DataShielder NFC HSM, you can secure your web accounts and your Gmail messages and attachments with passwordless, 2FA, and encryption. You do not need to display, know, or type your username, password, or encryption key. You just need to tap your NFC phone on the PassCypher NFC HSM or DataShielder NFC HSM and the extension will autofill, auto login, encrypt, or decrypt your web account, message, or attachment. You also do not need to use another device or application to generate the 2FA code, since the PassCypher NFC HSM will do it for you.

Here is a table that shows how PassCypher NFC HSM and DataShielder NFC HSM can protect you from different FormBook attack vectors, such as keylogger, password stealer, file transfer, screenshot, etc. I used a check mark or a cross mark to show visually what PassCypher NFC HSM and DataShielder NFC HSM protect.

FormBook	PassCypher	DataShielder
Keylogger	✔️	✔️
Password stealer	✔️	✔️
File transfer	❌	✔️
Screenshot	✔️	✔️
Remote control	❌	❌
Phishing	✔️	✔️
Exploit kit	❌	❌
Drive-by download	❌	❌
Removable media	❌	✔️
Social media	❌	❌

This table shows that PassCypher NFC HSM and DataShielder NFC HSM can protect your web accounts from FormBook’s keylogger, password stealer, and phishing, by using passwordless and 2FA. They can also protect your Gmail messages and attachments from FormBook’s file transfer and screenshot, by using encryption and decryption. DataShielder NFC HSM can also protect your data stored in computers or removable media, by using encryption and decryption. However, neither device can protect your device from FormBook’s remote control, exploit kit, drive-by download, or unsecured social media, which can compromise your system and your data. Therefore, you should also use an antivirus software and a firewall to prevent FormBook from accessing your device.

Articles, EviCore NFC HSM Technology, legal, News, Training

Dual-Use Encryption Products: a regulated trade for security and human rights

Posted on November 17, 2023March 15, 2024 by FMTAD

17
Nov

Dual-use encryption products by Jacques Gascuel: This article will be updated with any new information on the topic.

Dual-use encryption products: a challenge for security and human rights

Encryption is a technique that protects data and communications. Encryption products are dual-use goods, which can have civilian and military uses. The export of these products is controlled by the EU and the international community, to prevent their misuse or diversion. This article explains the EU regime for the export of dual-use encryption products, and how it has been updated.

A hyper-realistic image illustrating Password Statistics 2025, featuring a laptop login screen with multiple password entry fields, a digital world map, and cybersecurity elements like a fingerprint scanner and security shield.

2025 Cyberculture

Password Statistics 2025: Global Trends & Usage Analysis

March 9, 2025

A woman looking at a computer screen displaying a fingerprint, the words 'Cookieless' and 'PassCypher Data Privacy Security', along with the date 'February 16, 2025', symbolizing Google's fingerprinting policy shift. The image highlights the importance of stopping browser fingerprinting and protecting online privacy

2025 Cyberculture

Stop Browser Fingerprinting: Prevent Tracking and Protect Your Privacy

February 2, 2025

Courtroom scene with a judge's gavel and legal documents on a wooden desk in the foreground, symbolizing a ruling on IT liability. A screen in the background displays a ransomware warning, emphasizing the case's digital focus.

2025 Cyberculture Legal information

French IT Liability Case: A Landmark in IT Accountability

January 22, 2025

Digital scale balancing time and money, representing the cost of login methods such as passwords, two-factor authentication, and facial recognition, in a professional setting.

2025 Cyberculture

Time Spent on Authentication: Detailed and Analytical Overview

January 12, 2025

Hyper-realistic depiction of French Digital Surveillance, featuring Paris cityscape with digital networks, surveillance cameras, and facial recognition grids.

2024 Cyberculture

French Digital Surveillance: Escaping Oversight

November 26, 2024

Mobile Cyber Threats for Government Agencies – smartphone with cyber threat notifications on white background.

2024 Cyberculture

Mobile Cyber Threats: Protecting Government Communications

November 14, 2024

2024 Cyberculture

Electronic Warfare in Military Intelligence

November 3, 2024

A modern smartphone displaying a notification to 'Restart Your Phone Weekly', emphasizing cybersecurity on a clean white background with a security shield icon.

2024 Cyberculture

Restart Your Phone Weekly for Mobile Security and Performance

October 25, 2024

The international regulations on dual-use encryption products

The main international regulations that apply to dual-use encryption products are the Wassenaar Arrangement and the EU regime for the control of exports of dual-use goods.

The Wassenaar Arrangement

The Wassenaar Arrangement is a multilateral export control regime that aims to contribute to regional and international security and stability. It promotes transparency and responsibility in the transfers of conventional arms and dual-use goods and technologies. It was established in 1996 and currently has 42 participating states, including the United States, Canada, Japan, Australia, Russia, China and most of the EU member states.

The Wassenaar Arrangement maintains a list of dual-use goods and technologies that are subject to export control by the participating states. The list is divided into 10 categories, with subcategories and items. Category 5, part 2, covers information security, including encryption products. The list of encryption products includes, among others, the following items:

Cryptographic systems, equipment, components and software, using symmetric or asymmetric algorithms, with a key length exceeding 56 bits for symmetric algorithms or 512 bits for asymmetric algorithms, or specially designed for military or intelligence use.
Cryptanalytic systems, equipment, components and software, capable of recovering the plain text from the encrypted text, or of finding cryptographic keys or algorithms.
Cryptographic development systems, equipment, components and software, capable of generating, testing, modifying or evaluating cryptographic algorithms, keys or systems.
Non-cryptographic information security systems, equipment, components and software, using techniques such as steganography, watermarking, tamper resistance or authentication.
Technology for the development, production or use of the above items.

The participating states of the Wassenaar Arrangement are required to implement national export controls on the items listed in the arrangement, and to report annually their exports and denials of such items. However, the arrangement does not impose binding obligations on the participating states, and each state is free to decide whether to grant or refuse an export license, based on its own policies and national interests.

The EU regime for the control of exports of dual-use goods

The common legal framework of the EU for dual-use goods

The EU regime for the control of exports of dual-use goods is a common legal framework. It applies to all EU member states, and it has two main goals. First, it aims to ensure a consistent and effective implementation of the international obligations of export control. Second, it aims to protect the security and human rights of the EU and its partners. The regime is based on the Regulation (EU) 2021/821, which was adopted in May 2021 and entered into force in September 2021. This regulation replaces the previous Regulation (EC) No 428/2009.

The Regulation (EU) 2021/821: the principles and criteria of export control

The Regulation (EU) 2021/821 establishes a Union list of dual-use goods. These are goods that can have both civilian and military uses, such as software, equipment and technology. These goods are subject to an export authorization, which means that exporters need to obtain a permission from the competent authorities before exporting them. The Regulation also sets out a set of general principles and criteria for granting or refusing such authorization. The Union list of dual-use goods is based on the international export control regimes, including the Wassenaar Arrangement. It covers the same categories and items as the latter. However, the EU list also includes some additional items that are not covered by the international regimes. These are cyber-surveillance items that can be used for internal repression or human rights violations.

The Union list of dual-use goods: the categories and items subject to an export authorization

The Union list of dual-use goods consists of ten categories, which are:

Category 0: Nuclear materials, facilities and equipment
Category 1: Materials, chemicals, micro-organisms and toxins
Category 2: Materials processing
Category 3: Electronics
Category 4: Computers
Category 5: Telecommunications and information security
Category 6: Sensors and lasers
Category 7: Navigation and avionics
Category 8: Marine
Category 9: Aerospace and propulsion

Each category contains a number of items, which are identified by a code and a description. For example, the item 5A002 is “Information security systems, equipment and components”. The items are further divided into sub-items, which are identified by a letter and a number. For example, the sub-item 5A002.a.1 is “Cryptographic activation equipment or software designed or modified to activate cryptographic capability”.

The novelties of the Regulation (EU) 2021/821: the due diligence obligation, the catch-all clause, the human security approach and the transparency and information exchange mechanism

The Regulation (EU) 2021/821 also provides for different types of export authorizations. These are individual, global, general or ad hoc authorizations, depending on the nature, destination and end-use of the items. Moreover, the Regulation introduces some novelties, such as:

A due diligence obligation for exporters. This means that exporters have to verify the end-use and the end-user of the items, and to report any suspicious or irregular transaction.
A catch-all clause. This allows the competent authorities to impose an export authorization on items that are not listed, but that can be used for weapons of mass destruction, a military end-use, human rights violations or terrorism.
A human security approach. This requires the competent authorities to take into account the potential impact of the items on human rights, international humanitarian law, regional stability and sustainable development, especially for cyber-surveillance items.
A transparency and information exchange mechanism. This requires the competent authorities to share information on the authorizations, denials and consultations of export, and to publish annual reports on their export control activities.

The dual-use encryption products: sensitive goods for security and human rights

The dual-use encryption products are a specific type of dual-use goods that fall under the category 5 of the Union list. These are products that use cryptographic techniques to protect the confidentiality, integrity and authenticity of data and communications. These products can have both civilian and military uses, and they raise important issues for security and human rights.

The dual-use encryption products: a definition and examples

The dual-use encryption products are defined by the Regulation (EU) 2021/821 as “information security systems, equipment and components, and ‘software’ and ‘technology’ therefor, which use ‘cryptography’ or cryptanalytic functions”. The Regulation also provides a list of examples of such products, such as:

Cryptographic activation equipment or software
Cryptographic equipment for mobile cellular systems
Cryptographic equipment for radio communication systems
Cryptographic equipment for computer and network security
Cryptanalytic equipment and software
Quantum cryptography equipment and software

The dual-use encryption products: security issues

The dual-use encryption products can have a significant impact on the security of the EU and its partners. On the one hand, these products can enhance the security of the EU and its allies, by protecting their sensitive data and communications from unauthorized access, interception or manipulation. On the other hand, these products can also pose a threat to the security of the EU and its adversaries, by enabling the encryption of malicious or illegal activities, such as terrorism, espionage or cyberattacks. Therefore, the export of these products needs to be carefully controlled, to prevent their misuse or diversion to undesirable end-users or end-uses.

The dual-use encryption products: human rights issues

The dual-use encryption products can also have a significant impact on the human rights of the EU and its partners. On the one hand, these products can protect the human rights of the EU and its citizens, by safeguarding their privacy and freedom of expression on the internet. On the other hand, these products can also violate the human rights of the EU and its partners, by enabling the repression or surveillance of dissidents, activists or journalists by authoritarian regimes or non-state actors. Therefore, the export of these products needs to take into account the potential consequences of the items on human rights, international humanitarian law, regional stability and sustainable development, especially for cyber-surveillance items.

The modification of the Union list of dual-use goods by the Delegated Regulation (EU) 2022/1

The Union list of dual-use goods is not static, but dynamic. It is regularly updated to reflect the changes in the technological development and the international security environment. The latest update of the list was made by the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the Regulation (EU) 2021/821.

The changes made by the international export control regimes in 2020 and 2021

The Delegated Regulation (EU) 2022/1 reflects the changes made by the international export control regimes in 2020 and 2021. These are the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group and the Missile Technology Control Regime. These regimes are voluntary and informal arrangements of states that coordinate their national export control policies on dual-use goods. The EU is a member of these regimes, and it aligns its Union list of dual-use goods with their lists of controlled items. The changes made by these regimes include the addition, deletion or modification of some items, as well as the clarification or simplification of some definitions or technical parameters.

The new items added to the Union list of dual-use goods: the quantum technologies, the drones and the facial recognition systems or biometric identification systems

The Delegated Regulation (EU) 2022/1 also adds some new items to the Union list of dual-use goods. These are items that are not covered by the international export control regimes, but that are considered to be sensitive for the security and human rights of the EU and its partners. These items include:

Certain types of software and technology for the development, production or use of quantum computers or quantum cryptography. These are devices or techniques that use the principles of quantum physics to perform computations or communications that are faster or more secure than conventional methods.
Certain types of equipment, software and technology for the development, production or use of unmanned aerial vehicles (UAVs) or drones. These are aircraft or systems that can fly without a human pilot on board, and that can be used for various purposes, such as surveillance, reconnaissance, delivery or attack.
Certain types of equipment, software and technology for the development, production or use of facial recognition systems or biometric identification systems. These are systems or techniques that can identify or verify the identity of a person based on their facial features or other biological characteristics, such as fingerprints, iris or voice.

The entry into force and application of the Delegated Regulation (EU) 2022/1

The Delegated Regulation (EU) 2022/1 entered into force on 7 January 2022. It applies to all exports of dual-use goods from the EU from that date. The exporters of dual-use goods need to be aware of the changes and updates to the Union list of dual-use goods, and to comply with the export control rules and procedures established by the Regulation (EU) 2021/821. The competent authorities of the member states need to implement and enforce the new Union list of dual-use goods, and to cooperate and coordinate with each other and with the Commission. The Commission needs to monitor and evaluate the impact and effectiveness of the new Union list of dual-use goods, and to report to the European Parliament and the Council.

The national regulations on dual-use encryption products

How some countries have their own rules on dual-use encryption products

The case of the United States

Some countries have their own national regulations on dual-use encryption products, which may differ or complement the existing regimes. For example, the United States has a complex and strict export control system, based on the Export Administration Regulations (EAR). The EAR classify encryption products under category 5, part 2, of the Commerce Control List (CCL). The EAR require an export license for most encryption products, except for some exceptions, such as mass market products, publicly available products, or products intended for certain countries or end-users. The EAR also require that exporters submit annual self-classification reports, semi-annual sales reports, and encryption review requests for certain products.

The case of Andorra

Andorra is a small country between France and Spain. It is not an EU member, but it has a customs union with it. However, this customs union does not cover all products. It only covers those belonging to chapters 25 to 97 of the Harmonized System (HS), which are mainly industrial products. Agricultural products and products belonging to chapters 1 to 24 of the HS are free of import duties in the EU. But they are subject to the most-favored-nation (MFN) treatment in Andorra.

Andorra has adopted the EU list of dual-use goods. It requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. This regulation came into force on 9 September 2021 and replaced the previous Regulation (EC) No 428/2009. Andorra has also adopted the necessary customs provisions for the proper functioning of the customs union with the EU. These provisions are based on the Community Customs Code and its implementing provisions, by the Decision No 1/2003 of the Customs Cooperation Committee.

Andorra applies the EU regulation, as it is part of the internal market. Moreover, Andorra has adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods. This modification reflects the changes made by the international export control regimes in 2020 and 2021. It also adds some new items, such as software and technologies for quantum computing, drones or facial recognition. The Delegated Regulation (EU) 2022/1 came into force on 7 January 2022, and applies to all exports of dual-use goods from the EU from that date.

Andorra entered the security and defense sector for the first time by participating in Eurosatory 2022. This is the international reference exhibition for land and airland defense and security. Andorra became the 96th country with a security and defense industry on its territory. Among the exhibitors, an Andorran company, Freemindtronic, specialized in counter-espionage solutions, presented innovative products. For example, DataShielder Defense NFC HSM, a device to protect sensitive data against physical and logical attacks. It uses technologies such as EviCypher NFC HSM and EviCore NFC HSM, contactless hardware security modules (NFC HSM). The president of Coges events, a subsidiary of GICAT, identified these products as dual-use and military products. They need an export or transfer authorization, according to the Regulation (EU) 2021/821. Freemindtronic also showed its other security solutions, such as EviKey NFC HSM, a secure USB key, a security token. These products were displayed in the Discover Village, a space for start-ups and SMEs innovations.

Switzerland

Switzerland is not an EU member, but it has a free trade agreement with it. Switzerland has adopted the Regulation (EU) 2021/821 by the Ordinance of 5 May 2021 on the control of dual-use goods. Switzerland applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. Switzerland has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

Turkey

Turkey is not an EU member, but it has a customs union with it. Turkey has adopted the Regulation (EU) 2021/821 by the Presidential Decree No 3990 of 9 September 2021 on the control of exports of dual-use goods. Turkey applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. Turkey has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

United Kingdom

The United Kingdom left the EU on 31 January 2020. It has adopted the Regulation (EU) 2021/821 by the Dual-Use Items (Export Control) Regulations 2021, which came into force on 9 September 2021. The United Kingdom applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. The United Kingdom has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

The challenges and opportunities for the exporters of dual-use encryption products

The exporters of dual-use encryption products face several challenges and opportunities in the current context of export control regulations. Among the challenges, we can mention:

The complexity and diversity of the regulations, which may vary depending on the countries, the products, the destinations and the end-uses, and which require a deep knowledge and a constant monitoring from the exporters.
The costs and delays related to the administrative procedures, which can be high and unpredictable, and which can affect the competitiveness and profitability of the exporters, especially for small and medium enterprises (SMEs).
The legal and reputational risks, which can result from an involuntary or intentional violation of the regulations, or from a misuse or diversion of the products by the end-users, and which can lead to sanctions, prosecutions or damages to the image of the exporters.

Among the opportunities, we can mention:

The growing demand and innovation for encryption products, which are increasingly used in many sectors and domains, such as finance, health, education, defense, security, human rights, etc.
The contribution to the security and human rights of the exporters, their customers and the general public, by enabling the protection of data, privacy, freedom of expression, access to information and democratic participation, thanks to encryption products.
The cooperation with the competent authorities, the civil society and the international community, to ensure the compliance and accountability of the exporters, and to support the development and implementation of effective and balanced encryption policies and regulations, that respect the security and human rights of all stakeholders.

Conclusion

Dual-use encryption products can have both civil and military uses. They are subject to export control regulations at different levels: international, regional and national. These regulations aim to prevent the risks that these products can pose for security and human rights. At the same time, they allow the development and trade of these products. Therefore, the exporters of dual-use encryption products must comply with the regulations that apply to their products. They must also assess the impact of their products on security and human rights. The exporters of dual-use encryption products can benefit from the demand and innovation for these products. These products are essential for the digital economy and society. They can also enhance the security and human rights of the exporters, their customers and the public.

Freemindtronic Andorra is a company that specializes in dual-use encryption products. It offers secure and innovative solutions for data, communication and transaction protection. Freemindtronic Andorra respects the export control regulations that apply to its products. It is also committed to promoting and supporting the responsible and lawful use of its products. It follows the principles of security and human rights. Freemindtronic Andorra cooperates with the authorities, the civil society and the international community. It ensures the transparency and accountability of its activities. It also participates in the development and implementation of effective and balanced encryption policies and regulations. It respects the interests and needs of all stakeholders.

2023, Articles, EviCore HSM OpenPGP Technology, EviCore NFC HSM Technology, NFC HSM technology, Technical News, Technologies

Quantum computing RSA encryption: a threat and a solution

Posted on November 12, 2023November 18, 2023 by FMTAD

12
Nov

Quantum computing RSA encryption by Jacques Gascuel: This article will be updated with any new information on the topic.

Quantum computers RSA cryptography: how to secure your data

Quantum computers can break RSA encryption, which secures our online data. But there are solutions that are resistant to quantum attacks. One of them is Freemindtronic, an Andorran company that notably uses NFC HSM technology to share AES-256 keys using RSA-4096 encryption, which quantum computers cannot decipher.

2024 Articles Cardokey EviSwap NFC NDEF Technology GreenTech Technical News

NFC vCard Cardokey: Revolutionizing Digital Networking

March 25, 2024

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing

November 8, 2023

2023 Articles Cyberculture Eco-friendly Electronics GreenTech Technologies

The first wood transistor for green electronics

April 29, 2023

Eco-friendly GreenTech

Hardware secrets manager Eco-friendly

April 25, 2021

Quantum computing RSA encryption: a challenge and a solution

Quantum computing RSA encryption is a challenge for online security. Quantum computing is a new way of computing that uses quantum physics. It can do things that classical computers cannot or are too slow to do. One of these things is breaking RSA encryption, which secures data online. RSA encryption is based on the difficulty of factoring large numbers. Quantum computers can factor large numbers faster than classical computers. They use algorithms like Shor’s algorithm, which exploits quantum properties.

However, this threat is not imminent. Building and using quantum computers is still challenging and uncertain. Two recent announcements claimed to have cracked RSA encryption with quantum systems. But they have not been verified. The experts are skeptical and doubtful. They have not provided any evidence or details. They have made unrealistic or too good to be true claims. They have not been peer-reviewed or reproduced.

What is RSA encryption?

RSA encryption is a type of asymmetric encryption. It uses two keys: a public key and a private key. The public key can be shared with anyone, but the private key must be kept secret. They are mathematically related, but it is very hard to find the private key from the public key.

How does RSA encryption work?

RSA encryption uses large prime numbers to generate the keys. The public key and the private key are based on the product of two prime numbers. It is easy to multiply two prime numbers, but very hard to factor their product. For example, 17 x 23 = 391, but finding that 391 = 17 x 23 is much harder.

RSA encryption uses keys that are 2048 or 4096 bits long. These are numbers that have 2048 or 4096 binary digits (0 or 1). They are so large that it would take billions of years for a classical computer to factor them. Therefore, RSA encryption is very secure and widely used for online security.

What is quantum computing and how does it work?

Quantum computing is a new way of computing that uses quantum physics. It can do things that classical computers cannot or are too slow to do. Here is how it works:

Qubits: Quantum computers use quantum bits, or qubits. They can be 0 or 1, or both at the same time. This is called superposition. When we measure a qubit, it becomes either 0 or 1. This gives us more information than a classical bit, which is always 0 or 1.
Entanglement: Quantum computers can also use entanglement. This is when two qubits share a quantum state and affect each other, even if they are far apart. This allows us to manipulate multiple qubits at once and create complex quantum states.
Parallelism: Quantum computers can use these properties to perform parallel computations. This means they can do many calculations at the same time, using fewer qubits than classical bits. This can speed up some tasks that are hard for classical computers.

One of these tasks is breaking RSA encryption, which is based on factoring large numbers. Quantum computers can use a quantum algorithm, called Shor’s algorithm, to factor large numbers faster than classical computers. This can break RSA encryption by finding the private key from the public key. However, this requires a quantum computer with many qubits and low errors, which we do not have yet.

Quantum computing RSA encryption: a challenge and a solution

The ability to find an RSA private key from its public key by a quantum computer poses a serious threat to online security. However, this threat is not imminent, as there are still many challenges and uncertainties in building and using quantum computers. Two recent announcements have claimed to have cracked RSA encryption with quantum systems, but they have not been verified and have been met with skepticism and doubt from the experts. They have not provided any evidence or details of their work. They have made assumptions and claims that seem unrealistic or too good to be true. They have not been peer-reviewed or reproduced by other sources.

How quantum computers can break RSA encryption

RSA encryption is a type of asymmetric encryption. It uses two keys: a public key and a private key. The public key can be shared with anyone, but the private key must be kept secret. They are mathematically related, but it is very hard to find the private key from the public key.

RSA encryption uses large prime numbers to generate the keys. The public key and the private key are based on the product of two prime numbers. It is easy to multiply two prime numbers, but very hard to factor their product. For example, 17 x 23 = 391, but finding that 391 = 17 x 23 is much harder.

RSA encryption uses keys that are 2048 or 4096 bits long. These are numbers that have 2048 or 4096 binary digits (0 or 1). They are so large that it would take billions of years for a classical computer to factor them. Therefore, RSA encryption is very secure and widely used for online security.

Quantum computers can break RSA encryption by finding the prime factors of the composite number that is used to generate the public and private keys. Once the prime factors are known, the private key can be easily calculated from the public key, and the encrypted messages can be decrypted. Quantum computers can use a quantum algorithm, called Shor’s algorithm, to factor large numbers faster than classical computers. Shor’s algorithm can factor a large number in polynomial time, which means that the time it takes to factor a number grows relatively slowly as the number gets larger. In contrast, the best classical algorithms for factoring are exponential, which means that the time it takes to factor a number grows very fast as the number gets larger.

Two claims of breaking RSA encryption with quantum systems

Two recent announcements have raised concerns about quantum computing RSA encryption. One is from a team of Chinese researchers, who published a paper on arXiv in December 2022. They claim to have found a faster way to break RSA encryption with a quantum computer of 372 qubits. They combine a classical algorithm, called Schnorr’s algorithm, with a quantum algorithm, called QAOA (Quantum Approximate Optimization Algorithm). Schnorr’s algorithm is a method of factoring large numbers that uses a probabilistic approach and a lattice reduction technique. QAOA is a method of finding approximate solutions to optimization problems using a quantum computer.

The researchers say that by applying QAOA to the most computationally intensive step of Schnorr’s algorithm, they can reduce the number of qubits and the number of operations needed to factor a large number. They also say that they tested their method on a 10-qubit quantum computer and succeeded in factoring a 48-bit number. They extrapolate that their method can scale to factor a 2048-bit number, which is the standard for RSA encryption.

The other announcement is from a researcher named Ed Gerck, who posted on LinkedIn in November 2023. He claims to have decrypted RSA-2048 encryption, the most used public-key algorithm, with a quantum system implementable on a smartphone or a PC running Linux. He says that he developed a quantum algorithm that can calculate prime numbers faster than Shor’s algorithm and that he proved several mathematical conjectures, such as Goldbach’s conjecture. He published an excerpt of his work, but has not provided any proof or detail of his method.

Both announcements are not verified and have been met with skepticism and doubt from the experts. They have not provided any evidence or details of their work. They have made assumptions and claims that seem unrealistic or too good to be true. They have not been peer-reviewed or reproduced by other sources.

Quantum computing RSA encryption: possible solutions

How to protect RSA encryption from quantum attacks?

However, this announcement is not yet verified, and it raises many questions in the scientific community. It is therefore premature to draw hasty conclusions, and we must wait for the publication of the evidence of his work. It is also possible that RSA encryption can be adapted to resist quantum attacks, for example by increasing the length of the keys, or by using masking techniques. In addition, there are alternatives to RSA encryption, supposed to be more robust against quantum computing. These are post-quantum cryptography algorithms, based on other mathematical problems that are difficult to solve for quantum computers. Post-quantum cryptography is a very active field of research, which aims to anticipate the threats that quantum computers would pose to the security of communications. There are several potential candidates to replace RSA encryption, but they must be evaluated and compared in order to choose the most suitable ones for different needs and constraints. The NIST has launched an international competition to select and standardize the best post-quantum encryption algorithms, which should be ready by 2024.

What are the alternatives to RSA encryption?

Some of the alternatives to RSA encryption that are considered to be more resistant to quantum attacks are:

Lattice-based cryptography: This is based on the hardness of finding the shortest vector in a high-dimensional lattice, or the closest vector to a given point. Lattice-based cryptography has the advantage of being fast, versatile, and allowing for advanced features such as homomorphic encryption and digital signatures. Some examples of lattice-based algorithms are NTRU, BLISS, and NewHope.
Code-based cryptography: This is based on the hardness of decoding a general linear code, or finding the error vector in a noisy transmission. Code-based cryptography has the advantage of being simple, efficient, and having a long history of security analysis. Some examples of code-based algorithms are McEliece, Niederreiter, and BIKE.
Multivariate cryptography: This is based on the hardness of solving a system of multivariate polynomial equations over a finite field. Multivariate cryptography has the advantage of being compact, flexible, and allowing for various applications such as encryption, signatures, and identification. Some examples of multivariate algorithms are Rainbow, HFE, and GeMSS.
Hash-based cryptography: This is based on the hardness of finding collisions or preimages for a cryptographic hash function. Hash-based cryptography has the advantage of being simple, provably secure, and relying on minimal assumptions. Some examples of hash-based algorithms are XMSS, SPHINCS, and LMS.

How Freemindtronic protects data with RSA-4096 and NFC technology

Freemindtronic is an Andorran company that specializes in security and cybersecurity of information and computer systems. It designs and develops products and services based on NFC (Near Field Communication) technology, which allows wireless communication at short distance.

The HSM of Freemindtronic: devices that store and protect cryptographic keys

One of the products of Freemindtronic is the HSM (Hardware Security Module), which is a device that stores and protects cryptographic keys. The HSM of Freemindtronic uses two technologies: EviCore HSM OpenPGP and EviCore NFC HSM.

EviCore HSM OpenPGP is an implementation of the OpenPGP standard, an open standard for encryption and signature of data. It can manage symmetric and asymmetric encryption keys, both standard and OpenPGP. It can also create HSM on any type of storage device, such as key store, key chain, SD card, SSD, USB drive, NAS, cloud, etc. It can work in fixed, offline, or online mode (LAN/WAN).
EviCore NFC HSM is a technology that allows to share AES-256 standard keys using RSA-4096 standard encryption. It works without contact with NFC HSM, which use a pair of RSA-4096 keys for secret sharing (AES-256 encryption keys).

The AES-256 standard: a type of symmetric encryption with high level of security

The AES-256 standard is a type of symmetric encryption, which means that it uses the same key to encrypt and decrypt messages. The AES-256 standard offers a high level of security, as it uses keys that are 256 bits long, which are very hard to crack by brute force. The AES-256 standard is widely used for encrypting data and communications, such as files, emails, or messages.

The RSA-4096 encryption: a type of asymmetric encryption that protects the AES-256 keys from quantum attacks

However, the AES-256 standard requires that the key be securely transmitted between the sender and the receiver, without being intercepted, modified, or forged by an attacker. This is where the RSA-4096 encryption comes in, as it provides a way to protect the AES-256 keys from quantum attacks.

The RSA-4096 encryption is a type of asymmetric encryption, which means that it uses two different keys to encrypt and decrypt messages: a public key and a private key. The public key can be shared with anyone, while the private key must be kept secret. The RSA-4096 encryption uses keys that are 4096 bits long, which are out of reach of the current or future quantum computers. The RSA-4096 encryption can encrypt the AES-256 keys with the public key of the receiver, and decrypt them with the private key of the receiver. Thus, only the receiver can access the AES-256 keys, and use them to encrypt or decrypt the messages. The RSA-4096 encryption can also sign the AES-256 keys with the private key of the sender, and verify them with the public key of the sender. Thus, the receiver can ensure the identity of the sender, and the integrity of the AES-256 keys.

The RSA-4096 encryption is therefore an effective way to protect the AES-256 keys from quantum attacks, as it uses keys that are 4096 bits long, which are out of reach of the current or future quantum computers.

The RSA-4096 encryption is also a practical way to share the AES-256 keys between the HSM, as it uses the NFC technology, which allows wireless communication at short distance. The RSA-4096 encryption is therefore a major asset for the technologies of Freemindtronic, which offer an optimal security for the encryption of data.

Conclusion

Quantum computing is a new paradigm of computing that could break RSA encryption, the most common encryption method on the internet. With only 372 qubits, a quantum computer could break RSA encryption, exposing our online data and communications. However, there are solutions and alternatives that can resist quantum attacks. One of them is Freemindtronic, an Andorran company that uses NFC technology to share AES-256 standard keys using RSA-4096 standard encryption, which is beyond the reach of quantum computers. Freemindtronic’s technologies are based on the EviCore HSM OpenPGP and the EviCore NFC HSM, which are hardware devices that store and protect cryptographic keys. EviCore HSM OpenPGP transforms your smartphone, tablet or computer into a hardware security module compatible with the OpenPGP standard. EviCore NFC HSM allows you to store and use your crypto keys and secrets in a contactless NFC device, such as a card, a sticker, or a keychain. Both technologies offer features such as offline isolation, seamless integration, enhanced user experience, and multi-factor authentication. Therefore, Freemindtronic’s technologies are innovative and secure solutions for data and communication encryption, which can withstand quantum attacks and ensure the privacy and integrity of online activities.