Privacy is a matter of freedom. https://t.co/9zNXyuxr7R

“Privacy is part of freedom. If you don’t have privacy, you don’t really have freedom.” – Charles Guillemet, CTO @ Ledger The latest Ledger Podcast just dropped with @randhindi and @analog_kyle from @zama & Ledger CTO, @P3b7_ on hardware security, fully homomorphic encryption

Ten years ago, computing 2¹⁰⁰ hashes was considered virtually impossible. Now Bitcoin, may make it within my lifetime. Humanity always directs its energy toward what it values!

I had a conversation with @P3b7_, CTO at @Ledger on the state of privacy in blockchain. Turns out we both have a teen-hacker background ;)

Dive into the full technical breakdown, timeline, and open-source tools used in our Donjon investigation. Full blog post here: https://t.co/omS9uqUvDI

tl;dr - Don’t store secrets on your phone. This investigation reminds me of PS3 or Nintendo Wii hardware attacks back in the day. Initial HW attacks allowed reverse engineering which led to some crazy exploits - let’s see what this first exploit unlocks.

Mediatek responded very constructively to our disclosure 🤝 They informed all the affected OEM vendors. The lesson - take it from Mediatek themselves. Your phone is not explicitly designed to protect secrets. If you use a smartphone without a signer, your assets could be

The result? We achieved total control - arbitrary code execution at EL3, the highest privilege level on the processor. The attack success rate is 0.1%–1%, meaning full compromise is a matter of just a few minutes of trying...

The attack worked!!! EMFI trial-and-error tricked the chip into dumping the entire Boot ROM - our map to the exploit. 🗺️ Next, by precisely faulting the WRITE command, we were able to overwrite the return address on the stack (a ROP primitive).

🔬Our Method: Electro-Magnetic Fault Injection. EMFI uses precise electromagnetic pulses to disrupt the chip’s logic and bypass its security checks. We performed the attack using open-source tooling including the Silicon Toaster & Scaffold board Access to Github links in our

We targeted the bottom of the smartphone software stack: the Boot ROMs. These are hard-coded into System-on-Chips (SoCs) and have a limited code attack surface but high privilege levels (EL3). 🤔Our thesis - could we bypass SoC security & compromise the entire device?

We all store valuable data on our smartphones, but security measures often focus on remote attacks e.g. malware Without the PIN, pattern, or passcode what could an attacker do with your phone in their hand? Quite a lot, as it turns out

What if a hacker could gain total control of your smartphone, not via malware, but the hardware itself? The @DonjonLedger discovered a potentially unpatchable flaw impacting MediaTek Dimensity 7300 - a popular Android phone SoC - enabling arbitrary code execution in minutes.

The printer will go brrr...

Arbitrary code execution, persistence, and privilege escalation on the host system… Modern browsers are extremely complex pieces of software and notoriously hard to secure. The bounties paid for these vulnerabilities are shockingly low compared to the massive upside of

I'm sure, you start to feel it again :)

Hopefully, we have prediction markets to price the future!

MSCI’s move to exclude companies with more than 50% of their balance sheet in crypto (eg. Strategy), and S&P’s downgrade of USDT rating, are clear signs that legacy TradFi knows disruption is coming, and is desperately trying to push back. The paradigm shift is inevitable: you

MSCI’s move to exclude companies with more than 50% of their balance sheet in crypto (eg. Strategy), and S&P’s downgrade of USDT rating, are clear signs that legacy TradFi knows disruption is coming, and is desperately trying to push back. The paradigm shift is inevitable: you

MSCI’s move to exclude companies with more than 50% of their balance sheet in crypto (eg. Strategy), and S&P’s downgrade of USDT rating, are clear signs that legacy TradFi knows disruption is coming, and is desperately trying to push back. The paradigm shift is inevitable: you

The megaSaga is not over, the $500m pre-deposit will basically be rolled-back. MegaETH planned a “pre-deposit” sale ahead of its mainnet launch, letting verified users commit funds to secure allocations of its MEGA token with an initial cap of US$250 million, and an eventual