Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: encryption

Signal adds encypted local backup support to iOS, desktop apps

Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows).

The feature, introduced on Android nearly a year ago, lets users create end-to-end encrypted backups of their chats and restore them on other devices if they lose their phone.

The backup system supports two options: Signal-hosted backups, limited to 45 days of media and 128 KB per message for free users (100 GB in paid plans), and on-device, local backups, with no size restrictions.

JadePuffer agentic AI attacks target Azure, destroy cloud resources

The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components.

The malware emerged in July, with researchers at cloud security company Sysdig highlighting that it uses AI agents to automate the entire attack chain, from reconnaissance, credential theft, and lateral movement to persistence and data encryption.

Shortly after, the company noted that JadePuffer expanded its focus to AI assets, training datasets, and vector databases, using a tool called EncForge.

Physicists define new material blueprint for next-generation microchip encryption

Behind every secure online transaction or encrypted message lies a string of completely unpredictable numbers. A team of physicists has now proposed a theoretical way around a long-standing roadblock, opening the door to next-generation security chips that protect everyday data without slowing performance.

In a study published in Physical Review Letters, a research team co-led by Rice University’s Jun-Jie Zhang and Boris Yakobson describes a new class of materials. The research was conducted in collaboration with Shuai Dong, chair of the School of Physics at Southeast University in China.

These materials, called autferroics, could speed up physical true random number generators (TRNG) thousands of times while keeping signals clear.

New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing

Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server’s memory, so the processor keeps reading old encrypted data as if it were current.

The attack requires an attacker who already controls the server’s software and can briefly access the machine to insert a small circuit board, called an interposer, between the processor and a memory module.

The interposer costs under $200 to build. DDRop works against Intel TDX, Intel Scalable SGX, and AMD SEV-SNP, the hardware that cloud services use to keep customer data private while it is in use, even from the cloud provider.

New Android malware encrypts files, steals data, and harasses victims

A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims.

Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with phishing and social engineering messages.

After installation, the malware requests permission to use the Accessibility service, which gives it extensive control over compromised devices.

Android 17 adds ECH support to make web browsing harder to track

Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users’ home networks.

Android 17 adds support for Encrypted Client Hello (ECH), a new privacy standard that operates in conjunction with private DNS to hide profiling metadata, including visited domain names.

ECH acts as a privacy extension for TLS, the protocol that secures HTTPS connections, encrypting the opening part of the TLS handshake that reveals the contacted hostname via the Server Name Indication (SNI).

The silent data leak hidden inside encrypted reasoning traces of frontier AI models

To hide this reasoning while maintaining conversational context across multiple API turns, major providers such as Anthropic and OpenAI use Authenticated Encryption with Associated Data (AEAD) envelopes. AEAD is a cryptographic standard that encrypts data while attaching metadata to verify that the payload has not been modified in transit.

Providers designed these encrypted envelopes around three goals:

1. Confidentiality: Prevent clients from reading the intermediate reasoning tokens to protect proprietary information.

Hackers poison arrayref Rust crate to push infostealer malware

Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers’ systems during compilation.

Within a 23-minute window, the attacker also poisoned two other crates, append-only-vec and internment, in the same supply-chain attack.

The arrayref crate is a popular Rust library with more than 53 million downloads over the past 90 days that is used by cryptography, graphics, and blockchain tools.

/* */