PakCrypt.Org

Q-DAY IS COMING. AND THE CLOCK JUST MOVED FORWARD. For 30 years, Q-Day was a theoretical date in the future. Now Google is warning that quantum computers could break some encrypted systems by 2029. ------------------ 1. WHAT IS Q-DAY? Q-Day is the day a quantum computer has enough power and stability to break the encryption that protects almost everything online. Michele Mosca, CEO of evolutionQ, puts it like this: "It is the day when people, perhaps adversaries, will have access to a quantum computer that can break cryptographic codes that are in use." At that point, Mosca says, "everything is safe, safe, safe, and then suddenly it is not safe. It is a very drastic jump." Financial transactions. Medical files. Emails. Location history. Crypto wallets. All of it could be unlocked. ------------------ 2. WHY NOW? Two things changed the timeline. First, the Global Risk Institute's 7th Quantum Threat Timeline Report, based on 26 experts, says a full-scale, cryptographically relevant quantum computer is "quite possible" within 10 years and "likely" within 15. Second, new research from Google, UC Berkeley, Stanford, and the Ethereum Foundation found a 20-fold reduction in the physical qubits needed to break elliptic curve cryptography (ECC), the encryption behind most blockchains and crypto. Google called it a warning shot. Especially for crypto, where upgrading requires getting a decentralized network to agree. ------------------ 3. THE ATTACK IS ALREADY HAPPENING This is the part most people miss. Adversaries may already be doing "harvest now, decrypt later." Steal encrypted data today. Store it. Decrypt it later when the quantum computer is ready. That means post-quantum protection only protects future data. It does not protect what was already stolen. As researcher Catherine Mulligan says: "You can upgrade your software, but you cannot really upgrade your DNA." Health records, genetic data, long-term secrets. Once harvested, they cannot be un-harvested. ------------------ 4. WHY OUR CURRENT ENCRYPTION BREAKS Most internet security, that little padlock in your browser, relies on RSA encryption. RSA works because multiplying numbers is easy, but factoring them back is incredibly hard for a normal computer. A quantum computer does not work like a normal computer. It uses qubits that can be 0, 1, or both at the same time through superposition. That lets it solve that factoring puzzle fast. The Quantum Threat Timeline Report defines a cryptographically relevant computer as one that could break RSA in 24 hours. ------------------ 5. WHAT IS BEING DONE? There is good news, but it needs urgency. NIST finalized post-quantum encryption algorithms in 2024, designed to withstand quantum attacks. Google and Cloudflare are both now targeting 2029 to secure their systems with post-quantum cryptography. The White House recommends 2035 as the target for entities to have adopted post-quantum cryptography. And there is even quantum key cryptography, first conceived in the 1980s by this year's Turing Prize winners, which uses photons of light and the laws of physics, not just math, to create a secret key. MIT researchers are also building ultra-efficient chips, 20 to 60 times more energy-efficient, to protect tiny devices like insulin pumps and pacemakers that cannot run heavy security protocols today. Imagine a hacked pump being told: "release lethal dosage." ------------------ 6. WHY WE ARE STILL NOT READY Just over 90 percent of businesses still lack a road map for quantum security, according to data cited by McKinse. And cryptographic migrations normally take 10 to 20 years. This one will be more complicated and more costly. As Dustin Moody at NIST says: "If everyone were to migrate on time, we would be in good shape, but the problem is that is not going to happen in the real world." Worse, the real Q-Day may happen before we know it. Secret state labs, stealth companies, and malicious actors could be ahead of public research. Covert successes would stay invisible. The report warns: "The real Q-day may occur before the world becomes aware of it." And a 2023 Hudson Institute report estimated a quantum attack on the Fedwire Funds Service could trigger financial collapse and a six-month recession. ------------------ 7. WHAT SHOULD YOU DO? For most people: Nothing directly. You need to rely on your technology providers to handle this. For businesses and small companies: Ask your providers one question. "Have you taken care of the quantum threat?" That is it. Start the migration now. Do not wait for Q-Day to be announced, because by then it will be too late. Y2K was avoided because everyone worked hard to prevent it. This is our Y2K moment, except the deadline is moving closer, not further away. Source: CNN, May 17, 2026 edition.cnn.com/2026/05/17/s…

YOUR PLANE IS NOT ABOUT TO CRASH. BUT YOUR COCKPIT THINKS IT IS. "Terrain ahead. Pull up!" That is a command pilots should only hear in a disaster movie. Now they hear it in real cockpits, at safe altitude, because of bogus GPS signals. Welcome to the new normal of electronic warfare in the sky. __________________________ 1. WHAT IS HAPPENING IN THE COCKPIT? Around 900 flights every single day are affected by GPS interference. That number comes from Benoit Figuet at Zurich University of Applied Sciences, founder of SkAI Data Services, which has tracked incidents on GPSWise since 2024. Pilots report phantom "pull up" warnings from the ground proximity system, map shifts where the plane jumps miles from its real path on screen, and on the runway, systems saying the plane is somewhere else entirely. One commercial pilot, who asked not to be named, said cockpit displays have "become a work of fiction." To silence false alarms, pilots sometimes hit the terrain inhibit switch, manually decouple clocks from GPS, and navigate on ground-based systems "like it is the 1970s." __________________________ 2. JAMMING VS SPOOFING They sound the same. They are not. Jamming: Disruption. Your GPS signal is blocked. You lose positioning. Spoofing: Deception. Your system reports a false location. You think you are somewhere you are not. As Captain Ron Hay, president of the International Federation of Air Line Pilots Associations, which represents over 160,000 pilots in 70+ countries, says: "The aircraft thinks that it is absolutely someplace else. The map does not match. The time does not match." And the worst part: "When you are being spoofed, you can determine you are being spoofed, but you do not know where you are going to be spoofed." __________________________ 3. WHY IS GPS SO EASY TO BREAK? GPS signals are incredibly weak by the time they reach us. They travel over 20,000 kilometers from space. By arrival, they are comparable in strength to a couple of light bulbs. That makes them easy to overpower with high-intensity radio signals on the same frequency. The intended targets are usually drones and missiles. Commercial planes are collateral damage. This vulnerability was long understood. It became a daily problem after Russia's invasion of Ukraine in 2022, when drones were widely deployed in combat for the first time. Now disruption is endemic in conflict zones: the Middle East, including the region hit by the Iran war, the Baltic Sea, and the Black Sea. But it is not only there. SkAI has also detected clusters in Asia: on the India-Pakistan border, around North Korea and South Korea, and in Myanmar. __________________________ 4. THE REAL DANGER: NORMALIZATION Hay says fellow pilots encounter this on a regular basis. "I have fellow pilots that encounter this on a regular basis. That is the true danger. It is becoming normalized," he said. He fears pilots will lose trust in critical safety systems as they become desensitized to warnings. The FAA said the same in its 2026 resource guide: As interference becomes more common, organizations and pilots may develop a higher tolerance for risk. "Once trust in these systems is lost, it can be difficult to regain." For passengers, Hay says this is not a reason to panic. It is an operational headache for pilots, airlines, and air traffic control. Example: A plane crossing the Atlantic that hits interference near the Black Sea may be spaced further apart for safety, lose access to the North Atlantic track system, and be forced onto longer, less fuel-efficient routes. That means delays and disruption. __________________________ 5. WHEN IT TURNED DEADLY GPS interference has already contributed to a catastrophe. On December 25, 2024, an Azerbaijan Airlines flight from Baku to Grozny, Russia, crashed in Kazakhstan. At least 38 of the 67 people on board were killed. According to a February 2025 preliminary report from Kazakhstan's Ministry of Transport, the pilots encountered electronic interference. They lost GPS and reported "pull up" warnings near Grozny, where fog made landing with beacons difficult. After two failed landing attempts, they turned back to Baku. During the return, the aircraft lost primary control systems and tried an emergency landing. In October 2025, Russian President Vladimir Putin said missiles fired by Russian air defenses at a Ukrainian drone had caused the crash. But Figuet is clear: "GPS interference was not the primary cause of the crash. But because of GPS interference, they could not land where they were supposed to." Ramsey Faragher, CEO of the Royal Institute of Navigation, agrees: "If it had not had the problems with its GNSS, it would have very, very, very likely landed an hour earlier." __________________________ 6. A DAILY NUISANCE IN FINLAND 【entity-Finnair¦canonical_name=Finnair】 calls it a daily nuisance. Most flights departing southbound from Helsinki encounter GPS spoofing and jamming, says chief flight instructor Captain Aleksi Kuosmanen. On April 6, Finair flight to Kirkenes, a town in northern Norway near the Russian border, had to make a second landing attempt after GPS interference on the first try. Finland's Traficom received 421 reports of GPS interference in January and February this year alone. Last year, it received 1,704 reports. In 2024, Finair even suspended flights to Tartu, Estonia, for a month while the airport improved ground-based landing systems. Kuosmanen: "We are in a position to manage the situation, and the pilots are used to it. But I would not like to see this as a new normal." Finland was among 13 EU members that pushed for action. That led to a European Aviation Action Plan in March, with short-term fixes like standard phraseology with air traffic control, and longer-term coordination with militaries on interference sources. __________________________ 7. IS THERE A FIX? NO SILVER BULLET. Pilots are well trained. But technology has to catch up. What is already helping: - Live jamming and spoofing awareness maps from SkAI, integrated into electronic flight bags, so crews know where to expect interference - IFALPA recommends a ground reset after every suspected flight to erase corrupted signals - Better software filters to detect big jumps in position and time - Isolating the GPS receiver from all other aircraft systems - Controlled Reception Pattern Antennas that filter out spoofing signals - Galileo, the European system, now lets users authenticate the data they receive - Stronger signals from low Earth orbit. The European Space Agency's Celeste mission sent its first navigation signal on April 17, aiming for 11 satellites to test better positioning. Faragher is frustrated: "It is disappointing that the hardware manufacturers have not fixed some of these problems by now." He points to 9/11: When terrorists stormed cockpits, locks were installed on cockpit doors "within weeks." "Given the right motivation, things can happen much more quickly." For now, Kuosmanen says: "We are in a phase of waiting, waiting for new technology, and in the airline industry the change is not always that fast." "New equipment, new system software requires a lot of testing before they can be set up. In the meantime, it is our job to make sure that our pilots are trained to competently handle these situations." So next time your flight is delayed on a route near a conflict zone, it may not be weather. It may be that your plane's GPS is being lied to. And your pilots are flying through fiction to keep you safe. edition.cnn.com/2026/04/28/s…

🎙️ The era of clunky, high-latency multi-signature wallets is officially over. Threshold ECDSA has crossed the chasm from theoretical mathematics to practical, deployable reality. For years, Multi-Party Computation (MPC) and threshold cryptography were bottlenecked by heavy communication overhead. But recent breakthroughs have changed the game entirely. Here is your technical deep-dive into how modern threshold ECDSA works, why it’s a paradigm shift, and what it means for the future of digital custody. 🧵👇 **1️⃣ THE BREAKTHROUGH: The DKLS18/19 Advantage** Traditional multi-party ECDSA required excessive round trips, making it impractical for real-time, high-throughput systems. Enter the advancements pioneered by Doerner, Kondi, Lee, and Shelat (DKLS 2018/2019). This isn't just an incremental optimization; it’s a fundamental architectural shift. By leveraging highly optimized **Oblivious Transfer (OT)** protocols and clever **unique-hash-prefix Fiat-Shamir** transformations, researchers have drastically slashed computational and communication overhead. **2️⃣ THE MECHANICS: How It Achieves Blazing Speed** The magic lies in the protocol design. The new 2-of-n ECDSA protocols reduce the signing process to a highly efficient, pipelined **3-message, 5-round handshake**. * **Oblivious Transfer:** Allows parties to compute joint functions over their private key shares without ever revealing the shares to each other. * **Unique-Hash-Prefix Fiat-Shamir:** Converts interactive zero-knowledge proofs into non-interactive ones securely, preventing signature malleability and ensuring the mathematical integrity of the distributed signature. **3️⃣ THE REAL-WORLD IMPACT: Beyond Just "Faster"** Speed is only half the story. The true value of modern threshold ECDSA lies in its robust security properties: 🔐 **Proactive Security (Refreshable Keys):** Participants can periodically refresh their individual key shares *without* changing the master public key. If a device is compromised, the old share becomes mathematically useless, neutralizing long-term key leakage risks. ⚖️ **Formal Security Proofs:** We are no longer relying on "heuristic security." These modern protocols come with rigorous, mathematically proven security guarantees in the Universal Composability (UC) framework. 🏦 **Enterprise & DeFi Ready:** Distributed Key Management Systems (DKMS) can now operate with the speed and user experience of a single signature, while retaining the fault tolerance and security of a distributed network. **4️⃣ THE PAKCRYPT VISION: Building the Next Generation** This is the absolute cutting edge of applied cryptography. At the **PakCrypt Symposium**, we don’t just observe these global advancements; we actively dissect them alongside leading international experts from Germany, Norway, China, and Turkey. To the brilliant young Pakistani students, developers, and cybersecurity professionals reading this: **The future of secure digital infrastructure needs you.** Multi-Party Computation and threshold cryptography are the bedrock of Web3, secure voting, and next-gen enterprise security. Master these concepts. Participate in national-level events and hackathons. Let’s ensure Pakistan is not just consuming this technology, but actively building world-class cryptographic solutions. 🇵🇰🚀🔐 🔗 **READ MORE & DIVE DEEP:** 📄 **The Seminal DKLS Research (IACR ePrint):** "Two-Party ECDSA from Hash Proof Systems and Efficient Instantiations" – eprint.iacr.org/ 🛡️ **Practical Guide to MPC & Threshold Signatures:** A comprehensive industry primer on Multi-Party Computation in digital asset custody – medium.com/chainlink/what-is… #ThresholdCryptography #ECDSA #MultiPartyComputation #MPC #CyberSecurity #Cryptography #InfoSec #PakCrypt #TechPakistan #BlockchainSecurity #CryptoResearch

🎙️ Read closely, because the foundational rules of digital trust just changed. Quantum threat is looming and NIST’s Post-Quantum Cryptography (PQC) standards are officially LIVE. In mid-2025, the National Institute of Standards and Technology (NIST) released the first quantum-safe FIPS specifications. We are no longer theorizing about quantum resistance; we are actively deploying it. Here is a comprehensive technical breakdown of the new standards, the math behind them, and the strict migration timelines you need to know. 🧵👇 **1️⃣ THE NEW GOLD STANDARDS: FIPS 203, 204, and 205** NIST has finalized the first three critical specifications to replace our vulnerable RSA and ECC infrastructure. If you are in cybersecurity, you need to know these by heart: 🔹 **FIPS 203 (ML-KEM / formerly Kyber):** The standard for Key Encapsulation Mechanisms. It secures the symmetric keys used to encrypt data in transit. 🔹 **FIPS 204 (ML-DSA / formerly Dilithium):** The primary standard for Digital Signatures. It will be the workhorse for verifying software updates, certificates, and identities. 🔹 **FIPS 205 (SLH-DSA / formerly SPHINCS+):** The conservative backup for Digital Signatures. **2️⃣ THE MATH: Lattice vs. Hash-Based Cryptography** Why these specific algorithms? Because they rely on entirely different mathematical problems that even Shor’s Algorithm cannot crack. 📐 **Lattice-Based (FIPS 203 & 204):** Rely on the hardness of finding the shortest vector in a high-dimensional lattice (Module-LWE). They offer an excellent balance of small key sizes and fast computation, making them highly efficient for everyday internet traffic. 🧮 **Hash-Based (FIPS 205):** Rely purely on the security of the underlying hash function. While they produce much larger signature sizes, they are mathematically conservative. If there is a hidden flaw in lattice math, hash-based signatures remain our ultimate safety net. **3️⃣ THE MANDATE: The Road to 2035** Agencies and global regulators are no longer suggesting a "wait and see" approach. The directive is clear: **Start migration immediately, with a hard goal to complete the transition by ~2035.** Why the urgency? Because of **Harvest Now, Decrypt Later (HNDL)**. Adversaries are stealing encrypted data today. If your data needs to remain secret for more than 10 years, it is *already* at risk. You must implement **Crypto-Agility** now—building systems that can seamlessly swap out classical algorithms for PQC without requiring a total infrastructure rewrite. **4️⃣ THE PAKCRYPT VISION: Leading the Transition** This is the exact frontier we are tackling at the **PakCrypt Symposium**. We are bringing together top international minds from Germany, Norway, China, and Turkey to demystify these standards. To the young students and cybersecurity professionals reading this: **This is your moment.** The world needs PQC engineers, cryptographers, and security architects. Equip yourselves with these skills, participate in national-level events, and let’s ensure you are not just a consumer of this technology, but a global leader in the post-quantum era. 🔐🚀 🔗 📄 **NIST PQC Official Page & Standards:** csrc.nist.gov/projects/post-… 🛡️ **CISA Quantum Computing Cybersecurity Timeline:** cisa.gov/quantum-computing-c… #PostQuantumCryptography #PQC #NIST #CyberSecurity #Cryptography #QuantumComputing #InfoSec #FIPS #PakCrypt #TechPakistan #FutureOfTech

The countdown to "Q-Day" isn't science fiction anymore. It’s an engineering reality. Experts warn that future quantum computers could break RSA and ECC in hours—or even minutes. When that happens, the public-key cryptography securing our digital world becomes instantly obsolete. Here is the full narrative of the quantum threat, the blast radius, and the urgent roadmap to secure our future. 🧵👇 **1️⃣ THE THREAT: Why RSA & ECC are on Borrowed Time** Today’s internet relies on public-key cryptography (RSA, ECC). These algorithms are secure because they rely on mathematical problems—like integer factorization and discrete logarithms—that would take classical computers millions of years to solve. Enter Quantum Computing. Using **Shor’s Algorithm**, a sufficiently powerful quantum computer with enough stable logical qubits can solve these exact mathematical problems exponentially faster. What takes millennia for classical machines takes mere minutes for quantum ones. **2️⃣ THE BLAST RADIUS: What Breaks When Quantum Arrives?** If RSA and ECC fall, the foundational trust of the modern internet crumbles overnight: ❌ **HTTPS/TLS:** Secure web browsing and data-in-transit encryption are shattered. ❌ **VPNs & SSH:** Secure remote access and network tunnels are compromised. ❌ **Digital Signatures & PKI:** Code signing, SSL certificates, and identity verification lose their root of trust. ⚠️ **The Hidden Danger:** You don't need to wait for Q-Day to be vulnerable. Adversaries are actively executing **"Harvest Now, Decrypt Later" (HNDL)** attacks. They are stealing and storing encrypted data *today*, waiting for quantum hardware to mature so they can decrypt it tomorrow. **3️⃣ THE ANTIDOTE: NIST’s Post-Quantum Cryptography (PQC)** We cannot wait for quantum computers to mature to act. The solution is already here. NIST has finalized its first Post-Quantum Cryptography standards, relying on entirely different mathematical foundations (like lattice-based cryptography) that even quantum computers struggle to solve. The new gold standards include: 🔹 **ML-KEM (formerly Kyber):** For secure key encapsulation and encryption. 🔹 **ML-DSA (formerly Dilithium) & SLH-DSA:** For robust, quantum-resistant digital signatures. **4️⃣ THE PLAYBOOK: How to Migrate NOW** Migrating to PQC isn't just a "find and replace" in your codebase. It requires a strategic, enterprise-wide overhaul: 🔍 **Discover:** Conduct a deep inventory of all cryptographic assets, libraries, and dependencies. 📊 **Assess:** Identify where classical RSA/ECC are used and evaluate your specific quantum risk profile. 🏗️ **Architect:** Design for **Crypto-Agility**. Build systems where cryptographic algorithms can be swapped out seamlessly without rewriting the core application. 🔄 **Migrate:** Implement **Hybrid Schemes** (combining classical + PQC algorithms) as a transitional bridge to ensure security during the migration phase. **THE BOTTOM LINE:** The quantum threat is no longer a theoretical debate for academics; it is a critical, immediate cybersecurity imperative. The time to build quantum-resistant infrastructure is *before* the quantum computers are fully online.

🧵 if you do not know Shafi Goldwasser, you are living in stone age of crypto. She is co-inventor of zero-knowledge proofs, Turing Award winner, and now one of the people asking whether you can trust an AI model at all. 🔐🤖 Born in New York City in 1959, raised in Tel Aviv. Carnegie Mellon for undergrad (1979), then Berkeley for her MS (1981) and PhD (1984), advised by Manuel Blum. Her PhD work was on probabilistic encryption, and she later shared the 2012 Turing Award with Silvio Micali. Those ideas became the foundations of modern cryptography. 📜 Her top 3 AI x crypto moves: 1️⃣ Undetectable backdoors (FOCS 2022). With Kim, Vaikuntanathan, and Zamir, she showed a malicious trainer can plant a backdoor in a classifier that no bounded observer can detect, under standard crypto assumptions. The backdoored model can look robust while every input has an adversarial example. Yikes. 😬 2️⃣ Detection vs. mitigation (2025). With Gluch, she took a cryptographic lens to adversarial inputs at inference time and showed that detecting them and mitigating them are equivalent for classification tasks. That changes what "defense" even means. 3️⃣ Trust engineering. Her research program covers verification protocols for ML models and data sources, privacy in training and inference, and robustness against adversaries. She also co-founded Duality Technologies, a privacy-tech company. Why she matters in age of AI? 🤔 → The tools she helped invent, like zero-knowledge proofs, are the same ones people now use to verify AI without trusting the vendor. → She's saying the quiet part out loud: some backdoors may be provably undetectable. Audits built only on tests are weaker than we assumed. → When AI becomes infrastructure, trust is the product. The people who define trust mathematically will matter a lot. NGMI if you're trusting a model you didn't train, test, or verify. Follow the person who helped define what a proof is. 🧠 🔗 people.csail.mit.edu/shafi 🔗 www2.eecs.berkeley.edu/Facul… 📄 arxiv.org/abs/2204.06974 (Planting Undetectable Backdoors in ML Models) #Cryptography #AI #MachineLearning #AISafety #ZeroKnowledge

🧵 Do you know Emmanuel Prouff? one of the researchers who helped turn deep learning into a chip-hacking tool, and then built the benchmark everyone uses to test it. 🔌🧠 As you might know that in side-channel attacks, you don't break the math, you eavesdrop on the hardware. Power draw, timing, and EM leaks let you read a secret key out of a chip's gossip. ML is very good at eavesdropping. 🕵️ His top 3 AI x crypto moves: 1️⃣ Deep learning vs. implementations (2016). With Maghrebi and Portigliatti, he published "Breaking cryptographic implementations using deep learning techniques." That was years before neural nets became a crypto trend, and he was already pointing them at chip measurements. 2️⃣ CNNs vs. jitter (CHES 2017). With Cagli and Dumas, he worked on convolutional nets with data augmentation against jitter-based countermeasures, with profiling attacks that skip heavy pre-processing. Countermeasures that used to need hand-tuned preprocessing started getting automated. 3️⃣ ASCAD (2018 → J. Cryptographic Engineering 2020). He co-created the first open database for deep-learning side-channel analysis, built on a masked AES implementation. Now it's a standard benchmark, so results can be compared instead of just marketed. Why follow him? 🤔 → Attackers and defenders use the same toolkit. He's an ANSSI expert, and he co-edited the 3-volume Embedded Cryptography series (2025), which covers both attacks and countermeasures. → He's a talent pipeline. His student Loïc Masure did a PhD on ML for profiling side-channel attacks and is now a CNRS researcher. → Smart cards, phones, and IoT chips are where AI meets real secrets. The question is no longer whether ML can read chip leaks, but how cheaply it can. your chip's secrets are becoming a machine-learning problem. Follow the person who helped make them one. NGMI if your secure element hasn't been tested against ML. 🔐 🔗 orcid.org/0000-0002-3998-047… (his ORCID profile; I found no personal website) 🔗 lip6.fr/actualite/personnes-… (Sorbonne LIP6 page) 📄 eprint.iacr.org/2018/053 (ASCAD) #SideChannel #Cryptography #AI #DeepLearning #HardwareSecurity

🔑 Your spare key shouldn't live under the gnome. Spare Key Under the Gnome, covers password reuse. When one password opens everything, one leak opens everything too. Criminals buy old breach lists of email and password pairs and test them on banks, shops and streaming sites. It's called credential stuffing, and it's cheap, automated and very patient. --- 📧 Your email is the master key: Whoever controls your inbox can reset passwords on your other accounts, so protect it first. 🔁 Reuse is the weak spot: A password leaked from one site can be tried on dozens of others in minutes. 🧠 Three random words: The NCSC suggests this for a strong password you can still remember. 🔐 2-step verification: Turn it on for email, banking and anything else that matters. 🗝️ Let a password manager remember: It creates and stores a unique password for every account. 🌍 Different villains, same weakness: Criminal gangs test leaked lists, while North Korea-linked and Russia-linked groups have been documented stealing credentials. Motives differ, but a stolen password is still the way in. The fix is simple: One key, one door. Check whether your email has appeared in a known breach at haveibeenpwned.com by typing the address in yourself, never through a link. If money has gone, call your bank straight away and report fraud through gov.uk. #PasswordSecurity #StaySafeOnline #CyberSecurity #UK

North Korea’s latest cyber era isn’t just hacking your firewall — it’s applying for your open remote dev role. Thousands of DPRK IT workers are suspected of using fake identities, stolen personas, and laptop farms to land remote tech jobs at U.S. and global companies. It’s giving “hired for the job, secretly funding the regime.” This isn’t just wage fraud. These insiders can get access to code, credentials, customer data, and internal systems — turning a “great hire” into an espionage backdoor. The scheme got so loud that the U.S., South Korea, and Japan issued joint warnings to companies in 2025. if the candidate’s LinkedIn is immaculate but their webcam is permanently off and their background blur looks like it’s hiding a server rack, HR should side-eye the onboarding. Read: 🔗 CISA North Korea Threat Overview: cisa.gov/topics/cyber-threat… 🔗 FBI IC3 PSA hub (search “North Korean IT workers”): ic3.gov/ #NorthKorea #InsiderThreat #CyberSecurity #OSINT #InfoSec #TechTwitter

💼 Your dream job offer might come with a nightmare zip file. Don't Run the Code, covers fake recruiters. A stranger offers a great salary, a "quick take-home test" and a zip file to install. Run it, and you've invited malware in. 🤝 Fake recruiters: Profile photos can be stock images, and job offers can arrive unprompted. Check the company through a website you type in yourself. 📦 Malware disguised as tests: Security researchers have documented North Korea-linked campaigns using trojanised "coding tests" aimed at engineers, including in defence and aerospace. 🛡️ "Turn off your antivirus": A real employer never asks you to disable security. That request is the giveaway. 🪪 Fake remote workers: US authorities have charged North Korean nationals running fake remote IT worker schemes, using stolen or borrowed identities. 📰 War-themed bait: Russia-linked groups have sent war-related lures to Ukrainian and Western targets, including officials, journalists and charities. 💸 Pay-to-apply scams: Criminal gangs ask for "placement fees" up front, then go quiet. Therefore, Don't run the code. Never open a setup file or switch off antivirus because a stranger asked. If you've already run something, disconnect from the internet, tell your IT team, change your passwords from a different device and report it through gov.uk. Real jobs will still be there after a check. 🇬🇧 #JobScam #StaySafeOnline #CyberSecurity #UK #Pakistan #Karachi

🍎📱 Apple's supplier got hacked, and the hackers allegedly have Apple and Tesla blueprints. Somewhere, a procurement manager just aged 10 years. 💀 Tata Electronics, which reportedly builds about a third of iPhones made in India, confirmed a cyber incident. Here's the tea ☕ 1️⃣ The haul: ransomware gang World Leaks posted about 204,000 files (630+ GB) on its dark web site around June 10 to 12. That's not a folder. That's a storage unit. 📦 2️⃣ The alleged contents: Apple and Tesla design and spec files, years of event logs, emails, and passport copies of employees, including foreign nationals. Your passport scan was never meant to be a supply chain document. 🛂 3️⃣ The official line: Tata says the incident hit "some of our systems," operations are unaffected, and its response protocols kicked in. Translation: the factory is humming, and the filing cabinet is on the dark web. 🏭 4️⃣ The ransom question: Reuters reports Tata reportedly received a ransom demand. The amount and negotiation status haven't been disclosed. Very "we'll get back to you" energy. 📞 5️⃣ Plot twist, same week: Bajaj Auto disclosed a ransomware attack on June 23 affecting its systems and subsidiary Bajaj Auto Technology. Shares dropped more than 2% after the exchange filing. Markets get nervous fast. 📉 6️⃣ The lesson: your factory floor can be spotless, but your IT and suppliers are the open windows. Manufacturers hold designs, specs, and partner secrets in one place, which makes them a dream target. 🪟 Takeaway: treat supplier data like the evidence in a heist movie. Classify it, encrypt it, and never let passport scans sit on a shared drive. 🔐 📖 Reuters via CNBC: cnbc.com/2026/06/23/indias-t… 📖 Cybernews: cybernews.com/security/tata-… 📖 Bajaj Auto filing coverage: cyberpress.org/bajaj-auto-co… #TataElectronics #Apple #Tesla #Ransomware #CyberSecurity #InfoSec #SupplyChainSecurity #India

🧵 Let's meet the wonderful Kristin Lauter, the mathematician whose group built Microsoft SEAL, the homomorphic encryption library, and who later asked whether AI can break the post-quantum crypto that protects our data. 🔐🧠 Born in Wisconsin in 1969. University of Chicago math: BA 1990, MS 1991, PhD 1996. Then a stint at Michigan, then 22 years at Microsoft Research, where she led the cryptography group. Now Senior Director at Meta's FAIR Labs in Seattle. Quite the glow-up 📈 I would say, her top 3 moves are as under: 1️⃣ SALSA (NeurIPS 2022). Train transformers on LWE samples, combine them with statistical cryptanalysis, and recover secrets for small-to-mid LWE instances with sparse binary secrets. Lattice crypto got a serious ML attacker. 2️⃣ The SALSA family tree. Her co-authored follow-ups extend the idea: SALSA VERDE (sparse small secrets), PICANTE (binary secrets), and FRESCA (angular embeddings and pre-training). 3️⃣ Benchmarks over vibes (2024). With Wenger, Saxena, Malhou, and Thieu, she built the first concrete benchmark of LWE secret recovery on standardized-style parameters. Kyber-style settings fell to SALSA and Cool&Cruel, but only with low-weight secrets, in 28–36 hours. The plain uSVP attack didn't recover secrets after 1,100+ hours. That nuance is the whole point. Why young researchers must follow her? 🤔 → Kyber was standardized by NIST in 2024. How much AI speeds up attacks on it is a live question, and she's one of the people measuring it with numbers. → She works both sides: Private AI and homomorphic encryption (computing on data while it stays encrypted), and ML attacks on lattice crypto. That dual view is rare. → Her Nov 2024 talk framed it well: we're living in a post-quantum era, and also a "post-AI" one. The 2024 benchmark found no break of standardized Kyber with real secrets. The attacks needed sparse secrets, and the cost is still steep. Follow the person putting numbers on the hype. NGMI if you're still running on vibes. 🧪 🔗 ai.meta.com/people/kristin-l… 🔗 math.washington.edu/people/k… 📄 arxiv.org/abs/2408.00882 (Benchmarking Attacks on LWE) #PostQuantum #Cryptography #AI #MachineLearning #HomomorphicEncryption