RESEARCH
July 2026: post-quantum signatures under attack, device fingerprints and mini-apps
In July 2026 a few leaked bits are enough to recover Falcon, HAWK and ML-DSA keys, and neural networks automate side-channel attacks on ML-KEM. Phones and browsers can be recognised from hundreds of properties or tiny GPU manufacturing differences. WeChat mini-apps get OAuth login wrong, and a rendering delay fools visual phishing detectors.
Archive: reconstruction written in November 2026
1. Halfspace Learning for Lattice Signature Key Recovery from Signs
CRYPTO · Marcus Brinkmann, Nicolai Kraus, Alexander May · Post-Quantum Cryptography
In short: Knowing just the sign of some random values is enough to recover HAWK, Falcon and ML-DSA secret keys.
The authors show that minimal leakage of the randomness used in signing, even a single bit or the Hamming weight, reveals the sign of a combination of the secret key. They treat recovery as a known learning problem and get the HAWK key from 30 signatures in 10 minutes, the Falcon key from 100 signatures in under a minute and, for the first time, the ML-DSA key from 190,000 signatures.
Why it matters. Post-quantum signatures are now entering products and certificates: implementations must be checked against minimal leaks, not just classical cryptanalysis.
2. Neur-SASCA: High-Noise-Tolerant and Automated Single-Trace Attack against NTT
IACR Transactions on Cryptographic Hardware and Embedded Systems · Yuxuan Wang, Jintong Yu, Yihan Nie, Yubo Zhao et al. · Post-Quantum Cryptography
In short: Neur-SASCA uses neural networks to attack ML-KEM from a single power trace, even with heavy noise and different devices.
The NTT transform is at the heart of ML-KEM and a known target for side-channel attacks. Until now these attacks needed hand-built templates, aligned traces and located leakage points. Neur-SASCA processes raw traces directly with a neural network, tolerates non-Gaussian noise and misalignment, and transfers from one profiling device to another.
Why it matters. Automation lowers the cost of physical attacks on post-quantum algorithms: embedded devices adopting them need countermeasures by design.
3. EXADPrinter: Semi-Exhaustive Permissionless Device Fingerprinting Within the Android Ecosystem
Proceedings on Privacy Enhancing Technologies · Sihem Bouhenniche, Pierre Laperdrix, Walter Rudametkin · Web & Mobile Security
In short: With no permissions at all, an Android app collects over 200,000 device properties, and five are enough to identify the phone.
As privacy rules tighten, trackers look for less scrutinised identifiers. EXADPrinter extracts over 200,000 hardware, system and user properties from each Android phone through Java reflection and shell commands, without asking for permissions. Across 4,004 fingerprints from 3,143 devices by 68 manufacturers, combining five attributes with no personal data is enough to recognise a phone.
Why it matters. Tracking without consent bypasses the permissions users can see: for anyone handling personal data it is a compliance risk that enters through third-party libraries in apps.
4. DRAWNAPART: A Device Identification and Spoofing Detection Technique Based on Remote GPU Fingerprinting
ACM Transactions on Privacy and Security · Tomer Laor, Naif Mehanna, Antonin Durey, Vitaly Dyadyuk et al. · Web & Mobile Security
In short: DrawnApart tells apart computers with identical hardware and software from tiny manufacturing differences in their GPUs.
Browser fingerprints change over time and end up confused with those of similar devices. DrawnApart exploits production variations between GPUs of the same model, measured by a script in the browser, to separate otherwise identical machines. It can also check the declared GPU model and expose attackers who mimic the victim's device to get past two-factor authentication.
Why it matters. The same technique serves to track users and to protect accounts: authentication teams can use it against session theft, but must account for privacy rules.
5. Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law’s Impact
Proceedings on Privacy Enhancing Technologies · Luka Nenadic, David Rodríguez, Joseph A. Calandrino · Policy, Law & Society
In short: After the 2023 revision, Swiss website privacy policies mention data subject rights far more often.
In 2023 Switzerland aligned its privacy law with the GDPR. The authors build a language-model system that reads policies in German, French, Italian and English without translating them, and apply it to over 35,000 websites before and after the reform. Disclosures of data subject rights rise significantly, driven mostly by automatic policy generators.
Why it matters. Reforms change texts more than practices: measuring a law's real effect needs tools like this one, which are also useful for assessing client compliance.
6. Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis
arXiv · Zidong Zhang, Zhentao Xie, Lingyun Ying, Qinsheng Hou et al. · Identity & Authentication
In short: Across more than 46,000 WeChat and Baidu mini-apps, 1,834 OAuth login mistakes let attackers impersonate users.
Mini-apps run inside super apps such as WeChat and use the platform's OAuth for login. The authors identify three new kinds of misuse that only appear at runtime and build MiniAuth, which executes login flows even on obfuscated code. Across 44,273 WeChat and 2,721 Baidu mini-apps they find 1,834 cases, including exposed credentials and static identifiers, plus a cryptographic flaw in Baidu's APIs.
Why it matters. Anyone offering services through super apps inherits the risks of integrations written by third parties: login must be checked at runtime, not only in code.
7. Investigating Developers’ Usage and Perception of Trusted Execution Environment Features in Android
IEEE European Symposium on Security and Privacy · Abdullah Imran, Güliz Seray Tuncay, René Mayrhofer, Antonio Bianchi · Web & Mobile Security
In short: Fewer than 6% of Android developers use hardware security features without trouble, and many misread their guarantees.
Android offers APIs backed by the trusted execution environment that hold up even against a compromised operating system. A survey of 396 developers and 20 interviews show that over 70% need these features, fewer than half know them and fewer than 6% adopt them smoothly. 62.4% wrongly believe the KeyStore resists physical tampering.
Why it matters. Banking and insurance apps rely on these protections for keys and biometrics: without better documentation and tooling they often go unused or misconfigured.
8. I can’t recognize (yet): Delayed Rendering to Defeat Visual Phishing Detectors
IEEE European Symposium on Security and Privacy · Ying Yuan, Cristiano Alex Rado, Giovanni Apruzzese, Mauro Conti et al. · Malware & Threat Intelligence
In short: Delaying the loading of logos and forms is enough to fool phishing detectors that judge a page by its looks.
The most advanced phishing detectors compare a screenshot of a page with that of the legitimate site it imitates. To do so they must take the snapshot at some moment. The authors show that this class of defence has never considered timing-based attacks: delaying the rendering of recognisable elements makes the page look harmless at the instant of the check.
Why it matters. Many corporate mail and web filters use this technique: a near-zero-cost trick weakens it, so repeated checks or other signals are needed.
9. Cross-Host Lateral Movement Attacks Detection with QUIC-Aware Dynamic Information Flow Tracking
IEEE European Symposium on Security and Privacy · Kokthay Poeng, Laurent Schumacher · Network Security
In short: A cross-host flow tracking system reconstructs lateral movement even when attackers use QUIC.
Spotting an attacker moving from host to host needs causal links between network flows. QUIC hides these links from syscall-based monitors, and existing systems lose over half of their accuracy. The authors combine lightweight kernel monitoring with instrumentation of QUIC servers, achieving complete attribution with detection latency under 15 microseconds.
Why it matters. Lateral movement decides how far an attack spreads: new protocols can blind detection tools unless they are updated.
10. Banshee: Target Switch Attacks on Gimbal-Stabilized Visual Tracking Systems via Acoustic Injection
IEEE Symposium on Security and Privacy · Jiarui Li, Joseph Brewington, Qingzhao Zhang, Zhuoqing Morley Mao · Web & Mobile Security
In short: With targeted sound aimed at the camera stabiliser, Banshee makes a drone follow a target the attacker chooses.
Drones that follow an object use a camera on a gimbal stabiliser whose sensors are sensitive to sound. Banshee generates acoustic waves that make the camera oscillate in a calculated way, breaking the association between frames: the tracker switches to the object the attacker picks. In flight, against a commercial drone, the attack succeeds 95.5% of the time.
Why it matters. Inspection, security and delivery drones rely on visual tracking: a cheap physical attack can hijack their mission without touching the software.
Read the paper · PDF · Code
Trends of the month
Post-Quantum Cryptography
72 papers this month on this topic
With post-quantum standards now set, research moves to implementations. A few leaked bits are enough to recover Falcon, HAWK and ML-DSA keys, and neural networks make side-channel attacks on ML-KEM more automated and robust. Migration needs verified implementations, not just new algorithms.
Papers cited:
- Halfspace Learning for Lattice Signature Key Recovery from Signs
- Neur-SASCA: High-Noise-Tolerant and Automated Single-Trace Attack against NTT
Privacy
76 papers this month on this topic
Tracking is moving from cookies to device characteristics. A permissionless app collects over 200,000 phone properties and GPU manufacturing differences tell identical computers apart. Meanwhile in Switzerland the 2023 reform mostly changes the text of privacy policies, often written by automatic generators.
Papers cited:
- EXADPrinter: Semi-Exhaustive Permissionless Device Fingerprinting Within the Android Ecosystem
- DRAWNAPART: A Device Identification and Spoofing Detection Technique Based on Remote GPU Fingerprinting
- Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law’s Impact
Identity & Authentication
83 papers this month on this topic
Integration mistakes weigh as much as protocol flaws. Mini-apps get OAuth login wrong in ways visible only at runtime, very few Android developers use hardware protections well, and visual phishing detectors fall to a simple rendering delay. The tools exist, but they must be adopted and verified.
Papers cited:
- Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis
- Investigating Developers’ Usage and Perception of Trusted Execution Environment Features in Android
- I can’t recognize (yet): Delayed Rendering to Defeat Visual Phishing Detectors
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1939.