RESEARCH
September 2026: side channels on post-quantum crypto, passwords stolen with smart glasses
RansomwareOT and industrial security
September 2026 is CHES month: physical attacks recover keys from masked ML-KEM, Classic McEliece and even NIST's Hash-DRBG random generator. Smart glasses record passwords typed on phones, infostealer logs show 170,000 victims and shared compression exposes SSH channels. Agents run more than the user approves.
Archive: reconstruction written in November 2026
1. How Strong is the FO-Calypse, Really? Instantiating Plaintext-Checking Oracles against Masked Software Implementations of ML-KEM
IACR Transactions on Cryptographic Hardware and Embedded Systems · Brieuc Balon, Gaëtan Cassiers, Thibaud Schoenauen, François‐Xavier Standaert · Post-Quantum Cryptography
In short: Even with seven masking shares, about 50 ML-KEM executions suffice to build an oracle that leads to key recovery.
A known weak point of ML-KEM is re-encryption during decapsulation, which can act as an oracle for key recovery. The authors measure how easy it is to build this oracle on three open source masked Keccak implementations for ARM Cortex-M4. They reach high accuracy up to seven shares with about 50 executions: on these platforms high protection levels are not affordable.
Why it matters. Smart cards, sensors and embedded devices adopting ML-KEM cannot rely on masking alone: protocol-level and hardware countermeasures are needed.
2. Key-Recovery Side-Channel Attack on the Berlekamp-Massey Decoding Algorithm in the Classic McEliece KEM
IACR Transactions on Cryptographic Hardware and Embedded Systems · Andrei Alexei, Omar Choudary, Vlad Drăgoi · Hardware & Side Channels
In short: A power analysis attack recovers the full Classic McEliece secret key in under two minutes.
Classic McEliece is a very conservative post-quantum candidate. The authors attack the Berlekamp-Massey algorithm used in decapsulation, whose power draw depends on secret elements. With chosen ciphertexts and one trace per coefficient they recover the Goppa support in under 50 seconds on a Cortex-M4, and the remaining polynomial in under a minute with a known algorithm.
Why it matters. Even the post-quantum schemes deemed safest on paper need protected implementations when they run on physically accessible devices.
3. The σ0 Side Channel: Single-Trace State Recovery from NIST SP 800-90A Hash-DRBG
IACR Transactions on Cryptographic Hardware and Embedded Systems · Xhani Marvin Saß, Jean‐Pierre Seifert · Hardware & Side Channels
In short: A single power trace is enough to rebuild the state of NIST's Hash-DRBG random generator and predict its output.
Hash-DRBG has no fixed key and its state changes with every call, so it was thought immune to side-channel attacks. The authors exploit SHA-256's σ0 function, which processes the state in slices and runs twice on the same input. Using neural networks they rebuild all 440 bits from one trace, with ≥99% success on three of four architectures, and propose a cheap countermeasure.
Why it matters. If the random generator is predictable, keys, nonces and tokens derived from it fall: even components deemed harmless need protection on embedded devices.
4. Faulting an 8 nm FinFET technology SoC using Photon Emission Microscopy-assisted LFI
IACR Transactions on Cryptographic Hardware and Embedded Systems · Thomas Ravelet, Jean-Max Dutertre, Raphael Viera, Rodrigo Silva Lima et al. · Cryptography
In short: For the first time a laser guided by photon emission microscopy faults the registers of an 8 nm chip and extracts an AES-256 key.
Smaller technology nodes were thought to make optical attacks on registers impractical. The authors use photon emission microscopy to pinpoint targets and inject laser faults into the registers of an 8 nm FinFET SoC running Linux. With persistent fault analysis they fully recover the AES-256 key used by the kernel.
Why it matters. Miniaturisation alone does not protect chips from physical attacks: anyone managing devices that hold keys must also consider this scenario.
5. Watch and Crack: Password Inference from Smart-Glasses Video
arXiv · Yoav Orenbach, Avishai Wool · Identity & Authentication
In short: A commercial smart-glasses camera is enough to reconstruct passwords typed on a phone, even random ones.
The authors present the first system that, from video shot with Meta Ray-Ban glasses, reconstructs alphanumeric passwords typed on smartphone QWERTY keyboards with no assumptions about the victim. It tracks fingers at sub-pixel precision and uses 2.19 billion leaked passwords. Human passwords up to 16 characters fall in hours or days, random ones up to 13 in under an hour.
Why it matters. Corporate password policies ignore anyone filming the screen: in public places passkeys and biometrics are preferable to manual entry.
6. A Data-Driven Analysis of Infostealer Malware Victims
Computers & Security · Arttu Paju, Juha Nurmi, David Arroyo, Sergio Chica et al. · Malware & Threat Intelligence
In short: An anonymised dataset of 170,298 infostealer victims shows credentials for governments, law enforcement and elite universities.
Infostealers steal credentials, browser sessions, private keys and certificates. The authors turn illicitly sourced logs into a research dataset that minimises sensitive data and use it to study 170,298 victims. They find credentials for law enforcement, government and military bodies and all Ivy League universities, plus widespread password reuse and a high risk of repeat victimisation.
Why it matters. A single infected device can open the doors of a whole organisation: monitoring infostealer logs is a useful indicator of a company's risk.
7. Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels
arXiv · Fabian Bäumer, Marcus Brinkmann · Hardware & Side Channels
In short: With compression on, all channels of an SSH connection share one context, and an attacker can recover secrets from them.
SSH carries several logical channels, such as shells and port forwarding, over one connection. The authors find that with compression on these channels share the same compression context: whoever injects partly chosen text into one channel and watches packet lengths can rebuild secrets from another. In the best case an 8-letter secret takes at most 276 guesses.
Why it matters. This is the first compression attack on SSH, the protocol used to administer servers: turning compression off is a simple mitigation.
8. Agent Approval Laundering: Transitive Effects Beyond the Approved Invocation
arXiv · Jinqian Zhang, Haojun Xia, Shujiang Wu, Jingkun Yue et al. · AI & LLM Security
In short: When you approve a coding agent's command, the record does not show everything that command sets in motion.
Agent approval interfaces bind the human decision to a command, but installing a package can run scripts and write files, and an MCP call can use the network. The authors call this gap approval laundering: the record names the command but omits its effects. They show that no record-only policy can suffice and propose effect predictions committed before approval.
Why it matters. Anyone using human approval as a control on agents should know the yes covers more than the record says, which also affects incident reconstruction.
9. PriMobiBench: Characterizing Visual Privacy Leakage in VLM-Driven Mobile GUI Agents
arXiv · Qihang Cen, Tianshuo Cong, Da Song, Xinlei He et al. · AI & LLM Security
In short: Agents that operate phones by reading screenshots extract sensitive data in up to 82.5% of cases and profile the user.
Mobile agents built on vision-language models automate tasks by interpreting screenshot streams, often sent to the cloud. PriMobiBench measures the risks using traces from 16 apps with 2,960 embedded sensitive items. Models extract sensitive information in up to 82.5% of cases and rebuild user profiles about 70% of the time. Masking unneeded elements cuts profiling by up to 58%.
Why it matters. Handing phone use to an agent means sending everything on screen to the cloud: for customer and employee data it is a compliance risk.
10. When Apps Outlive Vendors: Security Implications of IoT Abandonware
arXiv · Dayeon Kang, Elvis Yeboah-Duako, Sachin Thomas, Pubali Datta · CPS & IoT Security
In short: Across 61,500 abandoned Android apps for IoT devices, many keep sending data to expired or vulnerable domains.
When a vendor stops supporting a device, the app controlling it often stays installed and working with no updates. The authors analyse 61,500 IoT apps not updated for at least two years or out of service. They find libraries with CVEs disclosed after abandonment, domains that can be taken over to receive the data, and trackers that keep collecting user data and device telemetry.
Why it matters. Home cameras, locks and sensors stay in use years after support ends: assessing their risk means considering the vendor's lifecycle too.
Trends of the month
Hardware & Side Channels
54 papers this month on this topic
Physical attacks are hitting newly standardised post-quantum algorithms. Masked ML-KEM and Classic McEliece fall to a few power traces, NIST's Hash-DRBG generator proves vulnerable for the first time and a laser faults registers in 8 nm chips. Masking and miniaturisation alone are not enough.
Papers cited:
- How Strong is the FO-Calypse, Really? Instantiating Plaintext-Checking Oracles against Masked Software Implementations of ML-KEM
- Key-Recovery Side-Channel Attack on the Berlekamp-Massey Decoding Algorithm in the Classic McEliece KEM
- The σ0 Side Channel: Single-Trace State Recovery from NIST SP 800-90A Hash-DRBG
- Faulting an 8 nm FinFET technology SoC using Photon Emission Microscopy-assisted LFI
Identity & Authentication
89 papers this month on this topic
Credentials remain the main target and theft channels are multiplying. Smart glasses film typed passwords, infostealers harvest logins to public bodies and universities amid wide password reuse, and shared compression in SSH exposes secrets across channels. Passkeys and passwordless authentication remove much of this risk.
Papers cited:
- Watch and Crack: Password Inference from Smart-Glasses Video
- A Data-Driven Analysis of Infostealer Malware Victims
- Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels
AI & LLM Security
544 papers this month on this topic
With 544 of 2,313 papers, AI security remains the top theme. Agents carry out effects that human approval does not record, and those operating smartphones send whatever appears on screen to the cloud and build user profiles from it. Human checks and data limits must be designed around what the agent actually does.
Papers cited:
- Agent Approval Laundering: Transitive Effects Beyond the Approved Invocation
- PriMobiBench: Characterizing Visual Privacy Leakage in VLM-Driven Mobile GUI Agents
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 2313.