ValleyRAT Malware Identified by Delphos Labs

𝗦𝗵𝗶𝗽𝗽𝗶𝗻𝗴 𝘃𝟭.𝟬.𝟬 𝗼𝗳 𝗣𝗵𝗼𝗲𝗻𝗶𝘅 𝗦𝗗𝗥/𝗗𝗦𝗣 — 𝗣𝗼𝘀𝘁-𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗖𝗿𝘆𝗽𝘁𝗼𝗴𝗿𝗮𝗽𝗵𝘆 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝗯𝗶𝘁-𝗲𝘅𝗮𝗰𝘁 𝗼𝗻 𝗮𝗻 𝗔𝗠𝗗 𝗥𝘆𝘇𝗲𝗻 𝗔𝗜 𝗡𝗣𝗨. Today I tagged v1.0.0 of an open-source project I've been building: a signal-processing and cryptography kernel library that dispatches to the AMD Ryzen "Phoenix" NPU (the AI accelerator in the 7040/8040-series laptops). The v1.0.0 release closes the Post-Quantum Cryptography track: • FIPS 203 ML-KEM (the successor to Kyber) — NTT over Z_3329, Keccak-f 1600, K-PKE, and the full ML-KEM-{512, 768, 1024} KeyGen / Encaps / Decaps composer • FIPS 204 ML-DSA (the successor to Dilithium) — NTT over Z_8380417, rounding + hint arithmetic, and the ML-DSA-{44, 65, 87} KeyGen / Sign / Verify composer including 72 must-reject tampered-signature cases Every composer is validated bit-exact against the official NIST ACVP-Server known-answer test vectors. 34 tests, 34 pass, in 38 seconds on a fresh clone. Why this is interesting: The Phoenix NPU is marketed for AI inference. It turns out its AIE-ML tile array (4×5 topology, per the mainline Linux kernel driver) is very good at the polynomial-ring arithmetic that dominates lattice-based cryptography — the NTTs at the core of ML-KEM and ML-DSA map naturally onto vector tile pipelines. 𝗖𝗼𝗻𝘀𝘂𝗺𝗲𝗿 𝗹𝗮𝗽𝘁𝗼𝗽𝘀 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗵𝗮𝘃𝗲 𝗵𝗮𝗿𝗱𝘄𝗮𝗿𝗲 𝘁𝗵𝗮𝘁 𝗰𝗮𝗻 𝗮𝗰𝗰𝗲𝗹𝗲𝗿𝗮𝘁𝗲 𝗽𝗼𝘀𝘁-𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗰𝗿𝘆𝗽𝘁𝗼; 𝗶𝘁 𝗷𝘂𝘀𝘁 𝗶𝘀𝗻'𝘁 𝗯𝗲𝗶𝗻𝗴 𝘂𝘀𝗲𝗱 𝘁𝗵𝗮𝘁 𝘄𝗮𝘆 𝘆𝗲𝘁. Open source, reproducible. Three commands on a Ryzen Phoenix laptop take you from git clone to 34/34 PASS. Every claim in the repo cites its source — FIPS 203, FIPS 204, FIPS 202, NIST ACVP-Server, pq-crystals, kyber-py, dilithium-py. Repo + release notes: https://lnkd.in/dVncuqfN Built with AMD XDNA / Xilinx MLIR-AIE + LLVM Peano. Standards references linked in the release. Contributions and issues welcome. #PostQuantumCryptography #AMD #NPU #OpenSource #FIPS203 #FIPS204 #SDR #DSP #Cryptography #EmbeddedSystems

An AI agent that can only talk is a demo. An agent that can act, by querying production data or signing a transaction, is a product. Acting requires credentials. Handing credentials to an autonomous agent running on somebody else's infrastructure is the largest unsolved risk in the agent economy. Every option today asks you to trust an operator. Hosted tool gateways keep your keys on a vendor's servers. Self-hosting means you now run security infrastructure. Raw keys in agent memory is the default, and the reason keys leak constantly. Sentinel replaces that trust with hardware. Agent tools run inside AMD SEV-SNP confidential enclaves. Credentials are released only to an enclave that has cryptographically proved which code it is running. Every response carries an attestation anyone can verify against AMD's root of trust. The operator cannot see the queries, the credentials, or the results. You are not trusting our policy. You are checking a signature from the processor. It runs as a subnet on Bittensor, so this is a decentralised, incentivised network of attested tool servers rather than one company's service. Live on testnet as netuid 554. Open the site and there is a real attestation report from an AMD EPYC chip on it. Your browser checks the signature. There is a button to change one byte and watch the same check fail. Trust the silicon, not the vendor. #confidentialcomputing #AIagents #bittensor

📱 Porting your constant-time crypto test to a phone? That green "PASS" can be a dangerous illusion. Constant-time validation tools (dudect and friends) were built for the predictable silicon of servers. Cross-compile them for ARM/Android, and the platform quietly blinds them. The test returns a confident "no leak" while a real timing difference sails straight through. To prove it, I planted a known 2.8 ns leak on a Pixel 8 Pro. A naive on-device test never saw it. Three reasons the measurement (not the crypto) fails: ⏱️ Quantised clock. The user-space timer ticks in ~40.7 ns steps. A 2 ns leak is smaller than one tick, so most samples read identical, and a tie-mishandling statistic turns that into a phantom leak that was never there. ⚙️  Compiler hoisting. To average, you loop the call millions of times. LLVM notices the inputs don't change and lifts it clean out of the loop (LICM). You end up timing an empty loop. 📉 A statistical floor, not a hardware one. Batch hard enough and you can "detect 0.17 ns". However, that is the sensitivity floor of your test, not the silicon's resolution. The uncomfortable part is not a leak. It is how easily you get a scientifically convincing answer to the wrong question. It is exactly where a growing share of the world's cryptography now runs. A "no leakage detected" on a stock phone is only as trustworthy as the measurement underneath it. Fixing that means anchoring the test to the silicon: tie-aware statistics, pinned cores, a locked governor, and compiler barriers you have verified in the disassembly (on Clang, a memory barrier alone won't do it). Full deep-dive with links in comments. #MobileSecurity #SideChannel #Cryptography #AppSec #ConstantTime

For those who are bored with everything being about that topic (yes, that one), here’s a proposal to learn something new, and at the same time, something essential: how does a CPU actually work? In John Arundel Welcome to the Machine (https://lnkd.in/dAjepZS2), we start implementing an emulator for a CPU that… never existed (in fact, it’s part of the RX82 computer that never existed either 💙). The article presents a series of challenges for the reader to work through in Rust or Go, with a TypeScript version by yours truly as well.

Encryption is not one control. TLS protects data in transit. Storage encryption protects it at rest. During inference, however, a conventional compute environment needs access to the data in usable form. That creates a different exposure: data in use. Confidential computing addresses this layer by isolating computation inside a hardware-backed Trusted Execution Environment. For supported workloads, Enclave42 runs inference inside Intel TDX trust domains on NVIDIA GPUs and provides attestation evidence that customers can verify independently. This evidence can help assess the execution environment and bind the encryption key to a specific runtime instance. * It does not turn the full customer-to-TEE path into end-to-end encryption. * It does not prove physical location. * It does not assess what application code does once data is available inside the enclave. “Encrypted” is therefore not a complete security statement. Better questions are: — encrypted in which state? — protected against which threat? — independently verifiable how? Explore confidential and verifiable inference: https://lnkd.in/dpv32J_7 #ConfidentialComputing #DataSecurity #AIInfrastructure #EnterpriseAI #DubaiAI #Enclave42

your llm proxy might be leaking the keys it was supposed to protect. two reproducible credential leaks in LiteLLM and NVIDIA Switchyard, with wire evidence. https://lnkd.in/guhcCiMX

For GPU containers, the NVIDIA Container Toolkit is mandatory. It's also highly privileged and with five critical or high vulnerabilities in under two years - needs some watching... You cannot uninstall it and you cannot patch your way out of it. So we pulled it apart in the lab to see what actually runs. One [docker run --gpus all] produced six root executions on the host, before the workload's first instruction. Our new approach to catching Toolkit compromise is in the writeup, along with the challenges we hit getting there. Worth a look if you own detection content for this: you may want to check which binaries yours keys on. Ours found the obvious (legacy) candidates never executed at all. https://lnkd.in/eXf9_Uj2

One "docker run --gpus all" executes six binaries as root on your host before your container's entrypoint runs. They're NVIDIA Container Toolkit hooks: device nodes, driver libraries, ldcache. Privileged by necessity, short-lived, and almost entirely uninstrumented. The obvious detection is "alert when a hook executes." It's wrong. Hundreds of legitimate alerts an hour, muted inside a week, and a muted rule is a blind spot with a green checkmark on it. We alert on deviation instead: an injected linker variable in the hook's own environment, a binary outside the toolkit's install directories, or no container runtime anywhere in the hook's process ancestry. Checkout our latest extended research 👇

Cryptography is everywhere, and it's shaping trust as we head further into Agentic AI and Quantum. When we say 'everywhere', did you know there's even cryptography all the way down to the silicon layers on all your devices and end-points? Take a look at this new blog from Keyfactor and Intel about cryptography at the PC Endpoint - and how it's a critical component of a holistic post-quantum migration roadmap. Special thanks to Intel and Steve Orrin for their key insights! https://lnkd.in/erUiBFBu

Qualcomm IPQ Crash Dump：真正有價值的不是「當機了」，而是留下足夠的證據 ⠀ 最近在整理 IPQ807x／IPQ807xA／IPQ817x／IPQ60xx 的 crash dump 機制。系統發生 crash 或 hang 後，TrustZone 會準備 dump table，而 kernel 透過 IMEM 中的 magic number 留下異常重啟線索；下一次開機時，U-Boot 會據此判斷是否需要啟動 crash dump collection。 ⠀ 預設可以收集完整 DDR，但實務上也能在 U-Boot 的 dumpinfo structure 中指定特定 memory region。這一點很重要，因為完整 dump 雖然資訊最多，但同時也增加儲存、傳輸與分析成本；選對 region，反而能讓 debug workflow 更有效率。 ⠀ 我的 takeaway 是：crash handling 不只是「reboot recovery」，而是一套跨 kernel、IMEM、TrustZone、U-Boot 與後端分析流程的設計。真正成熟的 embedded system，必須在系統倒下時，仍然能留下足夠資訊讓工程師重建現場。 ⠀ Qualcomm IPQ Crash Dump: The Real Value Is Preserving Enough Evidence After a Failure ⠀ I recently reviewed the crash dump mechanism used on IPQ807x/IPQ807xA/IPQ817x/IPQ60xx platforms. When a crash or hang occurs, TrustZone prepares a dump table, while the kernel uses a magic number in IMEM to indicate whether the previous shutdown completed normally. On the next boot, U-Boot checks this state and can initiate crash dump collection. ⠀ The default collection can include full DDR, but the dumpinfo structure in U-Boot can also be customized to capture only selected memory regions. This matters in practice because a full dump provides maximum visibility, but also increases storage, transfer, and analysis overhead. Choosing the right regions can make the debugging workflow much more efficient. ⠀ My takeaway: crash handling is not just about reboot recovery. It is a coordinated flow across the kernel, IMEM, TrustZone, U-Boot, and post-processing tools. A robust embedded system should not only recover from failure—it should preserve enough evidence to reconstruct what happened. ⠀ #Qualcomm #IPQ #CrashDump #UBoot #TrustZone #EmbeddedLinux #BSP #FirmwareEngineering #KernelDebugging #SystemDebugging #PostMortemDebugging #EmbeddedSystems #SystemIntegration