CONNECT WITH US
Tuesday 1 July 2025
System cybersecurity and code storage flash technology
This article outlines the various code storage flash technologies used today and their contribution to platform cybersecurity and resiliency. It also outlines the minimal set of requirements to meet the demands of cyber protection in 2025 and beyond.Non-volatile storage media contain all the essential platform assets. The platform code, operational data, user data, and various states of the platform. For that reason, the content of the non-volatile storage is considered to be the most vulnerable to cyberattacks. Such attacks may try to extract user data (privacy), platform or network data (stability and resiliency) or modify the platform code as an extended attack vector for more complex attacks.Previously, standalone devices with no network connectivity were common, requiring attackers to have physical access to compromise system code. Such equipment had to be physically manipulated in order to gain access to the content of the non-volatile (NVM) storage. In those platforms, we would have one of three possible configurations for the non-volatile storage:*Embedded flash - where the NVM would be part of the controller silicon*External flash - where the NVM would reside side by side with the controller device*Multi-Chip-Module (MCM) - where the NVM die would be placed in the same plastic package as the controllerEach of these configurations would have its pros and cons. The embedded NVM would be the most secure, as it could be made almost impossible for an attacker to probe and access the embedded NVM portion of the silicon die. However, embedded flash does not allow easy expansion in storage capacity, and is not available in advanced manufacturing processesThe external flash would prove to be the easiest to attack. Connecting simple bus "sniffing" equipment to the flash would allow an attacker to extract information, modify code and perform any other actions required to compromise the platform and its data.Unauthorized NVM Access & Bus SniffingThe MCM approach seems to have the benefit of limited physical access to the NVM Flash device, while offering better cost structure. However, it is fairly easy today to decap (open) any chip package and access internal connecting signals, making the MCM approach nearly as (non) secure as the external flash configuration.MCMIn order to mitigate attacks on NVM, a special type of flash was developed, called "Secure Flash" where the interface signals between the controller and flash are encrypted. This prevents the traditional probing attacks from being successful.Secure flashWith modern devices increasingly connected to networks, security risks have expanded beyond physical threats to remote cyberattacks. All the above attacks required physical access to the attacked platform because of no networking connectivity. This rather limited the scope of such attacks. However, most of the platforms today, regardless of their functions, become network-connected. This trend is driven by a few key concepts:*Extended functionality (by using network resources)*Ease of use*Remote management and information/statistics collection*Frequent, automatic firmware updates*Easier deployment and life cycle controlThe key driver for network connectivity is remote firmware update. This is mandated by all the latest standards and regulations, such as EU RED EN18031, US CNSA2.0, and the coming EU Cyber Resiliency Act. It is well understood today that orderly firmware updates are a must in order to keep systems resilient and protected, and their users safe.Making platforms network-connected and set up for automatic remote system updates opens up a whole new landscape of potential security attacks. This makes the physical protection, mentioned here before, an outdated issue in most cases, with the exception being open-loop financial transactions and ID cards (such as passports).Modern platforms must be protected from a completely different set of threats:*Unprotected and outdated updates - attempt to force a platform to revert to an older version of its software with known vulnerabilities or lack critical security features, making them easier for attackers to exploit.*Supply chain attacks - attempt to insert Trojan hardware or install malicious software at some point within the manufacturing, transportation, or distribution of platforms.*Storage breeching (keys, user data, credentials theft) - unauthorized access or compromise of stored sensitive information.*Threats to the resiliency of the platforms - attempt to infect systems with malicious code, exploit vulnerabilities in platform firmware, or make the platform unavailable by destroying critical data in NVM.It is well understood that large-scale attacks can be leased upon millions of devices without a need to physically access any of them. It is thus required to implement protection mechanisms against such potential attacks.Firmware update protection - latest standards call for protection of firmware updates in terms of integrity, authenticity, and freshness, allowing only a complete, signed, and newer version of firmware to replace an existing version. Moreover, the cryptographic signature mechanisms to be used must be quantum-safe, meaning algorithms developed to resist being attacked by quantum computers.Supply chain protection - this topic is at the top of the list for potential large-scale attacks published by EU ENISA in 2024. Due to the distributed nature of supply chains used in the production of electronic equipment, it is relatively easy for rogue players to replace key components such as the NVM devices and basic firmware code with devices and code that include malicious capabilities. These capabilities can then be employed to unleash a large-scale attack on infrastructure.Storage protection - if a platform is allowed to access any information in the NVM at any time, a rogue piece of code, even temporarily loaded into memory, can scan the NVM and access secret or sensitive data, transmit it back to the attacker, and even modify this data. It is essential to maintain privileged access restrictions on such data in the non-volatile memory.Platform resiliency - as more and more platforms become online and network-connected, it is essential to ensure they are kept in correct working order or otherwise gracefully brought down to ensure no harm is done if they are somehow compromised. To facilitate this, strong internal diagnostics of the NVM content (code and data) are required, and in the case of some malfunction, allow the platform to either fix the problem or go offline and shut itself down. Platform firmware resiliency is detailed in NIST SP 800-193.Given these contemporary threats, it is clear that NVM packaging technology plays a diminished role, if any, in platform cyber protection. The focus should be on using the appropriate NVM built-in security capabilities and configurations to minimize and eliminate these threats.The Winbond W77Q Secure Flash is introduced as a robust solution to address the outlined threats. The key features of W77Q Secure Flash relevant to the document's topics include:*Code and Data Protection: robust protection for both code and data, making it exceedingly difficult for hackers to tamper. RoT implementation follows the TCG DICE attestation mechanism.*Authentication: Winbond Secure Flash devices employ stringent authentication protocols, ensuring that only authorized actors and software layers gain access. *Secure Software Updates with Rollback Protection: The devices facilitate remote secure software updates while safeguarding against rollback attacks, ensuring that only legitimate updates are executed. To maintain the highest level of security and integrity during software updates, W77Q employs Quantum-Safe Leighton-Micali Signature (LMS) algorithms, as recommended by NIST Special Publication 800-208. This method guarantees the authenticity and integrity of the updated software, thereby providing an additional layer of security for years to come.*Platform Resiliency: following NIST 800-193 recommendations, unauthorized code changes are automatically detected, enabling the system to automatically recover to a secure state and disturbing potential cyber threats.*Secure Supply Chain: The origin and integrity of flash content are guaranteed by Secure Flash at every stage of the supply chain. W77Q implements remote attestation based on LMS-OTS (NIST 800-208). This advanced approach effectively prevents content tampering and misconfiguration during platform assembly, transportation, and configuration, safeguarding against cyber adversaries.Winbond W77Q Secure Flash addresses critical security concerns discussed in the paper, providing strong protection for code and data storage while ensuring platform integrity, resiliency, and compliance with emerging cybersecurity frameworks.For more information on how Winbond can support your security and compliance needs, visit Winbond's website or contact Winbond directly, or download the latest Hardware Security White Paper.
Tuesday 1 July 2025
Bytelingo's professional services redefine AI translation, attracting engagement from publicly traded companies
Despite the increasing prevalence of AI applications, the majority of free translation solutions are incapable of satisfying the specific translation needs of enterprises in professional sectors, as they are designed to address generic situational requirements. Organizations that depend on free AI translation frequently must allocate substantial human resources to review and proofread, a process that is both labor-intensive and time-consuming. This holds true when using standard financial statements or product manuals as examples.Bytelingo has acknowledged this challenge and has implemented generative AI to offer translation solutions that are exceedingly precise, particularly for professional publications like annual reports and ESG reports. As of now, Bytelingo's services have been adopted by more than 150 publicly traded companies, with a renewal rate of 90%, indicating a significant level of market confidence.Ringo Chang, founder and CEO of Bytelingo, observed that common AI translation services, including ChatGPT, often produce "highest probability" assumptions based on model algorithms when faced with numerous proper nouns and terminologies (such as full names and abbreviations of products, subsidiaries, affiliated entities, government agencies, etc.), resulting in a considerable incidence of translation errors.Conversely, Bytelingo utilizes a different technique. It initially collects and classifies clients' historical translation papers and official website data, then integrates this information with existing professional databases, including accounting subjects and global standards, to improve translation accuracy and consistency.Exclusive technology outperforms peers with annual report translation taking only 3 hoursChang, with considerable expertise in AI algorithms, acknowledged the Financial Supervisory Commission's mandate for listed companies to submit English financial statements and ESG reports, resulting in the establishment of Bytelingo in June 2022 to tackle the challenges of professional translation for corporations.Initially, Bytelingo relied on proprietary AI models. At the end of 2022, as generative AI and large language model technologies progressed rapidly, the firm modified its product development strategy, concentrating on the development of an AI translation platform based on efficient large language models accessible in the market.Currently, Bytelingo maintains comprehensive databases comprising over 30,000 entries in accounting and sustainability, along with proprietary optimization methods that provide swift access to clients' company-specific information. After completing data preparation, the capabilities of generative AI are effectively governed through its advanced RAG (Retrieval-Augmented Generation) technique, yielding more accurate and consistent translation outputs."Our service requires only one morning to finalize the data configuration, followed by merely three hours to translate the entire annual report," Chang emphasized that this efficiency substantially surpasses that of conventional manual translation, which frequently requires a month. Moreover, Bytelingo's pricing is only 50% to 70% of that of traditional translation agencies, enabling faster customer acquisition. He claimed that Bytelingo's publicly traded clients are expected to surpass 200 by the end of 2025.Full TTA support boosts global prominenceSince its inception, Bytelingo has garnered multiple honors and been selected for various startup awards and government subsidies. This includes the Taipei City Government's 2023 SITI Star investment-potential start-up team, the Ministry of Digital Affairs' Go Next Digital review award, and the endorsement from the Small and Medium Enterprise and Startup Administration of Taiwan's Ministry of Economic Affairs for entry into TAcc+.Upon becoming a TTA (Taiwan Tech Arena) team, Bytelingo received mentorship and support from the STARTUP101 accelerator, which facilitated the company's business expansion, fundraising, brand visibility, and other critical areas.Chang stated that TTA resources and initiatives have afforded Bytelingo a global perspective. During a visit by a large German media conglomerate to TTA, Bytelingo was granted the opportunity to present on stage, therefore enhancing the company's brand recognition and providing substantial benefits in following endeavors to secure venture capital funding. In the future, Bytelingo will strengthen its collaboration with TTA and accelerate its global expansion.Bytelingo is not only translating annual and ESG reports but also diversifying its applications, encompassing product catalog and technical document translation, AI conference support, and AI product introductions, to more effectively meet the complex needs of companies in cross-linguistic communications.Considering international market prospects and the mandate from Japan's financial regulatory bodies for local companies in Japan to provide English annual reports, Bytelingo will utilize its successful model from Taiwan to enter the Japanese market and exploit opportunities in the AI professional translation service industry.Bytelingo offers a variety of AI platform modules to satisfy the unique translation process requirements of businesses. Credit: Company
Monday 30 June 2025
Why age verification online is facing more scrutiny in 2025
Age checks online are now facing stronger criticism from both users and privacy advocates. As digital services expand, platforms are expected to meet higher standards for transparency and data handling. Many consumers are beginning to push back against identity checks that demand documents or personal data, especially when the process feels invasive or inconsistent. Governments, too, are reviewing how these checks are implemented and whether current systems offer real protection or just barriers to access.Users push back against unnecessary data requestsUsers are increasingly frustrated with how age checks are handled online. Many platforms ask for identity documents even when the content is low risk, creating barriers that feel unnecessary and intrusive. There is often little clarity about where this data goes or how long it is kept, leading to growing concerns around privacy and security.A clear example of shifting user sentiment can be seen in the increasing number of people seeking a casino without verification in 2025. These platforms are becoming popular not only for the entertainment they offer but also for their convenience, fast access, and strong focus on privacy. This trend reflects wider frustrations with current age-check systems across the internet, where users are often required to share documents just to view or access basic content. Many feel that such requests are unnecessary or poorly secured.Technology is both the solution and the problemAdvances in technology have made it easier for platforms to request identity confirmation. Facial recognition, document scanning, and AI-driven checks are now widely available. However, these same tools are causing concern. Users worry about how their data is stored, shared, or even sold. In many cases, platforms collect far more data than is needed for a simple age check. Once this data is held, there are questions about how long it stays on file and who has access to it.There is also growing concern around bias in automated systems. Some users report being wrongly denied access due to technical faults or mismatched results. When these systems replace human review, errors can go unchecked, leaving users locked out with no clear way to correct the problem. These frustrations are leading to renewed calls for simpler, less intrusive forms of age confirmation that don't rely on collecting personal data.Policy shifts may shape the next stepsRegulators are starting to take notice of the issue. In several countries, new rules are being proposed to limit the amount of data platforms can request. There is a strong push to make age checks clearer and easier to complete without forcing users to give up sensitive details. These changes are being driven by a wider interest in online privacy and data rights. As more people question how their information is used, lawmakers are under pressure to respond.At the same time, tech firms are testing new ways to confirm age without collecting documents. Some are working on systems that check device activity or use third-party services that don't store personal data. These developments are still in early stages but could offer a more balanced way forward. The goal is to provide access controls that work without turning every check into a privacy risk.User expectations are changing fastUsers now expect quicker access and fewer steps when visiting digital services. The old model of uploading IDs or waiting for approval feels outdated, especially for services where age is a minor factor. People are also more aware of privacy rights than in previous years, which means platforms can no longer rely on the same systems without facing pushback.Age confirmation will still be part of the online world, but the methods behind it need to shift. The focus is moving towards low-friction solutions that respect both safety and privacy. For tech firms, adapting to this shift is not only about compliance but also about staying competitive in a market where trust and ease of access are becoming key priorities.