AntiMalware•September 29, 2026•🇷🇺Translated from Russian

FAS Clears Russian Operators on 'Unlimited' Internet Claims Despite Speed Throttling to 128 Kbit/s

The Federal Antimonopoly Service has decided not to pursue complaints against Russian mobile operators over their marketing of unlimited internet and roaming access without restrictions.

The Association of Professional Users of Social Networks and Messengers filed the complaint, highlighting that operators Vimpelcom, MegaFon, MTS, and T2 Mobile advertise unlimited plans while imposing speed limits of 128-512 Kbit/s once initial high-speed traffic volumes are exhausted. Additional data packages must sometimes be purchased to restore normal speeds, although the connection itself is never fully disconnected.

According to the association, this practice turns activities such as video streaming, file downloads, and access to many websites into slow, frustrating experiences resembling a meditation session with a progress bar. Operators defend the use of the term unlimited by noting the absence of any overall data volume cap; only connection speed changes, with all conditions clearly stated in service descriptions.

T2 Mobile specifically stated that 128 Kbit/s remains sufficient for messaging apps and social networks. The complainants reject the FAS position and plan to seek a substantive review of the matter.

Legal experts point out that the service examined only pages containing technical parameters, while the original complaint also covered banners, promotional news items, search advertising, SMS messages, and push notifications. These additional materials could potentially qualify as advertising under Russian law, yet they received no separate assessment.

As a result, the label unlimited continues to apply even when speeds drop to near-obsolete levels, provided the connection remains technically active. Whether such access meets practical user needs appears to remain a secondary consideration for regulators.

Related articles

BoletimSec•Policy & Regulation

Anthropic Model Reconstructs NSA Seeds for NIST Elliptic Curves in Under 30 Minutes

An internal Anthropic research model traced the origins of the five seeds used by the NSA to generate the NIST elliptic curves P-192, P-224, P-256, P-384, and P-521. The discovery resolves a 25-year-old question that arose when the curves were standardized in FIPS 186-2 for ECDSA in 2000. Researchers combined analysis of 1990s random number generators, 34 generator-output combinations, and lattice reduction techniques to identify lrand48 initialized with Unix timestamps from May 1997 to April 1998. The P-256 seed corresponds to the 1842nd candidate from a run started on 16 August 1997, and example seeds from ANSI X9.62 follow the same pattern. The work does not demonstrate any cryptographic break or backdoor in the curves and does not recommend changes to production systems. Several questions remain open, including the seed for curve B-163 and the reason certain candidate values were discarded.

AntiMalware•Policy & Regulation

Bitget Bans Residents of Russia, Kazakhstan and Belarus, Sets Strict Deadlines for Position Closure and Asset Withdrawal

Cryptocurrency exchange Bitget has updated its user agreement to prohibit residents of Russia, Kazakhstan and Belarus from using its services. The changes took effect on 16 October, with affected users receiving individual notifications via email, the mobile app and push alerts. New trading, orders and subscriptions were disabled at 10:00 Moscow time on 18 October. Users must close all positions and withdraw assets by 10:00 Moscow time on 21 October, after which remaining positions will be liquidated automatically and account access will be restricted. The exchange has not disclosed the specific reason for the decision in its public statement. The move underscores how access to crypto platforms can be terminated by changes in terms of service rather than technical issues or user credentials.

Habr•Policy & Regulation

Encrypt Don't Trust: Securing Palm Vein Biometrics from Sensor to Access Control Server

An in-depth technical analysis explores how to protect palm vein biometric data in access control systems using a security-by-design approach. The article emphasizes that biometric templates cannot be changed like passwords, making robust protection essential against physical theft, insider threats, and presentation attacks. It details the application of Zero Trust principles, minimizing the Trusted Computing Base, and implementing hardware roots of trust such as Secure Boot and encrypted non-volatile memory. Russian regulatory requirements including 152-FZ, Government Decree No. 1119 for data protection levels, FSTEC Order No. 21, and FSB Order No. 378 are mapped directly to technical controls like mTLS, OSDP v2.2, and liveness detection. Threat actor profiles ranging from external attackers to privileged insiders are analyzed with specific countermeasures for each segment of the data path. The piece concludes that trust must be compressed to the hardware root, server room, and dual-operator registration process while everything else relies on verifiable cryptography and auditing.

Habr•Policy & Regulation

25-Year Mystery Solved: NIST Elliptic Curve Seeds Came from lrand48 and Unix Timestamps

Researchers at Anthropic used the Claude model to trace the origins of the mysterious seed values embedded in NIST elliptic curves standardized in FIPS 186-2. The seeds for curves including NIST P-192, P-224, P-256, P-384 and P-521 were not derived from hashed humorous phrases as previously rumored but instead generated by the non-cryptographic lrand48 linear congruential generator seeded with Unix timestamps from 1997 and 1998. The discovery also explains the base points of several curves using the FreeLIP library's random number generator. The findings reduce long-standing suspicions of deliberate backdoors inserted by the NSA. Several candidate curves that met the criteria were skipped during selection, leaving open questions about the exact filtering process. The work was performed by a team including Nicholas Carlini and others, with the reproduction code released into the public domain.