Java Card Tutorial: Implementing Supplementary Security Domain to Limit ISD Privileges
A new technical tutorial explains how to create a Supplementary Security Domain (SSD) on Java Card platforms, addressing the risk that full Issuer Security Domain (ISD) keys grant unrestricted control over the entire card.
The architecture places the SSD between the applet and the ISD. The ISD continues to manage card contents but loses direct interaction with the applet, which is now handled exclusively by the SSD. This design ensures that even if an attacker obtains SSD keys, privileges remain strictly limited.
The process begins with installation of the SSD instance from the package AID A0000001515350 and module AID A000000151535041. Install parameters include the tag 8102 0255 for SCP02 with configuration i=55 and the tag 8201 20 to accept extradition only from the ISD. The privilege byte is set to 80 for Security Domain rights.
After installation the domain reaches the SELECTABLE lifecycle state. Personalization follows with the INSTALL [for personalization] command and subsequent STORE DATA operations that deliver encrypted ENC, MAC and DEK keys along with their key check values, all formatted according to GP CS v2.3 section 11.11.4.
Once the SSD is in the PERSONALIZED state, an applet is installed under the ISD and then moved to the SSD using the INSTALL [for extradition] command. The resulting hierarchy shows the applet parent changed to the new SSD AID while the original package relationships remain intact.
The tutorial provides five Python scripts based on the FunGP library that automate reader initialization, mutual authentication over SCP02, SSD creation, key loading, and applet extradition, offering a reproducible reference implementation for developers working with GlobalPlatform-compliant smart cards.
Related articles
How to Properly Compare CDNs: TTFB, p95 Latency, Caching, DDoS Protection and True Pricing
Selecting a CDN based solely on the number of points of presence is as unreliable as choosing a car by dashboard buttons. Networks with dozens of global PoPs may underperform for audiences concentrated in Novosibirsk or Yekaterinburg, while smaller regional providers often deliver superior peering with Russian operators. The article evaluates CDNVideo, EdgeCenter, Curator, NGENIX and Yandex Cloud CDN across verifiable features, network design, caching behavior, security controls, operations and commercial models. Performance data is separated because marketing claims cannot substitute for independent measurements from services such as CDNMON. Emphasis is placed on p95 metrics, cache hit ratios, origin shielding, raw logs and API limits rather than marketing scores. The analysis shows that no single universal ranking exists; optimal choice depends on traffic profile, audience geography, security requirements and operational workflows.
Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios
Innostage researchers conducted extensive performance testing of PT NGFW version 1.10.3, the certified release at the time of trials. The evaluation covered TCP connection setup rates, concurrent session capacity, and throughput on a custom EMIX traffic profile with varying security modules enabled. Tests used Cisco TRex generators and a high-rule-count policy of 100,000 entries to simulate realistic enterprise conditions. Results showed the device sustaining 700,000 CPS and 6.4 million concurrent connections, matching or approaching vendor claims under HA-cluster configuration. Throughput remained above 27 Gbps even with IPS, application control, antivirus, NAT, URL filtering, and logging active. The report highlights differences in test methodology compared with vendor figures, including packet sizes and clustering setup.
Linus Torvalds Embraces Generative AI for Coding After Initial Skepticism
Linus Torvalds has publicly shared his evolving views on generative AI tools for programming during the Open Source Summit Europe. The Linux creator noted that AI assistance makes small personal projects more enjoyable by accelerating the path from idea to working result. He described using an AI model to modernize the outdated C-based user interface of a custom guitar pedal project. Initial AI output proved unusable until Torvalds supplied the existing implementation and clear instructions on required changes. Torvalds emphasized that AI helps newcomers achieve tangible outcomes that feel meaningful compared to professional-grade software. At the same time he urged caution when applying these tools to serious kernel development work. He also highlighted the growing burden on maintainers who must review increasing volumes of low-quality, AI-generated vulnerability reports and superficial patches.
Hacker or Engineer? Reconstructing Attack Chains in Industrial OT Networks
Positive Technologies expert Anton Kutepov presents a detailed educational scenario from the Standoff online polygon to demonstrate how security teams can trace an attack from initial perimeter compromise to unauthorized writes on a PLC. The case begins with an unexpected SCADA server command to a hydrocracking unit controller outside the maintenance window. By correlating network traffic, endpoint telemetry, authentication logs, and asset context, analysts reconstruct the full path: exploitation of a vulnerable DMZ system, lateral movement via Kerberoasting and Active Directory certificate abuse, RDP access to an engineering workstation, and finally weakening of Windows Defender on the SCADA server before issuing the control command. The analysis shows that a single permitted industrial protocol operation becomes suspicious only when placed in the context of prior defensive control changes and anomalous access routes. The article stresses that protecting OT environments requires continuous asset inventory, unified telemetry from traffic and endpoints, and pre-approved response playbooks that avoid disrupting the physical process.