December 2018 - nexa - server-nexa.polito.it

US Weapons Systems Are Easy Cyberattack Targets, New Report Finds

by Alberto Cammozzo

lo stesso approccio alla sicurezza dell'IOT, salvo che le "cose" sono armi... Dal rapporto originale: [] Many weapon systems use such systems to carry out essential functions. For example, a ship may use industrial control systems to control engines and fire suppression systems. According to NIST, industrial control systems were originally designed for use in trusted environments, so many did not incorporate security controls. 34 Government and industry reports state that attacks on these systems are increasing. However, DOD officials said that program offices may not know which industrial control systems are embedded in their weapons or what the security implications of using them are. [] <https://www.wired.com/story/us-weapons-systems-easy-cyberattack-targets/> The first step in solving any problem is admitting there is one. But a new report <https://www.gao.gov/products/GAO-19-128> from the US Government Accountability Office finds that the Department of Defense <https://www.wired.com/story/why-big-tech-and-the-government-need-to-work-to…> remains in denial about cybersecurity threats to its weapons systems. Specifically, the report concludes that almost all weapons that the DOD tested between 2012 and 2017 have “mission critical” cyber vulnerabilities. “Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications,” the report states. And yet, perhaps more alarmingly, the officials who oversee those systems appeared dismissive of the results. The GAO released its report Tuesday, in response to a request from the Senate Armed Services Committee ahead of a planned $1.66 trillion in spending by the Defense Department to develop its current weapons systems. Subtitled "DOD Just Beginning to Grapple with Scale of Vulnerabilities," the report finds that the department "likely has an entire generation of systems that were designed and built without adequately considering cybersecurity." Neither Armed Services Committee chairman James Inhofe nor ranking member Jack Reed responded to requests for comment. The GAO based its report on penetration tests the DOD itself undertook, as well as interviews with officials at various DOD offices. Its findings should be a wakeup call for the Defense Department, which the GAO describes as only now beginning to grapple with the importance of cybersecurity, and the scale of vulnerabilities in its weapons systems. “I will say that the GAO can be prone to cyber hyperbole, but unless their sampling or methodology were way off or deliberately misleading, DOD has a very grave problem on its hands,” says R. David Edelman, who served as special assistant to President Obama on cybersecurity and tech policy. “In the private sector, this is the sort of report that would put the CEO on death watch.” DOD testers found significant vulnerabilities in the department’s weapon systems, some of which began with poor basic password security or lack of encryption. As previous hacks of government systems, like the breach at the Office of Personnel Management <https://www.wired.com/2016/10/inside-cyberattack-shocked-us-government/> or the breach of the DOD’s unclassified email server <https://www.cnn.com/2018/09/17/politics/state-department-email-breach/index…>, have taught us, poor basic security hygiene can be the downfall of otherwise complex systems. "In the private sector, this is the sort of report that would put the CEO on death watch." R. David Edelman, former White House cybersecurity adviser The GAO report says that one tester was able to guess an admin password on a weapons system in nine seconds. Other weapons used commercial or open source software but administers failed to change the default passwords. Yet another tester managed to partially shut down a weapons system by merely scanning it—a technique so basic, the GAO says, it “requires little knowledge or expertise.” Testers were sometimes able to take full control of these weapons. “In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing,” the report states. The DOD also had a hard time detecting when testers were probing the weapons. In one case, testers were in the weapons system for weeks, according to the GAO, but the administrators never found them. This, despite the testers being intentionally “noisy.” In other cases, the report states that automated systems did detect the testers, but that the humans responsible for monitoring those systems didn’t understand what the intrusion technology was trying to tell them. [...]

Dec. 14, 2018

"Legacy Copyright Industries Lobbying Hard For EU Copyright Directive... While Pretending That Only Google Is Lobbying"

by J.C. DE MARTIN

Legacy Copyright Industries Lobbying Hard For EU Copyright Directive... While Pretending That Only Google Is Lobbying Have you heard that all of the opposition to the EU Copyright Directive and its hugely problematic Articles 11 and 13 is really being driven by Google lobbying? Most of you probably realized this was nonsense, but it now turns out that not only was the lobbying almost entirely dominated by the legacy copyright players, but *a key plank of their lobbying campaign was to falsely allege that all opposition was just Google*. If you've been paying attention at all to the crazy fights over the EU Copyright Directive <https://www.techdirt.com/blog/?tag=eu+copyright+directive>, you may have heard some claims being passed around that it's somehow "Google" lobbying heavily against the bill. Indeed, all over Twitter, that's the talking point from tons of EU Copyright Directive supporters. After the EU Parliament put the brakes on the bill back in July, I even saw a former RIAA exec (who has since blocked me on Twitter, so I can't show it to you) tweet that this was a clear perversion of the "will of the people" by Google's corporate lobbying. Of course, it's *hilarious* for that to come from an ex-RIAA exec, who was heavily involved over the past 3 decades in pushing through all sorts of protectionist, anti-public, anti-musician legislation and trade agreements. continua qui: https://www.techdirt.com/articles/20181212/07074641205/legacy-copyright-ind…

Dec. 14, 2018

Fwd: Corte Ue: per l'Avvocato generale, non si può inserire in una composizione musicale un breve brano (sampling) di una precedente composizione senza l'autorizzazione dell'autore di quest'ultima (CONCL C-476/17)

by Marco Ciurcina

FYI m.c. <snip> L’avvocato generale Szpunar propone alla Corte di dichiarare che il sampling costituisce una lesione dei diritti del produttore di un fonogramma qualora esso venga realizzato senza la sua autorizzazione (Conclusioni dell’avvocato generale nella causa C‑476/17, Pelham GmbH, Moses Pelham, Martin Haas / Ralf Hütter, Florian Schneider-Esleben) Immagini della lettura delle conclusioni sono disponibili su « Europe by Satellite<http://ec.europa.eu/avservices/ebs/schedule.cfm?page=1>» ( (+32) 2 2964106 In allegato il comunicato stampa in italiano. </snip>

Dec. 12, 2018

Congresswoman to Google CEO: Why when I search ‘idiot’ do I get pictures of Trump? - The Washington Post

by Alberto Cammozzo

<https://www.washingtonpost.com/politics/2018/12/11/congresswoman-google-ceo…> In an effort to understand how Google search algorithms work, a Democratic congresswoman asked the tech company’s chief executive a simple question: “If you Google the word ‘idiot' under images, a picture of Donald Trump comes up. How would that happen? How does search work so that that would occur?” In the middle of a congressional hearing ostensibly about privacy and data collection, Rep. Zoe Lofgren (D-Calif.) seemed to perform that search from the dais. As it turns out, the image results for “idiot” does reveal a page of mostly Trump photos. [...]

Dec. 12, 2018

Universal income vs. the robots: Meet the presidential candidate fighting automation

by Enrico Nardelli

https://www.technologyreview.com/s/612558/universal-income-vs-the-robots-me… -- EN ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it home page: http://www.mat.uniroma2.it/~nardelli blog: http://www.ilfattoquotidiano.it/blog/enardelli/ http://link-and-think.blogspot.it/ ===================================================================== --

Dec. 11, 2018

Report on the state of the art on algorithmic decision making

by Luigi Scorca

Here you find the preliminary report of the EC consultants on the state of the art on algorithmic decision making: https://www.algoaware.eu/state-of-the-art-report/

Dec. 11, 2018

Re: [nexa] Jurix 2018 (proceedings)

by Diego Giorio

Eccezionale, e pure gratis! Grazie mille, come sempre, al prof. Pagallo Saluti a tutti D. ________________________________ From: nexa <nexa-bounces(a)server-nexa.polito.it> on behalf of Ugo Pagallo <ugo.pagallo(a)unito.it> Sent: Monday, December 10, 2018 2:39 PM To: NEXA_lista Subject: [nexa] Jurix 2018 (proceedings) Per chi fosse interessato, trova qui http://ebooks.iospress.nl/ISBN/978-1-61499-935-5 il link al PDF di Jurix 2018 http://jurix2018.ai.rug.nl/index.html#home Nel volume, insieme a Eleonora Bassi, Massimo Durante e Marco Crepaldi, mi sono occupato di uno dei temi discussi in lista ultimamente, ossia blockchain e il diritto alla cancellazione dei dati ex Art. 17 GDPR. Cheers, u.p. _______________________________________________ nexa mailing list nexa(a)server-nexa.polito.it https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Dec. 11, 2018

Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret - The New York Times

by J.C. DE MARTIN

https://www.nytimes.com/interactive/2018/12/10/business/location-data-priva… Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret Dozens of companies use smartphone locations to help advertisers and even hedge funds. They say it’s anonymous, but the data shows how personal it is. (Sent from my wireless device; please excuse brevity and typos (if any))

Dec. 11, 2018

Re: [nexa] Australia passes new law to thwart strong encryption

by Stefano Zacchiroli

On Mon, Dec 10, 2018 at 09:31:29PM +0000, Giacomo wrote: > Stefano il tuo riferimento a Debian mi fa pensare se distribuire solo > software in formato sorgente non possa mitigare fortemente i rischi di > manomissione. > > Naturalmente con il software attuale questo comporterebbe un notevole > incremento del tempo di installazione (e probabilmente anche un costo > energetico/ecologico maggiore visto che la compilazione verrebbe > effettuata ad ogni installazione). A mio avviso esiste un best of both worlds: ovvero build riproducibili byte-by-byte, nel senso di https://reproducible-builds.org/ Così hai i sorgenti (per audit pubblico) e puoi anche con una certa fiducia usare binari precompilati, basandoti sull'ipotesi che un certo numero di persone nella tua comunità di riferimento (o anche progetti di audit indipendenti) facciano l'esercizio di ricompilare/verificare, ed eventualmente fare un gran casino quando c'è un mismatch. Molte distribuzioni e package manager ci stanno lavorando da un po' di anni, con ottimi risultati. (Disclaimer: sono nello steering committee di reproducible-builds.org, e quindi decisamente di parte.) -- Stefano Zacchiroli . zack(a)upsilon.cc . upsilon.cc/zack . . o . . . o . o Computer Science Professor . CTO Software Heritage . . . . . o . . . o o Former Debian Project Leader & OSI Board Director . . . o o o . . . o . « the first rule of tautology club is the first rule of tautology club »

Dec. 10, 2018

Re: [nexa] Australia passes new law to thwart strong encryption

by Giacomo

Stefano il tuo riferimento a Debian mi fa pensare se distribuire solo software in formato sorgente non possa mitigare fortemente i rischi di manomissione. Naturalmente con il software attuale questo comporterebbe un notevole incremento del tempo di installazione (e probabilmente anche un costo energetico/ecologico maggiore visto che la compilazione verrebbe effettuata ad ogni installazione). D'altro canto, cosa succederebbe se il governo Australiano inviasse un ordine di manomettere il repository di Debian al ftp master? Giacomo

Dec. 10, 2018