May 2018 - nexa - server-nexa.polito.it

Mobile Giants: Please Don’t Share the Where
by Alberto Cammozzo May 24, 2018

May 24, 2018

In seguito alla questione LocationSmart, è in evidenza il fatto che la posizione degli utenti negli USA viene venduta dei servizi telefonici. Nulla di nuovo. Qualcuno sa come siamo messi in Italia/EU? <https://krebsonsecurity.com/2018/05/mobile-giants-please-dont-share-the-whe…> Your mobile phone is giving away your approximate location all day long. This isn’t exactly a secret: It has to share this data with your mobile provider constantly to provide better call quality and to route any emergency 911 calls straight to your location. But now, the major mobile providers in the United States — AT&T, Sprint, T-Mobile and Verizon — are selling this location information to third party companies — in real time — without your consent or a court order, and with apparently zero accountability for how this data will be used, stored, shared or protected. Think about what’s at stake in a world where anyone can track your location at any time and in real-time. Right now, to be free of constant tracking the only thing you can do is remove the SIM card from your mobile device never put it back in unless you want people to know where you are. It may be tough to put a price on one’s location privacy, but here’s something of which you can be sure: The mobile carriers are selling data about where you are at any time, without your consent, to third-parties for probably far less than you might be willing to pay to secure it. The problem is that as long as anyone but the phone companies and law enforcement agencies with a valid court order can access this data, it is always going to be at extremely high risk of being hacked, stolen and misused. Consider just two recent examples. Earlier this month The New York Times reported that a little-known data broker named Securus was selling local police forces around the country the ability to look up the precise location of any cell phone across all of the major U.S. mobile networks. Then it emerged that Securus had been hacked, its database of hundreds of law enforcement officer usernames and passwords plundered. We also found out that Securus’ data was ultimately obtained from a California-based location tracking firm LocationSmart. On May 17, KrebsOnSecurity broke the news of research by Carnegie Mellon University PhD student Robert Xiao, who discovered that a LocastionSmart try-before-you-buy opt-in demo of the company’s technology was wide open — allowing real-time lookups from anyone on anyone’s mobile device — without any sort of authentication, consent or authorization. Xiao said it took him all of about 15 minutes to discover that LocationSmart’s lookup tool could be used to track the location of virtually any mobile phone user in the United States. [...]

1 0

FYI: mailing lists nuovamente online
by Giovanni Garifo May 24, 2018

May 24, 2018

A tutti gli iscritti alle mailing lists del Centro Nexa, vi informo che tutte le mailing lists ospitate dal Centro Nexa sono nuovamente online. Cordiali saluti -- Giovanni Garifo IT Manager Nexa Center for Internet & Society Politecnico di Torino - DAUIN Via Pier Carlo Boggio, 65/A - 10138 Torino w. nexa.polito.it/people/ggarifo l. linkedin.com/in/giovannigarifo

1 0

"UK.gov's use of black box algorithms to decide stuff needs watching"
by J.C. DE MARTIN May 24, 2018

May 24, 2018

*UK.gov's use of black box algorithms to decide stuff needs watching* /PS: Don't forget to try to cash in on public data – MPs/ By Rebecca Hill 23 May 2018 at 12:40 Increased use of algorithms in decision-making risks disproportionately affecting certain groups, MPs have said, urging the government to boost transparency and tackle bias - but not forget the value of public data. In a report on algorithmic decision-making, published today, the House of Commons Science and Technology Committee said the tech has the potential to improve public services and drive wider innovation in a range of sectors, from transport to healthcare. It said the data held by public authorities could be a potentially lucrative asset, urging the government to ensure it negotiates good deals for its use by private companies. However, the MPs also sounded a strong note of caution - emphasising that algorithms should not be seen as a magic formula; rather they have the potential to be biased and need to operate in a strong regulatory and ethical framework. […] Continua qui: https://www.theregister.co.uk/2018/05/23/ukgov_told_to_treat_algorithms_wit…

1 0

Doctorow: The emerging split in modern trustbusting: Alexander Hamilton’s Fully Automated Luxury Communism vs Thomas Jefferson’s Redecentralization – Boing Boing
by J.C. DE MARTIN May 24, 2018

May 24, 2018

https://boingboing.net/2018/05/22/too-big-to-fail-2.html/ The emerging split in modern trustbusting: Alexander Hamilton's Fully Automated Luxury Communism vs Thomas Jefferson's Redecentralization 2 days ago Cory Doctorow From the late 1970s on, the Chicago School economists worked with the likes of Ronald Reagan, Margaret Thatcher, Augusto Pinochet and Brian Mulroney to dismantle antitrust enforcement, declaring that the only time government should intervene is when monopolists conspired to raise prices -- everything else was fair game. Some 40 years later, a new generation of trustbusters have emerged, with their crosshairs centered on Big Tech, the first industry to grow up under these new, monopoly-friendly rules, and thus the first (but far from the only) example of an industry in which markets, finance and regulatory capture were allowed to work their magic to produce a highly concentrated sector of seemingly untame-able giants who are growing bigger by the day. The new anti-monopolism is still in its infancy but a very old division has emerged within its ranks: the Jeffersonian ideal of decentralized power (represented by trustbusters who want to break up Big Tech into small, manageable firms that are too small to crush emerging rivals or capture regulators) versus the Hamiltonian ideal of efficiency at scale, tempered by expert regulation that forces firms to behave in the public interest (with the end-game sometimes being "Fully Automated Luxury Communism" in which the central planning efficiencies of Wal-Mart and Amazon are put in the public's hands, rather than their shareholders'). (....) (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Ce la faranno i nostri eroi? http://openlettertomogherini.world/
by Roberto Dolci May 24, 2018

May 24, 2018

http://openlettertomogherini.world/

1 0

FYI: domani 24 maggio - mailing lists non raggiungibili
by Giovanni Garifo May 23, 2018

May 23, 2018

A tutti gli iscritti alle mailing lists del Centro Nexa, vi informo che domani, 24 maggio, le mailing lists ospitate presso i nostri server non saranno raggiungibili per l'intera giornata a causa di interventi tecnici. Riceverete comunicazione mediante la mailing list una volta che tutti i servizi saranno tornati online. Cordiali saluti -- Giovanni Garifo IT Manager Nexa Center for Internet & Society Politecnico di Torino - DAUIN Via Pier Carlo Boggio, 65/A - 10138 Torino w. nexa.polito.it/people/ggarifo l. linkedin.com/in/giovannigarifo

1 0

Fwd: I: EXPERT GROUP ON THE IMPACT OF THE DIGITAL TRANSFORMATION ON EU LABOUR MARKETS - CALL FOR APPLICATIONS (Deadline 4th June)
by Margot Bezzi May 23, 2018

May 23, 2018

fyi ------------------------------ *Da:* iesicommunity(a)iesi.eu <iesicommunity(a)iesi.eu> per conto di Gianluca Misuraca <gianluca.misuraca(a)ec.europa.eu> *Inviato:* martedì 22 maggio 2018 20:40 *A:* IESI Community *Oggetto:* [iesi_community] EXPERT GROUP ON THE IMPACT OF THE DIGITAL TRANSFORMATION ON EU LABOUR MARKETS - CALL FOR APPLICATIONS (Deadline 4th June) Dear colleagues, The Commission is setting up a high-level expert group (HLG) on the impact of the digital transformation on EU labour markets, in the context of its broader activities on the future of work. See https://ec.europa.eu/esf/ transnationality/content/call-applications-expert-group- impact-digital-transformation-eu-labour-markets Call for applications – Expert group on the impact of the ... <https://ec.europa.eu/esf/transnationality/content/call-applications-expert-…> ec.europa.eu Call for applications – Expert group on the impact of the digital transformation on EU labour markets - EUROPEAN SOCIAL FUND A *call for applications <http://ec.europa.eu/transparency/regexpert/index.cfm?do=calls.calls_for_app> *to select the 9 members of the expert group was published on 4 May and *applications can be submitted until 4 June 2018*. The goal of the expert group is to *analyse and advise* the Commission on the impact of the digital transformation on EU labour markets, and *explore policy options* in this regard. It will, among other things: - analyse how to shape the transformation and what framework conditions to be put in place to make it smooth and human-centric, - identify the potential social impacts (risks and opportunities) of digitalisation and artificial intelligence, - assess to what extent current systems (such as social security, tax and benefits, lifelong learning) are fit for purpose, and - make suggestions on a way forward. The expert group will report on its *analysis and findings by early 2019*. *Context* Digitalisation is transforming the world of work at unprecedented speed. Technological change has the potential to create jobs, increase the productivity of labour, and boost innovation, investment, and economic prosperity. However, these benefits are not automatic, nor are they evenly distributed among European regions and citizens. Europe must steer these developments to foster well-being and economic growth, ensuring decent working conditions, social protection and equal opportunities for all. More information available here <http://ec.europa.eu/transparency/regexpert/index.cfm?do=news.open_doc&id=14…> . You are receiving this message because you are a member of the community IESI Community <http://iesi.eu/iesi_community>. View this contribution on the web site <http://iesi.eu/_/j9r1f4ab> A reply to this message will be sent to all members of IESI Community. Reply to sender <gianluca.misuraca(a)ec.europa.eu> | Unsubscribe <leave.iesicommunity(a)iesi.eu>

1 0

I: EXPERT GROUP ON THE IMPACT OF THE DIGITAL TRANSFORMATION ON EU LABOUR MARKETS - CALL FOR APPLICATIONS (Deadline 4th June)
by Margot Bezzi May 23, 2018

May 23, 2018

fyi ________________________________ Da: iesicommunity(a)iesi.eu <iesicommunity(a)iesi.eu> per conto di Gianluca Misuraca <gianluca.misuraca(a)ec.europa.eu> Inviato: martedì 22 maggio 2018 20:40 A: IESI Community Oggetto: [iesi_community] EXPERT GROUP ON THE IMPACT OF THE DIGITAL TRANSFORMATION ON EU LABOUR MARKETS - CALL FOR APPLICATIONS (Deadline 4th June) Dear colleagues, The Commission is setting up a high-level expert group (HLG) on the impact of the digital transformation on EU labour markets, in the context of its broader activities on the future of work. See https://ec.europa.eu/esf/transnationality/content/call-applications-expert-… Call for applications – Expert group on the impact of the ...<https://ec.europa.eu/esf/transnationality/content/call-applications-expert-…> ec.europa.eu Call for applications – Expert group on the impact of the digital transformation on EU labour markets - EUROPEAN SOCIAL FUND A call for applications<http://ec.europa.eu/transparency/regexpert/index.cfm?do=calls.calls_for_app> to select the 9 members of the expert group was published on 4 May and applications can be submitted until 4 June 2018. The goal of the expert group is to analyse and advise the Commission on the impact of the digital transformation on EU labour markets, and explore policy options in this regard. It will, among other things: * analyse how to shape the transformation and what framework conditions to be put in place to make it smooth and human-centric, * identify the potential social impacts (risks and opportunities) of digitalisation and artificial intelligence, * assess to what extent current systems (such as social security, tax and benefits, lifelong learning) are fit for purpose, and * make suggestions on a way forward. The expert group will report on its analysis and findings by early 2019. Context Digitalisation is transforming the world of work at unprecedented speed. Technological change has the potential to create jobs, increase the productivity of labour, and boost innovation, investment, and economic prosperity. However, these benefits are not automatic, nor are they evenly distributed among European regions and citizens. Europe must steer these developments to foster well-being and economic growth, ensuring decent working conditions, social protection and equal opportunities for all. More information available here<http://ec.europa.eu/transparency/regexpert/index.cfm?do=news.open_doc&id=14…>. You are receiving this message because you are a member of the community IESI Community<http://iesi.eu/iesi_community>. View this contribution on the web site<http://iesi.eu/_/j9r1f4ab> A reply to this message will be sent to all members of IESI Community. Reply to sender<mailto:gianluca.misuraca@ec.europa.eu> | Unsubscribe<mailto:leave.iesicommunity@iesi.eu>

1 0

Convegno "L'entrata in vigore del Regolamento (UE) 2016/679: la riforma alla prova dela prassi in Italia e in Spagna"- Università di Pisa, 8 e 9 giugno 2018
by Dianora Poletti May 22, 2018

May 22, 2018

Gentilissimi, seguo da tempo le interessanti segnalazioni e discussioni in lista, dalle quali traggo molti stimoli. Sperando di fare cosa gradita, intervengo per segnalare a mia volta il Convegno "L'entrata in vigore del Regolamento (UE) 2016/675: la riforma alla prova della prassi in Italia e in Spagna", che si terrà presso l'Università di Pisa nei giorni 8 e 9 giugno p.v. L'ingresso è libero, previa conferma della propria partecipazione all'indirizzo scuolalegale(a)mail.jus.unipi.it <mailto:datagovernance@unimi.it>. Trametto in allegato la locandina dell'iniziativa. Con molti cordiali saluti Dianora Poletti /Ordinario di Diritto Privato e Diritto dell'Informatica - Università di Pisa Direttrice Master II livello in Internet Ecosystem: Governance e Diritti / --- Questa e-mail è stata controllata per individuare virus con Avast antivirus. https://www.avast.com/antivirus

1 0

Ex-Intel security expert: This new Spectre attack can even reveal firmware secrets
by gabriele elia May 22, 2018

May 22, 2018

A mio avviso conferma il fatto che non ci può essere sicurezza nazionale senza "indipendenza" e controllo della industria dei processori e dei semiconduttori, cosa che l’Europa ha dismesso e obiettivo che non è nemmeno analizzato, e che la Cina ha messo come priorità per il 2025 per sganciarsi dal predominio USA ricordo che ARM è diventata giapponese, tutte le altre aziende di microprocessori sono USA o , secondariamente, coreane o cinesi e le foundry significative in USA, Taiwan e parte Cina g https://www.zdnet.com/article/ex-intel-security-expert-this-new-spectre-att… [https://zdnet1.cbsistatic.com/hub/i/r/2018/05/18/05a88543-c7e5-4866-b7b1-ce…]<https://www.zdnet.com/article/ex-intel-security-expert-this-new-spectre-att…> Ex-Intel security expert: This new Spectre attack can even reveal firmware secrets | ZDNet<https://www.zdnet.com/article/ex-intel-security-expert-this-new-spectre-att…> www.zdnet.com A new variant of Spectre can expose the contents of memory that normally can't be accessed by the OS kernel. Ex-Intel security expert: This new Spectre attack can even reveal firmware secrets A new variant of Spectre can expose the contents of memory that normally can't be accessed by the OS kernel. By Liam Tung<https://www.zdnet.com/meet-the-team/eu/liam-tung/> | May 18, 2018 -- 12:55 GMT (13:55 BST) | Topic: Security<https://www.zdnet.com/topic/security/> Yuriy Bulygin, the former head of Intel's advanced threat team, has published research showing that the Spectre CPU flaws can be used to break into the highly privileged CPU mode on Intel x86 systems known as System Management Mode (SMM). Spectre and Meltdown vulnerabilities<https://www.zdnet.com/article/security-flaws-affect-every-intel-chip-since-…> enable software attacks using CPU design flaws common to Intel, AMD, and Arm chips to access secrets stored in memory. Bulygin, who has launched security firm Eclypsium, has modified Spectre variant 1 with kernel privileges to attack a host system's firmware and expose code in SMM, a secure portion of BIOS or UEFI firmware. SMM resides in SMRAM, a protected region of physical memory that should only be accessible by BIOS firmware and not the operating system kernel, hypervisors or security software. SMM handles especially disruptive interrupts and is accessible through the SMM runtime of the firmware, knows as System Management Interrupt (SMI) handlers. As a former Intel researcher explained<http://web.cecs.pdx.edu/~karavan/research/SMM_IISWC_preprint.pdf> in a 2013 paper, when an SMI event occurs, say, due to thermal throttling or system health checks, all the CPU's cores enter SMM or system management mode. "Because SMM generally has privileged access to physical memory, including memory isolated from operating systems, our research demonstrates that Spectre-based attacks can reveal other secrets in memory (eg, hypervisor, operating system, or application)," Bulygin explains<https://blog.eclypsium.com/2018/05/17/system-management-mode-speculative-ex…>. To expose code in SMM, Bulygin modified a publicly available proof-of-concept Spectre 1 exploit running with kernel-level privileges to bypass Intel's System Management Range Register (SMRR), a set or range registers that protect SMM memory. "These enhanced Spectre attacks allow an unprivileged attacker to read the contents of memory, including memory that should be protected by the range registers, such as SMM memory," he notes. "This can expose SMM code and data that was intended to be confidential, revealing other SMM vulnerabilities as well as secrets stored in SMM. Additionally, since we demonstrate that the speculative memory access occurs from the context of SMM, this could be used to reveal other secrets in memory as well."

2 1