August 2018 - nexa - server-nexa.polito.it

Award-winning security research reveals a host of never-seen, currently unblockable web-tracking techniques
by Alberto Cammozzo Aug. 21, 2018

Aug. 21, 2018

<https://boingboing.net/2018/08/16/who-left-open-the-cookie-jar.html> Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies <https://wholeftopenthecookiejar.eu/static/tpc-paper.pdf> won the Distinguished Paper prize at this year's Usenix Security Conference; its authors, researchers at Belgium's Catholic University in Leuven, revealed a host of devastating, never-seen tracking techniques for identifying web-users who were using privacy tools supplied by browser-vendors and third-party tracking-blocking tools. The techniques the KU Leuven team identified allowed them to track users across sites by means of the Appcache API; "lesser-known HTML tags"; the Location response-header; various <meta> redirects; Javascript in PDF tables, Javascript's location.href property; and through service workers. These techniques bypassed the stock browser privacy protections, including the latest, most extensive privacy settings in Firefox; they also worked against popular cookie-blocking/ad-blocking/script-blocking browser extensions. The good news is that the researchers found no evidence of these techniques being exploited in the wild and they tipped off the browser vendors before going public, which means that we can hope that future browsers will be better equipped to defend against these tactics. The bad news is that until then, we're all vulnerable to unscrupulous websites using these tactics to track us everywhere. Here's the researchers' catalog of exploits <https://wholeftopenthecookiejar.eu/> with suggested countermeasures. [...]

2 1

Is coding style personal data?
by Giovanni Battista Gallus Aug. 20, 2018

Aug. 20, 2018

Identifying Programmers by their Coding Style *[2018.08.13]* <https://www.schneier.com/blog/archives/2018/08/identifying_pro.html> Fascinating research <https://www.wired.com/story/machine-learning-identify-anonymous-code/> de-anonymizing code -- from either source code or compiled code: Rachel Greenstadt, an associate professor of computer science at Drexel University, and Aylin Caliskan, Greenstadt's former PhD student and now an assistant professor at George Washington University, have found that code, like other forms of stylistic expression, are not anonymous. At the DefCon hacking conference Friday, the pair will present a number of studies they've conducted using machine learning techniques to de-anonymize the authors of code samples. Their work could be useful in a plagiarism dispute, for instance, but it also has privacy implications, especially for the thousands of developers who contribute open source code to the world. Una prospettiva molto interessante, segnalata sull'ultimo Cryptogram ( https://www.schneier.com/crypto-gram/archives/2018/0815.html#cg29) Buone riflessioni agostane. G.Battista Gallus

3 2

How Royal Mail saved home mover marketing from the GDPR graveyard
by Luigi Scorca Aug. 20, 2018

Aug. 20, 2018

https://www-computerworlduk-com.cdn.ampproject.org/c/s/www.computerworlduk.…

1 0

Botched CIA Communications System Helped Blow Cover of Chinese Agents
by Alberto Cammozzo Aug. 20, 2018

Aug. 20, 2018

<https://foreignpolicy.com/2018/08/15/botched-cia-communications-system-help…># t was considered one of the CIA’s worst failures in decades: Over a two-year period starting in late 2010, Chinese authorities systematically dismantled the agency’s network of agents across the country, executing dozens of suspected U.S. spies. But since then, a question has loomed over the entire debacle. How were the Chinese able to roll up the network? Now, nearly eight years later, it appears that the agency botched the communication system it used to interact with its sources, according to five current and former intelligence officials. The CIA had imported the system from its Middle East operations, where the online environment was considerably less hazardous, and apparently underestimated China’s ability to penetrate it. “The attitude was that we’ve got this, we’re untouchable,” said one of the officials who, like the others, declined to be named discussing sensitive information. The former official described the attitude of those in the agency who worked on China at the time as “invincible.” [] When CIA officers begin working with a new source, they often use an interim covert communications system—in case the person turns out to be a double agent. The communications system used in China during this period was internet-based and accessible from laptop or desktop computers, two of the former officials said. This interim, or “throwaway,” system, an encrypted digital program, allows for remote communication between an intelligence officer and a source, but it is also separated from the main communications system used with vetted sources, reducing the risk if an asset goes bad. Although they used some of the same coding, the interim system and the main covert communication platform used in China at this time were supposed to be clearly separated. In theory, if the interim system were discovered or turned over to Chinese intelligence, people using the main system would still be protected—and there would be no way to trace the communication back to the CIA. But the CIA’s interim system contained a technical error: It connected back architecturally to the CIA’s main covert communications platform. When the compromise was suspected, the FBI and NSA both ran “penetration tests” to determine the security of the interim system. They found that cyber experts with access to the interim system could also access the broader covert communications system the agency was using to interact with its vetted sources, according to the former officials. In the words of one of the former officials, the CIA had “fucked up the firewall” between the two systems. [...]

1 0

This company embeds microchips in its employees, and they love it
by Guido Noto La Diega Aug. 19, 2018

Aug. 19, 2018

Last August, 50 employees at Three Square Market got RFID chips in their hands. Now 80 have them https://www.technologyreview.com/s/611884/this-company-embeds-microchips-in… -- Guido Dr Guido Noto La Diega Senior Lecturer / European Research Partnerships Coordinator @ Northumbria Law School Director @italiot | Fellow @nexacenter | Co-convenor @NINSOrig | Co-founder @DPA2018 Northumbria Law School City Campus East, Newcastle upon Tyne NE1 8ST noto.la.diega(a)gmail.com +44(0)191 349 5562 You can access my papers on Academia.edu <http://northumbria.academia.edu/GuidoNotoLaDiega> and on the Social Science Research Network (SSRN <https://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=1794950>) This e-mail and any attachment hereto are strictly confidential and are exclusively intended for the person above identified. Without intended recipient’s entitlement, use, copy and dissemination of this e-mail is prohibited. If you have received it in error, please advice us immediately by telephone and return the documents received to the above address, deleting the files. Thank you. Unless necessary, please do not print this e-mail.

1 0

Gli algoritmi del copyright censurano articoli contro la censura- BrunoSaetta.it
by J.C. DE MARTIN Aug. 17, 2018

Aug. 17, 2018

https://brunosaetta.it/diritto-autore/algoritmi-copyright-censurano-articol… Gli algoritmi del copyright censurano articoli contro la censura (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Interesting and relevant paper
by Roberto Dolci Aug. 16, 2018

Aug. 16, 2018

Segnalo questo articolo che prende un approccio economico interessante sul controllo e possesso dei dati, concentrandosi sul concetto di (non) rivalita’. Buona lettura Rob http://christophertonetti.com/files/papers/JonesTonetti_DataNonrivalry.pdf

2 1

To Catch A Robber, The FBI Attempted An Unprecedented Grab For Google Location Data
by J.C. DE MARTIN Aug. 16, 2018

Aug. 16, 2018

https://www.forbes.com/sites/thomasbrewster/2018/08/15/to-catch-a-robber-th… To Catch A Robber, The FBI Attempted An Unprecedented Grab For Google Location Data Thomas Fox-Brewster (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Google’s snooping proves big tech will not change – unless governments step in
by Alberto Cammozzo Aug. 15, 2018

Aug. 15, 2018

I dispositivi Android devono poter funzionare anche senza Google Apps anche se l'utente non è un hacker. <https://www.theguardian.com/commentisfree/2018/aug/14/googles-snooping-prov…> A recent investigation by the Associated Press has revealed that Google records your movements regardless of whether you have disabled the “location history” setting. This is egregious, especially considering Google’s support page on the issue states: “With location history off, the places you go are no longer stored.” While it is possible to prevent Google from time-stamping your every digital footstep, it is not exactly intuitive. You must log in to your Google account, go to the “manage your Google activity” section, open “activity controls” and disable the permissions there, which are enabled by default. This stops apps such as Google Maps and browsers from recording your location. However, it doesn’t wipe your past location data; more steps are needed to delete that. Going through the above is a hassle with which most people won’t bother – as I imagine Google knows well. Who cares about privacy these days, after all? It seems big tech has realised it can afford constant data-based scandals, because not enough people care that the minutiae of their daily existence is being relentlessly mined and monetised without their informed consent. This apathy is, in part, attributable to the fact we are told we shouldn’t care about privacy if we have nothing to hide. Google has helped propagate this notion. The company’s former CEO Eric Schmidt once said: “If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.” [...]

2 1

OK, Be Evil
by Alberto Cammozzo Aug. 15, 2018

Aug. 15, 2018

Google Removes 'Don't Be Evil' Clause From Its Code of Conduct <https://gizmodo.com/google-removes-nearly-all-mentions-of-dont-be-evil-from…> Google’s unofficial motto has long been the simple phrase “don’t be evil.” But that’s over, according to the code of conduct that Google distributes to its employees. The phrase was removed sometime in late April or early May, archives hosted by the Wayback Machine show. “Don’t be evil” has been part of the company’s corporate code of conduct <https://abc.xyz/investor/other/google-code-of-conduct.html> since 2000. When Google was reorganized under a new parent company, Alphabet, in 2015, Alphabet assumed a slightly adjusted version <https://www.engadget.com/2015/10/02/alphabet-do-the-right-thing/> of the motto, “do the right thing.” However, Google retained its original “don’t be evil” language until the past several weeks. The phrase has been deeply incorporated into Google’s company culture—so much so that a version of the phrase has served as the wifi password on the shuttles that Google uses to ferry its employees to its Mountain View headquarters, sources told Gizmodo. Here’s the relevant section of the old code of conduct, as archived by the Wayback Machine on April 21, 2018 <https://web.archive.org/web/20180421105327/https://abc.xyz/investor/other/g…>: “Don’t be evil.” Googlers generally apply those words to how we serve our users. But “Don’t be evil” is much more than that. Yes, it’s about providing our users unbiased access to information, focusing on their needs and giving them the best products and services that we can. But it’s also about doing the right thing more generally – following the law, acting honorably, and treating co-workers with courtesy and respect. The Google Code of Conduct is one of the ways we put “Don’t be evil” into practice. It’s built around the recognition that everything we do in connection with our work at Google will be, and should be, measured against the highest possible standards of ethical business conduct. We set the bar that high for practical as well as aspirational reasons: Our commitment to the highest standards helps us hire great people, build great products, and attract loyal users. Trust and mutual respect among employees and users are the foundation of our success, and they are something we need to earn every day. So please do read the Code, and follow both its spirit and letter, always bearing in mind that each of us has a personal responsibility to incorporate, and to encourage other Googlers to incorporate, the principles of the Code into our work. And if you have a question or ever think that one of your fellow Googlers or the company as a whole may be falling short of our commitment, don’t be silent. We want – and need – to hear from you. And here’s the updated version, first archived by the Wayback Machine on May 4, 2018 <https://web.archive.org/web/20180504211806/https://abc.xyz/investor/other/g…>: The Google Code of Conduct is one of the ways we put Google’s values into practice. It’s built around the recognition that everything we do in connection with our work at Google will be, and should be, measured against the highest possible standards of ethical business conduct. We set the bar that high for practical as well as aspirational reasons: Our commitment to the highest standards helps us hire great people, build great products, and attract loyal users. Respect for our users, for the opportunity, and for each other are foundational to our success, and are something we need to support every day. So please do read the Code and Google’s values, and follow both in spirit and letter, always bearing in mind that each of us has a personal responsibility to incorporate, and to encourage other Googlers to incorporate, the principles of the Code and values into our work. And if you have a question or ever think that one of your fellow Googlers or the company as a whole may be falling short of our commitment, don’t be silent. We want – and need – to hear from you. Despite this significant change, Google’s code of conduct says it has not been updated since April 5, 2018.

1 0