May 2019 - nexa - server-nexa.polito.it

(no subject)
by Giacomo Tesio May 2, 2019

May 2, 2019

Bell'esempio di proposta di legge dalle buone intenzioni ma controproducente. Potrebbe spingere gli utenti a fidarsi maggiormente del Web, ma senza appropriato supporto tecnico, il tracciamento rimane possibile e non osservabile: non c'è modo di scoprire e punire i trasgressori (a meno che non facciano diversi passi falsi facilmente evitabili). L'header "Do Not Track" non può funzionare perché affida la protezione della privacy al lato sbagliato della connessione TCP: il server non ha nessun interesse a scartare le informazioni che il browser gli manda comunque visto che può salvarle dove nessuno le troverà mai. Per impedire il tracciamento bisogna intervenire sui browser. A questi la legge dovrebbe imporre specifiche minime a garanzia degli utenti. La sicurezza non può essere Opt-In. https://spreadprivacy.com/do-not-track-act-2019/ When you turn on the setting in your browser that says “Do Not Track”, you probably expect to no longer be tracked on most websites you visit. Right? Well, you would be wrong. But don’t worry, you’re not alone. Our recent study on the Do Not Track (DNT) browser setting indicated that about a quarter of people have turned on this setting, and most were unaware big sites do not respect it. That means approximately 75 million Americans, 115 million citizens of the European Union, and many more people worldwide are, right now, broadcasting a DNT signal. [...] While DuckDuckGo actively supports the passing of strong, comprehensive privacy laws, we also recognize that it will take time for them to take effect worldwide. In the meantime, governments can provide immediate relief by enacting separate, simpler Do Not Track legislation. [...] That’s why we're announcing draft legislation that can serve as a starting point for legislators in America and beyond. It’s entitled the "Do-Not-Track Act of 2019" and, if it were to be enacted, would require sites to respect the Do Not Track browser setting in this manner: - No third-party tracking by default. [...] - No first-party tracking outside what the user expects. [...]

1 0

UK To Introduce New Law For IoT Device Security
by J.C. DE MARTIN May 2, 2019

May 2, 2019

https://www.forbes.com/sites/charlestowersclark/2019/05/02/uk-to-introduce-… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Sabino Cassese: «La democrazia non è soltanto potere del popolo»
by don Luca Peyron May 2, 2019

May 2, 2019

I saggi vanno ascoltati... Buona lettura dl [...] Il secondo problema evoca la disponibilità di una grande quantità di dati. Ma non va ingigantito. Uno dei modi di occultare un dato è quello di fornirne troppi. C’è, invece, la questione dell’offerta di servizi da parte delle grandi imprese che governano il mondo digitale, offerta che consente loro di captare e capitalizzare informazioni sugli utenti. Qui c’è un difetto di disciplina, che deriva dalla estensione globale di quell’offerta. [...] https://www.sicilianpost.it/sabino-cassese-la-democrazia-non-e-soltanto-pot… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Le elezioni ai tempi dei social media
by Niccolò Caranti May 2, 2019

May 2, 2019

Segnalo il policy workshop “Le elezioni ai tempi dei social media. Elezioni europee, disinformazione e micro-targeting: che fare?”, che si terrà il prossimo 14 maggio a Roma, dalle ore 14:00 alle ore 18:00, in Corso Vittorio Emanuele II, 349 (presso la Federazione Nazionale Stampa Italiana). In vista delle elezioni europee, ad un anno dalla Dichiarazione di Perugia <https://globalfreedomofexpression.columbia.edu/wp-content/uploads/2018/02/p…> - che chiedeva nuove regole e maggiore trasparenza nella propaganda politica sui social network in particolare durante le campagne elettorali, ci interroghiamo sui passi compiuti sino ad ora, e su cosa c’è ancora da fare per salvaguardare la trasparenza del discorso pubblico e l'integrità dei processi democratici nel rispetto dei diritti fondamentali. Questo il programma: SALUTI ISTITUZIONALI Mario Raffaelli, Presidente Centro per la Cooperazione Internazionale Rappresentante della Federazione Nazionale Stampa Italiana *PRIMA SESSIONE, La disinformazione all'opera* INTRODUCE E MODERA: Fazila Mat, OBC Transeuropa / Centro per la cooperazione internazionale Fabiana Zollo, Università Ca’ Foscari Venezia Walter Quattrociocchi, Università Ca’ Foscari Venezia Nicola Bruno, Dataninja Giorgio Comai, OBC Transeuropa / Centro per la cooperazione internazionale SECONDA SESSIONE, Ripensare le regole del gioco MODERA: Tommaso Scannicchio, CILD, Coalizione Italiana Libertà e Diritti Civili Fabio Chiusi, Valigia Blu / Nexa Center for Internet & Society Riccardo Acciai, Garante per la protezione dei dati personali Daniele De Bernardin, Openpolis Antonella Napolitano, Privacy International *Conclusioni.* *L'evento è organizzato nell'ambito del progetto ESVEI, Exploring systemic vulnerabilities for external influence in Italy <https://www.balcanicaucaso.org/Progetti/ESVEI>, promosso da Osservatorio Balcani Caucaso Transeuropa / Centro per la Cooperazione Internazionale.* L'incontro è libero, previa registrazione online tramite questo modulo <https://www.eventbrite.it/e/biglietti-le-elezioni-ai-tempi-dei-social-media…> . A presto, Niccolò Caranti OBC Transeuropa *Centro per la Cooperazione Internazionale* vicolo San Marco 1 <https://maps.google.com/?q=vicolo+San+Marco+1+38122+Trento+(TN)+-+Italia&en…> 38122 Trento (TN) - Italia <https://maps.google.com/?q=vicolo+San+Marco+1+38122+Trento+(TN)+-+Italia&en…> www.balcanicaucaso.org www.balcanicaucaso.org/eng Tel: +39 0461 1828617

1 0

A Conspiracy To Kill IE6
by Giacomo Tesio May 2, 2019

May 2, 2019

Divertente storiella di come 10 anni fa, una singola azienda ha "convinto" un utente del web su 5 a cambiare browser... senza _quasi_ farlo apposta. Ma va tutto bene eh... non vi preoccupate! ;-) http://blog.chriszacharias.com/a-conspiracy-to-kill-ie6 IE6 users represented around 18% of our user base at that point. We understood that we could not just drop support for it. However, sitting in that cafeteria, having only slept about a few hours each in the previous days, our compassion for these users had completely eroded away. [...] The plan was very simple. We would put a small banner above the video player that would only show up for IE6 users. It would read “We will be phasing out support for your browser soon. Please upgrade to one of these more modern browsers.” Next to the text would be links to the current versions of the major browsers, including Chrome, Firefox, IE8 and eventually, Opera. [...] The first person to come by our desks was the PR team lead. [...] Fortunately for us, the publications had already settled on a narrative that this was a major benefit to the Internet. [...] Satisfied that he could get back in front of the story, the PR team lead turned and warned us to never do anything like this without telling him first. He did not want to let great public relations opportunities like this slip by ever again. [...] Between YouTube, Google Docs, and several other Google properties posting IE6 banners, Google had given permission to every other site on the web to add their own. IE6 banners suddenly started appearing everywhere. Within one month, our YouTube IE6 user base was cut in half and over 10% of global IE6 traffic had dropped off while all other browsers increased in corresponding amounts. The results were better than our web development team had ever intended.

1 1

Paper: “The Antitrust Case Against Facebook” by Dina Srinivasan :: SSRN
by J.C. DE MARTIN May 2, 2019

May 2, 2019

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362 The Antitrust Case Against Facebook Berkeley Business Law Journal Vol. 16, Issue 1, Forthcoming 83 Pages Posted: 7 Feb 2019 Last revised: 9 Feb 2019 Dina Srinivasan Yale University - Law School Date Written: September 10, 2018 Abstract The Facebook, Inc. (“Facebook”) social network, this era’s new communications service, plays an important role in the lives of 2+ billion people across the world. Though the market was highly competitive in the beginning, it has since consolidated in Facebook’s favor. Today, using Facebook means to accept a product linked to broad-scale commercial surveillance — a paradox in a democracy. This Paper argues that Facebook’s ability to extract this qualitative exchange from consumers is merely this titan’s form of monopoly rents. The history of early competition, Facebook’s market entry, and Facebook’s subsequent rise tells the story of Facebook’s monopoly power. However, the history which elucidates this firm’s dominance also presents a story of anticompetitive conduct. Facebook’s pattern of false statements and misleading conduct induced consumers to trust and choose Facebook, to the detriment of market competitors and consumers' own welfare. Keywords: antitrust, competition law, two-sided platforms, two-sided markets, facebook, big tech, anticompetitive, consumer welfare, privacy, democracy, commercial surveillance, surveillance, monopoly power, collusion, sherman act, antitrust (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Hacking College Admissions
by Giacomo Tesio May 2, 2019

May 2, 2019

Questa è una perla. La vulnerabilità è stata identificata da un 17enne solo NAVIGANDO il sito web. E questi geni hanno provato a nascondere^W correggere l'errore con 15 righe di JavaScript da eseguire sul browser dell'attaccante! Sarebbe ridicolo e divertente... se solo non fosse così deprimente... Ma guardiamo il lato positivo: Per un ragazzino curioso di 17 anni penetrare in sistemi informativi istituzionali è come affondare il coltello nel burro. Non usa nessun tool avanzato. Solo un browser. E se ha imparato lui, possono imparare anche gli altri! ;-) https://d4stiny.github.io/Hacking-College-Admissions/ Getting into college is one of the more stressful time of a high school student’s life. Since the admissions process can be quite subjective, students have to consider a variety of factors to convince the admissions officers that “they’re the one”. Some families do as much as they can to improve their chances - even going as far as trying to cheat the system. For wealthier families, this might be donating a very large amount to the school or as we’ve heard in the news recently, bribing school officials. If you don’t know about me already, I’m a 17-year-old high school senior that has an extreme interest in the information security field and was part of the college admissions process this year. Being part of the college admissions process made me interested in investigating, “Can you hack yourself into a school?”. In this article, I’ll be looking into TargetX, a “Student Lifecycle Solution for Higher Education” that serves several schools. All of this research was because of my genuine interest in security, not because I wanted to get into a school through malicious means. [...] After finding this vulnerability, I immediately reached out to WPI’s security team the same day to let them know about the vulnerabilities I found. They were very receptive and within a day they applied their first “patch”. Whenever I tried accessing the backend panel, I would see my screen flash for a quick second and then a 404 Message popped up. The flash had me interested, upon reading the source code of the page, I found all the data still there! I was very confused and diff’d the source code with an older copy I had saved. [...] What they were doing was stopping the page from loading and then replacing the HTML with a 404 error. I could just use NoScript, but I decided to create a simple userscript to disable their tiny “fix”.

1 1

Johnny, you are fired! – Spoofing OpenPGP and S/MIME Signatures in Emails
by Giacomo Tesio May 2, 2019

May 2, 2019

https://github.com/RUB-NDS/Johnny-You-Are-Fired OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery attacks against various implementations of OpenPGP and S/MIME email signature verification in five attack classes: (1) We analyze edge cases in S/MIME's container format. (2) We exploit in-band signaling in the GnuPG API, the most widely used OpenPGP implementation. (3) We apply MIME wrapping attacks that abuse the email clients' handling of partially signed messages. (4) We analyze weaknesses in the binding of signed messages to the sender identity. (5) We systematically test email clients for UI redressing attacks. Our attacks allow the spoofing of digital signatures for arbitrary messages in 14 out of 20 tested OpenPGP-capable email clients and 15 out of 22 email clients supporting S/MIME signatures. While the attacks do not target the underlying cryptographic primitives of digital signatures, they raise concerns about the actual security of OpenPGP and S/MIME email applications. Finally, we propose mitigation strategies to counter these attacks.

1 0

Remote Code Execution on most Dell computers
by Giacomo Tesio May 2, 2019

May 2, 2019

https://d4stiny.github.io/Remote-Code-Execution-on-most-Dell-computers/ When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is “What third-party software came with my PC?”. In this article, I’ll be looking at a Remote Code Execution vulnerability I found in Dell SupportAssist, software meant to “proactively check the health of your system’s hardware and software” and which is “preinstalled on most of all new Dell devices”. [...] # Exploitation The first issue we face is making requests to the SupportAssist client. Assume we are in the context of a Dell subdomain, we’ll get into how exactly we do this further in this section. I decided to mimic the browser and make requests using javascript. [...] # Demo Here’s a small demo video showcasing the vulnerability. You can download the source code of the proof of concept here. https://invidio.us/watch?v=0cTfnZ04jgQ https://github.com/D4stiny/Dell-Support-Assist-RCE-PoC # Timeline 10/26/2018 - Initial write up sent to Dell. 10/29/2018 - Initial response from Dell. 11/22/2018 - Dell has confirmed the vulnerability. 11/29/2018 - Dell scheduled a “tentative” fix to be released in Q1 2019. 01/28/2019 - Disclosure date extended to March. 03/13/2019 - Dell is still fixing the vulnerability and has scheduled disclosure for the end of April. 04/18/2019 - Vulnerability disclosed as an advisory. Written on April 30, 2019

1 0

The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance by Roseanna Sommers, Vanessa K. Bohns :: SSRN
by J.C. DE MARTIN May 2, 2019

May 2, 2019

mi sembra importante. jc The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance Yale Law Journal, Vol. 128, No. 7, 2019 72 Pages Posted: Roseanna Sommers University of Chicago - Law School Vanessa K. Bohns Cornell University Date Written: April 10, 2019 Abstract Consent-based searches are by far the most ubiquitous form of search undertaken by police. A key legal inquiry in these cases is whether consent was granted voluntarily. This Essay suggests that fact finders’ assessments of voluntariness are likely to be impaired by a systematic bias in social perception. Fact finders are likely to underappreciate the degree to which suspects feel pressure to comply with police officers’ requests to perform searches. In two preregistered laboratory studies, we approached a total of 209 participants (“Experi- encers”) with a highly intrusive request: to unlock their password-protected smartphones and hand them over to an experimenter to search through while they waited in another room. A sepa- rate 194 participants (“Forecasters”) were brought into the lab and asked whether a reasonable person would agree to the same request if hypothetically approached by the same researcher. Both groups then reported how free they felt, or would feel, to refuse the request. Study 1 found that whereas most Forecasters believed a reasonable person would refuse the experimenter’s request, most Experiencers—100 out of 103 people—promptly unlocked their phones and handed them over. Moreover, Experiencers reported feeling significantly less free to refuse than did Forecasters contemplating the same situation hypothetically. Study 2 tested an intervention modeled after a commonly proposed reform of consent searches, in which the experimenter explicitly advises participants that they have the right to with- hold consent. We found that this advisory did not significantly reduce compliance rates or make Experiencers feel more free to say no. At the same time, the gap between Experiencers and Fore- casters remained significant. These findings suggest that decision makers judging the voluntariness of consent consistently underestimate the pressure to comply with intrusive requests. This is problematic because it indi- cates that a key justification for suspicionless consent searches—that they are voluntary—relies on an assessment that is subject to bias. The results thus provide support to critics who would like to see consent searches banned or curtailed, as they have been in several states. The results also suggest that a popular reform proposal—requiring police to advise citizens of their right to refuse consent—may have little effect. This corroborates previous observational stud- ies, which find negligible effects of Miranda warnings on confession rates among interrogees, and little change in rates of consent once police start notifying motorists of their right to refuse vehicle searches. We suggest that these warnings are ineffective because they fail to address the psychology of compliance. The reason people comply with police, we contend, is social, not informational. The social demands of police-citizen interactions persist even when people are informed of their rights. It is time to abandon the myth that notifying people of their rights makes them feel empowered to exercise those rights. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3369844 (Sent from my wireless device; please excuse brevity and typos (if any))

1 0