May 2019 - nexa - server-nexa.polito.it

Re: [nexa] Hacking College Admissions

by Giacomo Tesio

Of course if the vulnerability had not been completely patched yet, I did not want to bring any attention to it. I sent back an email appreciating their response and that I looked forward to their response. A week past. I sent a follow up email asking on the status of things. No response. I sent another follow up the next week and this time I mentioned that I again was planning to publish. Radio silence. It has been about a week since I sent that email and because I have had no response from them, I decided to publish given that they had said they had patched the vulnerability and because I could not extract any more data. Il silenzio radio può voler dire solo una cosa: si sono accorti che le vulnerabilità sono state exploitate in passato in diverse scuole. Probabilmente non solo per gioco. E non solo da ragazzi in gamba come questo. Giacomo

May 2, 2019

Hacking College Admissions

by Giacomo Tesio

Questa è una perla. La vulnerabilità è stata identificata da un 17enne solo NAVIGANDO il sito web. E questi geni hanno provato a nascondere^W correggere l'errore con 15 righe di JavaScript da eseguire sul browser dell'attaccante! Sarebbe ridicolo e divertente... se solo non fosse così deprimente... Ma guardiamo il lato positivo: Per un ragazzino curioso di 17 anni penetrare in sistemi informativi istituzionali è come affondare il coltello nel burro. Non usa nessun tool avanzato. Solo un browser. E se ha imparato lui, possono imparare anche gli altri! ;-) https://d4stiny.github.io/Hacking-College-Admissions/ Getting into college is one of the more stressful time of a high school student’s life. Since the admissions process can be quite subjective, students have to consider a variety of factors to convince the admissions officers that “they’re the one”. Some families do as much as they can to improve their chances - even going as far as trying to cheat the system. For wealthier families, this might be donating a very large amount to the school or as we’ve heard in the news recently, bribing school officials. If you don’t know about me already, I’m a 17-year-old high school senior that has an extreme interest in the information security field and was part of the college admissions process this year. Being part of the college admissions process made me interested in investigating, “Can you hack yourself into a school?”. In this article, I’ll be looking into TargetX, a “Student Lifecycle Solution for Higher Education” that serves several schools. All of this research was because of my genuine interest in security, not because I wanted to get into a school through malicious means. [...] After finding this vulnerability, I immediately reached out to WPI’s security team the same day to let them know about the vulnerabilities I found. They were very receptive and within a day they applied their first “patch”. Whenever I tried accessing the backend panel, I would see my screen flash for a quick second and then a 404 Message popped up. The flash had me interested, upon reading the source code of the page, I found all the data still there! I was very confused and diff’d the source code with an older copy I had saved. [...] What they were doing was stopping the page from loading and then replacing the HTML with a 404 error. I could just use NoScript, but I decided to create a simple userscript to disable their tiny “fix”.

May 2, 2019

Johnny, you are fired! – Spoofing OpenPGP and S/MIME Signatures in Emails

by Giacomo Tesio

https://github.com/RUB-NDS/Johnny-You-Are-Fired OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery attacks against various implementations of OpenPGP and S/MIME email signature verification in five attack classes: (1) We analyze edge cases in S/MIME's container format. (2) We exploit in-band signaling in the GnuPG API, the most widely used OpenPGP implementation. (3) We apply MIME wrapping attacks that abuse the email clients' handling of partially signed messages. (4) We analyze weaknesses in the binding of signed messages to the sender identity. (5) We systematically test email clients for UI redressing attacks. Our attacks allow the spoofing of digital signatures for arbitrary messages in 14 out of 20 tested OpenPGP-capable email clients and 15 out of 22 email clients supporting S/MIME signatures. While the attacks do not target the underlying cryptographic primitives of digital signatures, they raise concerns about the actual security of OpenPGP and S/MIME email applications. Finally, we propose mitigation strategies to counter these attacks.

May 2, 2019

Remote Code Execution on most Dell computers

by Giacomo Tesio

https://d4stiny.github.io/Remote-Code-Execution-on-most-Dell-computers/ When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is “What third-party software came with my PC?”. In this article, I’ll be looking at a Remote Code Execution vulnerability I found in Dell SupportAssist, software meant to “proactively check the health of your system’s hardware and software” and which is “preinstalled on most of all new Dell devices”. [...] # Exploitation The first issue we face is making requests to the SupportAssist client. Assume we are in the context of a Dell subdomain, we’ll get into how exactly we do this further in this section. I decided to mimic the browser and make requests using javascript. [...] # Demo Here’s a small demo video showcasing the vulnerability. You can download the source code of the proof of concept here. https://invidio.us/watch?v=0cTfnZ04jgQ https://github.com/D4stiny/Dell-Support-Assist-RCE-PoC # Timeline 10/26/2018 - Initial write up sent to Dell. 10/29/2018 - Initial response from Dell. 11/22/2018 - Dell has confirmed the vulnerability. 11/29/2018 - Dell scheduled a “tentative” fix to be released in Q1 2019. 01/28/2019 - Disclosure date extended to March. 03/13/2019 - Dell is still fixing the vulnerability and has scheduled disclosure for the end of April. 04/18/2019 - Vulnerability disclosed as an advisory. Written on April 30, 2019

May 2, 2019

The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance by Roseanna Sommers, Vanessa K. Bohns :: SSRN

by J.C. DE MARTIN

mi sembra importante. jc The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance Yale Law Journal, Vol. 128, No. 7, 2019 72 Pages Posted: Roseanna Sommers University of Chicago - Law School Vanessa K. Bohns Cornell University Date Written: April 10, 2019 Abstract Consent-based searches are by far the most ubiquitous form of search undertaken by police. A key legal inquiry in these cases is whether consent was granted voluntarily. This Essay suggests that fact finders’ assessments of voluntariness are likely to be impaired by a systematic bias in social perception. Fact finders are likely to underappreciate the degree to which suspects feel pressure to comply with police officers’ requests to perform searches. In two preregistered laboratory studies, we approached a total of 209 participants (“Experi- encers”) with a highly intrusive request: to unlock their password-protected smartphones and hand them over to an experimenter to search through while they waited in another room. A sepa- rate 194 participants (“Forecasters”) were brought into the lab and asked whether a reasonable person would agree to the same request if hypothetically approached by the same researcher. Both groups then reported how free they felt, or would feel, to refuse the request. Study 1 found that whereas most Forecasters believed a reasonable person would refuse the experimenter’s request, most Experiencers—100 out of 103 people—promptly unlocked their phones and handed them over. Moreover, Experiencers reported feeling significantly less free to refuse than did Forecasters contemplating the same situation hypothetically. Study 2 tested an intervention modeled after a commonly proposed reform of consent searches, in which the experimenter explicitly advises participants that they have the right to with- hold consent. We found that this advisory did not significantly reduce compliance rates or make Experiencers feel more free to say no. At the same time, the gap between Experiencers and Fore- casters remained significant. These findings suggest that decision makers judging the voluntariness of consent consistently underestimate the pressure to comply with intrusive requests. This is problematic because it indi- cates that a key justification for suspicionless consent searches—that they are voluntary—relies on an assessment that is subject to bias. The results thus provide support to critics who would like to see consent searches banned or curtailed, as they have been in several states. The results also suggest that a popular reform proposal—requiring police to advise citizens of their right to refuse consent—may have little effect. This corroborates previous observational stud- ies, which find negligible effects of Miranda warnings on confession rates among interrogees, and little change in rates of consent once police start notifying motorists of their right to refuse vehicle searches. We suggest that these warnings are ineffective because they fail to address the psychology of compliance. The reason people comply with police, we contend, is social, not informational. The social demands of police-citizen interactions persist even when people are informed of their rights. It is time to abandon the myth that notifying people of their rights makes them feel empowered to exercise those rights. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3369844 (Sent from my wireless device; please excuse brevity and typos (if any))

May 2, 2019

NIMH » Release of “13 Reasons Why” Associated with Increase in Youth Suicide Rates

by J.C. DE MARTIN

https://www.nimh.nih.gov/news/science-news/2019/release-of-13-reasons-why-a… (Sent from my wireless device; please excuse brevity and typos (if any))

May 1, 2019

A parere dell’avvocato generale Szpunar, un servizio come quello fornito dalla piattaforma AIRBNB costituisce un servizio della società dell’informazione

by J.C. DE MARTIN

A parere dell’avvocato generale Szpunar, un servizio come quello fornito dalla piattaforma AIRBNB costituisce un servizio della società dell’informazione https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-04/cp190051it… (Sent from my wireless device; please excuse brevity and typos (if any))

May 1, 2019

I vantaggi dei beni digitali nel Pil, quanto può pesare la rivoluzione? - ilSole24ORE

by don Luca Peyron

Un gruppo di ricercatori del MIT ha proposto una metodologia <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3356697> per includere nel PIL i benefici derivanti dai beni digitali gratuitamente disponibili per i consumatori. Secondo la loro stima i guadagni di benessere potrebbero aggiungere alla crescita del prodotto, così rettificata, fino allo 0,11% all’anno. Buon primo maggio! Dl https://www.econopoly.ilsole24ore.com/2019/04/30/beni-digitali-pil/

May 1, 2019

The Airbnb Invasion of Barcelona | The New Yorker

by J.C. DE MARTIN

https://www.newyorker.com/magazine/2019/04/29/the-airbnb-invasion-of-barcel… (Sent from my wireless device; please excuse brevity and typos (if any))

May 1, 2019

Re: [nexa] Apache Software Foundation joins GitHub open source community

by Giacomo

On May 1, 2019 7:06:09 AM UTC, Stefano Zacchiroli <zack(a)upsilon.cc> wrote: >On Wed, May 01, 2019 at 12:51:12AM +0200, Giacomo Tesio wrote: >> Dunque rimango dell'idea che la vera ragione di questo enorme lavoro >> sia da ricercarsi negli sponsor della ASF. Non riesco ad immaginare >> un'altra spiegazione razionale. > >In buona sostanza stai dicendo: "esiste un argomento dichiarato per la >migrazione, non ho elementi concreti per sostenere sia falso, ma penso >che lo sia". Ho capito bene? No, hai capito male. Ma solo perché sei un idealista un po' ingenuo... :-) Gli elementi concreti per sostenere il contrario sono i dollari pagati da Microsoft, Amazon, Cloudera e Google etc... Quasi un milione di dollari all'anno pagati da società statunitensi che operano nel cloud. Di queste, Microsoft possiede GitHub. > Liberissimo, eh, ma non è >un'argomentazione che personalmente trovo convincente. Dici che erano dollari del Monopoli? Ci credo che il denaro non ti convincerebbe ad una scelta così miope... ma ci sono i lobbisti per questo! >PS1 non penso che ASF avrebbe dovuto migrare su GitHub, ma gli argomenti > contrari per una fondazione faro del mondo del software libero sono > da cercare altrove, per esempio qui: > https://www.gnu.org/software/repo-criteria.en.html Questi sono criteri utili ad una scelta etica individuale. Sono aspetti rilevanti per uno sviluppatore di software libero o per un piccolo team... ma dettagli irrilevanti per la ASF che ha una rilevanza Politica globale. La mia obbiezione è che questa decisione costata probabilmente migliaia di ore di lavoro è autolesionista e aumenta tutta una serie di rischi sia per gli sviluppatori, sia per gli utenti, sia per le aziende in tutto il mondo, sia per la ASF stessa. >PS2 l'infrastruttura non fa più parte del valore aggiunto di ASF da > molto tempo. I veri assets della fondazione oggi sono il nome Apache > e lo stewardship sulla licenza omonima Esatto: asset virtuali per una fondazione sempre meno reale. Supponiamo che la fondazione risparmi l'80% del proprio budget che ci fa con i soldi in più? Conferenze per mettere in mostra gli sponsor? :-D Assume qualche sviluppatore in più così da poterlo mandare in giro come esperto a presidiare gli interessi degli sponsor? Corsi di informatica per lobbisti? Ma sì dai... in fondo hai ragione... l'hanno fatto per risparmiare... Per concentrarsi sul core Bu$in€ss! ;-) Giacomo

May 1, 2019