August 2019 - nexa - server-nexa.polito.it

NYRB: "Beware the Big Five"

by J.C. DE MARTIN

*Beware the Big Five* Tamsin Shaw April 5, 2018 Issue / //The Darkening Web: The War for Cyberspace // //by Alexander Klimburg// //Penguin, 420 pp., $30.00// / The big Silicon Valley technology companies have long been viewed by much of the American public as astonishingly successful capitalist enterprises operated by maverick geniuses. The largest among them—Microsoft, Apple, Facebook, Amazon, and Google (the so-called Big Five)—were founded by youthful and charismatic male visionaries with signature casual wardrobes: the open-necked blue shirt, the black polo-neck, the marled gray T-shirt and hoodie. These founders have won immense public trust in their emergent technologies, from home computing to social media to the new frontier, artificial intelligence. Their companies have seemed to grow organically within the flourishing ecology of the open Internet. [...] continua qui: https://www.nybooks.com/articles/2018/04/05/silicon-valley-beware-big-five/

Aug. 31, 2019

Cryptographic key used to sign one of Facebook’s Android apps compromised

by Giacomo Tesio

The security of Android app updates hinges on the secrecy of a given app’s signing key. It’s how app updates are verified as secure, and if it falls into the wrong hands, false updates could be distributed containing nefarious changes. As a result, developers usually guard signing keys quite closely, but someone at Facebook seriously messed up. A key used by the company to digitally sign its Free Basics by Facebook app has been compromised, and third-party apps reusing the key have been spotted online. After APK Mirror and Android Police owner Artem Russakovskii discovered the issue and reported it to Facebook, the original app listing was pulled from the Play Store and replaced with a new appusing a new signing key. Since then, the company has not publicly divulged the nature of the compromised key or the precise reason for the re-released app to its users, placing them at risk if they still have the old version installed. Before the listing was removed, the original Free Basics by Facebook app had over five million downloads on the Play Store. > In the past several weeks, I noticed a bunch of random APKs > being uploaded with @facebook's crypto signature > used in its Free Basics app. > > Upon closer examination, they either used a public > debug key or the key got leaked. > > Either way, this is dumb, FB. https://t.co/71uSMPO8YP > >— Artem Russakovskii (@ArtemR) August 9, 2019 ## What happened? Android Police’s sister site APK Mirror hosts Android apps for download. We do it for several reasons: to circumvent censorship, so enthusiasts can download updates before they’re widely rolled out, to mitigate geographic restrictions, and to provide a historical archive for comparison and ease of rolling back updates, among other reasons. We’re especially concerned about security, given how dangerous downloading apps from third-party sources can be, so we go out of our way to manually review and vet every APK that hits the site. In the last month, we’ve spotted third-party apps using a debug signing key which matched the key used by Facebook for its Free Basics Android app. (As an aside, using a “debug” key in production is also not a best practice for developers, let alone one of Facebook’s reach and stature.) We notified Facebook about the leaked key earlier this month, and the company verified it, pledging to address the issue in a new version of the app, which the company claims it has prompted users to upgrade to from inside the old app. Based on details provided to us by Facebook, the precise reason why customers need to upgrade isn’t included in that prompt, and it hasn’t published details regarding it elsewhere. The listing for the Free Basics by Facebook app has since been pulled from the Play Store and replaced with a new listing utilizing a new app signing key. We aren’t sure of precisely when the app was de-listed, as the last Internet Archive backup of the listing was in July, and the replacement app landed on August 14th. Facebook claims that it released a new version of the app within 24 hours of Russakovskii’s report. APK Mirror is also not accepting uploads that use the compromised key. ___ Continua su http://web.archive.org/web/20190830171739/https://www.androidpolice.com/201…

Aug. 30, 2019

"Mysterious iOS Attack Changes Everything We Know About iPhone Hacking"

by J.C. DE MARTIN

Mysterious iOS Attack Changes Everything We Know About iPhone Hacking For two years, a handful of websites have indiscriminately hacked thousands of iPhones. https://www.wired.com/story/ios-attack-watering-hole-project-zero/

Aug. 30, 2019

Justice Department Opposes Google's Undersea Cable From China

by J.C. DE MARTIN

https://www.bloomberg.com/news/articles/2019-08-28/justice-department-oppos… (Sent from my wireless device; please excuse brevity and typos (if any))

Aug. 29, 2019

Huawei Technicians Helped African Governments Spy on Political Opponents

by Giacomo Tesio

https://wwwhive.com/2019/08/14/huawei-technicians-helped-african-government… Huawei employees have provided other services, not disclosed publicly. Technicians from the Chinese powerhouse have, in at least two cases, personally helped African governments spy on their political opponents, including intercepting their encrypted communications and social media, and using cell data to track their whereabouts, according to senior security officials working directly with the Huawei employees in these countries. [...] Huawei has “never been engaged in ‘hacking’ activities,” said a Huawei spokesman in a written statement. “Huawei rejects completely these unfounded and inaccurate allegations against our business operations. Our internal investigation shows clearly that Huawei and its employees have not been engaged in any of the activities alleged. We have neither the contracts, nor the capabilities, to do so.” The spokesman added: “Huawei’s code of business conduct prohibits any employees from undertaking any activities that would compromise our customers or end users data or privacy or that would breach any laws. Huawei prides itself on its compliance with local regulations and laws in all markets where it operates.” [...] A senior police commander relayed a presidential order to access Mr. Wine’s encrypted written and spoken communications, including those through WhatsApp and Skype, to a six-man cyber team based at police headquarters, according to the security officials. They spent days trying to penetrate the communications using the Pegasus spyware but failed. They asked for help from Huawei technicians—who then cracked Mr. Wine’s encrypted communications using Pegasus within two days, the security officials said. “It was very clear he was organizing a political event, not a music show. We had to act quickly,” one of the officials said. In a WhatsApp chat group, Uganda’s cyber team saw a list of 11 lawmakers Mr. Wine was planning to secretly insert into the concert program. The rally, at Mr. Wine’s beach club, was scheduled unusually early to throw off the security services. Using information from the cyber hub, hundreds of police swarmed the venue, arresting dozens of organizers and attendees. Some were arrested before they could reach the club. “We were shocked. They knew everything about the event and the speakers, who we hadn’t announced,” Mr. Wine said. One of the security officials showed the Journal screenshots of Mr. Wine’s WhatsApp chats with the Firebase crew where participants were exchanging details on the planned events. The official said the operation would have been impossible without the skills of Huawei’s technicians. Mr. Wine, whose attempts to organize subsequent rallies have also been foiled, said the surveillance has spread to his family, his entourage and the people who frequent bars where his music is played. He now switches between several phones and uses devices of sympathetic members of the public, but he said he is outgunned by Mr. Museveni’s expanding machine. “The deal with Huawei is a survivor strategy to consolidate power,” he said in an interview in his Kampala home. “It’s an all-out assault.” [...] _____ Credo ci siano due aspetti interessanti in questa storia (vera o falsa che sia): - il coinvolgimento di singoli impiegati, non della azienda - la diffusione della tecnologie in questione anche in Europa Giacomo

Aug. 29, 2019

NYTimes: Utopia, Abandoned

by J.C. DE MARTIN

Utopia, Abandoned The Italian town Ivrea was once a model for workers’ rights and progressive design. Now, it’s both a cautionary tale and evidence of a grand experiment in making labor humane. https://www.nytimes.com/2019/08/28/t-magazine/olivetti-typewriters-ivrea-it… (Sent from my wireless device; please excuse brevity and typos (if any))

Aug. 28, 2019

L’Italia centralizza il governo del digitale: nasce un nuovo dipartimento a Palazzo Chigi - Repubblica.it

by J.C. DE MARTIN

https://www.repubblica.it/economia/2019/08/28/news/l_italia_centralizza_il_… (Sent from my wireless device; please excuse brevity and typos (if any))

Aug. 28, 2019

[notsp] Agenda and videos of the UNIDIR “Innovations Dialogue: Digital Technologies and International Security"

by Diego Latella

Dear All, On Aug. 19, 2019 an “Innovations Dialogue” took place in Geneva, at Palais des Nations, organized by the United Nations Institute for Disarmament Research (UNIDIR). The meeting addressed “Digital Technologies and International Security”. More information available at: http://unidir.org/programmes/security-and-technology/2019-innovations-dialo… <http://unidir.org/programmes/security-and-technology/2019-innovations-dialo…> The meeting agenda can be found here: http://unidir.org/files/medias/pdfs/innovations-dialogue-agenda-eng-0-838.p… <http://unidir.org/files/medias/pdfs/innovations-dialogue-agenda-eng-0-838.p…> The videos of the main sessions are available here: http://webtv.un.org/search/session-i-unidir-innovations-dialogue-2019-/6074… <http://webtv.un.org/search/session-i-unidir-innovations-dialogue-2019-/6074…> All the Best Diego Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat

Aug. 28, 2019

Halt the use of facial-recognition technology until it is regulated

by J.C. DE MARTIN

https://www.nature.com/articles/d41586-019-02514-7 (Sent from my wireless device; please excuse brevity and typos (if any))

Aug. 28, 2019

Organisation of a stakeholder dialogue on the application of Article 17 of Directive on Copyright in the Digital Single Market | Digital Single Market

by J.C. DE MARTIN

https://ec.europa.eu/digital-single-market/en/news/organisation-stakeholder… (Sent from my wireless device; please excuse brevity and typos (if any))

Aug. 28, 2019