July 2021 - nexa - server-nexa.polito.it

Arm’s cheap and flexible plastic microchip could create an ‘internet of everything’

by don Luca Peyron

Buona lettura dl https://www.theverge.com/2021/7/23/22590001/arm-plasticarm-cheap-flexible-p… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

July 24, 2021

Re: [nexa] The Essential Facilities Doctrine in the Digital Economy: Dispelling Persistent Myths by Nikolas Guggenberger :: SSRN

by Roberto Dolci

Articolo molto pro-Google, che ignora o nasconde svariati aspetti, quale la richiesta delle aziende automotive di usare JuicePass sul loro infotainment Android Auto, ed altri ancora. Interessante Roberto ________________________________ Da: nexa <nexa-bounces(a)server-nexa.polito.it> per conto di Antonio Iacono <antiac(a)gmail.com> Inviato: venerdì 23 luglio 2021 11:57:07 A: Center Nexa Oggetto: Re: [nexa] The Essential Facilities Doctrine in the Digital Economy: Dispelling Persistent Myths by Nikolas Guggenberger :: SSRN Pubblicazione molto interessante, così come interessante è l'istituto giuridico delle "Essential Facilities". L'articolo cita giustamente la decisione dell’antitrust sul caso Enel contro Google [1][2]. Decisione contro cui Google ha, in questi giorni, deciso di ricorrere in appello [3]. La nota in cui Google lo comunica inizia con: "Nonostante i nostri sforzi e le nostre migliori intenzioni, lo scorso aprile l’AGCM ha emesso una decisione che impone una multa molto elevata ad Android Auto, un servizio che Google offre gratuitamente." "gratuitamente" non è messo lì a caso, è il nodo centrale. Le "infrastrutture essenziali", pensiamo ad aeroporti, porti, finora è stato abbastanza semplice regolarle. Prendiamo un porto, la società che lo gestisce fa pagare l'ormeggio in base alle dimensioni della barca, fine. Cosa succederebbe se il gestore stabilisse: "l'ormeggio è gratuito ma decido io chi può accedervi" ? Antonio [1] https://chillingcompetition.com/2021/05/27/the-italian-competition-authorit… [2] https://www.agcm.it/dotcmsdoc/allegati-news/A529_chiusura.pdf [3] https://www.dday.it/redazione/40073/enel-x-su-android-auto-google-ricorre-c… On Fri, Jul 23, 2021 at 7:42 AM J.C. DE MARTIN <demartin(a)polito.it> wrote: > > > https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3802559 > > > (Sent from my wireless device; please excuse brevity and typos (if any)) > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa _______________________________________________ nexa mailing list nexa(a)server-nexa.polito.it https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

July 24, 2021

"Social è responsabilità" - seminario MediaLaws 26 luglio ore 18.30

by Marco Bassini

Buonasera, ho il piacere di segnalare il seminario online di presentazione del libro di Antonio Palmieri "Social è responsabilità!" che si terrà sotto l'egida di MediaLaws lunedì prossimo alle 18.30. Allego la locandina. Per iscrizioni, è possibile scrivere a eventi(a)medialaws.eu Un cordiale saluto e l'augurio di un buon weekend Marco Marco Bassini Bocconi University "A. Sraffa" Department of Legal Studies Via Roentgen, 1 20136 Milan - Italy room 1-C1-12 Direct (ITA) +39.02.5836.5611 Mobile (ITA) +39.329.2478832 Coordinator LL.M. in Law of Internet Technology View my LinkedIn profile<https://www.linkedin.com/in/marcobassini/> View my SSRN page<http://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=1151162> View my Google Scholar profile<https://scholar.google.it/citations?hl=en&user=wJyuA6wAAAAJ>

July 23, 2021

Re: [nexa] The Essential Facilities Doctrine in the Digital Economy: Dispelling Persistent Myths by Nikolas Guggenberger :: SSRN

by Antonio Iacono

Pubblicazione molto interessante, così come interessante è l'istituto giuridico delle "Essential Facilities". L'articolo cita giustamente la decisione dell’antitrust sul caso Enel contro Google [1][2]. Decisione contro cui Google ha, in questi giorni, deciso di ricorrere in appello [3]. La nota in cui Google lo comunica inizia con: "Nonostante i nostri sforzi e le nostre migliori intenzioni, lo scorso aprile l’AGCM ha emesso una decisione che impone una multa molto elevata ad Android Auto, un servizio che Google offre gratuitamente." "gratuitamente" non è messo lì a caso, è il nodo centrale. Le "infrastrutture essenziali", pensiamo ad aeroporti, porti, finora è stato abbastanza semplice regolarle. Prendiamo un porto, la società che lo gestisce fa pagare l'ormeggio in base alle dimensioni della barca, fine. Cosa succederebbe se il gestore stabilisse: "l'ormeggio è gratuito ma decido io chi può accedervi" ? Antonio [1] https://chillingcompetition.com/2021/05/27/the-italian-competition-authorit… [2] https://www.agcm.it/dotcmsdoc/allegati-news/A529_chiusura.pdf [3] https://www.dday.it/redazione/40073/enel-x-su-android-auto-google-ricorre-c… On Fri, Jul 23, 2021 at 7:42 AM J.C. DE MARTIN <demartin(a)polito.it> wrote: > > > https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3802559 > > > (Sent from my wireless device; please excuse brevity and typos (if any)) > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

July 23, 2021

The Essential Facilities Doctrine in the Digital Economy: Dispelling Persistent Myths by Nikolas Guggenberger :: SSRN

by J.C. DE MARTIN

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3802559 (Sent from my wireless device; please excuse brevity and typos (if any))

July 23, 2021

Re: [nexa] AI based GitHub copilot

by Maurizio Napolitano

> secondo me nulla eguaglierà mai il cut'n paste da Stack Overflow :-)) > Ho installato il plugin di copilot per vscode dimenticando di averlo fatto anche perché, al tempo, ero in lista di attesa. Settimana scorsa avevo necessità di scrivere del codice python abbastanza noioso (uno scraper html e json) Con mia sorpresa vedo vscode che oltre a farmi il solito lavoro di completamento dei metodi degli oggetti mi suggerisce pezzi di codice come cicli et simila ... in pratica mi è sembrato di fare il copia incolla da stack overflow senza dover aprire il browser. A quel punto ho costruito un commento di una funzione come se fosse la descrizione di una richiesta a stack overflow, e mi è apparso il codice della funzione. In poco tempo però ho trovato la cosa irritante visto che era un continuo "attento a non accettare che poi ti tocca correggere quello che arriva" arrivando quindi ad evitare di commettare le funzioni che scrivevo. Ammetto di essere un pessimo developer My2cents -- -- Le informazioni contenute nella presente comunicazione sono di natura privata e come tali sono da considerarsi riservate ed indirizzate esclusivamente ai destinatari indicati e per le finalità strettamente legate al relativo contenuto. Se avete ricevuto questo messaggio per errore, vi preghiamo di eliminarlo e di inviare una comunicazione all’indirizzo e-mail del mittente. -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you received this in error, please contact the sender and delete the material.

July 21, 2021

Group Privacy - A Defense and an Interpretation (di Luciano Floridi)

by Giacomo Tesio

This chapter identifies three problems affecting the plausibility of group privacy and argue in favor of their resolution. The first problem concerns the nature of the groups in question. It argues that groups are neither discovered nor invented, but designed by the level of abstraction (LoA) at which a specific analysis of a social system is developed. Their design is therefore justified insofar as the purpose, guiding the choice of the LoA, is justified. This should remove the objection that groups cannot have a right to privacy because groups are mere artefacts (there are no groups, only individuals) or that, even if there are groups, it is too difficult to deal with them. The second problem concerns the possibility of attributing rights to groups. It is argued that the same logic of attribution of a right to individuals may be used to attribute a right to a group, provided one modifies the LoA and now treats the whole group itself as an individual. This should remove the objection that, even if groups exist and are manageable, they cannot be treated as holders of rights. The third problem concerns the possibility of attributing a right to privacy to groups. Here, the paper argues that sometimes it is the group and only the group, not its members, that is correctly identified as the correct holder of a right to privacy. This should remove the objection that privacy, as a group right, is a right held not by a group as a group but rather by the group’s members severally. The solutions of the three problems supports the thesis that an interpretation of privacy in terms of a protection of the information that constitutes an individual — both in terms of a single person and in terms of a group — is better suited than other interpretations to make sense of group privacy. Continua (disponibile per intero) su https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3854483 Per quel che conta, ho trovato interessantissima la riflessione. > social groups should neither be conceived as mere conventions or > artefacts (invented) nor assumed to exist before the interest in > identifying them is specified (discovered). > They are more or less correctly and successfully designed by our > epistemological interests and practices together with the ontological > constraining affordances provided by the world. Ragionando sull'attribuzione di diritti a gruppi sociali, definirli come "designed" significa riconoscere una autonomia / responsabilità politica (a chi li progetta) ma limitata dalle "constraining affordances" per cui viene effettuata la definizione [1]. > Of course the grouped (profiled) individuals may not know > that they have been profiled, e.g. by automatic algorithms, and may > never discover that they have been treated as a group. > This is not the point. > What I am arguing is that if they end up being profiled and this > profiling becomes explicit, what gives the group the initial > possibility of reacting to it is the “interested” practice of > profiling it in the first place, not some pre-existing ontological > status of the group as a group, that would allegedly predate the > profiling [...] > All this explains why profiled individuals often object not so much > to the treatment of themselves as members of a group but to the very > profiling in the first place. It is not being a slice the problem, > the problem is being severed from the cake in the first place. Questo non può non far pensare a Google FLoC: se un gruppo assume il diritto alla tutela della propria riservatezza nel momento in cui viene identificato [2], anche sostenere di non poter identificare i singoli membri del gruppo perde istantanemente rilevanza. Sulla questione se i gruppi [3] possano avere diritti, io avrei optato per una dimostrazione costruttivista: esistono moltissime leggi che assegnano diritti a gruppi determinati, dunque questi possono avere diritti. Basti pensare al primo comma dell'articolo 29 della nostra Costituzione: > La Repubblica riconosce i diritti della famiglia come società > naturale fondata sul matrimonio. Al di là delle conclusioni, che condivido pienamente, ho trovato particolarmente importante e condivisibile quanto segue: > More than a century later, privacy requires a radical > re-interpretation. Such a reinterpretation is achieved by considering > each individual person or group as constituted by his, her or its > information, and hence by understanding a breach of an individual’s > informational privacy as a form of aggression towards that > individual’s identity. [...] > > Looking at the nature of an individual person or group as being > constituted by that individual’s information enables one to > understand the right to privacy as a right to immunity from unknown, > undesired, or unintentional changes in one’s own identity as an > informational entity, both actively and passively.[...] > > The identity-constituting interpretation suggests that a group’s > informational sphere and the identity of a group are co-referential, > or two sides of the same coin. The right to privacy, both in the > active and in the passive sense just seen, shields the group’s > identity. This is why privacy is extremely valuable and ought to be > respected. [...] > > If some information is finally acknowledged to be a constitutive part > of personal and group identity, then one day it may become strictly > illegal to trade in some kinds of information, exactly as it is > illegal to trade in human organs (including one’s own) or slaves. > [...] > > A further issue that might be illuminated by looking at privacy from > an identityconstituting perspective are those of confidentiality and > intimacy, two intrinsically groupbased phenomena. [...] > Confidentiality and intimacy create a bond that is hard and slow to > forge properly, yet resilient to many external forces when finally in > place, as the group (the supra-agent) is stronger than the > constitutive agents themselves. [...] But it is also a bond > that is brittle and difficult to restore when it comes to internal > betrayal, since the disclosure, deliberate or unintentional, of some > personal information in violation of confidence can entirely and > irrecoverably destroy the intimacy and privacy of the new, > supra-agent born out of the joining agents, by painfully introducing > discord. [...] > > It is therefore a very dangerous fallacy to think that, if we protect > personal data that identify people individually, the protection of > groups of people will take care of itself. Una considerazione che invece manca nel testo riguarda le relazioni fra i gruppi stessi, laddove ciascun individuo appartiene inevitabilmente a più gruppi contemporaneamente. Se posso profilare, tracciare ed influenzare un gruppo, posso influenzare anche tutti i gruppi che lo contengono (e probabilmente quelli che ne condividono alcuni membri, seppure in modo più complesso). Dunque tutelare la privacy di un gruppo è tutelare la privacy di tutti. Un'altra considerazione interessante che non viene analizzata consiste nella relazione fra il gruppo ed i suoi membri laddove il gruppo detenga un proprio diritto alla privacy: se infatti il gruppo ha un diritto alla privacy, i membri oltre ad un diritto individuale alla tutela della propra privacy e di quella del gruppo, acquisiscono anche un DOVERE a rispettare e tutelare la privacy del gruppo stesso. Diventa infatti chiaro che diffondere dati personali su sé stessi è diffondere dati personali sul gruppo (e su tutti i suoi membri). In altri termini, come spesso ho sentito dire a Maria Chiara Pievatolo, la privacy è un po' come una mascherina chirurgica: la mia protegge voi, la vostra progegge noi. Giacomo [1] Floridi definisce "constraining affordance" a pagina 6 come "my preferred definition of data", ma sebbene il contesto dell'articolo non sia esplicitamente informatico, questa definizione è piuttosto pericolosa, in quanto omette e nasconde l'azione umana di scegliere e di esprimere (o stabilire come esprimere) una informazione in un dato impresso su un supporto. I dati sono sempre espressione diretta o indiretta ("through technological mediations", per usare le parole di Floridi) dell'uomo e come tali ne rispecchiano i limiti evolutivi e culturali nonché gli interessi politici. Noi possiamo costruire spettrometri per rappresentare (come dati che possiamo interpretare) lunghezze d'onda che non possiamo vedere, ma solo perché ne percepiamo e distinguiamo alcune. Ma il modo in cui le rappresentiamo (lunghezze d'onda) potrebbe non avere molto a che fare con la realtà sottostante, esattamente come avveniva con la teoria corpuscolare. In altri termini, i dati di un problema sono sempre espressione di una mente umana che li ha selezionati come rilevanti ed ha deciso come rappresentarli (eventualmente "through technological mediations"). Se accettiamo che l'esperienza soggettiva di un fenomeno sia distinto dal fenomeno stesso, tale esperienza va distinta sia dalla sua rappresentazione mentale (informazione) sia dalla sua rappresentazione trasferibile/comunicabile (il dato). Collassare fenomeno, informazione e dato (peraltro in una parola già abbondantemente sovraccaricata come "dato") è pericoloso perché fa apparire il dato come misura oggettiva, mentre è sempre rappresentazione di una esperienza soggettiva (seppure talvolta mediata da un automatismo che incapsula ed esegue la volontà e gli interessi di chi lo costruisce). [2] "identificato" nel senso che diventa targettizzabile, indipendentemente dall'associazione di un identificativo esplicito (come un nome od un numero) che potrebbe non essere estraibile, ad esempio, dalle matrici che una "rete neurale artificiale" opaca esegue. [3] è interessante considerare una prospettiva sistemistica alternativa rispetto questa modellazione dei gruppi come detentori di diritti: i ruoli. Laddove il gruppo aggrega individui secondo un livello di astrazione rilevante (quelli che sono predicati logici applicabili ad un insieme), il ruolo "frammenta" l'individuo secondo i suoi interessi come una proprietà dell'individuo stesso. Naturalmente è possibile passare da ruolo a gruppo e da gruppo a ruolo (da "appartenenete a" ad "appartiene a" e vice-versa), ma ragionare anche per ruoli, rivela che ogni individuo ha il diritto di scegliere di modulare la privacy rispetto a ruoli diversi in modo diverso. Il mio diritto individuale alla privacy potrebbe essere applicato separatamente a diversi ruoli (come visitatore di un sito internet, amministratore di un server, padre, marito, programmatore) e potrebbe anche includere il diritto a tenere i dati relativi ai diversi ruoli SEPARATI fra loro (ancor prima che riconducibili o meno alla mia identità). In altri termini, la mia visita ad un sito internet non dovrebbe essere accessibile ad altri che al server che la gestisce per fornirmi quanto ho esplicitamente richiesto. Cedere a terzi i dati relativi a quel ruolo costituirebbe una violazione del mio diritto a tenere separati i diversi ruoli che adotto.

July 20, 2021

Hit by a ransomware attack? Your payment may be deductible

by Stefano Traverso

Buongiorno a tutti, Condivido questo articolo che non mi sembra di aver visto circolare su questa lista. https://apnews.com/article/technology-business-government-and-politics-d8c1… Immagino che l’obiettivo sia di permettere all’azienda vittima di sopravvivere garantendo futuro a lavoratori e famiglie. Ma mi chiedo quanto sia corretto che uno stato faccia pagare ai contribuenti (quegli stessi lavoratori) i danni causati da criminali e manager negligenti. E in Italia? I ransom sono deducibili? Grazie, Stefano -- [signature_513209660] Stefano Traverso, PhD Research Lead Ermes – Intelligent Web Protection www.ermes.company<https://www.ermes.company/> Mobile : +39 331 455 9794

July 20, 2021

Re: [nexa] What is Pegasus spyware and how does it hack phones? | Surveillance | The Guardian

by 380°

Buongiorno, Alberto Cammozzo via nexa <nexa(a)server-nexa.polito.it> writes: > <https://www.theguardian.com/news/2021/jul/18/what-is-pegasus-spyware-and-ho…> > > > What is Pegasus spyware and how does it hack phones? > Pegasus can infect a phone through ‘zero-click’ attacks, which do not require any interaction from the phone’s owner to succeed. > > NSO Group software can record your calls, copy your messages and secretly film you > David Pegg and Sam Cutler > Sun 18 Jul 2021 17.00 BST > > Last modified on Mon 19 Jul 2021 09.53 BST Grazie mille Alberto per il riferimento. Purtroppo, come a me pare troppo spesso accada con molti, troppi articoli della stampa "mainstream", mancano /clamorosamente/ riferimenti alle FONTI. Tento di riparare a questa insopportabile leggerezza, almeno qui.... ANCHE PERCHÉ sono _esattamente_ i "dettagli" (di come viene raccontata la storia) a fare la differenza... oltre che la mancanza di riferimenti ai documenti tecnici. La "root news" dell'intero grappolo credo sia questa, pubblicata da Forbidden Stories [1]: https://forbiddenstories.org/about-the-pegasus-project/ «About The Pegasus Project» --8<---------------cut here---------------start------------->8--- [...] The Forbidden Stories consortium discovered that, contrary to what NSO Group has claimed for many years, including in a recent transparency report, this spyware has been widely misused. The leaked data showed that at least 180 journalists have been selected as targets in countries like India, Mexico, Hungary, Morocco and France, among others. Potential targets also include human rights defenders, academics, businesspeople, lawyers, doctors, union leaders, diplomats, politicians and several heads of states. In a letter shared with Forbidden Stories and its partners, NSO Group contended that the consortium’s reporting was based on “wrong assumptions” and “uncorroborated theories.” NSO Group insisted that the analysis of the data by journalists who were part of the Pegasus Project relied on a “misleading interpretation of leaked data from accessible and overt basic information, such as HLR Lookup services, which have no bearing on the list of the customers targets of Pegasus or any other NSO products.” HLR refers to Home Location Register – a database that is essential to operating cellular phone networks. A person with direct knowledge of NSO’s systems, speaking on the condition of anonymity, told journalists from the Pegasus Project that an HLR lookup is a key step of determining certain characteristics of a phone, such as whether it is turned on or in a country that allows Pegasus targeting. [...] The consortium met with victims from all over the world whose phone numbers appeared in the data. The forensic analyses of their phones – conducted by Amnesty International’s Security Lab and peer-reviewed by the Canadian organization Citizen Lab – was able to confirm an infection or attempted infection with NSO Group’s spyware in 85% of cases, or 37 in total. Such a rate is remarkably high given the state-of-the-art spyware is supposed to be undetectable on the device in compromises. [...] The project shines a harsh light on the business of NSO Group, which, despite claiming it vets its clients based on their human rights track records, decided to sell its product to authoritarian regimes such as Azerbaijan, the United Arab Emirates and Saudi Arabia. Insiders disclosed the important role played by the Israeli Ministry of Defense when it came to picking NSO Group’s clients. Multiple sources corroborated the fact that Israeli authorities pushed for Saudi Arabia to be added to the list of customers despite NSO Group’s hesitations. The company’s lawyer denied “NSO Group takes governmental direction regarding customers.” --8<---------------cut here---------------end--------------->8--- Credo non sfuggirà ai più smaliziati (anzi _complottisti_) di voi che il /presunto/ coinvolgimento del ministro israeliano aprirebbe scenari geopolitici interessanti in merito al cosiddetto terrorismo internazionale. Il report (che non ho ancora letto) che descrive come è stata condotta l'analisi forense è stato pubblicato da Amnesty International ieri: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-rep… «Forensic Methodology Report: How to catch NSO Group’s Pegasus» 18 July 2021, 17:00 UTC --8<---------------cut here---------------start------------->8--- [...] In this Forensic Methodology Report, Amnesty International is sharing its methodology and publishing an open-source mobile forensics tool and detailed technical indicators, in order to assist information security researchers and civil society with detecting and responding to these serious threats. This report documents the forensic traces left on iOS and Android devices following targeting with the Pegasus spyware. This includes forensic records linking recent Pegasus infections back to the 2016 Pegasus payload used to target the HRD Ahmed Mansoor. The Pegasus attacks detailed in this report and accompanying appendices are from 2014 up to as recently as July 2021. These also include so-called “zero-click” attacks which do not require any interaction from the target. Zero-click attacks have been observed since May 2018 and continue until now. Most recently, a successful “zero-click” attack has been observed exploiting multiple zero-days to attack a fully patched iPhone 12 running iOS 14.6 in July 2021. Sections 1 to 8 of this report outline the forensic traces left on mobile devices following a Pegasus infection. This evidence has been collected from the phones of HRDs and journalists in multiple countries. Finally, in section 9 the report documents the evolution of the Pegasus network infrastructure since 2016. NSO Group has redesigned their attack infrastructure by employing multiple layers of domains and servers. Repeated operational security mistakes have allowed the Amnesty International Security Lab to maintain continued visibility into this infrastructure. We are publishing a set of 700 Pegasus-related domains. [...] --8<---------------cut here---------------end--------------->8--- Saluti, 380° [...] [1] https://forbiddenstories.org/about-us/ -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

July 19, 2021

What is Pegasus spyware and how does it hack phones? | Surveillance | The Guardian

by Alberto Cammozzo

<https://www.theguardian.com/news/2021/jul/18/what-is-pegasus-spyware-and-ho…> What is Pegasus spyware and how does it hack phones? Pegasus can infect a phone through ‘zero-click’ attacks, which do not require any interaction from the phone’s owner to succeed. NSO Group software can record your calls, copy your messages and secretly film you David Pegg and Sam Cutler Sun 18 Jul 2021 17.00 BST Last modified on Mon 19 Jul 2021 09.53 BST It is the name for perhaps the most powerful piece of spyware ever developed – certainly by a private company. Once it has wormed its way on to your phone, without you noticing, it can turn it into a 24-hour surveillance device. It can copy messages you send or receive, harvest your photos and record your calls. It might secretly film you through your phone’s camera, or activate the microphone to record your conversations. It can potentially pinpoint where you are, where you’ve been, and who you’ve met. Pegasus is the hacking software – or spyware – that is developed, marketed and licensed to governments around the world by the Israeli company NSO Group. It has the capability to infect billions of phones running either iOS or Android operating systems. The earliest version of Pegasus discovered, which was captured by researchers in 2016, infected phones through what is called spear-phishing – text messages or emails that trick a target into clicking on a malicious link. Quick Guide What is in the Pegasus project data? Show Since then, however, NSO’s attack capabilities have become more advanced. Pegasus infections can be achieved through so-called “zero-click” attacks, which do not require any interaction from the phone’s owner in order to succeed. These will often exploit “zero-day” vulnerabilities, which are flaws or bugs in an operating system that the mobile phone’s manufacturer does not yet know about and so has not been able to fix. In 2019 WhatsApp revealed that NSO’s software had been used to send malware to more than 1,400 phones by exploiting a zero-day vulnerability. Simply by placing a WhatsApp call to a target device, malicious Pegasus code could be installed on the phone, even if the target never answered the call. More recently NSO has begun exploiting vulnerabilities in Apple’s iMessage software, giving it backdoor access to hundreds of millions of iPhones. Apple says it is continually updating its software to prevent such attacks. Technical understanding of Pegasus, and how to find the evidential breadcrumbs it leaves on a phone after a successful infection, has been improved by research conducted by Claudio Guarnieri, who runs Amnesty International’s Berlin-based Security Lab. “Things are becoming a lot more complicated for the targets to notice,” said Guarnieri, who explained that NSO clients had largely abandoned suspicious SMS messages for more subtle zero-click attacks. Pegasus: the spyware technology that threatens democracy – video 04:55 Pegasus: the spyware technology that threatens democracy – video For companies such as NSO, exploiting software that is either installed on devices by default, such as iMessage, or is very widely used, such as WhatsApp, is especially attractive, because it dramatically increases the number of mobile phones Pegasus can successfully attack. As the technical partner of the Pegasus project, an international consortium of media organisations including the Guardian, Amnesty’s lab has discovered traces of successful attacks by Pegasus customers on iPhones running up-to-date versions of Apple’s iOS. The attacks were carried out as recently as July 2021. Forensic analysis of the phones of victims has also identified evidence suggesting NSO’s constant search for weaknesses may have expanded to other commonplace apps. In some of the cases analysed by Guarnieri and his team, peculiar network traffic relating to Apple’s Photos and Music apps can be seen at the times of the infections, suggesting NSO may have begun leveraging new vulnerabilities. Where neither spear-phishing nor zero-click attacks succeed, Pegasus can also be installed over a wireless transceiver located near a target, or, according to an NSO brochure, simply manually installed if an agent can steal the target’s phone. Once installed on a phone, Pegasus can harvest more or less any information or extract any file. SMS messages, address books, call history, calendars, emails and internet browsing histories can all be exfiltrated. “When an iPhone is compromised, it’s done in such a way that allows the attacker to obtain so-called root privileges, or administrative privileges, on the device,” said Guarnieri. “Pegasus can do more than what the owner of the device can do.” Lawyers for NSO claimed that Amnesty International’s technical report was conjecture, describing it as “a compilation of speculative and baseless assumptions”. However, they did not dispute any of its specific findings or conclusions. NSO has invested substantial effort in making its software difficult to detect and Pegasus infections are now very hard to identify. Security researchers suspect more recent versions of Pegasus only ever inhabit the phone’s temporary memory, rather than its hard drive, meaning that once the phone is powered down virtually all trace of the software vanishes. One of the most significant challenges that Pegasus presents to journalists and human rights defenders is the fact that the software exploits undiscovered vulnerabilities, meaning even the most security-conscious mobile phone user cannot prevent an attack. “This is a question that gets asked to me pretty much every time we do forensics with somebody: ‘What can I do to stop this happening again?’” said Guarnieri. “The real honest answer is nothing.”

July 19, 2021