October 2025 - nexa - server-nexa.polito.it

Re: [nexa] Chat control: sicurezza o sorveglianza? Anatomia critica di un regolamento europeo
by alessandro marzocchi Oct. 8, 2025

Oct. 8, 2025

380° ha scritto Date: Fri, 26 Sep 2025 14:16:56 +0200 > From: 380° <g380(a)biscuolo.net> > Subject: [nexa] Chat control: sicurezza o sorveglianza? Anatomia > critica di un regolamento europeo > Buongiorno, > segnalo questo ottimo articolo apparso ieri su Diritto.it firmato > dall'Avv. Luisa Di Giacomo ... ... ... > Le discussioni su Chat Control non riguardano soltanto algoritmi, > crittografia, interoperabilità o compliance normativa ... ... ... quanto > siamo disposti a > sacrificare, in termini di libertà e diritti, nel nome della > sicurezza? Il regolamento CSAR – è una proposta non ancora approvata – vuole prevenire abusi sessuali, evitare che accadano, questa è l’ottica di valutazione. Gli statunitensi si appellano alla libertà assicurata dalla loro costituzione Usa e comprano armi senza controlli preventivi, per noi europei sarebbe impensabile. ********* > Il vero pericolo è la *normalizzazione del controllo*: > l'abitudine a essere osservati, scansionati, valutati. È il lento > scivolamento verso un paradigma in cui la privacy non è più il > default, ma un privilegio da conquistarsi; in cui la trasparenza è > richiesta solo al cittadino, mentre le decisioni automatizzate restano > opache e inaccessibili. In questa ottica più ampia, osservo che il digitale cambia molto dell’esperienza precedente, alla sorveglianza di massa opporrei la trasparenza di massa, GAFAM deve rendermi disponibili e trasparenti tutti i suoi dati fino al codice sorgente senza alcuna protezione nè riserva. La trasparenza totale dovrebbe essere la richiesta di noi umani al digitale, inclusa l'alfabetizzazione digitale. Nell'attesa ... GAFAM continua a padroneggiare e schiavizzarci. Buona domenica. Duccio (Alessandro Marzocchi)

7 8

MEMENTO | 187° Mercoledì di Nexa | 8 ottobre 2025, ore 17.00
by Nexa - Media Oct. 6, 2025

Oct. 6, 2025

Gentilissime, gentilissimi, Vi ricordiamo che mercoledì 8 ottobre, alle ore 17.00, si terrà il 187° Mercoledì di Nexa con un incontro dal titolo "L’Era dei Tecno-stati: USA e Cina nella battaglia per la supremazia tecnologica". Ospite dell'incontro: Paolo Gerbaudo (Università Complutense di Madrid). L'incontro si terrà IN PRESENZA e ONLINE. SEDE FISICA dell'incontro: Centro Nexa su Internet e Società, Politecnico di Torino, Via Boggio 65/a, Torino (1° piano). Per accedere alla sala si raccomanda di suonare al citofono Portineria e di seguire le indicazioni segnalate lungo il percorso. QUI<https://nexa.polito.it/contatti> maggiori informazioni su come raggiungerci. STANZA VIRTUALE dell'incontro: https://didattica.polito.it/VClass/NexaEvent Maggiori informazioni alla pagina: https://nexa.polito.it/mercoledi-187 Un saluto cordiale, -- Valeria Bergantino Communication Manager Nexa Center for Internet & Society Politecnico di Torino - DAUIN Via Pier Carlo Boggio, 65/A - 10138 Torino web: https://nexa.polito.it/ mail: valeria.bergantino(a)polito.it<mailto:valeria.bergantino@polito.it> tel: 3473443585

1 0

F-Droid and Google's Developer Registration Decree
by Giacomo Tesio Oct. 4, 2025

Oct. 4, 2025

For the past 15 years, F-Droid has provided a safe and secure haven for Android users around the world to find and install free and open source apps. When contrasted with the commercial app stores — of which the Google Play store is the most prominent — the differences are stark: they are hotbeds of spyware and scams, blatantly promoting apps that prey on their users through attempts to monetize their attention and mine their intimate information through any means necessary, including trickery and dark patterns. F-Droid is different. It distributes apps that have been validated to work for the user’s interests, rather than for the interests of the app’s distributors. The way F-Droid works is simple: when a developer creates an app and hosts the source code publicly somewhere, the F-Droid team reviews it, inspecting it to ensure that it is completely open source and contains no undocumented anti-features such as advertisements or trackers. Once it passes inspection, the F-Droid build service compiles and packages the app to make it ready for distribution. The package is then signed either with F-Droid’s cryptographic key, or, if the build is reproducible, enables distribution using the original developer’s private key. In this way, users can trust that any app distributed through F-Droid is the one that was built from the specified source code and has not been tampered with. Do you want a weather app that doesn’t transmit your every movement to a shadowy data broker? Or a scheduling assistant that doesn’t siphon your intimate details into an advertisement network? F-Droid has your back. Just as sunlight is the best disinfectant against corruption, open source is the best defense against software acting against the interests of the user. # Google’s move to break free app distribution The future of this elegant and proven system was put in jeopardy last month, when Google unilaterally decreed that Android developers everywhere in the world are going to be required to register centrally with Google. In addition to demanding payment of a registration fee and agreement to their (non-negotiable and ever-changing) terms and conditions, Google will also require the uploading of personally identifying documents, including government ID, by the authors of the software, as well as enumerating all the unique “application identifiers” for every app that is to be distributed by the registered developer. The F-Droid project cannot require that developers register their apps through Google, but at the same time, we cannot “take over” the application identifiers for the open-source apps we distribute, as that would effectively seize exclusive distribution rights to those applications. If it were to be put into effect, the developer registration decree will end the F-Droid project and other free/open-source app distribution sources as we know them today, and the world will be deprived of the safety and security of the catalog of thousands of apps that can be trusted and verified by any and all. F-Droid’s myriad users will be left adrift, with no means to install — or even update their existing installed — applications. (How many F-Droid users are there, exactly? We don’t know, because we don’t track users or have any registration: “No user accounts, by design”) # The Security Canard While directly installing — or “sideloading” — software can be construed as carrying some inherent risk, it is false to claim that centralized app stores are the only safe option for software distribution. Google Play itself has repeatedly hosted malware, proving that corporate gatekeeping doesn’t guarantee user protection. By contrast, F-Droid offers a trustworthy and transparent alternative approach to security: every app is free and open source, the code can be audited by anyone, the build process and logs are public, and reproducible builds ensure that what is published matches the source code exactly. This transparency and accountability provides a stronger basis for trust than closed platforms, while still giving users freedom to choose. Restricting direct app installation not only undermines that choice, it also erodes the diversity and resilience of the open-source ecosystem by consolidating control in the hands of a few corporate players. Furthermore, Google’s framing that they need to mandate developer registration in order to defend against malware is disingenuous because they already have a remediation mechanism for malware they identify on a device: the Play Protect service that is enabled on all Android Certified devices already scans and disables apps that have been identified as malware, regardless of their provenience. Any perceived risks associated with direct app installation can be mitigated through user education, open-source transparency, and existing security measures without imposing exclusionary registration requirements. We do not believe that developer registration is motivated by security. We believe it is about consolidating power and tightening control over a formerly open ecosystem. Continua su <https://f-droid.org/en/2025/09/29/google-developer-registration-decree.html> Se Google ci riesce, il DMA è carta straccia. Giacomo

1 0

One Token to rule them all (aka God Mode Vulnerability in Microsoft's cloud services).
by 380° Oct. 3, 2025

Oct. 3, 2025

Buongiorno, di recente è stato rivelato un _enorme_ baco di sicurezza nei servizi cloud (pubblici) di Microsoft. Tranquili: tutt'apposto!!! B-) Piccola premessa: Microsoft Entra ID è il sistema di autenticazione per accedere ai servizi cloud (multi-tenant); dettagli qui: https://en.wikipedia.org/wiki/Microsoft_Entra_ID «One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens» September 17, 2025 https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-ac… --8<---------------cut here---------------start------------->8--- [...] This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments [1]). If you are an Entra ID admin reading this, yes that means complete access to your tenant. The vulnerability consisted of two components: undocumented impersonation tokens, called “Actor tokens”, that Microsoft uses in their backend for service-to-service (S2S) communication. Additionally, there was a critical flaw in the (legacy) Azure AD Graph API that failed to properly validate the originating tenant, allowing these tokens to be used for cross-tenant access. Effectively this means that with a token I requested in my lab tenant I could authenticate as /any user/, including Global Admins, in /any other tenant/. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants. Since the Azure AD Graph API is an older API for managing the core Azure AD / Entra ID service, access to this API could have been used to make any modification in the tenant that Global Admins can do, including taking over or creating new identities and granting them any permission in the tenant. With these compromised identities the access could also be extended to Microsoft 365 and Azure. I reported this vulnerability the same day to the Microsoft Security Response Center (MSRC). Microsoft fixed this vulnerability on their side within days of the report being submitted and has rolled out further mitigations that block applications from requesting these Actor tokens for the Azure AD Graph API. Microsoft also issued [CVE-2025-55241] for this vulnerability. [CVE-2025-55241] <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241> [...] Practical abuse ──────────────── With this vulnerability it would be possible to compromise any Entra ID tenant. Starting with an Actor token from an attacker controlled tenant, the following steps would lead to full control over the victim tenant: 1. Find the tenant ID for the victim tenant, this can be done using public APIs based on the domain name. 2. Find a valid `netId' of a regular user in the tenant. Methods for this will be discussed below. 3. Craft an impersonation token with the Actor token from the attacker tenant, using the tenant ID and `netId' of the user in the victim tenant. 4. List all Global Admins in the tenant and their `netId'. 5. Craft an impersonation token for the Global Admin account. 6. Perform any read or write action over the Azure AD Graph API. [...] Compromising tenants by hopping over B2B trusts ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌ I previously mentioned that a users `netId' is used to establish links between a user account in multiple tenants. This is something that I researched a few years ago when I gave a talk at [Black Hat USA 22] about external identities. [...] To abuse this, a threat actor could perform the following steps, given that they have access to at least one tenant with a guest user: 1. Query the guest users and their `alternativeSecurityIds' attribute which gives the `netId'. 2. Query the tenant ID of the guest users home tenant based on the domain name in their UPN. 3. Create an impersonation token, impersonating the victim in their home tenant. 4. Optionally list Global Admins and impersonate those to compromise the entire tenant. 5. Repeat step 1 for each tenant that was compromised. The steps above can be done in 2 API calls per tenant, which do not generate any logs. Most tenants will have guest users from multiple distinct other tenants. [...] Looking at the list of guest users in the tenants of some of my clients, this technique would be extremely powerful. I also observed that one of the first tenants you will likely compromise is Microsoft's own tenant, since Microsoft consultants often get invited to customer tenants. Many MSPs and Microsoft Partners will have a guest account in the Microsoft tenant, so from the Microsoft tenant a compromise of most major service provider tenants is one step away. [...] Conclusion ─────────── This blog discussed a critical token validation failure in the Azure AD Graph API. While the vulnerability itself was a bad oversight in the token handling, the whole concept of Actor tokens is a protocol that was designed to behave with all the properties mentioned in the paragraphs above. If it weren't for the complete lack of security measures in these tokens, I don't think such a big impact with such limited telemetry would have been possible. Thanks to the people at MSRC who immediately picked up the vulnerability report, searched for potential variants in other resources, and to the engineers who followed up with fixes for the Azure AD Graph and blocked Actor tokens for the Azure AD Graph API requested with credentials stored on Service Principals, essentially restricting the usage of these Actor tokens to only Microsoft internal services. Disclosure timeline ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌ • July 14, 2025 - reported issue to MSRC. • July 14, 2025 - MSRC case opened. • July 15, 2025 - reported further details on the impact. • July 15, 2025 - MSRC requested to halt further testing of this vulnerability. • July 17, 2025 - Microsoft pushed a fix for the issue globally into production. • July 23, 2025 - Issue confirmed as resolved by MSRC. • August 6, 2025 - Further mitigations pushed out preventing Actor tokens being issued for the Azure AD Graph with SP credentials. • September 4, 2025 - [CVE-2025-55241] issued. • September 17, 2025 - Release of this blogpost. [CVE-2025-55241] <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241> Footnotes ───────── [1] I do not have access to any tenants in a national cloud deployment, so I was not able to test whether the vulnerability existed there. Since national cloud deployments use their own token signing keys, it is unlikely that it would have been possible to execute this attack from a tenant in the public cloud to one of these national clouds. I do consider it likely that this attack would have worked across tenants in the same national cloud deployments, but that is speculation. --8<---------------cut here---------------end--------------->8--- Saluti, 380° -- 380° (lost in /traslation/) «Welcome to the chaos of the times If you go left and I go right Pray we make it out alive This is Karmageddon»

1 0

l'incomprensibile alfabeto arabo ... alfabetizzazione digitale
by alessandro marzocchi Oct. 1, 2025

Oct. 1, 2025

> > > Date: Wed, 1 Oct 2025 07:08:55 +0200 > From: "J.C. DE MARTIN" <juancarlos.demartin(a)polito.it> > To: Nexa <nexa(a)server-nexa.polito.it> > Subject: Re: [nexa] انضم لحساب Canva Pro مجانًا > الآن > > Visto che è la seconda volta che qualcuno si iscrive alla lista e poi > manda spam, da questo momento in avanti le iscrizioni alla lista > verranno vagliate (prima erano libere). Forse non è stato solo mio il disagio davanti al codice arabo: non è quello cui siamo abituati, a me sembra lo stesso problema che si verifica quando si passa dal codice alfabetico a quello digitale, il primo ci è familiare, ci siamo nati e cresciuti, il digitale ... ""è arabo"", ma lo si può imparare, anche se pochissimi arriveranno a scrivere le mille e una notte (in arabo <https://it.wikipedia.org/wiki/Lingua_araba> ألف ليلة وليلة‎? <https://it.wikipedia.org/wiki/Aiuto:Arabo>, *ʾAlf layla wa layla*; in persiano <https://it.wikipedia.org/wiki/Lingua_persiana> *هزار و یک شب*‎, *Hezār-o yek šab*) ridotto ai minimi termini è quanto propongo con l'alfabetizzazione digitale convinto che quest'ultimo è il nuovo alfabeto. Ovviamente non metto in discussione parole e decisioni di J.C. De Martin. Cordialmente. Duccio (Alessandro Marzocchi)

5 5

Save the date! GIG-ARTS 2026: 14-15 May 2026 Dublin
by Mauro SANTANIELLO Oct. 1, 2025

Oct. 1, 2025

Dear colleagues, The Tenth European Multidisciplinary Conference on Global Internet Governance Actors, Regulations, Transactions and Strategies will be held in *Dublin, Ireland, on 14-15 May 2026*. This edition will be hosted by Dublin City University (DCU) and co-chaired by Edoardo Celeste, Tetyana Lokot, and Mauro Santaniello. The main theme of GIG-ARTS 2026 will be “*Digital Futures, Sustainable Freedoms: Rights, Responsibilities and Governance*”. Save the date and stay tuned—the full Call for Papers will be released soon! To receive the latest news directly, subscribe to our mailing list <https://gig-arts.eu/mailman/listinfo/mailinglist_gig-arts.eu>. Best regards, GIG-ARTS 2026 Organizing Committee: Edoardo Celeste, Tetyana Lokot, Mauro Santaniello

1 0

انضم لحساب Canva Pro مجانًا الآن
by jib l3azz Oct. 1, 2025

Oct. 1, 2025

انضم الآن إلى حساب Canva Pro مجانًا عبر رابط الدعوة المخصص للمعلمين والطلاب في 2025، واستفد من جميع المزايا المدفوعة دون أي تكلفة. في هذا المقال نوضح لك كيفية الحصول على دعوة مجانية لحساب Canva Pro Edu، وما الذي يميزه عن الحسابات الأخرى، والخطوات العملية للتسجيل. https://www.targir.com/2025/02/canva-pro.html ما هو Canva Pro؟ Canva منصة تصميم مشهورة عالميًا تتيح إنشاء عروض تقديمية، ملصقات، منشورات اجتماعية، فيديوهات وغير ذلك بسهولة. الحساب المجاني يوفر أدوات وقوالب محدودة، بينما يقدم Canva Pro مكتبة ضخمة من الصور والفيديوهات، أدوات احترافية مثل إزالة الخلفية، وتخزين سحابي بسعة كبيرة. أنواع الحسابات الحساب المجاني: يتيح الوصول لآلاف القوالب وصور ورسومات محدودة، مع 5 جيجا تخزين. مناسب للمبتدئين. Canva Pro: مدفوع يوفر أكثر من 100 مليون صورة، قوالب متميزة، 1 تيرابايت تخزين، وأدوات مثل تغيير مقاسات التصميم. Canva Teams: مصمم للمؤسسات، مع مزايا تعاون فوري وتخصيص العلامة التجارية. Canva Pro Edu: مجاني للمعلمين والطلاب، يحتوي على جميع ميزات Canva Pro بالإضافة إلى أدوات تعليمية. كيف تحصل على Canva Pro Edu مجانًا؟ – التسجيل عبر رابط دعوة رسمي خاص بالتعليم. – إنشاء حساب جديد أو استخدام بريدك التعليمي إن توفر. – بعد قبول الدعوة، يتحول حسابك تلقائيًا إلى Canva Pro Edu مجاني بكامل المزايا. ماذا تحتاج للتسجيل؟ – أن تكون معلمًا أو طالبًا بمؤسسة تعليمية. – بريد إلكتروني مرتبط بالتعليم (مثل edu). – الانضمام عبر رابط دعوة نشط. هل يمكن الحصول على Canva Pro بطرق أخرى؟ نعم، هناك نسخة تجريبية مجانية لمدة 30 يومًا متاحة للجميع عبر الموقع الرسمي. خلال هذه الفترة تستمتع بجميع المزايا، ويمكنك إلغاء الاشتراك قبل انتهائها لتجنب الرسوم. أما الحصول على Canva Pro شخصي دائمًا بشكل مجاني فغير ممكن إلا عبر الدعوة التعليمية. أهم المزايا التي يقدمها Canva Pro Edu مجانًا – مكتبة تضم أكثر من 100 مليون صورة ورسوم وفيديوهات. – أكثر من 600 ألف قالب احترافي. – أدوات متقدمة مثل إزالة الخلفية وتغيير مقاسات التصاميم. – تخزين سحابي 1 تيرابايت. – إمكانية العمل الجماعي مع الطلاب والزملاء على مشاريع مشتركة. لماذا تختار Canva Pro Edu؟ هذا الحساب يمنحك جميع أدوات Canva Pro دون تكلفة، وهو مثالي للمدرسين لإعداد دروس تفاعلية، وللطلاب لإنشاء مشاريع وعروض احترافية. يساعدك على رفع جودة أعمالك ويوفر موارد ضخمة جاهزة للاستخدام. خاتمة إذا كنت طالبًا أو معلمًا، فإن أفضل طريقة للحصول على Canva Pro مجانًا هي عبر رابط الدعوة إلى Canva Pro Edu. بهذه الخطوة ستفتح لك جميع الأدوات المميزة دون أي رسوم. سجّل الآن واستفد من فرصة مذهلة تتيح لك تطوير تصاميمك التعليمية والشخصية، والوصول إلى مستوى احترافي باستخدام Canva Pro Edu في 2025.

3 2