- nexa - server-nexa.polito.it

Android Mobile OS Snooping By Samsung, Xiaomi, Huawei and Realme Handsets
by Giacomo Tesio Oct. 17, 2021

Oct. 17, 2021

The privacy of mobile apps has been extensively studied, but much less attention has been paid to the privacy of the mobile OS itself. A mobile OS may communicate with servers to check for updates, send telemetry and so on. We undertake an in-depth analysis of the data sent by six variants of the Android OS, namely those developed by Samsung, Xiaomi, Huawei, Realme, LineageOS and /e/OS. We find that even when minimally configured and the handset is idle these vendorcustomized Android variants transmit substantial amounts of information to the OS developer and also to third-parties (Google, Microsoft, LinkedIn, Facebook etc) that have pre-installed system apps. While occasional communication with OS servers is to be expected, the observed data transmission goes well beyond this and raises a number of privacy concerns. There is no opt out from this data collection. [...] we find that sending persistent identifiers in connections is ubiquitous. Table I lists the main identifiers sent in connections on each handset. Some of these identifiers are long-lived, e.g. the IMEI (which is typically engraved on the SIM slot), hardware serial number and, on Huawei handsets, the device RSA cert [22]. These identifiers persist across factory resets of the device and are effectively permanent and indelible. Others, such as the Google Advertising Id and VAID, are user-resettable either manually or by a factory reset of the phone. But in practice that means they rarely change and act as strong device identifiers. Further, as we discuss in more detail below, most of these resettable identifiers can be relinked back to the device since long-lived identifiers are sent alongside them. [...] Additionally, Samsung, Xiaomi, Realme, Huawei, Heytap and Google also collect details of all apps installed on a handset. This is potentially more sensitive information since the set of apps installed is more likely to be unique to one handset, or a small number of handsets, and so act as a device fingerprint (especially when combined with device hardware/system configuration data). It is not clear why this data collection is needed [...] Samsung and Xiaomi both log data that can reveal user interactions occurring on a handset. Third-party system apps by Google and Microsoft also carry our event logging that can reveal user interactions. Heytap, Daily Motion and the mobile operator log events related to operation of their specific app. [...] The events logged include, for example, every opening and closing of an app window (“activities” in Android parlance) plus the duration a window is open. Since all window events appear to be logged, this can easily reveal detailed information on user handset usage. [...] Microsoft’s Swiftkey keyboard (used on the Huawei handset) also carries out extensive event logging [...] In particular, when the keyboard is used within an app then the app name, number of characters entered and an event timestamp are sent. In this way use, for example, of the searchbar, contacts and messaging apps is logged and so can easily reveal detailed information on user handset usage. [...] Several Samsung system apps use Google Analytics to log user interaction events, including windows/activities viewed plus duration and timestamp. [...] Google Play Services and the Google Play store collect large volumes of data from all of the handsets (see Figure 2). This has also been observed in other recent studies, which also note the opaque nature of this data collection (no documentation, binary encoded payloads, obfuscated code). From our discussions with Google we understand that they plan to publish documentation on this data collection/telemetry, but to date that has not happened. [...] In response to privacy concerns, identifiers used to track user behaviour are now often resettable [23]. For example, the Google Advertising Identifier (GAID) can be reset via the Settings app on an Android handset. The idea is that by resetting such an identifier a person effectively unlinks themselves from the data collected about them in the past and starts afresh. However, this aim is largely subverted as the data collected allows relinking of the new identifier to the same physical user/handset. We find that data collection allowing the potential for relinking is commonplace. [...] We find that typically multiple parties collect data from a handset. For example, on a Samsung handset Samsung, Google and Microsoft/LinkedIn all collect data. That raises the question of whether the data collected separately by these parties can be linked together (and of course combined with data from other sources). While we are not in a position to know whether such linking actually takes place, by inspection of the identifiers jointly collected by the parties we can see whether the potential exists for data linking [...] Continua con maggiori dettagli su: https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pdf Giacomo

1 1

prime condanna in Italia per caporalato digitale Tribunale di Milano 15 ottobre 02021
by Mauro Alovisio Oct. 17, 2021

Oct. 17, 2021

Gent.me/mi segnalo, in attesa di leggere le motivazioni, interessante sentenza del Tribunale di Milano che condannato impresa per l’intermediazione illecita e per lo sfruttamento del lavoro dei ciclo-fattorini del servizio Uber Eat per approfondimenti: https://www.corrierecomunicazioni.it/digital-economy/caporalato-digitale-pr… https://www.affaritaliani.it/milano/condanna-per-caporalato-su-rider-440mil… Cordiali saluti Mauro Alovisio

1 0

What the Facebook Whistleblower Tells Us About Big Tech | Electronic Frontier Foundation
by J.C. DE MARTIN Oct. 17, 2021

Oct. 17, 2021

https://www.eff.org/deeplinks/2021/10/what-facebook-whistleblower-tells-us-… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Facebook banned me for life because I created the tool Unfollow Everything.
by J.C. DE MARTIN Oct. 17, 2021

Oct. 17, 2021

https://slate.com/technology/2021/10/facebook-unfollow-everything-cease-des… (Sent from my wireless device; please excuse brevity and typos (if any))

4 4

A new high-end RISC-V 64 implementation(Under GPLv3)
by Giacomo Tesio Oct. 16, 2021

Oct. 16, 2021

Ciao, vi segnalo un progetto interessante di open hardware: Very high end RISC-V implementation – goal cloud server class Out of order, super scalar, speculative RV64-IMAFDCHB(V) Up to 8 IPC (instructions per clock) peak, goal ~4 average on ALU heavy work 2-way simultaneous multithreading capable Multi-core Early (low) dhrystone numbers: ~2 DMips/MHz - still a work in progress. Goal ~5 with working BTC Currently boots Linux on an AWS-FPGA instance GPL3 – dual licensing possible https://moonbaseotago.github.io/talk/index.html https://github.com/MoonbaseOtago/vroom Si tratta del tipo di progetti su cui un Paese con un minimo di cultura cibernetica e politica industriale potrebbe investire. Non l'Italia, naturalmente, che da noi la politica industriale consiste sempre nel sovvenzionare i cantori del libero mercato. Giacomo PS naturalmente il progetto in sé è ancora in una fase embrionale, sebbene possa già eseguire Linux su una FPGA emulata. L'introduzione dell'esecuzione speculativa in una nuova CPU dopo Meltdown e Spectre è andarsi a cercar grane col lanternino. Tuttavia secondo me rimane un punto di partenza interessante.

2 1

Amazon copied products and rigged search results, documents show
by J.C. DE MARTIN Oct. 16, 2021

Oct. 16, 2021

https://www.reuters.com/investigates/special-report/amazon-india-rigging/ (Sent from my wireless device; please excuse brevity and typos (if any))

3 2

Paper: “Bugs in our Pockets: The Risks of Client-Side Scanning”
by J.C. DE MARTIN Oct. 15, 2021

Oct. 15, 2021

https://regmedia.co.uk/2021/10/14/key_risks_paper.pdf Bugs in our Pockets: The Risks of Client-Side Scanning Embargoed until 0200 CET Oct 15 Ross Anderson Steven M. Bellovin Matt Blaze Jon Callas Peter G. Neumann Jeffrey I. Schiller Bruce Schneier Carmela Troncoso October 14, 2021 Executive Summary Whitfield Diffie Ronald L. Rivest Vanessa Teague Susan Landau Our increasing reliance on digital technology for personal, economic, and government affairs has made it essential to secure the communications and devices of private citizens, businesses, and governments. This has led to pervasive use of cryptography across society. Despite its evident advantages, law enforcement and national security agencies have argued that the spread of cryptography has hindered access to evidence and intelligence. Some in industry and government now advocate a new technology to access targeted data: client-side scanning (CSS). Instead of weakening encryption or providing law enforcement with backdoor keys to decrypt communications, CSS would enable on-device analysis of data in the clear. If targeted information were detected, its existence and, potentially, its source, would be revealed to the agencies; otherwise, little or no information would leave the client device. Its proponents claim that CSS is a solution to the encryption versus public safety debate: it offers privacy—in the sense of unimpeded end-to-end encryption—and the ability to successfully investigate serious crime. In this report, we argue that CSS neither guarantees efficacious crime prevention nor prevents surveillance. Indeed, the effect is the opposite. CSS by its nature creates serious security and privacy risks for all society while the assistance it can provide for law enforcement is at best problematic. There are multiple ways in which client-side scanning can fail, can be evaded, and can be abused. Its proponents want CSS to be installed on all devices, rather than installed covertly on the devices of suspects, or by court order on those of ex-offenders. But 1 universal deployment threatens the security of law-abiding citizens as well as law- breakers. Technically, CSS allows end-to-end encryption, but this is moot if the message has already been scanned for targeted content. In reality, CSS is bulk in- tercept, albeit automated and distributed. As CSS gives government agencies access to private content, it must be treated like wiretapping. In jurisdictions where bulk intercept is prohibited, bulk CSS must be prohibited as well. Although CSS is represented as protecting the security of communications, the technology can be repurposed as a general mass-surveillance tool. The fact that CSS is at least partly done on the client device is not, as its proponents claim, a security feature. Rather, it is a source of weakness. As most user devices have vulnerabilities, the surveillance and control capabilities provided by CSS can potentially be abused by many adversaries, from hostile state actors through criminals to users’ intimate partners. Moreover, the opacity of mobile operating systems makes it difficult to verify that CSS policies target only material whose illegality is uncontested. The introduction of CSS would be much more privacy invasive than previous proposals to weaken encryption. Rather than reading the content of encrypted com- munications, CSS gives law enforcement the ability to remotely search not just com- munications, but information stored on user devices. Introducing this powerful scanning technology on all user devices without fully understanding its vulnerabilities and thinking through the technical and policy con- sequences would be an extremely dangerous societal experiment. Given recent expe- rience in multiple countries of hostile-state interference in elections and referenda, it should be a national-security priority to resist attempts to spy on and influence law- abiding citizens. CSS makes law-abiding citizens more vulnerable with their personal devices searchable on an industrial scale. Plainly put, it is a dangerous technology. Even if deployed initially to scan for child sex-abuse material, content that is clearly illegal, there would be enormous pressure to expand its scope. We would then be hard-pressed to find any way to resist its expansion or to control abuse of the system. The ability of citizens to freely use digital devices, to create and store content, and to communicate with others depends strongly on our ability to feel safe in doing so. The introduction of scanning on our personal devices—devices that keep information from to-do notes to texts and photos from loved ones—tears at the heart of privacy of individual citizens. Such bulk surveillance can result in a significant chilling effect on freedom of speech and, indeed, on democracy itsel (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

he lawful purchaser of a computer program is entitled to decompile all or part of that program in order to correct errors affecting its operation
by Alberto Cammozzo Oct. 14, 2021

Oct. 14, 2021

<https://curia.europa.eu/juris/document/document.jsf?docid=247056&text=&dir=…> The request has been made in proceedings between Top System SA and the Belgian State concerning the decompilation by SELOR, the Selection Office of the Federal Authorities (Belgium), of a computer program developed by Top System and forming part of an application in respect of which that selection office holds a user licence. [...] By its first question, the referring court asks, in essence, whether Article 5(1) of Directive 91/250 must be interpreted as meaning that the lawful purchaser of a computer program is entitled to decompile all or part of that program in order to correct errors affecting the operation of that program, including where the correction consists in disabling a function that is affecting the proper operation of the application of which the program forms a part. [...] In the light of the foregoing considerations, the answer to the first question referred is that Article 5(1) of Directive 91/250 must be interpreted as meaning that the lawful purchaser of a computer program is entitled to decompile all or part of that program in order to correct errors affecting its operation, including where the correction consists in disabling a function that is affecting the proper operation of the application of which that program forms a part. [...]

1 0

Google creates tools to track carbon footprint, emissions data
by Giuseppe Attardi Oct. 13, 2021

Oct. 13, 2021

Non so quanto questo risponda alla richiesta di Giovanna Sissa di rendere visibili i consumi di carbonio dei servizi cloud: https://www.zdnet.com/article/google-creates-tools-to-track-carbon-footprin…

4 4

Hundreds of professional footballers threaten legal action over use of data
by don Luca Peyron Oct. 12, 2021

Oct. 12, 2021

The players argue leading companies are profiting from their personal data. Under Article 4 of the GDPR, “personal data” refers to a range of identifiable information, such as physical attributes or physiological information. Buona lettura dl https://www.theguardian.com/football/2021/oct/12/hundreds-of-professional-f… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0