- nexa - server-nexa.polito.it

In epic hack, Signal developer turns the tables on forensics firm Cellebrite | Ars Technica
by Alberto Cammozzo April 22, 2021

April 22, 2021

<https://arstechnica.com/information-technology/2021/04/in-epic-hack-signal-…> For years, Israeli digital forensics firm Cellebrite has helped governments and police around the world break into confiscated mobile phones, mostly by exploiting vulnerabilities that went overlooked by device manufacturers. Now, Moxie Marlinspike—creator of the Signal messaging app—has turned the tables on Cellebrite. On Wednesday, Marlinspike published a post that reported vulnerabilities in Cellebrite software that allowed him to execute malicious code on the Windows computer used to analyze devices. The researcher and software engineer exploited the vulnerabilities by loading specially formatted files that can be embedded into any app installed on the device. Virtually no limits “There are virtually no limits on the code that can be executed,” Marlinspike wrote. He continued: For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question. Cellebrite provides two software packages: The UFED breaks through locks and encryption protections to collect deleted or hidden data, and a separate Physical Analyzer uncovers digital evidence (“trace events”). To do their job, both pieces of Cellebrite software must parse all kinds of untrusted data stored on the device being analyzed. Typically, software that is this promiscuous undergoes all kinds of security hardening to detect and fix any memory-corruption or parsing vulnerabilities that might allow hackers to execute malicious code. “Looking at both UFED and Physical Analyzer, though, we were surprised to find that very little care seems to have been given to Cellebrite’s own software security,” Marlinspike wrote. “Industry-standard exploit mitigation defenses are missing, and many opportunities for exploitation are present.” Compromising integrity One example of this lack of hardening was the inclusion of Windows DLL files for audio/video conversion software known as FFmpeg. The software was built in 2012 and hasn’t been updated since. Marlinspike said that in the intervening nine years, FFmpeg has received more than 100 security updates. None of those fixes are included in the FFmpeg software bundled into the Cellebrite products. Marlinspike included a video that shows UFED as it parses a file he formatted to execute arbitrary code on the Windows device. The payload uses the MessageBox Windows API to display a benign message, but Marlinspike said that “it’s possible to execute any code, and a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” Our latest blog post explores vulnerabilities and possible Apple copyright violations in Cellebrite's software: "Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective"https://t.co/DKgGejPu62 pic.twitter.com/X3ghXrgdfo — Signal (@signalapp) April 21, 2021 Marlinspike said he also found two MSI installer packages that are digitally signed by Apple and appear to have been extracted from the Windows installer for iTunes. Marlinspike questioned if the inclusion constitutes a violation of Apple copyrights. Apple didn't immediately provide a comment when asked about this. In an email, a Cellebrite representative wrote: "Cellebrite is committed to protecting the integrity of our customers’ data, and we continually audit and update our software in order to equip our customers with the best digital intelligence solutions available." The representative didn't say if company engineers were aware of the vulnerabilities Marlinspike detailed or if the company had permission to bundle Apple software. Marlinspike said he obtained the Cellebrite gear in a “truly unbelievable coincidence” as he was walking and “saw a small package fall off a truck ahead of me.” The incident does seem truly unbelievable. Marlinspike declined to provide additional details about precisely how he came into possession of the Cellebrite tools. The fell-of-a-truck line wasn't the only tongue-in-cheek statement in the post. Marlinspike also wrote: In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software. Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. There is no other significance to these files. The vulnerabilities could provide fodder for defense attorneys to challenge the integrity of forensic reports generated using the Cellebrite software. Cellebrite representatives didn’t respond to an email asking if they were aware of the vulnerabilities or had plans to fix them. “We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future,” Marlinspike wrote.

2 1

Le mirabolanti avventure di Lovelace e Babbage
by Antonio Iacono April 21, 2021

April 21, 2021

Una segnalazione che, sono sicuro, farà piacere agli amanti della storia del computer e del ... fumetto :) https://www.oscarmondadori.it/libri/le-mirabolanti-avventure-di-lovelace-e-… o, in inglese The Thrilling Adventures of Lovelace and Babbage: The (Mostly) True Story of the First Computer https://www.penguin.co.uk/books/286/286982/the-thrilling-adventures-of-love… Antonio

1 0

Neuralink Could Sell Your Private Thoughts to the Highest Bidder
by Antonio Iacono April 21, 2021

April 21, 2021

Last week, Elon Musk’s neural implant company Neuralink released a video of a primate, who’d been implanted with its technology, playing the game “Pong” with its thoughts. The technologically flashy but otherwise disappointing demo — neuroscientists first developed and demonstrated mind-control tech in primates decades ago — represented Neuralink’s growing prominence in the public sphere, and raised important questions about privacy, data ownership, and biomedical ethics. [1] Antonio [1] https://futurism.com/neoscope/expert-neuralink-sell-private-thoughts-highes…

1 0

superare il capitalismo della sorveglianza
by Alberto Cammozzo April 21, 2021

April 21, 2021

Cari Nexiani, a vostro avviso quali sono i progetti più promettenti o più ambiziosi per superare l'attuale impasse attorno alle piattaforme a il loro soffocante modello di business? Vorrei dare agli studenti degli input basati su un certo ottimismo (della ragione, se non dello spirito) e vedo alcuni vettori la cui composizione rende possibile (anche se non probabile) il superamento del SC: 1) *architetture* IT: progetti che favoriscano decentralizzazione, policentizzazione, disacoppiamento dati/identità, proprietà dei dati personali, anonimizzazione, cifratura, ... 2) *leggi*: regolazioni che pongano limiti a certi tipi di trattamento, alla concentrazione di mercato, all'accentramento, vedi Digital Services Act & Digital Markets Act ... 3) *norme* sociali e comportamenti: crescente sensibilità verso la privacy, paura della manipolazione, connotazione negativa per chi usa certe piattaforme, noluddismo, rebound offline post-pandemico ... 4) *mercato* : fine del modello di business legato alla pubblicità (perché scoperto non redditivo, ...), crescente inefficienza dei monopoli, ?... Che ne pensate? Grazie per ogni vostro contributo! Alberto

4 4

For Vaccine Passports, Less Tech Is Best
by Luigi Scorca April 21, 2021

April 21, 2021

https://www.nytimes.com/2021/04/20/technology/vaccine-passports-privacy.html Luigi

2 1

NYTimes: A Global Tipping Point for Reining In Tech Has Arrived
by J.C. DE MARTIN April 20, 2021

April 20, 2021

A Global Tipping Point for Reining In Tech Has Arrived https://www.nytimes.com/2021/04/20/technology/global-tipping-point-tech.htm… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Should the internet be treated like a public utility? - Harvard Law Today
by J.C. DE MARTIN April 20, 2021

April 20, 2021

Should the internet be treated like a public utility? At Klinsky Lecture, John Palfrey ’01 says ‘absence of regulation does not make sense today, if it ever did’ By Brett Milano/HLS Correspondent, April 20, 2021 https://today.law.harvard.edu/should-the-internet-be-treated-like-a-public-… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

le stonature dell'AI
by Guido Vetere April 20, 2021

April 20, 2021

Illustri, questo mio piccolo pezzo potrebbe interessarvi e perfino divertirvi https://www.agendadigitale.eu/cultura-digitale/lintelligenza-artificiale-st… Saluti, Guido V

1 0

The interplay between standards and Open Source Software and Open Source Software and risk management
by Diego Giorio April 20, 2021

April 20, 2021

Segnalo questa iniziativa gratuita, che credo possa interessare qualche nexiano: https://www.berggren.eu/en/live-radio-upcoming-episodes [https://www.berggren.eu/hubfs/Live%20Radio_1200_627.png#keepProtocol]<https://www.berggren.eu/en/live-radio-upcoming-episodes> Berggren Live Radio Upcoming episodes<https://www.berggren.eu/en/live-radio-upcoming-episodes> Berggren Live Radio is a fast-paced 30-minute program on global intellectual property and business issues hosted by Berggren’s own Robert Alderson and Mariella Massaro.. UPCOMING EPISODE: www.berggren.eu Buona giornata a tutti D.

1 0

Call for papers sul tema dell’utilizzo dei dati nei processi decisionali alla luce della pandemia da Covid-19
by Antonio Vetro' April 20, 2021

April 20, 2021

Segnalo questa Call for Papers della Rivista quadrimestrale di Scienze dell’Amministrazione, sulla tematica del ruolo dei dati e delle tecnologie per analizzarli nella pandemia, trattato spesso in questa lista. ** “La Rivista quadrimestrale di Scienze dell’Amministrazione “Il Piemonte delle Autonomie”, edita dal Consiglio regionale del Piemonte, intende organizzare una Call for papers sul tema dell’utilizzo dei dati nei processi decisionali alla luce della pandemia da Covid-19. Nell’ambito delle dinamiche di trasformazione digitale che attraversano le società contemporanee, i flussi di dati, generati da soggetti pubblici e privati, richiedono sempre più spesso, in ragione della loro estensione in termini di volume, velocità e quantità (big data), tecnologie e metodi analitici e, quindi,competenze idonee ad estrarne segnali, ossia valore e conoscenze utili per la collettività (data mining). In un contesto nel quale le istituzioni democratico-rappresentative, così come le organizzazioni internazionali o sovranazionali, si caratterizzano per una crescente dipendenza dall’uso dei dati a fini decisionali (data-driven decision-making), si tratta di comprendere di quali e quanti dati abbia bisogno il decisore e di che tipo di tecnologie e infrastrutture di calcolo (algoritmi in primis) debba avvalersi per selezionarli, filtrarli ed elaborarli prima di porli alla base delle proprie scelte politico-amministrative o normative. " Continua qui: http://piemonteautonomie.cr.piemonte.it/cms/images/pdf/numero1_2021/callfor… <http://piemonteautonomie.cr.piemonte.it/cms/images/pdf/numero1_2021/callfor…> ** Un caro saluto, AV

1 0