- nexa - server-nexa.polito.it

Fwd: [RISKS] Risks Digest 31.62
by Diego.Latella March 22, 2020

March 22, 2020

Cari, Seguono stralci dalla RISKS-LIST 31(62) Buona lettura Diego RISKS-LIST: Risks-Forum Digest Saturday 21 March 2020 Volume 31 : Issue 62 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, founder and still moderator ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/31.62> The current issue can also be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: [Cleaning up part of the backlog; more to come] Many to blame in fatal crash of a Tesla (Tom Krisher via PGN) [ ... OMISSIS ...] Boeing Culture Concealment 747 Max report (The Guardian) [ ... OMISSIS ...] Live Coronavirus Map Used to Spread Malware (Krebs) [ ... OMISSIS ...] Crimea, Kashmir, Korea -- Google redraws disputed borders, depending on who's looking (WashPost) [ ... OMISSIS ...] Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Sat, 21 Mar 2020 12:33:06 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Many to blame in fatal crash of a Tesla (Tom Krisher via PGN) Tom Krisher, SFChronicle.com (which as usual ignores the existence of the Science Fiction Chronicle), front page of the Chron's Business Report, 21 Mar 2020, PGN-ed As we have noted in many cases (including Deepwater Horizon RISKS-29.49, the Boeing 737 Max, and many others), attempts to place blame are often frustrated by reality: blame may be widely distributed. The cited article by Tom Krisher notes the National Transportation Safety Board (NTSB) report released on 19 Mar 2020 on the Tesla crash on 1 March 2019 in Delray Beach, Florida. The Tesla was under Autopilot driving at 69 mph when the Autopilot neither braked or otherwise attempted to avoid a tractor-trailer that crossed in its path. The report noted that all of the following factors were relevant: * The driver of the Tesla for not paying attention. He had turned the Autopilot on just 12.3 seconds before impact. Autosteer (which keeps the car centered in its lane) turned on 2.4 seconds later. * The driver (who was not injured) of the tractor-trailer, which sheared off the roof of the Tesla * Tesla, because it allowed the driver to avoid paying attention to the Autopilot, and to limit where it was safe to use the Autopilot, activating it in conditions for which it was not designed. (However, Tesla told the NTSB investigators that ``forward collision warning and automatic emergency braking systems on Model 3 in the Delray cash weren't designed to activate for crossing traffic or to prevent crashes at high speeds.'' Tesla also had noted that the driver wasn't warned about not having his hands on the wheel ``because the approximate 6-second duration was too short to trigger a warning under the circumstances.'' However, Tesla also claims that ``the Autopilot is a driver-assist system, and that drivers must be ready to intervene at all times.'' * The National Highway Traffic Safety Administration (NHTSA) for its lax regulations, and failing to put limits on the use of automated driving systems to just those cases in which they were designed to work A statement for the NTSB chairman Robert Sumwalt noted this was the ``third fatal vehicle crash we have investigated where a driver's overreliance on Tesla's Autopilot and the operational design of the Tesla's Autopilot have led to tragic consequences.'' Krisher notes that the Delray Beach crash was remarkably similar to one in Williston FL in 2016, which also killed the driver of a Tesla. ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Sat, 7 Mar 2020 12:47:02 PST From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Boeing Culture Concealment 747 Max report (The Guardian) https://www.theguardian.com/business/2020/mar/06/boeing-culture-concealment… https://transportation.house.gov/imo/media/doc/TI%20Preliminary%20Investiga… ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Sun, 15 Mar 2020 16:24:01 -0400 From: Monty Solomon <monty(a)roscom.com> Subject: Live Coronavirus Map Used to Spread Malware https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-mal… ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Sun, 8 Mar 2020 14:53:02 -0400 From: Gabe Goldberg <gabe(a)gabegold.com> Subject: Crimea, Kashmir, Korea -- Google redraws disputed borders, depending on who's looking (WashPost) The Silicon Valley firm alters maps under political pressure and the inscrutable whims of tech executives https://www.washingtonpost.com/technology/2020/02/14/google-maps-political-… The risk? War... ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Mon, 14 Jan 2019 11:11:11 -0800 From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: The mailman Web interface can be used directly to subscribe and unsubscribe: http://mls.csl.sri.com/mailman/listinfo/risks => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line that includes the string `notsp'. Otherwise your message may not be read. *** This attention-string has never changed, but might if spammers use it. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you never send mail where the address becomes public! => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines! => OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's searchable html archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue. Also, ftp://ftp.sri.com/risks for the current volume or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume If none of those work for you, the most recent issue is always at http://www.csl.sri.com/users/risko/risks.txt, and index at /risks-31.00 Lindsay has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001) *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. Apologies for what Office365 and SafeLinks may have done to URLs. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 31.62 ************************ -- Dott. Diego Latella - Senior Researcher - CNR/ISTI, Via Moruzzi 1, 56124 Pisa, IT (http:www.isti.cnr.it [1]); FM&&T Laboratory (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - phone: +39 0503152982 - mob: +39 348 8283101 - fax +39 0503152040 Links: ------ [1] http://www.isti.cnr.it

1 0

Russia Has New Tool For Massive Internet Shutdown Attack, Leaked Documents Claim - Defense One
by Alberto Cammozzo March 21, 2020

March 21, 2020

<https://www.defenseone.com/technology/2020/03/russia-has-new-tool-massive-i…> As the world hunkers down in coronavirus isolation and relies on the internet more than ever, a group of dissidents has revealed that Russia has new tools to shut down internet services by tapping internet-connected cameras and similar smart devices. It’s a new version of an old weapon — a creator of botnets that can drive an internet service offline with floods of fake data — that puts to use a previously untapped source of computing power: the ever-growing “internet of things.” The new botnet tool was revealed in documents that give instructions for using a suite of hacking apps called Fronton, Fonton-3D, and Fonton-18. That doesn’t mean the Russian FSB security service will soon be peering through Americans’ cell phones and laptops or internet-connected doorbells. Instead, it means that the Russian government has a new tool for creating a DDoS-capable botnet. These botnets harness the computing power of millions of internet-connected things, direct them to spew random data at specific computers, and overwhelm vital services into uselessness. With millions of Americans newly teleworking during the COVID-19 pandemic, the United States has never been more dependent on the internet. The internet of things, or IoT, is a term-of-art for the vast array of electronic products that connect to the internet, from refrigerators to medical equipment to automobiles. IoT vulnerabilities have long worried national security experts who say adversaries could exploit them to shut down entire sectors of digital capabilities and infrastructure. The documents say “An attack on national DNS servers can make the Internet inaccessible for several hours in a small country.” On Wednesday, the group Digital Revolution claimed to have obtained technical documents that detail a suite of hacking tools — Fronton, Fonton-3D, and Fonton-18 — and offer advice for tapping into smart devices, including security cameras. Created in 2017 and 2018 by Russia’s FSB Information Security Center, the documents explain how to use the tools to make large botnet attacks on critical national services. [...]

1 0

Il decreto legge "Cura Italia" - La norma sugli appalti
by Maurizio Mensi March 21, 2020

March 21, 2020

Buongiorno, mi permetto di condividere alcune considerazioni sull'art. 75 del decreto legge "Cura Italia". https://formiche.net/2020/03/cloud-golden-power-sicurezza-mensi/ Maurizio ________ Maurizio Mensi maurizio.mensi(a)gmail.com

1 0

In the battle against coronavirus, personal privacy is at risk - CNN
by Alberto Cammozzo March 21, 2020

March 21, 2020

<https://edition.cnn.com/2020/03/20/tech/quarantine-privacy-coronavirus/inde…> San Francisco (CNN Business)When Declan Chan arrived in Hong Kong from Zurich on March 17 after six weeks overseas, city officials made him put on a plain-looking white wristband and download an app called StayHomeSafe before he exited the airport. He was told to register on the app once he got home, which would start a 14-day countdown, and walk to all four corners of his apartment so it could capture the location and confines of his home. As countries around the world fight the spread of the coronavirus, several governments are using technology to monitor quarantines — particularly of people coming in from overseas. Israel this week approved the use of cellphone tracking technology to monitor suspected coronavirus patients — an option normally used only for counterterrorism. Thailand is reportedly giving all new arrivals at its airports a free SIM card and making them download an app that tracks their location for 14 days. But there are concerns that tracking measures to contain the pandemic could pave the way for greater government surveillance. In Israel, for example, Opposition politicians and constitutional experts criticized the tracking measures, not only for their invasion of privacy but also for the lack of parliamentary oversight in pushing them through. The urgency to fight the coronavirus could open up a new front in the long-running global debate between privacy and security. Over the years, some governments have relied on controversial practices such as using facial recognition and phone data collection to protect citizens, potentially at the expense of their personal privacy. "I think the question might be whether the means justify the ends," Jennifer King, director of privacy at Stanford University's Center for Internet and Society, told CNN Business. "I'd want to hear a clear justification as to why some of the requests for personal data are being made, and why other methods might not work as well or reasonably well without the privacy impact." Before he left the airport, Chan was made to put on a wristband connected to a smartphone app. Chan's wristband is one of 60,000 that Hong Kong is deploying to enforce quarantines and prevent the spread of the coronavirus. The wristband and the app were developed in collaboration with a local startup "to ascertain people under quarantine are staying at their dwelling places," according to a government statement. Chan, 36, said he wasn't explicitly told what would happen if he took off the wristband or disconnected the app. A form he was given -- a photo of which he shared with CNN Business -- says that anyone who "contravenes or knowingly gives false information to [the] Department of Health" is liable to face a 5000 HKD ($644) fine and six months in prison. "Should the app be deleted during quarantine period, the Department of Health and the police will be alerted to take follow-up action," a Hong Kong government spokesperson told CNN Business. The spokesperson said users are free to delete the app after 14 days. The coronavirus is stretching Facebook to its limits The governments have painted the quarantine tracking and monitoring as necessary steps to curb the virus, while also insisting they are committed to protecting privacy. "The [Hong Kong government] attaches great importance to privacy protection," the spokesperson said, adding that its tracking app does not collect any additional data from the users' smartphone. "The collection of personal data is minimal in accordance with the provision of the quarantine order." The Hong Kong government's wristband is connected to an app that has a 14-day countdown clock. The Hong Kong government's wristband is connected to an app that has a 14-day countdown clock. Israel's deputy attorney general, Raz Nizri, said tracking people is "essential" to save lives. "The aim was to find the optimal solution that will minimize the infringement of privacy," he told Kan Reshen Bet radio. Thai authorities will delete user data collected by their tracking app within 14 days, an official at the country's telecommunications authority told the Bangkok Post newspaper. Experts say that while some amount of tracking may be necessary to contain the virus, users need to be protected from it being turned into a broader surveillance tool. "Mandatory orders or those with no explicit restrictions on the collection and use of the data would be very worrisome," said King. There is also the risk that measures seemingly justified by the current pandemic could be retained or expanded even after they are no longer necessary. "I think we have to be on the lookout for 'scope creep' — contexts where we demand emergency powers that risk privacy and then fail to walk back after the emergency passes," she said. Trump administration wants to use Americans' location data to track the coronavirus Trump administration wants to use Americans' location data to track the coronavirus The US government is also in discussions with the tech industry to use Americans' location data to track the spread of the coronavirus, with Google (GOOGL) and Facebook (FB) confirming they are exploring ways to share aggregated, anonymized data rather than location data of specific users, a point they took great pains to emphasize. But larger Western democracies will likely face bigger challenges and greater pushback in trying to institute some of the tracking measures other countries have. "Every country is different, and I think that the incentive to engage in this sort of tracking is higher for smaller countries that have dense populations and the political will and technology necessary to make this happen — like Israel and Hong Kong," said Dipayan Ghosh, a former Facebook and Obama administration official who is now a fellow at Harvard University's Kennedy School of Government. "It is difficult to imagine these policies extending to Western democratic countries at this time." Chan said he preferred being forced to quarantine at home rather than being placed in a government facility. "I kind of feel weird that there's no other option, other than the bracelets. I do feel a bit weird," he said. "But it's the lesser of the two evils, if I have to choose between this and a quarantine camp... at least home is a safer environment."

1 0

Tribunale, rivoluzione digitale: udienze e interrogatori online
by don Luca Peyron March 21, 2020

March 21, 2020

Non a caso, in uno degli allegati al procotollo gli avvocati ribadiscono di ritenere che il processo a distanza "determini il grave pericolo di compromissione dei diritti costituzionali e in particolare del diritto di difesa". Poi però le toghe prendono atto della "drammatica eccezionalità delle condizioni sanitarie determinate dalla pandemia" e convengono sulla necessità di "prevede modalità di celebrazione delle udienze con detenuti, arrestati o in stato di custodia cautelare, mediante videoconferenza con i collegamenti con remoto". A patto, aggiungono, che si tratti di soluzioni "di natura eccezionale e rigorosamente temporanea per il periodo di vigenza della legislazione di emergenza", dunque fino al 15 aprile a meno di ulteriori proroghe. L'irreversibilità della tecnologia dell'emergenza dove ci porterà? Permettetemi di usa lo slogan della pastorale universitaria: urge #pensareconlode Buona lettura, dl https://napoli.repubblica.it/cronaca/2020/03/20/news/tribunale_rivoluzione_… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

2 1

Top Tips for Cybersecurity when Working Remotely — ENISA
by Alberto Cammozzo March 21, 2020

March 21, 2020

<https://www.enisa.europa.eu/news/executive-news/top-tips-for-cybersecurity-…> One of the key preventative measures for the spread of Covid-19 is social distancing. Luckily, in this increasingly connected world we can continue our professional and private lives virtually. However, with huge increases in the number of people working remotely, it is vital that we also take care of our cyber hygiene. Awareness and preparedness are both vital - use the CERT-EU News Monitor to stay updated on the latest threats and check the following basics: Secure wifi connection. Most wifi systems at home these days are correctly secured, but some older installations might not be. With an insecure connection, people in the near vicinity can snoop your traffic. Fully updated anti-virus system in place. Up to date security software. Security tools such as privacy tools, add-ons for browsers etc need to be up to date. Patch levels should be regularly checked. Remember to back up periodically. All important files should be backed up regularly. In a worst case scenario, staff could fall foul of ransomware for instance. Then all is lost without a backup. Lock your screen if you work in a shared space. (you should really avoid co-working or shared spaces at this moment. Remember, social distancing is extremely important to slow down the spread of the virus). Make sure you are using a secure connection to your work environment. Check if you have encryption tools installed. Things employers can do: Provide initial and then regular feedback to staff on how to react in case of problems. Who to call, hours of service, emergency procedures and how they evolve. Give suitable priority to the support of remote access solutions. Employers should provide at least authentication and secure session capabilities (essentially encryption). Provide virtual solutions. At the EU Agency for Cybersecurity, we use electronic signatures and virtual approval workflows to ensure continuous functionality. Ensure adequate support in case of problems. This may require setting up special rotas for staff. Define a clear procedure to follow in case of a security incident. Consider restricting access to sensitive systems where it makes sense. Covid-19 Phishing Attacks It is important to step up awareness of digital security during this time as we have already seen an increase in phishing attacks. We recommend, as far as possible, to not mix work and leisure activities on the same device and be particularly careful with any mails referencing the corona-virus. Attackers are exploiting the situation, so look out for phishing emails and scams. In the current situation, one should be suspicious of any e-mails asking to check or renew your credentials even if it seems to comes from a trusted source. Please try to verify the authenticity of the request through other means, do not click on suspicious links or open any suspicious attachments. Be very suspicious of mails from people you don't know- especially if they ask to connect to links or open files (if in doubt phone your security officer). Mails that create an image of urgency or severe consequences are key candidates for phishing - in these cases always verify via an external channel before complying. Mails sent from people you know, but asking for unusual things are also suspect - verify by phone if possible.

1 0

South Korea Telecommunications Memo | Electronic Frontier Foundation
by Alberto Cammozzo March 21, 2020

March 21, 2020

<https://www.eff.org/document/south-korea-telecommunications-memo> Memo drafted by EFF Legal Fellow Joseph Laherran on the history of South Korean infrastructure policies that developed its telecommunications industry.

1 0

Health and Technology, Volume 7, Issue 4 - Springer
by Alberto Cammozzo March 21, 2020

March 21, 2020

Speciale issue <https://link.springer.com/journal/12553/7/4/page/1> Volume 7, Issue 4, December 2017 Privacy and Security of Medical Information ISSN: 2190-7188 (Print) 2190-7196 (Online)

1 0

Stanford Professor: Data Indicates We’re Severely Overreacting To Coronavirus
by Giacomo Tesio March 20, 2020

March 20, 2020

https://www.dailywire.com/news/stanford-professor-data-indicates-were-overr… In an analysis published Tuesday, Stanford’s John P.A. Ioannidis — co-director of the university’s Meta-Research Innovation Center and professor of medicine, biomedical data science, statistics, and epidemiology and population health — suggests that the response to the coronavirus pandemic may be “a fiasco in the making” because we are making seismic decisions based on “utterly unreliable” data. The data we do have, Ioannidis explains, indicates that we are likely severely overreacting. [...] “Draconian countermeasures have been adopted in many countries. If the pandemic dissipates — either on its own or because of these measures — short-term extreme social distancing and lockdowns may be bearable,” the statistician writes. “How long, though, should measures like these be continued if the pandemic churns across the globe unabated? How can policymakers tell if they are doing more good than harm?” [...] Due to extremely limited testing, we are likely missing “the vast majority of infections” from COVID-19, he states, thus making reported fatality rates from the World Health Organization “meaningless.” “Patients who have been tested for SARS-CoV-2 are disproportionately those with severe symptoms and bad outcomes,” Ioannidis explains. With very limited testing in many health systems, he suggests, that “selection bias” may only get worse going forward. ______ Spero di non essere off-topic e nel caso mi scuso. Ma quanto leggo inizia a preoccuparmi. Vedo persone intelligenti, preparate e ragionevoli accettare di buon grado e persino supportare l'introduzione di misure di sorveglianza di massa come se fossero il male minore. Contemporaneamente vedo mia moglie, medico di famiglia, barcamenarsi fra centinaia di pazienti estremamente impauriti ma NON infetti e pochi infetti attorno ai quali le procedure messe in atto dalla unità di crisi sono EVIDENTEMENTE insufficienti a contenere alcunché. Agli anziani, sempre più impauriti e soli, mia moglie chiede espressamente di spegnere la televisione. Forse è un suggerimento buono per tutti. Questo martellamento continuo genera ansia nei più deboli ma evidentemente condiziona profondamente anche le persone più colte. Vi prego, manteniamo la calma. Il panico, per quanto sublimato, non è mai stato utile ad affrontare un'emergenza. Giacomo

2 3

EDPB: Statement on the processing of personal data in the context of the COVID-19 outbreak. Adopted on 19 March 2020
by J.C. DE MARTIN March 20, 2020

March 20, 2020

https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_2020_pro… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0