- nexa - server-nexa.polito.it

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts | WIRED
by Alberto Cammozzo Aug. 8, 2019

Aug. 8, 2019

<https://www.wired.com/story/boeing-787-code-leak-security-flaws/> Late one night last September, security researcher Ruben Santamarta sat in his home office in Madrid and partook in some creative googling, searching for technical documents related to his years-long obsession: the cybersecurity of airplanes. He was surprised to discover a fully unprotected server on Boeing's network, seemingly full of code designed to run on the company's giant 737 and 787 passenger jets, left publicly accessible and open to anyone who found it. So he downloaded everything he could see. Now, nearly a year later, Santamarta claims that leaked code has led him to something unprecedented: security flaws in one of the 787 Dreamliner's components, deep in the plane's multi-tiered network. He suggests that for a hacker, exploiting those bugs could represent one step in a multistage attack that starts in the plane’s in-flight entertainment system and extends to highly protected, safety-critical systems like flight controls and sensors. Andy Greenberg writes about security for WIRED. He is the author of the forthcoming book Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers. Boeing flatly denies that such an attack is possible, and it rejects his claim of having discovered a potential path to pull it off. Santamarta himself admits that he doesn't have a full enough picture of the aircraft—or access to a $250 million jet—to confirm his claims. But he and other avionics cybersecurity researchers who have reviewed his findings argue that while a full-on cyberattack on a plane's most sensitive systems remains far from a material threat, the flaws uncovered in the 787's code nonetheless represent a troubling lack of attention to cybersecurity from Boeing. They also say that the company's responses have not been altogether reassuring, given the critical importance of keeping commercial airplanes safe from hackers. At the Black Hat security conference today in Las Vegas, Santamarta, a researcher for security firm IOActive, plans to present his findings, including the details of multiple serious security flaws in the code for a component of the 787 known as a Crew Information Service/Maintenance System. The CIS/MS is responsible for applications like maintenance systems and the so-called electronic flight bag, a collection of navigation documents and manuals used by pilots. Santamarta says he found a slew of memory corruption vulnerabilities in that CIS/MS, and he claims that a hacker could use those flaws as a foothold inside a restricted part of a plane's network. An attacker could potentially pivot, Santamarta says, from the in-flight entertainment system to the CIS/MS to send commands to far more sensitive components that control the plane's safety-critical systems, including its engine, brakes, and sensors. Boeing maintains that other security barriers in the 787's network architecture would make that progression impossible. [...]

1 0

Fred Turner: Silicon Valley Thinks Politics Doesn’t Exist - 032c
by J.C. DE MARTIN Aug. 8, 2019

Aug. 8, 2019

https://032c.com/fred-turner-silicon-valley-thinks-politics-doesnt-exist (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Fwd: Security research is not a crime | EFFector 32.12
by Diego Latella Aug. 8, 2019

Aug. 8, 2019

> Begin forwarded message: > > From: EFFector List <editor(a)eff.org> > Subject: Security research is not a crime | EFFector 32.12 > Date: 8 August 2019 at 03:27:12 CEST > To: diego.latella(a)cnr.it > Reply-To: EFFector List <editor(a)eff.org> > > View as a web page <https://www.eff.org/effector/32/12> > <https://www.eff.org/effector/32/12> > > Security research is not a crime - EFFector 32.12 > > In our 755th issue: > > UPDATES <x-msg://24/#updates> > <https://supporters.eff.org/join/effector> > Members make it possible for EFF to fight for your rights. Become a member today. > > <>Top Features > > Security research is not a crime <https://www.eff.org/deeplinks/2019/08/ecuador-political-actors-must-step-aw…> > In most issues of EFFector, we give an overview of all the work we're doing at EFF right now. This week, we’re taking a deep dive into a single issue: the increasingly dangerous climate for technologists, developers, and cybersecurity researchers in the Americas—and in particular, the case of Ola Bini, who was arrested in April in Ecuador despite little evidence. We’ve just returned from a fact-finding mission to the country to learn more. > > I’m Danny O’Brien, EFF’s Director of Strategy. I’ve just returned from a trip to Ecuador, along with Katitza Rodriguez, EFF’s International Rights Director, and Veridiana Alimonti, our Latin American Senior Policy Analyst. EFF doesn’t regularly make visits like this, but we were on a fact-finding mission to discover more about the arrest of Ola Bini, a Swedish open source developer who was arrested in unusual circumstances in April. I’ll tell you more about Ola in a moment. > > Authors, speakers, and journalists have long been understood by those in power as dangerous elements; and over the last thirty years, “technologist” has joined the list of occupations that corrupt politicians and dictators fear. I’ve led EFF’s “Offline” project, which shines a light on those coders, bloggers, hackers, and researchers who have been jailed, detained, or otherwise persecuted for their work online. Even as they build and improve the tools we use to protect ourselves from surveillance, and even while they help to enhance free expression and privacy around the world, these experts are increasingly threatened or jailed by governments that misunderstand their work or misrepresent it for political gain. > > This is not new to us, and is not likely to surprise you, as an EFF supporter. Since EFF was founded in 1990, we have frequently stepped in to defend security researchers <https://www.eff.org/issues/coders> from misunderstandings made by law enforcement, and raised awareness <http://eff.org/offline> when technologists in the United States have been incarcerated. Even now, much of the EFF staff is joining the tens of thousands of fellow travelers currently descending on Las Vegas <https://www.eff.org/deeplinks/2019/07/eff-vegas-security-week> for various online security conferences, to discuss exactly the kind of work for which these technologists are often persecuted, and even work with technologists who might face prosecution or persecution for work announced at Black Hat, DEFCON, and other events. > > In Latin America, security researchers’ rights are not always as well-recognized or appreciated by law enforcement and governments as they are in the United States. While security researchers play a vital role in fixing flaws in the software and hardware that everyone uses, their actions and behaviors are often misunderstood. For example, as part of their work, they may discover and inform a company of a dangerous software flaw—a civic duty that could be confused with a hacking attack. Partly for this reason, we recently launched a new LatAm Coders’ Rights Project <https://www.eff.org/deeplinks/2018/10/canada-chile-security-researchers-hav…> to help establish that security researchers have rights too. > > Just months after its launch, Ola Bini was arrested in Ecuador on a warrant for a “Russian hacker.” With the most basic research, we knew that he is neither of these. From our viewpoint in San Francisco, the evidence presented seem slim, and so we decided to send a team to Ecuador to learn more about his prosecution. > > Meet the Developer: Ola Bini > Ola Bini is Swedish citizen and open source developer who has worked for years to improve the security and privacy of the Internet. He builds secure tools, develops new languages, and contributes to a wide range of popular free software projects, including JRuby and implementations of the secure and open communication protocol OTR. He has also contributed to Certbot, the EFF-managed tool that provides strong encryption for millions of websites around the world. Ola’s team at ThoughtWorks was one of the few paid groups tackling popular, but under-resourced, applications like Enigmail. > > Like many people working on the many distributed projects defending the Internet, Ola has no need to work from a particular location. He settled recently in Ecuador, and co-founded a non-profit organization <https://autonomia.digital/about/> there devoted to creating user-friendly security tools. Then, as he prepared to travel from his home in Quito to Japan, he was seized by authorities claiming that he was attempting to flee the country. Bini had, in fact, booked the vacation long ago, and had publicly mentioned it on his Twitter account. > > Initially, we thought his arrest was due to a common misunderstanding. Security researchers can have habits and behavior that seem eccentric or suspicious: they encrypt all of their communications and lock down their computers, they sometimes dress and behave differently from the norm. As part of their work, they collect unusual books and hardware—like the so-called “evidence” presented <https://twitter.com/FiscaliaEcuador/status/1117042706084188161> after Ola’s arrest—a pile of USB drives, hard drives, two-factor authentication keys, and technical manuals. > > > > All of these items are familiar property for anyone working in his field. Of course, owning such things is not a crime, but they can seem suspicious to an authority who isn’t in the know. > > Building and Testing Secure Tools Is Not a Crime > There is nothing wrong with testing and finding flaws in security. Security and encryption researchers help build a safer future for all of us using digital technologies. Even in the U.S, too many legitimate researchers face serious legal challenges that prevent or inhibit their work from laws such as the Convention on Cybercrime, the Digital Millennium Copyright Act, the Computer Fraud and Abuse Act, and similar state laws. And computer crime laws in many countries around the world are even more pernicious. > > But that is not what Ola Bini does. From our prior knowledge of his work, he builds strong systems—he does not pen-test or analyze them for exploits. If the Ecuadorian government was looking for someone with the skills to attack Ecuador’s systems, they found the wrong guy. > > As Bini’s case dragged on, another anomaly struck us. If someone breaks into a house, and you arrest a suspect, the prosecution should at the very least be able to tell you which house was broken into. It's the same in the digital world. > > During a press conference held just before Ola’s arrest, Ecuador’s Interior Minister announced that the government was about to apprehend individuals who are supposedly involved in trying to establish a “piracy center” in Ecuador, including two Russian hackers, a Wikileaks collaborator, and a person close to Julian Assange. She stated: “We are not going to allow Ecuador to become a hacking center, and we cannot allow illegal activities to take place in the country, either to harm Ecuadorian citizens or those from other countries or any government.” Neither she nor any investigative authority has provided any evidence to back these claims. > > Bini’s prosecutors did not say what systems he is supposed to have broken into at that press conference in April. And despite many opportunities to clarify—after Bini’s initial arrest and his nine-week imprisonment, since his release following a successful Habeas Corpus plea, or even after last week’s thirty-day extension of the investigation—we still do not know what systems he is supposed to have targeted, or any more details of his alleged criminal behavior. > > Ola Bini’s Case is a Political One, Not a Criminal One > After being in Quito for a week and speaking to journalists, politicians, lawyers, academics, and Ola and his defense team—and extending invitations to Interior Minister María Paula Romo and Diana Salazar Mendez to meet with us—we believe we now have a better picture of what this prosecution is about. > > In brief, based on the interviews that we conducted, our conclusion is that Bini's prosecution is a political case, not a criminal one. > > Bini's lawyers told us that they have counted 65 violations of due process so far during the trial. The subsequent Habeas Corpus decision that released him from jail after over two months of imprisonment confirmed the weakness of the initial detention. Journalists have told us that no one is able to provide them with concrete descriptions of what he has done. And we know that while Ola Bini’s behavior and contacts in the security world may look strange to authorities, his computer security expertise is not a crime. > > We think Ecuador’s politics have attached their own stakes to either abandoning Ola’s case or continuing to prosecute. Supporters of the present government need Bini’s successful prosecution in order to confirm their claim of a threat to Ecuador from Julian Assange—and justify why the government changed the policy of the previous government and ejected him from the embassy. Opponents of the new leadership want to show support for Assange by defending Bini, and use his case as an example of the maliciousness of the new administration. At this point, there is no political faction who wants Bini’s case to quietly end, and allow him to return to his normal life. Everyone benefits from him being a visible example—either of the danger of Assange and “Russian Hackers,” or the political bias of the courts under Ecuador’s new government. > > Bini’s innocence or guilt should not be a political decision. It should be determined by a fair trial that follows due process. At this point, we are urging political actors of all sides to step away from this case, and to allow justice to be done <https://www.eff.org/deeplinks/2019/08/ecuador-political-actors-must-step-aw…>. By remaining involved, they risk damaging the reputation of Ecuador’s judicial system abroad, and violating the international human rights standards as defined within the Inter-American system for the protection of human rights. > > Protecting The Rights of Security Researchers > Ola Bini’s detainment is a flagship case of the targeting of technologists, and the dangers of overbroad cybercrime laws. > > Technologists, developers, security researchers, and hackers all have fundamental human rights. We must not allow politics to sway the judicial process towards scapegoating their work. We must stop politicians from demonizing benign uses of technology. And we must ensure that the laws protect the fundamental human rights of security researchers across the world. > > If you are a researcher wondering if your own research is in a legal gray area, or concerned that the vendor will threaten legal action, please reach out to info(a)eff.org <mailto:info@eff.org>or visit our Coders' Rights project <https://www.eff.org/issues/coders> for legal FAQs. All EFF legal consultations are pro bono (free), as part of our commitment to help the security researcher community. If you happen to be in Las Vegas this week, you can also stop by the EFF booths at BSides, Black Hat, or DEF CON to make an appointment with one of our attorneys, though we highly recommend contacting us as far in advance of your talk as possible. And as always, even if you don’t have a legal question, come say hi at the booth or watch one of our talks. <https://www.eff.org/deeplinks/2019/07/eff-vegas-security-week> > For now, Ola Bini is in legal limbo. The clock is running out for the prosecution to formally charge him, although it was just reset to 30 days when they linked a new individual, Ricardo Arguello, to the case. Over the years, we have often heard from those who have been released from detention that shining a spotlight on their case has led to better treatment in prison or a speedier release. We hope you’ll join us in advocating for Ola and other individuals like him <http://eff.org/offline> whose online work has led authorities to unjustly incarcerate them or take them offline. > > Digital rights are human rights. Together, we can work to protect those rights globally, and fight back against the injustice and fearmongering perpetrated worldwide against innocent technologists. > > <>EFF Updates > > No other updates at this time. <https://eff.org/effector/32/12> > ... > > Supported by Donors > > Our members make it possible for EFF to bring legal and technological expertise into crucial battles about online rights. Whether defending free speech online or challenging unconstitutional surveillance, your participation makes a difference. Every donation gives technology users who value freedom online a stronger voice and more formidable advocate. > > If you aren't already, please consider becoming an EFF member today. > > <https://supporters.eff.org/join/effector> > Administrivia > > Editor: Danny O'Brien, Director of Strategy editor(a)eff.org <mailto:editor@eff.org> > EFFector is a publication of the Electronic Frontier Foundation. eff.org <https://www.eff.org/> > Membership & donation queries: membership(a)eff.org <mailto:membership@eff.org> > General EFF, legal, policy, or online resources queries: info(a)eff.org <mailto:info@eff.org> > Reproduction of this publication in electronic media is encouraged. MiniLinks do not necessarily represent the views of EFF. > > Back issues of EFFector <https://www.eff.org/effector/> > <http://twitter.com/eff> <http://www.facebook.com/eff> <https://www.instagram.com/efforg/> > About EFF > The Electronic Frontier Foundation is the leading organization protecting civil liberties in the digital world. Founded in 1990, we defend free speech online, fight illegal surveillance, promote the rights of digital innovators, and work to ensure that the rights and freedoms we enjoy are enhanced, rather than eroded, as our use of technology grows. EFF is a member-supported organization. Find out more at https://eff.org. > > ACTIVISM | IMPACT LITIGATION | TECHNOLOGY > This newsletter is printed from 100% recycled electrons. > 815 Eddy Street, San Francisco, CA 94109 United States > EFF appreciates your support and respects your privacy <http://www.eff.org/policy>. > > Unsubscribe or change your email preferences <https://supporters.eff.org/update-your-preferences?cid1=1848942&cs=05b956d0…>, or opt out of all EFF email <https://supporters.eff.org/civicrm/mailing/optout?reset=1&jid=82835&qid=105…> > > 815 Eddy Street > San Francisco, CA 94109-7701 > United States > Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat

1 0

Four questions about online hate speech - David Kaye - Medium
by J.C. DE MARTIN Aug. 8, 2019

Aug. 8, 2019

Four questions about online hate speech David Kaye Aug 6 · 6 min read The New York Times devoted the front page of its business section this morning to this screaming headline and three articles that followed it: https://medium.com/@dkisaway/four-questions-about-online-hate-speech-ae3e0a… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Hackers have stolen photos of travelers taken by the US border agency - MIT Technology Review
by Alberto Cammozzo Aug. 8, 2019

Aug. 8, 2019

<https://www.technologyreview.com/f/613660/hackers-have-stolen-photos-of-tra…> The data breach underlines the need for tighter controls over what the US government can do with our data. The news: US Customs and Border Protection (CBP) has disclosed that hackers breached a subcontractor’s systems and stole photographs the agency had taken of travelers and vehicle license plates at border crossings. As many as 100,000 people may have had their information compromised in the attack, the New York Times reported, citing an unnamed government official. CBP’s revelation comes a week after Perceptics, a company that makes license plate readers used by the US government, was reportedly hacked. It’s not yet clear if there is any connection between the two incidents. The irony: CBP is part of the Department of Homeland Security (DHS), which is charged with boosting cybersecurity in the US. The incident makes clear, however, that the DHS needs to take a harder look in its own backyard. CBP says the subcontractor breached security and privacy protocols by transferring images to its own network without the agency’s approval. The response: CBP, which first learned of the data breach on May 31, says it has taken the equipment involved out of service and that none of the stolen images have so far appeared online. Some politicians have already called on the government to review its systems for protecting people’s sensitive data. The bigger risk: Privacy activists are already concerned about how the US is embracing face recognition technology at airports and other border areas. The CBP breach will increase pressure on the US government to create clearer guidelines for collecting sensitive personal information—and for ensuring it doesn’t end up in hackers’ hands.

1 0

DeepMind’s Latest A.I. Health Breakthrough Has Some Problems
by J.C. DE MARTIN Aug. 8, 2019

Aug. 8, 2019

DeepMind’s Latest A.I. Health Breakthrough Has Some Problems The Google machine learning company trumpeted its success in predicting a deadly kidney condition, but its results raise questions around data rights and patient diversity Julia Powles Aug 6 · 8 min read https://onezero.medium.com/deepminds-latest-a-i-health-breakthrough-has-som… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Blockchain e GDPR secondo l'Europa
by Diego Giorio Aug. 7, 2019

Aug. 7, 2019

Non mi sembra sia ancora passato in lista, si tratta certamente di un report da studiare Saluti (e magari buone vacanze, per chi non le ha ancora fatte o le sta facendo) a tutti D. http://privacyitaliana.com/2019/08/07/blockchain-e-gdpr-la-posizione-delleu…

3 3

Legal Shield for Websites Rattles Under Onslaught of Hate Speech - The New York Times
by J.C. DE MARTIN Aug. 7, 2019

Aug. 7, 2019

https://www.nytimes.com/2019/08/06/technology/section-230-hate-speech.html (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

How Google and big tech watch your money
by Alberto Cammozzo Aug. 6, 2019

Aug. 6, 2019

<https://www.fastcompany.com/90349518/gmail-keeps-a-record-of-your-purchase-…> It’s no secret that Google gathers up large amounts of your data based on your search history. But far less known is that the company has also been automatically tallying up your digital and real-world financial transactions based on receipts found in your Gmail accounts and other Google services. It’s just another sign of the enormous reach of tech titans, including Facebook, mining our real-world transactions to generate new insights into our behavior and new revenue streams. If you have a Google account, see for yourself: In the Google Account Activity section, a tab called “Payments & subscriptions” reveals a page of your Purchases, Subscriptions, and Reservations, along with your stored Payment Methods. The page—which I stumbled upon recently, and which CNBC also reported on—includes transactions, like deliveries and online orders, gathered from receipts or confirmations received in Gmail as well as from Google services like the Google Play Store. (View yours at https://myaccount.google.com/payments-and-subscriptions by clicking on “Manage purchases.”) The data can be eye-opening: a partial catalog of years of purchases that you probably didn’t know Google had yanked from the depths of your digital life. Like many, I’ve long used Gmail like a cabinet or shoebox to keep track of receipts. But I was unaware that I had consented for the Google bots to scan my inbox, identify specific emails, and assemble a dossier of my purchases. Google says the purchase data is not used to target ads and is only viewable by the individual user. “To help you easily view and keep track of your purchases, bookings and subscriptions in one place, we’ve created a private destination that can only be seen by you,” a Google spokesperson explained in an email. The idea is to help you do things like track a package, cancel a reservation, or renew a subscription, according to Google. “We don’t use any information from your Gmail messages to serve you ads, and that includes the email receipts and confirmations shown on the Purchase page.” Plus, says Google, “you can delete this information at any time.” Not easy to delete But there is a catch. Removing data from “Purchases” requires users to click each purchase individually: There is no way for users to easily delete their entire purchase history from Google’s servers. Removing the original emails doesn’t work either: When CNBC reporter Todd Haselton bravely deleted every single email in his Gmail, the transactions in his purchase history still remained. [...]

1 0

Google "Street View" Wiretap Allegations Settled for a "Modest" $13 Million
by Alberto Cammozzo Aug. 6, 2019

Aug. 6, 2019

<https://www.jdsupra.com/legalnews/google-street-view-wiretap-allegations-79…> In 2007, Google began gathering photographs for its Google Maps “Street View” application featuring adjustable panoramic, street-level images tied to addresses searched in Google Maps. Google captured these photographs with cameras mounted on company vehicles traveling on public roads. However, the cars were also equipped with Wi-Fi reception antennas collecting data transmitted by homes and businesses over unencrypted Wi-Fi networks in areas where the Street View vehicles photographed. In addition to collecting basic identifying information about the Wi-Fi networks, Google also collected “payload data,” including messages, search queries, and other communications sent and received over the unencrypted Wi-Fi networks as the vehicles travelled and photographed the surroundings. In 2010, plaintiffs filed a number of class action lawsuits alleging Google violated the Wiretap Act and other state laws and wiretap statutes by collecting this payload data from the unencrypted Wi-Fi networks. The cases were consolidated in the Northern District of California where Google’s motions to dismiss were denied. [...]

1 0