- nexa - server-nexa.polito.it

Johnny, you are fired! – Spoofing OpenPGP and S/MIME Signatures in Emails
by Giacomo Tesio May 2, 2019

May 2, 2019

https://github.com/RUB-NDS/Johnny-You-Are-Fired OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery attacks against various implementations of OpenPGP and S/MIME email signature verification in five attack classes: (1) We analyze edge cases in S/MIME's container format. (2) We exploit in-band signaling in the GnuPG API, the most widely used OpenPGP implementation. (3) We apply MIME wrapping attacks that abuse the email clients' handling of partially signed messages. (4) We analyze weaknesses in the binding of signed messages to the sender identity. (5) We systematically test email clients for UI redressing attacks. Our attacks allow the spoofing of digital signatures for arbitrary messages in 14 out of 20 tested OpenPGP-capable email clients and 15 out of 22 email clients supporting S/MIME signatures. While the attacks do not target the underlying cryptographic primitives of digital signatures, they raise concerns about the actual security of OpenPGP and S/MIME email applications. Finally, we propose mitigation strategies to counter these attacks.

1 0

Remote Code Execution on most Dell computers
by Giacomo Tesio May 2, 2019

May 2, 2019

https://d4stiny.github.io/Remote-Code-Execution-on-most-Dell-computers/ When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is “What third-party software came with my PC?”. In this article, I’ll be looking at a Remote Code Execution vulnerability I found in Dell SupportAssist, software meant to “proactively check the health of your system’s hardware and software” and which is “preinstalled on most of all new Dell devices”. [...] # Exploitation The first issue we face is making requests to the SupportAssist client. Assume we are in the context of a Dell subdomain, we’ll get into how exactly we do this further in this section. I decided to mimic the browser and make requests using javascript. [...] # Demo Here’s a small demo video showcasing the vulnerability. You can download the source code of the proof of concept here. https://invidio.us/watch?v=0cTfnZ04jgQ https://github.com/D4stiny/Dell-Support-Assist-RCE-PoC # Timeline 10/26/2018 - Initial write up sent to Dell. 10/29/2018 - Initial response from Dell. 11/22/2018 - Dell has confirmed the vulnerability. 11/29/2018 - Dell scheduled a “tentative” fix to be released in Q1 2019. 01/28/2019 - Disclosure date extended to March. 03/13/2019 - Dell is still fixing the vulnerability and has scheduled disclosure for the end of April. 04/18/2019 - Vulnerability disclosed as an advisory. Written on April 30, 2019

1 0

The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance by Roseanna Sommers, Vanessa K. Bohns :: SSRN
by J.C. DE MARTIN May 2, 2019

May 2, 2019

mi sembra importante. jc The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance Yale Law Journal, Vol. 128, No. 7, 2019 72 Pages Posted: Roseanna Sommers University of Chicago - Law School Vanessa K. Bohns Cornell University Date Written: April 10, 2019 Abstract Consent-based searches are by far the most ubiquitous form of search undertaken by police. A key legal inquiry in these cases is whether consent was granted voluntarily. This Essay suggests that fact finders’ assessments of voluntariness are likely to be impaired by a systematic bias in social perception. Fact finders are likely to underappreciate the degree to which suspects feel pressure to comply with police officers’ requests to perform searches. In two preregistered laboratory studies, we approached a total of 209 participants (“Experi- encers”) with a highly intrusive request: to unlock their password-protected smartphones and hand them over to an experimenter to search through while they waited in another room. A sepa- rate 194 participants (“Forecasters”) were brought into the lab and asked whether a reasonable person would agree to the same request if hypothetically approached by the same researcher. Both groups then reported how free they felt, or would feel, to refuse the request. Study 1 found that whereas most Forecasters believed a reasonable person would refuse the experimenter’s request, most Experiencers—100 out of 103 people—promptly unlocked their phones and handed them over. Moreover, Experiencers reported feeling significantly less free to refuse than did Forecasters contemplating the same situation hypothetically. Study 2 tested an intervention modeled after a commonly proposed reform of consent searches, in which the experimenter explicitly advises participants that they have the right to with- hold consent. We found that this advisory did not significantly reduce compliance rates or make Experiencers feel more free to say no. At the same time, the gap between Experiencers and Fore- casters remained significant. These findings suggest that decision makers judging the voluntariness of consent consistently underestimate the pressure to comply with intrusive requests. This is problematic because it indi- cates that a key justification for suspicionless consent searches—that they are voluntary—relies on an assessment that is subject to bias. The results thus provide support to critics who would like to see consent searches banned or curtailed, as they have been in several states. The results also suggest that a popular reform proposal—requiring police to advise citizens of their right to refuse consent—may have little effect. This corroborates previous observational stud- ies, which find negligible effects of Miranda warnings on confession rates among interrogees, and little change in rates of consent once police start notifying motorists of their right to refuse vehicle searches. We suggest that these warnings are ineffective because they fail to address the psychology of compliance. The reason people comply with police, we contend, is social, not informational. The social demands of police-citizen interactions persist even when people are informed of their rights. It is time to abandon the myth that notifying people of their rights makes them feel empowered to exercise those rights. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3369844 (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

NIMH » Release of “13 Reasons Why” Associated with Increase in Youth Suicide Rates
by J.C. DE MARTIN May 1, 2019

May 1, 2019

https://www.nimh.nih.gov/news/science-news/2019/release-of-13-reasons-why-a… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

A parere dell’avvocato generale Szpunar, un servizio come quello fornito dalla piattaforma AIRBNB costituisce un servizio della società dell’informazione
by J.C. DE MARTIN May 1, 2019

May 1, 2019

A parere dell’avvocato generale Szpunar, un servizio come quello fornito dalla piattaforma AIRBNB costituisce un servizio della società dell’informazione https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-04/cp190051it… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

I vantaggi dei beni digitali nel Pil, quanto può pesare la rivoluzione? - ilSole24ORE
by don Luca Peyron May 1, 2019

May 1, 2019

Un gruppo di ricercatori del MIT ha proposto una metodologia <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3356697> per includere nel PIL i benefici derivanti dai beni digitali gratuitamente disponibili per i consumatori. Secondo la loro stima i guadagni di benessere potrebbero aggiungere alla crescita del prodotto, così rettificata, fino allo 0,11% all’anno. Buon primo maggio! Dl https://www.econopoly.ilsole24ore.com/2019/04/30/beni-digitali-pil/

1 0

The Airbnb Invasion of Barcelona | The New Yorker
by J.C. DE MARTIN May 1, 2019

May 1, 2019

https://www.newyorker.com/magazine/2019/04/29/the-airbnb-invasion-of-barcel… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Apache Software Foundation joins GitHub open source community
by Giacomo Tesio May 1, 2019

May 1, 2019

https://github.blog/2019-04-29-apache-joins-github-community/ In 2016, Apache made the decision to start integrating GitHub’s repository and tooling with their own services. After solidifying the integration over the years, they decided to simplify how they work and move all Git projects to GitHub. As of February 2019, Apache’s migration to GitHub was complete ____ 3 anni di lavoro per introdurre un single point of failure fuori dal controllo della comunità al centro del processo di sviluppo di oltre 350 progetti open source fondamentali per l'infrastruttura di milioni di aziende in tutto il mondo. E se vi chiedete perché... https://www.apache.org/foundation/thanks.html Giacomo

3 5

Facebook will open its data up to academics to see how it impacts elections - MIT Technology Review
by J.C. DE MARTIN May 1, 2019

May 1, 2019

https://www.technologyreview.com/f/613451/facebook-will-open-its-data-up-to… More than 60 researchers from 30 institutions will get access to Facebook user data to study its impact on elections and democracy, and how it’s used by advertisers and publishers. (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

NYT: "Apple Cracks Down on Apps That Fight iPhone Addiction"
by J.C. DE MARTIN May 1, 2019

May 1, 2019

*Apple Cracks Down on Apps That Fight iPhone Addiction* By Jack Nicas April 27, 2019 SAN FRANCISCO — They all tell a similar story: They ran apps that helped people limit the time they and their children spent on iPhones. Then Apple created its own screen-time tracker. And then Apple made staying in business very, very difficult. Over the past year, Apple has removed or restricted at least 11 of the 17 most downloaded screen-time and parental-control apps, according to an analysis by The New York Times and Sensor Tower, an app-data firm. Apple has also clamped down on a number of lesser-known apps. In some cases, Apple forced companies to remove features that allowed parents to control their children’s devices or that blocked children’s access to certain apps and adult content. In other cases, it simply pulled the apps from its App Store. Some app makers with thousands of paying customers have shut down. Most others say their futures are in jeopardy. […] Continua qui: https://www.nytimes.com/2019/04/27/technology/apple-screen-time-trackers.ht…

1 0