- nexa - server-nexa.polito.it

A Conspiracy To Kill IE6
by Giacomo Tesio May 2, 2019

May 2, 2019

Divertente storiella di come 10 anni fa, una singola azienda ha "convinto" un utente del web su 5 a cambiare browser... senza _quasi_ farlo apposta. Ma va tutto bene eh... non vi preoccupate! ;-) http://blog.chriszacharias.com/a-conspiracy-to-kill-ie6 IE6 users represented around 18% of our user base at that point. We understood that we could not just drop support for it. However, sitting in that cafeteria, having only slept about a few hours each in the previous days, our compassion for these users had completely eroded away. [...] The plan was very simple. We would put a small banner above the video player that would only show up for IE6 users. It would read “We will be phasing out support for your browser soon. Please upgrade to one of these more modern browsers.” Next to the text would be links to the current versions of the major browsers, including Chrome, Firefox, IE8 and eventually, Opera. [...] The first person to come by our desks was the PR team lead. [...] Fortunately for us, the publications had already settled on a narrative that this was a major benefit to the Internet. [...] Satisfied that he could get back in front of the story, the PR team lead turned and warned us to never do anything like this without telling him first. He did not want to let great public relations opportunities like this slip by ever again. [...] Between YouTube, Google Docs, and several other Google properties posting IE6 banners, Google had given permission to every other site on the web to add their own. IE6 banners suddenly started appearing everywhere. Within one month, our YouTube IE6 user base was cut in half and over 10% of global IE6 traffic had dropped off while all other browsers increased in corresponding amounts. The results were better than our web development team had ever intended.

1 1

Paper: “The Antitrust Case Against Facebook” by Dina Srinivasan :: SSRN
by J.C. DE MARTIN May 2, 2019

May 2, 2019

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362 The Antitrust Case Against Facebook Berkeley Business Law Journal Vol. 16, Issue 1, Forthcoming 83 Pages Posted: 7 Feb 2019 Last revised: 9 Feb 2019 Dina Srinivasan Yale University - Law School Date Written: September 10, 2018 Abstract The Facebook, Inc. (“Facebook”) social network, this era’s new communications service, plays an important role in the lives of 2+ billion people across the world. Though the market was highly competitive in the beginning, it has since consolidated in Facebook’s favor. Today, using Facebook means to accept a product linked to broad-scale commercial surveillance — a paradox in a democracy. This Paper argues that Facebook’s ability to extract this qualitative exchange from consumers is merely this titan’s form of monopoly rents. The history of early competition, Facebook’s market entry, and Facebook’s subsequent rise tells the story of Facebook’s monopoly power. However, the history which elucidates this firm’s dominance also presents a story of anticompetitive conduct. Facebook’s pattern of false statements and misleading conduct induced consumers to trust and choose Facebook, to the detriment of market competitors and consumers' own welfare. Keywords: antitrust, competition law, two-sided platforms, two-sided markets, facebook, big tech, anticompetitive, consumer welfare, privacy, democracy, commercial surveillance, surveillance, monopoly power, collusion, sherman act, antitrust (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Hacking College Admissions
by Giacomo Tesio May 2, 2019

May 2, 2019

Questa è una perla. La vulnerabilità è stata identificata da un 17enne solo NAVIGANDO il sito web. E questi geni hanno provato a nascondere^W correggere l'errore con 15 righe di JavaScript da eseguire sul browser dell'attaccante! Sarebbe ridicolo e divertente... se solo non fosse così deprimente... Ma guardiamo il lato positivo: Per un ragazzino curioso di 17 anni penetrare in sistemi informativi istituzionali è come affondare il coltello nel burro. Non usa nessun tool avanzato. Solo un browser. E se ha imparato lui, possono imparare anche gli altri! ;-) https://d4stiny.github.io/Hacking-College-Admissions/ Getting into college is one of the more stressful time of a high school student’s life. Since the admissions process can be quite subjective, students have to consider a variety of factors to convince the admissions officers that “they’re the one”. Some families do as much as they can to improve their chances - even going as far as trying to cheat the system. For wealthier families, this might be donating a very large amount to the school or as we’ve heard in the news recently, bribing school officials. If you don’t know about me already, I’m a 17-year-old high school senior that has an extreme interest in the information security field and was part of the college admissions process this year. Being part of the college admissions process made me interested in investigating, “Can you hack yourself into a school?”. In this article, I’ll be looking into TargetX, a “Student Lifecycle Solution for Higher Education” that serves several schools. All of this research was because of my genuine interest in security, not because I wanted to get into a school through malicious means. [...] After finding this vulnerability, I immediately reached out to WPI’s security team the same day to let them know about the vulnerabilities I found. They were very receptive and within a day they applied their first “patch”. Whenever I tried accessing the backend panel, I would see my screen flash for a quick second and then a 404 Message popped up. The flash had me interested, upon reading the source code of the page, I found all the data still there! I was very confused and diff’d the source code with an older copy I had saved. [...] What they were doing was stopping the page from loading and then replacing the HTML with a 404 error. I could just use NoScript, but I decided to create a simple userscript to disable their tiny “fix”.

1 1

Johnny, you are fired! – Spoofing OpenPGP and S/MIME Signatures in Emails
by Giacomo Tesio May 2, 2019

May 2, 2019

https://github.com/RUB-NDS/Johnny-You-Are-Fired OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery attacks against various implementations of OpenPGP and S/MIME email signature verification in five attack classes: (1) We analyze edge cases in S/MIME's container format. (2) We exploit in-band signaling in the GnuPG API, the most widely used OpenPGP implementation. (3) We apply MIME wrapping attacks that abuse the email clients' handling of partially signed messages. (4) We analyze weaknesses in the binding of signed messages to the sender identity. (5) We systematically test email clients for UI redressing attacks. Our attacks allow the spoofing of digital signatures for arbitrary messages in 14 out of 20 tested OpenPGP-capable email clients and 15 out of 22 email clients supporting S/MIME signatures. While the attacks do not target the underlying cryptographic primitives of digital signatures, they raise concerns about the actual security of OpenPGP and S/MIME email applications. Finally, we propose mitigation strategies to counter these attacks.

1 0

Remote Code Execution on most Dell computers
by Giacomo Tesio May 2, 2019

May 2, 2019

https://d4stiny.github.io/Remote-Code-Execution-on-most-Dell-computers/ When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is “What third-party software came with my PC?”. In this article, I’ll be looking at a Remote Code Execution vulnerability I found in Dell SupportAssist, software meant to “proactively check the health of your system’s hardware and software” and which is “preinstalled on most of all new Dell devices”. [...] # Exploitation The first issue we face is making requests to the SupportAssist client. Assume we are in the context of a Dell subdomain, we’ll get into how exactly we do this further in this section. I decided to mimic the browser and make requests using javascript. [...] # Demo Here’s a small demo video showcasing the vulnerability. You can download the source code of the proof of concept here. https://invidio.us/watch?v=0cTfnZ04jgQ https://github.com/D4stiny/Dell-Support-Assist-RCE-PoC # Timeline 10/26/2018 - Initial write up sent to Dell. 10/29/2018 - Initial response from Dell. 11/22/2018 - Dell has confirmed the vulnerability. 11/29/2018 - Dell scheduled a “tentative” fix to be released in Q1 2019. 01/28/2019 - Disclosure date extended to March. 03/13/2019 - Dell is still fixing the vulnerability and has scheduled disclosure for the end of April. 04/18/2019 - Vulnerability disclosed as an advisory. Written on April 30, 2019

1 0

The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance by Roseanna Sommers, Vanessa K. Bohns :: SSRN
by J.C. DE MARTIN May 2, 2019

May 2, 2019

mi sembra importante. jc The Voluntariness of Voluntary Consent: Consent Searches and the Psychology of Compliance Yale Law Journal, Vol. 128, No. 7, 2019 72 Pages Posted: Roseanna Sommers University of Chicago - Law School Vanessa K. Bohns Cornell University Date Written: April 10, 2019 Abstract Consent-based searches are by far the most ubiquitous form of search undertaken by police. A key legal inquiry in these cases is whether consent was granted voluntarily. This Essay suggests that fact finders’ assessments of voluntariness are likely to be impaired by a systematic bias in social perception. Fact finders are likely to underappreciate the degree to which suspects feel pressure to comply with police officers’ requests to perform searches. In two preregistered laboratory studies, we approached a total of 209 participants (“Experi- encers”) with a highly intrusive request: to unlock their password-protected smartphones and hand them over to an experimenter to search through while they waited in another room. A sepa- rate 194 participants (“Forecasters”) were brought into the lab and asked whether a reasonable person would agree to the same request if hypothetically approached by the same researcher. Both groups then reported how free they felt, or would feel, to refuse the request. Study 1 found that whereas most Forecasters believed a reasonable person would refuse the experimenter’s request, most Experiencers—100 out of 103 people—promptly unlocked their phones and handed them over. Moreover, Experiencers reported feeling significantly less free to refuse than did Forecasters contemplating the same situation hypothetically. Study 2 tested an intervention modeled after a commonly proposed reform of consent searches, in which the experimenter explicitly advises participants that they have the right to with- hold consent. We found that this advisory did not significantly reduce compliance rates or make Experiencers feel more free to say no. At the same time, the gap between Experiencers and Fore- casters remained significant. These findings suggest that decision makers judging the voluntariness of consent consistently underestimate the pressure to comply with intrusive requests. This is problematic because it indi- cates that a key justification for suspicionless consent searches—that they are voluntary—relies on an assessment that is subject to bias. The results thus provide support to critics who would like to see consent searches banned or curtailed, as they have been in several states. The results also suggest that a popular reform proposal—requiring police to advise citizens of their right to refuse consent—may have little effect. This corroborates previous observational stud- ies, which find negligible effects of Miranda warnings on confession rates among interrogees, and little change in rates of consent once police start notifying motorists of their right to refuse vehicle searches. We suggest that these warnings are ineffective because they fail to address the psychology of compliance. The reason people comply with police, we contend, is social, not informational. The social demands of police-citizen interactions persist even when people are informed of their rights. It is time to abandon the myth that notifying people of their rights makes them feel empowered to exercise those rights. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3369844 (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

NIMH » Release of “13 Reasons Why” Associated with Increase in Youth Suicide Rates
by J.C. DE MARTIN May 1, 2019

May 1, 2019

https://www.nimh.nih.gov/news/science-news/2019/release-of-13-reasons-why-a… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

A parere dell’avvocato generale Szpunar, un servizio come quello fornito dalla piattaforma AIRBNB costituisce un servizio della società dell’informazione
by J.C. DE MARTIN May 1, 2019

May 1, 2019

A parere dell’avvocato generale Szpunar, un servizio come quello fornito dalla piattaforma AIRBNB costituisce un servizio della società dell’informazione https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-04/cp190051it… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

I vantaggi dei beni digitali nel Pil, quanto può pesare la rivoluzione? - ilSole24ORE
by don Luca Peyron May 1, 2019

May 1, 2019

Un gruppo di ricercatori del MIT ha proposto una metodologia <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3356697> per includere nel PIL i benefici derivanti dai beni digitali gratuitamente disponibili per i consumatori. Secondo la loro stima i guadagni di benessere potrebbero aggiungere alla crescita del prodotto, così rettificata, fino allo 0,11% all’anno. Buon primo maggio! Dl https://www.econopoly.ilsole24ore.com/2019/04/30/beni-digitali-pil/

1 0

The Airbnb Invasion of Barcelona | The New Yorker
by J.C. DE MARTIN May 1, 2019

May 1, 2019

https://www.newyorker.com/magazine/2019/04/29/the-airbnb-invasion-of-barcel… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0