ZDNet | Technology News, Analysis, Comments and Product Reviews for IT Professionals

A new data leak hits Aadhaar, India’s national ID database
▻http://www.zdnet.com/article/another-data-leak-hits-india-aadhaar-biometric-database

Exclusive : The data leak affects potentially every Indian citizen subscribed to the database. India’s national ID database has been hit by yet another major security lapse. Known as Aadhaar, the government ID database is packed with identity and biometric information — like fingerprints and iris scans — on more than 1.1 billion registered Indian citizens, official figures show. Anyone in the database can use their data — or their thumbprint — to open a bank account, buy a cellular SIM card, (...)

#Aadhaar #UIDAI #biométrie #hacking

CERT : These emerging technologies bring new risks | ZDNet
▻http://www.zdnet.com/article/emerging-technologies-bring-new-risks

http://zdnet1.cbsistatic.com/hub/i/r/2017/05/14/706776c6-1092-473a-b3cd-c04238ec2dff/thumbnail/770x578/27dfece63d1e80bf575ed14f2ad33b6e/data61-blockchain-distributed-ledger.jpg

n its Emerging Technology Domains Risk Survey, CERT examines a variety of trends that can provide a lot of benefits to people and businesses, but also pose risks that need to be addressed.

Some of these areas are moving ahead so quickly in adoption that companies have not had a chance to completely evaluate their implications. For example, “machine learning and robotics are advancing more quickly than expected, and may have as-yet-undiscovered risks,” said Dan Klinedinst, senior threat and vulnerability researcher at CERT and one of the authors of the report.

#Sécurité_informatique #Intelligence_artificielle

A server hosting dozens of popular file converter sites has been hacked | ZDNet
▻http://www.zdnet.com/article/dozens-of-online-file-converter-sites-are-unsafe-to-use-warns-researcher

http://zdnet1.cbsistatic.com/hub/i/r/2017/08/31/745aeebc-7d30-44b2-81d4-6b9d8960057c/thumbnail/770x578/eefab587aecf9fbac77720c9f57aab13/doc-convert-jpg.jpg

Du danger de réaliser des transcodages sur un serveur extéireur : on ne maîtrise pas réellement ce qui nous est retourné.

The server was vulnerable to a year-old set of bugs found in the ImageMagick library, a popular tool used to convert images. The bugs, known collectively as “ImageTragick,” are extremely easy to exploit — in one case, as simple as uploading an image file containing four lines of code to the server. The bug is so serious that Facebook paid a record bug bounty to a researcher who found that the social network was vulnerable, and Yahoo stopped using the software altogether. Countless servers and websites remain unpatched to this day.

As soon as the image is uploaded, the code runs, opening up a bind shell on the server, which listens for commands or code from an attacker’s server.

Voir également ImageTragick ►https://imagetragick.com

#ImageMagick

Sonos says users must accept new privacy policy or devices may “cease to function” | ZDNet
▻http://www.zdnet.com/article/sonos-accept-new-privacy-policy-speakers-cease-to-function

http://zdnet2.cbsistatic.com/hub/i/r/2017/08/21/156cf341-5680-47f6-bc7e-55240a6bd023/thumbnail/770x578/4707dbc7ce04bf75186586bd71834052/sonos.jpg

A spokesperson for the home sound system maker told ZDNet that, “if a customer chooses not to acknowledge the privacy statement, the customer will not be able to update the software on their Sonos system, and over time the functionality of the product will decrease.”

“The customer can choose to acknowledge the policy, or can accept that over time their product may cease to function,” the spokesperson said.

The move has drawn ire from several privacy and policy experts.

“Sonos is a perfect illustration of how effective privacy, when it comes to not just services but also physical objects, requires more than just ’more transparency’ — it also requires choices and effective controls for users,” said Joe Jerome, a policy analyst at the Center for Democracy & Technology.

“We’re going to see this more and more where core services for things that people paid for are going to be conditioned on accepting ever-evolving privacy policies and terms of use,” he said. “That’s not going to be fair unless companies start providing users with meaningful choices and ensure that basic functionality continues if users say no to new terms.”

Lee Tien, a senior staff attorney at the Electronic Frontier Foundation, said it was a “growing” problem among the consumer electronics space.

“[Device] makers obviously can do a lot about the problem,” said Tien. “They can design their systems to separate more data collection side from product feature. Obviously some features don’t work without data but even so, you can often choose to store data locally and not transmit it to some mothership somewhere.”

“Society as a whole continues down a path where devices in your home, traditionally our most private space, are largely controlled by other people who want to know what you’re doing,” he said.

#Vie_privée #Sécurité_informatique

​Firefox’s new tool lets you send self-destructing 1GB files from any browser

Easy and fast upload, you get a link that you can copy.
Link can only be used (downloaded) once, then the file no longer exists.
(it also expires after 24h of non-use)

►https://send.firefox.com

▻http://www.zdnet.com/article/firefoxs-new-tool-lets-you-send-self-destructing-1gb-files-from-any-browser

Firefox Send uses WebCrypto API with the AES-GCM algorithm to encrypt and decrypt the file in the browser, meaning the file that’s transferred to Mozilla’s server is already encrypted and its contents can’t be viewed by Mozilla, though it does receive the filename and file size.

The link that users send includes the encryption key and allows anyone with the link to download and access the file, so long as it hasn’t already been downloaded once already.

With a single wiretap order, US authorities listened in on 3.3 million phone calls | ZDNet
▻http://www.zdnet.com/article/one-federal-wiretap-order-recorded-millions-phone-calls

http://zdnet1.cbsistatic.com/hub/i/r/2017/06/30/20795563-7517-4303-ad1e-f07ff8bd967f/thumbnail/770x578/e385956e000352460885c50d6f59e53d/cellphonestockimage-100577838-orig.jpg

#surveillance #wtf

Hundreds of privacy-invading apps are using ultrasonic sounds to track you | ZDNet
▻http://www.zdnet.com/article/hundreds-of-apps-are-using-ultrasonic-sounds-to-track-your-ad-habits

http://zdnet3.cbsistatic.com/hub/i/r/2017/05/03/b3994cd2-469d-4633-9558-e033379931fc/thumbnail/770x578/192381378d45b6edb1130f8117535e1a/thing-jpg.jpg

These near-silent tones can’t be picked up by the human ear, but there are apps in your phone that are always listening for them. This technology is called ultrasonic cross-device tracking, and it works by emitting high-frequency tones in advertisements and billboards, web pages, and across brick-and-mortar retail outlets or sports stadiums. Apps with access to your phone’s microphone can pick up these tones and build up a profile about what you’ve seen, where, and in some cases even the websites you’ve visited.

Many of these apps have been downloaded thousands of millions of times, such as games — like Pinoy Henyo, which was named in the research as one of the apps that opens up the microphone to listen to ultrasonic tones. Other app makers were named in the paper — including McDonalds and Krispy Kreme, though it’s not known how either company utilizes their ad-tracking technology.

#surveillance #vie_privée #mobiles

Systèmes de disques par redondance :
Le RAID 6 est amené à céder. Tout comme le RAID 5 est devenu peu recommandable. Et c’est dû à l’augmentation de la capacité des disques.

http://zdnet4.cbsistatic.com/hub/i/r/2014/10/04/c7d828f3-4b5c-11e4-b6a0-d4ae52e95e57/resize/370xauto/58d3fa92453ffa00d2681ceb9a716cf9/relativereliabilityr5vsr6.jpg

Who will have the AI edge? | Bulletin of the Atomic Scientists
▻http://thebulletin.org/who-will-have-ai-edge10497

[Mary] Cummings argues that companies like Google and Facebook could outpace militaries when it comes to the science of artificial intelligence, which in turn could lead to potentially dangerous technologies going into use before they have been properly tested.

#IA #silicon_army #voiture_autopilotée #armement

​LinkedIn’s Lynda.com suffers database breach

▻http://www.zdnet.com/article/linkedins-lynda-com-suffers-database-breach

Online learning platform Lynda.com has begun notifying its 9.5 million users that it recently experienced unauthorised third party access to a database that contains contact information of account holders, their learning data, and courses viewed.
[...]
“We are informing you of this issue out of an abundance of caution,” Lynda.com said. "While we have no evidence that your specific account was accessed or that any data has been made publicly available, we wanted to notify you as a precautionary measure."

#data_breach

New #UK #surveillance #law forces internet access providers to store browsing histories — including domains visited — for one year, in case of police investigations.
▻http://www.zdnet.com/article/snoopers-charter-expansive-new-spying-powers-becomes-law

South Australia Police adopting facial-recognition technology
▻http://www.zdnet.com/article/south-australia-police-adopting-facial-recognition-technology

NEC Australia has been awarded with a AU$780,000 contract to deploy facial-recognition technology for South Australia Police. The South Australian government has awarded NEC Australia with a AU$780,000 contract to implement facial-recognition technology as of late October for the state’s police force in an effort to make it easier to identify persons of interest and missing persons. The facial-recognition technology allows police to compare images of suspects from such sources as (...)

#NEC #CCTV #facial #biométrie #surveillance

​OwnCloud founder forks popular open-source cloud | ZDNet
▻http://www.zdnet.com/article/owncloud-founder-forks-popular-open-source-cloud

Karlitschek said he and his team “plan to significantly accelerate development, focus again on an open process with less blockers like Contributor Licence Agreements or closed enterprise apps. Over the coming days and weeks, we will gather input from community members and share our own ideas for improvements.”

#owncloud #nextcloud #cloud

Annonces de Karlitschek : ▻http://seenthis.net/messages/496185

En français : ▻https://linuxfr.org/users/barmic/journaux/nextcloud-le-fork-d-owncloud

How to block Windows 10 upgrades on your business network (and at home, too) | ZDNet
▻http://www.zdnet.com/article/how-to-block-windows-10-upgrades-on-your-business-network-and-at-home-too/#!

Here’s the first file, which I saved as DisableOSUpgrade.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]

“DisableOSUpgrade”=dword:00000001

The second file is DisableGWX.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\GWX]

“DisableGWX”=dword:00000001

#Google faces record €3b fine from European Commission : Report | ZDNet
▻http://www.zdnet.com/article/google-faces-record-3b-fine-from-european-commission-report

Google is facing a record antitrust fine of around €3 billion from the European Commission in the coming weeks, British newspaper The Sunday Telegraph has reported.

The European Union has accused Google of promoting its shopping service in internet searches at the expense of rival services in a case that has dragged on since late 2010.

Several people familiar with the matter told Reuters last month that they believed after three failed attempts at a compromise in the past six years, Google now had no plans to try to settle the allegations unless the EU watchdog changed its stance.

The Sunday Telegraph cited sources close to the situation as saying that officials planned to announce the fine as early as next month, but that the bill has not yet been finalised.

Google will also be banned from continuing to manipulate search results to favour itself and harm rivals, the newspaper said.

Un milliard d’Indiens, tous fichés
▻http://tempsreel.nouvelobs.com/economie/20160311.OBS6262/un-milliard-d-indiens-tous-fiches.html

Après 5 ans de travail, l’administration indienne a donné une identité numérique à un milliard d’habitants, identifiés par leur iris et leurs empreintes digitales. objectif : lutter contre la corruption et prouver que l’Inde est une grande puissance innovante 980 millions fin février, 990 millions le 10 mars... La barre du milliard d’Indiens « mis en fiche » devrait être atteinte à la fin du mois de mars et il ne restera plus que 250 millions de citoyens à transformer en numéro ! Contre toute attente, le (...)

#iris #biométrie #Aadhaar #UIDAI #empreintes #Morpho #Safran #Infosys

La limite de l’espionnage électronique : trop d’informations tuent l’information.

►http://www.zdnet.com/article/nsa-whistleblower-overwhelmed-with-data-ineffective

NSA is so overwhelmed with data, it’s no longer effective, says whistleblower

Salesforce buys machine learning startup PredictionIO
▻http://www.zdnet.com/article/salesforce-buys-machine-learning-startup-predictionio

“PredictionIO, a small startup that provides its technology open source, said it will be used to bolster SalesforceIQ’s machine learning. PredictionIO is a machine learning server. Data scientists generally use PredictionIO to evaluate models, create components and sample information.”

#machine_learning_Salesforce_PredictionIO_marché_acquisition_beclever

So, many have reported the BBC DDoS attack end January 2015 to be the largest ever at 602 Gbps. Many sites just spread that info without bothering to find out how they came to that number.

It turns out that number may well be exaggerated as there was no trace reported of such magnitude.

Here is a lengthy article that sums it all up rather well, without many technical details. Just crosschecking what the hackers ("The New World Hackers") claim, with that feedback obtained from Amazon, Arbor, BBC.

▻http://www.zdnet.com/article/tango-down-bbc-was-this-the-largest-ddos-web-attack

Some publications were quick to capitalize on the news of the “biggest-ever” web attack. Some hedged their bets in the face of a lack of evidence.

But the absence of convincing proof, coupled with a barrage of misleading statements, suggests that the biggest web attack in living history was — for all intents and purposes — nothing more than a publicity stunt from a faceless group.

#DDoS
#stresser #booter

NSA & GCHQ worked together to access Juniper equipment

The Intercept released a document indicating that GCHQ together with NSA had access in 2011 to different models of Juniper equipment.
There is however no direct link with the recently discovered backdoor in Juniper equipment. (see ►http://seenthis.net/messages/442614)

▻https://www.documentcloud.org/documents/2653542-Juniper-Opportunity-Assessment-03FEB11-Redacted.html
backup: ▻http://docdro.id/pdNxs3W

• Juniper NetScreen Firewalls models NS5gt, N25, NS50, NS500, NS204, NS208, NS5200, NS5000, SSG5, SSG20, SSG140, ISG 1000, ISG 2000. Some reverse engineering may be required depending on firmware revisions.
• Juniper Routers: M320 is currently being worked on and we would expect to have full support by the end of the 2010.

The document gives an interesting resume of Juniper, as a company and its technology, form an intelligence point of view.

Juniper as a target

Juniper is viewed as the ablest competitor selling SSL VPN technology.
• Well Established Position in the Carrier Space with high density routers
• Credible competitive alternative to Cisco dominance of core routing
• Carrier Ethernet Growing in Volume and Scope
• IP Traffic Growth Continues Unabated

Juniper as a Threat

Juniper’s leadership in core IP routing and the Enterprise Network Firewall and SSL VPN markets means that the SIGINT community should keep up with Juniper technology to be positioned to maintain CNE access over time. The threat comes from Juniper’s investment and emphasis on being a security leader. If the SIGINT community falls behind, it might take years to regain a Juniper firewall or router access capability if Juniper continues to rapidly increase their security.

The Intercept document

▻https://theintercept.com/2015/12/23/juniper-firewalls-successfully-targeted-by-nsa-and-gchq

Asked about the document [...] Juniper sent a written statement saying the company “operates with the highest of ethical standards, and is committed to maintaining the integrity, security, and quality of our products. As we’ve stated previously … it is against established Juniper policy to intentionally include ‘backdoors’ that would potentially compromise our products or put our customers at risk. Moreover, it is Juniper policy not to work with others to introduce vulnerabilities into our products.”

This so reads like a template. Replace “Juniper” with “Cisco” or “Huawei” and it would work as well...

#Juniper #backdoor
#NSA #SIGINT
#GCHQ