Mountain of sensitive FedEx customer data exposed, possibly for years
Enlarge/ A redacted copy of data FedEx employees left on a publicly accessible Amazon bucket.
Passports, driver licenses, and other sensitive documentation for thousands of FedEx customers were left online, possibly for years, in a blunder that left the information available to identity thieves and other malicious actors, researchers said Thursday.
In all, Kromtech Security Center said, researchers found 119,000 scanned documents stored in a publicly available Amazon S3 bucket. The photo ID scans were accompanied by completed US Postal Service forms that included names, home addresses, and phone numbers of people who requested to have mail delivered by an authorized agent.
“Citizens from all over the world left their scanned IDs—Mexico, Canada, EU countries, Saudi Arabia, Kuwait, Japan, Malaysia, China, Australia—to name a few,” Kromtech researchers wrote.
The data initially was gathered by Bongo International, a company that helped North American retailers and brands sell online to consumers in other countries, the researchers said. FedEx acquired Bongo International in 2014 and eventually changed its name to FedEx Cross-Border International. FedEx shut down the service last April. The discovery of the customer IDs and other personal information suggests that not only was the information never properly secured to begin with, but FedEx officials failed to purge the data once the service was discontinued. Kromtech said the information may have been available since 2009.
Thursday’s post said Kromtech researchers made “attempts to get in touch with FedEx via FedEx Cross-Border Merchant Customer Support line and emails.” The researchers said they didn’t succeed until Tuesday, when ZDNet reporter Zack Whittaker began contacting FedEx officials. The unsecured Amazon bucket was taken down on Wednesday.
In a statement, FedEx officials wrote: “After a preliminary investigation, we can confirm that some archived Bongo International account information located on a server hosted by a third-party, public cloud provider is secure. The data was part of a service that was discontinued after our acquisition of Bongo. We have found no indication that any information has been misappropriated and will continue our investigation.”
Of course, the absence of evidence isn’t evidence of absence. People who used Bongo International or FedEx Cross-Border International should be on alert. The incident is a good reason why people should avoid turning over personal information when practical.
https://arstechnica.com/?p=1260913
Zero-Day in Telegram’s Windows Client Exploited for Months
A zero-day vulnerability impacting Telegram Messenger’s Windows client had been exploited in malicious attacks for months before being discovered and addressed.
Exploitation of the bug involves the use of a classic right-to-left override attack when a file is sent using the messenger service. The special nonprinting right-to-left override (RLO) character represented as ‘U+202E’ is used to reverse the order of the characters following it in the string.
Cybercriminals have discovered that they could leverage the character to mislead victims by hiding the name and extension of an executable file. Thus, if an application is vulnerable to the attack, the filename and extension would be displayed either incompletely or in reverse.
According to Kaspersky, which observed the attacks abusing the flaw, the attack chain involves sending malware in a message, but using the special character to hide it. A JS file could be renamed as photo_high_re*U+202E*gnp.js, which would make Telegram display the string gnp.js in reverse, thus appearing to the unsuspecting user as a PNG image file instead.
The actual file, however, isn’t modified, but remains the same JS file that it always was. If the user clicks on it, a standard Windows security notification would appear – as long as it hasn’t been previously disabled in the system’s settings –, informing the user that it is a JavaScript file.
Kaspersky learned of the issue in October 2017 and, after an investigation into the matter, discovered that cybercriminals had been abusing it since at least March 2017, in a multitude of attack scenarios.
Some of the incidents, the researchers say, resulted in the attackers taking control of the victim’s system. For that, however, analysis of the target system’s environment and the installation of additional modules was necessary.
Such an attack starts with an initial downloader being sent to the target. It would achieve persistence and then begin checking for commands arriving from the control bot. The loader could silently deploy malicious tools such as backdoors, loggers, and other malware on the target system.
The vulnerability was also abused in attacks involving miners, Kaspersky says. The infection would start with an SFX archive with a script designed to launch a BAT file posing as an executable. The program would first open a decoy file, when it would launch two miners as services, using the nssm.exe utility for this operation.
One of the programs was nheq.exe, an Equihash miner for NiceHash (it mined Zcash in the observed attack), while the other was taskmgn.exe, a popular miner implementing the CryptoNight algorithm and used to mine Fantomcoin and Monero.
In some attacks, the batch script had extra capabilities, being able to disable Windows security features and to download an additional payload from a malicious FTP server. The payload contained more miners and a Remote Manipulator System (RMS) client for subsequent remote access.
On the malicious FTP server, the researchers discovered archives containing Telegram directories stolen from the victims, some of which were created in March 2017. Inside the archives, Kaspersky found “an encrypted local cache containing different files used in personal communications: documents, videos and audio records and photos.”
In another attack scenario, an SFX archive launching a VBScript was observed. It too would open a decoy image to distract the user, then fetch and run the payload, another SFX archive containing a script designed to control the launch of the miner CryptoNight (csrs.exe). The script monitors the task list and terminates the miner if a task manager (taskmgr.exe, processhacker.exe) is on that list.
“It appears that only Russian cybercriminals were aware of this vulnerability, with all the exploitation cases that we detected occurring in Russia. Also, while conducting a detailed research of these attacks we discovered a lot of artifacts that pointed to involvement by Russian cybercriminals,” Kaspersky says.
The researchers couldn’t determine which versions of Telegram were affected by the vulnerability, but they believe that the exploitation of flawed Windows clients started in March 2017. Telegram was informed on the bug and has since addressed it in its products.
Major Browser Vendors to Restrict AppCache to Secure Connections
Major web browser vendors plan on restricting the use of the Application Cache (AppCache) feature to secure connections in an effort to protect users against potential attacks.
Mozilla on Monday was the first to make an official announcement, but the developers of Chrome, Edge and WebKit (the layout engine used by Apple’s Safari) said they plan on doing the same.
AppCache is an HTML5 application caching mechanism that allows website developers to specify which resources should be available offline. This improves speed, reduces server load, and enables users to browse a site even when they are offline.
While application caching has some benefits, it can also introduce serious security risks, which is partly why it has been deprecated and its use is no longer recommended.
The problem is that AppCache does not properly revalidate its cache, making it possible for man-in-the-middle (MitM) attackers to load malicious content. Mozilla has described the following attack scenario:
“A user logs onto a coffee shop WiFi where an attacker can manipulate the WiFi that is served over HTTP. Even if the user only visits one HTTP page over the WiFi, the attacker can plant many insecure iframes using AppCache which allows the attacker to rig the cache with malicious content manipulating all of those sites indefinitely. Even a cautious user who decides only to login to their websites at home is at risk due to this stale cache.”
Mozilla has already banned access to AppCache from HTTP pages in Firefox 60 Nightly and Beta, and will do the same in the main branch starting with Firefox 62, scheduled for release in early May.
Mozilla says it will continue to remove features for websites using HTTP and advised developers to implement TLS encryption in order to preserve current functionality.
“Going forward, Firefox will deprecate more APIs over insecure connections in an attempt to increase adoption of HTTPS and improve the safety of the internet as a whole,” explained Mozilla’s Jonathan Kingston.
Google Chrome developers initiated a discussion on removing AppCache on insecure origins back in 2016, but failed to find a solution. Following Mozilla’s lead, the Chrome team has picked up discussions on this topic on February 2.
Microsoft reportedly started making plans for AppCache restriction last week and WebKit developers are also looking into making changes. Some modifications will also be made in the HTML standard.
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Questo sito si avvale di cookie tecnici e, con il tuo consenso, di cookie di profilazione, anche di terze parti. Chiudendo questo banner, cliccando in un’area sottostante o accedendo ad un’altra pagina del sito, acconsenti all’uso dei cookie. Per ulteriori informazioni o negare il consenso, consulta la cookie policy. OkLeggi di più
Il Responsabile della Protezione dei Dati (Data Protection Officer-DPO)
Di Stefano Comellini
Maggioli editore
Data di pubblicazione: febbraio 2018
ISBN: 8891626578
Pagine: 64
Prezzo: € 18,00
Soluzioni di Diritto è una collana che offre soluzioni operative per la pratica professionale o letture chiare di problematiche di attualità. Uno strumento di lavoro e di approfondimento spendibile quotidianamente. L’esposizione è lontana dalla banale ricostruzione manualistica degli istituti ovvero dalla sterile enunciazione di massime giurisprudenziali. Si giunge a dare esaustive soluzioni ai quesiti che gli operatori del diritto incontrano nella pratica attraverso l’analisi delle norme, itinerari dottrinali e giurisprudenziali e consigli operativi sul piano processuale.
L’opera è un’analisi dei compiti e dei margini di attività della nuova figura del “Responsabile dei dati personali” (anche noto come DPO, acronimo di Data Protection Officer), in considerazione degli adempimenti che imprese e soggetti pubblici devono affrontare per effetto del Regolamento UE 2016/679. Il testo è strutturato in numerosi quesiti di taglio pratico (quando deve essere designato un DPO? Chi deve nominarlo? Chi può essere nominato DPO e quali requisiti sono richiesti? DPO dipendente oppure soggetto esterno? Quale atto formale di nomina occorre in ambito pubblico? Se il DPO è un dipendente pubblico quale qualifica deve avere? Qual è la posizione del DPO nell’ente/azienda? Quali sono i suoi compiti?), ai quali l’autore fornisce una soluzione sulla scorta del testo normativo, delle linee guida adottate dal Gruppo di Lavoro ex art. 29 (WP29) e delle più recenti indicazioni fornite dal Garante della Privacy.
Stefano Comellini Avvocato in Bologna, patrocinante in Cassazione, si occupa prevalentemente di Diritto Industriale, Diritto dell’Informatica e delle Telecomunicazioni nonché della disciplina della Privacy. E’ iscritto nell’elenco dei rappresentanti presso la EUIPO (Ufficio dell’Unione Europea per la proprietà intellettuale). Relatore in convegni, è particolarmente attivo sui social network, dove svolge attività di divulgazione giuridica. Nel 2002, il sito www.comellini.it, da lui curato, ha ottenuto, dalla giuria di “Italex Award 2002 – il premio per i migliori siti giuridici italiani”, il riconoscimento di migliore studio legale online.
Swiss telecoms giant Swisscom on Wednesday said it had tightened security controls after suffering a data breach that affected roughly 800,000 of its customers.
The company said unauthorized parties gained access to customer data by leveraging the access privileges of a sales partner. The attackers somehow obtained the partner’s credentials and used them to access contact information, including names, physical addresses, phone numbers, and dates of birth.
Swisscom pointed out that it collects this type of data legally from customers when they enter a subscription agreement, and sales partners are given limited access to records for identification and contracting purposes.
The company noted that this type of information is not considered sensitive under data protection laws, and it’s mostly either already in the public domain or in the hands of list brokers.
The data breach has affected approximately 800,000 Swisscom customers, mostly mobile services subscribers. The company said it had detected the incident during a routine check, but an in-depth investigation was launched following its discovery.
“Swisscom stresses that the system was not hacked and no sensitive data, such as passwords, conversation or payment data, was affected by the incident,” Swisscom stated. “Rigorous long-established security mechanisms are already in place in this case.”
While the compromised data is non-sensitive, Swisscom has reported the incident to the Swiss Federal Data Protection and Information Commissioner (FDPIC).
In response to the breach, the company has revoked access for the firm whose credentials were stolen and implemented tighter controls for partners. In the future, Swisscom wants to ensure that high-volume queries for customer information can no longer be run, and introduce two-factor authentication for sales partners when accessing its systems.
The company says it is not aware of any schemes leveraging the stolen data, but it has advised customers to be wary of any suspicious calls.
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Le Smart TV sono facili da hackerare. A rischio la privacy degli utenti
La Consumer Union americana, organizzazione senza scopo di lucro che dedica test imparziali sui prodotti di consumo e fa ricerche orientate al consumatore, ha appena dato la notizia su Consumer Reports. Milioni di smart TV possono essere controllate facilmente da hacker che sfruttano falle di sicurezza.
Secondo la rivista, la vulnerabilità è stata riscontrata in TV Samsung, TCL e dispositivi che utilizzano la piattaforma Roku TV, che può includere marchi come Philips, RCA, Hisense, Hitachi, Insignia e Sharp, insieme ad alcuni dei lettori di streaming di Roku.
Dal report è risultato che un hacker (anche poco esperto) può cambiare canale o alzare il volume, aprire i contenuti di YouTube o spegnere la TV. Inoltre, i test hanno rilevato che le smart TV hanno sollevato problemi di privacy raccogliendo informazioni molto dettagliate sui loro utenti. I consumatori possono limitare la raccolta dei dati ma devono rinunciare a molte delle funzionalità delle TV, suggerisce Consumer Reports.
“Lo standard digitale può essere utilizzato per valutare molti prodotti che raccolgono dati e si connettono a Internet”, ha commentato Maria Rerecich, che supervisiona i test elettronici presso Consumer Reports.”Le smart TV erano un punto di partenza naturale. Queste tecnologie stanno crescendo notevolmente da un punto di vista di vendite e possono trasmettere una notevole quantità di informazioni sui loro utenti ai produttori di TV e ai loro partner commerciali. L’obiettivo –continua Rerecich – è quello di educare i consumatori sulla loro privacy e sulle opzioni di sicurezza e di influenzare i produttori a prendere in considerazione queste preoccupazioni durante lo sviluppo dei loro prodotti.”
Secondo Consumer Report i test hanno rilevato che i televisori monitoravano costantemente ciò che i loro proprietari stavano osservando e trasmettevano al TV maker e/o ai suoi partner commerciali, tutte le informazioni sul cliente utilizzando una tecnologia chiamata ACR (Automatic Content Recognition). L’ACR aiuta la TV a capire quali altri spettacoli ti potrebbero piacere, ma i dati possono essere combinati con altri aspetti delle informazioni personali per aiutare a creare profili sul comportamento che vengono venduti ad altri operatori di marketing.
Consumer Reports consiglia ai proprietari di smart TV che desiderano proteggere la loro privacy di controllare i manuali di istruzioni su come ripristinare le impostazioni di fabbrica del televisore e impostarli nuovamente, prestando molta attenzione a non ricevere i dati di visualizzazione raccolti. In tal caso, consigliano di prestare molta attenzione durante l’installazione. In questo caso, puoi accettare la politica sulla privacy di base e i termini del servizio, che comunque attivano una quantità significativa di raccolta dati, mentre si riduce l’ACR.
Per aumentare notevolmente la privacy è possibile sia disattivare totalmente l’ACR, utilizzando le impostazioni della TV, anche se queste impostazioni sono in genere sepolte da tre o quattro menu difficili da trovare, e disattivare la connessione WiFi del televisore. Fai questo, però, e in pratica non hai più una smart TV. È necessario aggiungere un dispositivo multimediale di streaming separato per ottenere contenuti basati sul Web. Udite udite, ma anch’esso a rischio vulnerabilità.
Hackers From Florida, Canada Behind 2016 Uber Breach
Two individuals living in Canada and Florida were responsible for the massive data breach suffered by Uber in 2016, the ride-sharing company’s chief information security officer said on Tuesday.
In a hearing before the Senate Subcommittee on Consumer Protection, Product Safety, Insurance, and Data Security, Uber CISO John Flynn shared additional details on the data breach that the company covered up for more than a year.
The details of 57 million Uber riders and drivers were taken from the company’s systems between mid-October and mid-November 2016. The compromised data included names, email addresses, phone numbers, user IDs, password hashes, and the driver’s license numbers of roughly 600,000 drivers. The incident was only disclosed by Uber’s CEO, Dara Khosrowshahi, on November 21, 2017.
Flynn told the Senate committee on Tuesday that the data accessed by the hackers had been stored in an Amazon Web Services (AWS) S3 bucket used for backup purposes. The attackers had gained access to it with credentials they had found in a GitHub repository used by Uber engineers. Uber decided to stop using GitHub for anything other than open source code following the incident.
Uber’s security team was contacted on November 14, 2016, by an anonymous individual claiming to have accessed Uber data and demanding a six-figure payment. After confirming that the data obtained by the hackers was valid, the company decided to pay the attackers $100,000 through its HackerOne-based bug bounty program to have them destroy the data they had obtained.
While some members of Uber’s security team were working on containing the incident and finding the point of entry, others were trying to identify the attackers. The man who initially contacted Uber was from Canada and his partner, who actually obtained the data, was located in Florida, the Uber executive said.
“Our primary goal in paying the intruders was to protect our consumers’ data,” Flynn said in a prepared statement. “This was not done in a way that is consistent with the way our bounty program normally operates, however. In my view, the key distinction regarding this incident is that the intruders not only found a weakness, they also exploited the vulnerability in a malicious fashion to access and download data.”
A code of conduct added by HackerOne to its disclosure guidelines last month includes an entry on extortion and blackmail, prohibiting “any attempt to obtain bounties, money or services by coercion.” It’s unclear if this is in response to the Uber incident, but the timing suggests that it may be.
The Uber CISO has not said if any actions have been taken against the hackers, but Reuters reported in December that the Florida resident was a 20-year-old who was living with his mother in a small home, trying to help pay the bills. The news agency learned from sources that Uber had decided not to press charges as the individual did not appear to pose a further threat.
Flynn admitted that “it was wrong not to disclose the breach earlier,” and said the ride-sharing giant has taken steps to ensure that such incidents are avoided in the future. He also admitted that the company should not have used its bug bounty program to deal with extortionists.
Uber’s chief security officer, Joe Sullivan, and in-house lawyer Craig Clark were fired over their roles in the breach. Class action lawsuits have been filed against the company over the incident and some U.S. states have announced launching investigations into the cover-up.
U.S. officials are not happy with the way Uber has handled the situation.
“The fact that the company took approximately a year to notify impacted users raises red flags within this Committee as to what systemic issues prevented such time-sensitive information from being made available to those left vulnerable,” said Sen. Jerry Moran, chairman of the congressional committee.
Just before the Senate hearing, Congresswoman Jan Schakowsky and Congressman Ben Ray Lujan highlighted that Uber had deceived the Federal Trade Commission (FTC) by failing to mention the 2016 breach while the agency had been investigating another, smaller cybersecurity incident suffered by the firm in 2014.
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
‘Braccialetto Amazon? 5 condizioni per applicarlo’. Videointervista a Francesco Pizzetti (Costituzionalista, già Garante Privacy)
“Qualora dovesse essere utilizzato in Italia non basta che Amazon dica il braccialetto è utilizzato per il controllo a distanza dei dipendenti, deve dimostrare:
Che non archivi i dati.
Non misuri il tempo con il quale il dipendente processa l’ordine.
Se lo fa deve dichiararlo nelle policy aziendali.
Deve ottenere il consenso delle organizzazioni sindacali in base alla legge italiana.
Il dipendente deve essere informato”.
Le 5 regole, che la società dovrà obbligatoriamente rispettare nel caso decida di porre il braccialetto ai dipendenti italiani, sono elencate in maniera chiara da Francesco Pizzetti, professore ordinario di diritto costituzionale all’università di Torino e docente alla LUISS, e presidente dell’Autorità Garante per la protezione dati personali dal 18 aprile 2005 al 17 giugno 2012.
Ecco la sua videointervista rilasciata a Key4biz.
[embedded content]
Pizzetti ha poi ricordato che: “Noi abbiamo moltissimi casi in cui il controllo a distanza è consentito, per esempio ai portavalori, dove è fondamentale che siano controllati sempre per evitare rapine”.
“Quindi bisogna tenere i nervi saldi, la notizia dei brevetti Amazon sul braccialetto merita, certamente, attenzione e credo che ci siano anche le condizioni, se si vedessero le prime applicazioni, perché i garanti nazionali, e meglio ancora in modo coordinato quelli europei, chiedano ad Amazon spiegazioni, analizzino esattamente l’utilizzo di questi strumenti e poi facciano valere le regole dell’Unione europea”, ha concluso il costituzionalista.
San Francisco is trying to find network providers to build a city-wide, gigabit fiber Internet service with mandated net neutrality and consumer privacy protections. It would be an open-access network, allowing multiple ISPs to offer service over the same lines and compete for customers.
The city yesterday issued a Request for Qualifications (RFQ) to find companies that are qualified “to design, build, finance, operate, and maintain a ubiquitous broadband FTTP [fiber-to-the-premises] network that permits retail service providers to lease capacity on the network.” The project would also involve a free Wi-Fi service for city parks, city buildings, major thoroughfares, and visitor areas. Low-income residents would qualify for subsidies that make home Internet service more affordable.
ISPs offering service over the network would not be allowed to block or throttle lawful Internet traffic or engage in paid prioritization. ISPs would also need customers’ opt-in consent “prior to collecting, using, disclosing, or permitting access to customer personal information or information about a customer’s use of the network.”
San Francisco started considering the network even before the federal government repealed broadband privacy rules and net neutrality rules. A city-wide fiber network would benefit residents and business regardless of whether those federal rules exist, but the gutting of the rules adds urgency to the project in the eyes of city officials.
“Trump’s hand-picked FCC and Republicans in Congress have dismantled crucial net neutrality, privacy, and consumer protections,” Mayor Mark Farrell said in an announcement yesterday. “We will provide an alternative that favors the general public and San Francisco values, not corporate interests. Through this project, we will close the digital divide, ensure net neutrality, and create a truly fair and open Internet in San Francisco.”
About 100,000 people—12 percent of the city’s residents—lack Internet access at home, the announcement said. “About 15 percent of the City’s public school students do not have Internet access, a number that increases to 30 percent for African American and Latino students,” the announcement also said. “The cost of Internet services has been repeatedly cited as a barrier to access for low-income families.”
City will foot some of the bill
The city says it will cover a portion of the costs for the multi-billion dollar project and provide or lease access to necessary city property and infrastructure. But San Francisco isn’t planning to build the network itself, a step that hundreds of smaller cities and towns have taken.
The winning bidder is “expected to assume the full performance risk,” including “all risks related to design, construction, financing, operation, and maintenance” of the network, the RFQ says. As a result, the biggest challenge may be finding companies willing to meet all of San Francisco’s demands.
The network would have to cover San Francisco’s land area of 46.7 square miles and a population of more than 860,000. The city estimates construction would take three to five years.
On the plus side for bidding entities, San Francisco would provide payments to the builder when construction milestones are reached. The private builder would also get a share of the network’s revenue.
San Francisco says it will also “provide or lease access to City fiber, communication assets, and conduits to reduce capital costs and construction; [and] provide or lease space on City properties suitable for placement of data centers, fiber hubs, or central offices at a reasonable rate.”
The RFQ seeks up to three qualified consortia or joint ventures; only those three would be eligible to bid on a Request for Proposals, the next step in the process. The RFQ deadline is March 26.
The RFQ anticipates that the city would sign a 15-year agreement with the winning bidder. Respondents are expected to submit specific financing plans.
The network “will serve as a platform for multiple [ISPs] to reach subscribers over a shared infrastructure,” the RFQ says. ISPs “will be able to connect to the network and deliver services to their subscribers. This shared last-mile fiber will reduce the cost for new service providers to enter the market, reduce redundant and costly builds to reach subscribers and give subscribers more choices for service providers to meet their connectivity needs.”
Stalled project in LA
Los Angeles issued a similar Request for Proposals in 2013. Another request followed in 2015, but “the city never received a workable proposal from a private company to build out the network,” according to an article last month in Curbed Los Angeles.
The LA project may have been doomed by LA’s decision to discourage proposals that required any financial support from the city. By contrast, San Francisco is willing to chip in some money.
Bringing fiber to all San Francisco residences and businesses would cost a few billion dollars, according to a report commissioned by San Francisco that was released in October. A “dual” fiber scenario would involve a “lit fiber” network (estimated to cost at least $1.8 billion) and “dark fiber” (estimated to cost at least $1.4 billion).
Alternatively, the report says the city could find a partner to build the dark fiber network “and then lease dark fiber to competing service providers who would light and operate the fiber.”
Average prices of $51 per month for residential customers and $73 per month for businesses “would cover all of the project costs” and make the service financially feasible, the report says. If San Francisco’s planning is correct, the revenue would also cover a subsidy that would allow low-income residents to pay only $10 a month.
The report acknowledged that there are significant “uncertainties related to capital costs” and financing.
Tags:
Tags:
Tags:
Tags:
