Google sotto la lente dell’antitrust Ue

È ufficiale, con il caso numero AT.40670, la Commissione europea ha avviato formalmente un’indagine antitrust per valutare se Google abbia o meno violato le regole per la libera concorrenza nel mercato dell’Unione con l’obiettivo di favorire i propri servizi pubblicitari online sfruttando la grande mole di dati a sua disposizione.

In particolare, si legge nel comunicato ufficiale della Commissione, il focus dell’indagine sarà centrato anche sui tipi di servizi di inserzione pubblicitaria in rete e sulle soluzioni “ad tech”, cioè le tecnologie pubblicitarie (advertising technologies), tra cui le pubblicità comportamentali (Online Behavioural Advertising) e le offerte in tempo reale (Real Time Bidding) di programmatic advertising.

Le ad tech sono un insieme di applicativi web e mobile per la gestione delle informazioni utili alle campagne pubblicitarie, tra cui ovviamente anche i nostri dati personali. Raccolta ed elaborazione dati avvengono in completa automazione.

Grazie a questo continuo flusso di informazioni pubblicitarie, le aziende del settore individuano sempre nuovi spazi per l’advertising in rete, più rilevanti sia per il mercato, sia per i propri clienti.

Il messaggio della Commissaria Ue Vestager

La Commissione europea vuole capire se Google stia o meno distorcendo e di quanto i livelli di libera concorrenza nel mercato comune, con la conseguenza di limitare enormemente l’accesso al mercato pubblicitario e alle informazioni relative di altri attori e altre aziende.

Google ha già subito una sanzione di 220 milioni di euro in Francia, nell’ambito di un accordo con le autorità francesi di regolamentazione della concorrenza, per archiviare uno dei primi casi antitrust in cui l’azienda era stata accusata di aver abusato della propria posizione dominante nel settore della pubblicità digitale.

“I servizi pubblicitari online sono al centro del modo in cui Google e gli editori monetizzano i propri servizi online. Google raccoglie dati da utilizzare per scopi pubblicitari mirati, in tal senso vende spazi e si propone anche da intermediario online. Quindi Google è presente in quasi tutti i livelli della filiera dell’industria dei display online”, ha commentato Margrethe Vestager, vicepresidente della Commissione e Commissario per il digitale.

“Siamo preoccupati che Google abbia reso più difficile per i servizi pubblicitari online rivali competere nel mercato advertising. La parità di condizioni è essenziale per tutti supply chain dell’online display advertising. La concorrenza leale è fondamentale, sia per gli inserzionisti che devono raggiungere i consumatori, sia per gli editori che devono vendere il proprio spazio agli inserzionisti, per generare entrate e finanziamenti da investire nella produzione di sempre nuovi contenuti”, ha aggiunto la vicepresidente della Commissione Ue.

La fetta di guadagni in gioco è grande: nel 2019, la spesa per l’online display advertising nell’Unione è stata stimata in circa 20 miliardi di euro.

I presunti illeciti potrebbero riguardare la violazione delle regole per la libera concorrenza delle imprese nell’Unione e il presunto abuso di posizione dominante.

Tutelare libera concorrenza e anche la privacy

La libera concorrenza nel mercato interno dell’Unione va tutelata di pari passo alla privacy, perché alla fine si sta parlando anche di dati personali trattati dalle società del settore, tra cui Google certamente, che devono rispettare le norme previste dal Regolamento europeo per il trattamento dei dati (Gdpr).

L’indagine Ue si concentrerà soprattutto su alcuni elementi chiave per stabilire eventuali violazioni di Google, tra cui: l’obbligo per gli inserzionisti e gli editori di utilizzar i servizi di Google Display & Video o DV360 e/o Google Ads per l’acquisto di annunci display su YouTube; oppure l’obbligo per le stesse categorie di utilizzare Google Ad Manager e ulteriori potenziali limitazioni imposte dal motore di ricerca sul modo sull’acquisto di servizi concorrenti; limitazioni imposte a terzi da parte sempre di Google nell’accesso ai dati personali degli utenti, come identità, comportamento e orientamento.

In risposta all’azione intrapresa da Bruxelles, secondo quanto riportato dall’Ansa, un portavoce del gigante di internet ha commentato: “Migliaia di aziende europee utilizzano i nostri prodotti pubblicitari per raggiungere nuovi clienti e per finanziare i propri siti internet. Scelgono i nostri prodotti perché sono competitivi ed efficaci. Continueremo a confrontarci in modo costruttivo con la Commissione europea per rispondere alle richieste di chiarimento e dimostrare i benefici che i nostri prodotti portano alle aziende e ai consumatori europei“.

https://www.key4biz.it/google-ue-apre-inchiesta-antitrust-al-centro-dellindagine-non-solo-concorrenza-anche-la-privacy/365752/

Pornhub was sued yesterday by 34 women alleging that the site hosted videos without their consent and profited from other nonconsensual content involving rape, child sexual abuse, and human trafficking.

Of the victims involved in the lawsuit, 14 said they were victims of people charged with or convicted of sex crimes, and 14 said they were underage in the videos served on Pornhub.

“It is time for the companies and individuals who have profited off of nonconsensual and illegal content be held liable for their crime,” one of the plaintiffs said in a conference call reported by CNN. “I joined the lawsuit because I seek justice for myself and the countless victims who don’t come forward.”

Pornhub’s parent company, MindGeek, which owns or runs over 150 pornographic websites, was included in the lawsuit. Pornhub, which is among the largest pornography websites on the internet, drew scrutiny last December when New York Times columnist Nicholas Kristof published a feature alleging that it “monetizes child rapes, revenge pornography, spy cam videos of women showering, racist and misogynist content, and footage of women being asphyxiated in plastic bags.”

At the time, the site reportedly received 6.8 million new videos per year, making it one of the largest video platforms on the web. In the wake of Kristof’s article, MasterCard and Visa investigated the site. The announcement sent Pornhub scrambling, and within two days, the site blocked uploads by unidentified users and removed the ability to download videos (except for “paid downloads within the verified Model Program,” the site said at the time). The changes weren’t enough, though, and MasterCard and Visa both banned it from their payment networks.

Several days later, Pornhub purged millions of user-uploaded videos, representing around two-thirds of the site’s content.

In February, Pornhub announced that it had expanded moderation by relying on both software and “an extensive team of human moderators” who review every upload. It also took a page from Facebook and let nonprofit groups do some of the lifting, giving them a “trusted flagger program” that would disable videos those groups thought contained illegal content. Lastly, they began working with a third party, Yoti, to verify the identities of its users.

Despite those measures, Pornhub does not follow other standards that are followed in the more traditional pornography industry. It does not, for example, verify the ages of everyone in videos hosted on the site, nor does it confirm that they consented to the videos being taken or uploaded.

The lawsuit was filed by Brown Rudnick LLP, and several of the alleged victims who signed on were found through a site called Traffickinghub, which seeks to shut down Pornhub. The site is run by a religious organization known as Exodus Cry, and CBS News notes the group “has been criticized for its efforts to criminalize parts the sex industry and abolish pornography altogether.”

Yet Michael Bowe, the lawyer representing the women in the lawsuit, told CBS that he was not seeking to outlaw online porn but bring it in line with traditional pornography rules and regulations. “This case is not about porn, it’s about rape. This is a legitimate industry that consenting people have every right to participate in. It just needs to be done legally and not with illegal content.” he told CBS.

Yesterday’s lawsuit wasn’t the first time Pornhub has been sued for hosting videos that allegedly featured sex trafficking. In December, shortly after MasterCard and Visa began their investigations, 40 women filed a lawsuit saying they were victims of GirlsDoPorn, a company whose producers lured victims with “fake modeling ads, false promises and deceptive front companies, ultimately devolving to threats to coerce these women into making sex videos,” Acting US Attorney Randy Grossman said after a recent sentencing hearing for one of the producers and actors who was convicted of crimes associated with his work for the site. In the February lawsuit, the plaintiffs alleged that “MindGeek knew GirlsDoPorn was trafficking its victims by using fraud, coercion, and intimidation as part of its customary business practices to get the women to film the videos.”

MindGeek is also under investigation by Canada’s privacy commissioner. The inquiry came about after women filed complaints stating that Pornhub dismissed their requests to take down videos uploaded without their consent.

https://arstechnica.com/?p=1774586

Since the dawn of the iPhone, many of the smarts in smartphones have come from elsewhere: the corporate computers known as the cloud. Mobile apps sent user data cloudward for useful tasks like transcribing speech or suggesting message replies. Now Apple and Google say smartphones are smart enough to do some crucial and sensitive machine-learning tasks like those on their own.

At Apple’s WWDC event this month, the company said its virtual assistant Siri will transcribe speech without tapping the cloud in some languages on recent and future iPhones and iPads. During its own I/O developer event last month, Google said the latest version of its Android operating system has a feature dedicated to secure, on-device processing of sensitive data, called the Private Compute Core. Its initial uses include powering the version of the company’s Smart Reply feature built into its mobile keyboard that can suggest responses to incoming messages.

Apple and Google both say on-device machine learning offers more privacy and snappier apps. Not transmitting personal data cuts the risk of exposure and saves time spent waiting for data to traverse the internet. At the same time, keeping data on devices aligns with the tech giants’ long-term interest in keeping consumers bound into their ecosystems. People that hear their data can be processed more privately might become more willing to agree to share more data.

The companies’ recent promotion of on-device machine learning comes after years of work on technology to constrain the data their clouds can “see.”

In 2014, Google started gathering some data on Chrome browser usage through a technique called differential privacy, which adds noise to harvested data in ways that restrict what those samples reveal about individuals. Apple has used the technique on data gathered from phones to inform emoji and typing predictions and for web browsing data.

More recently, both companies have adopted a technology called federated learning. It allows a cloud-based machine-learning system to be updated without scooping in raw data; instead, individual devices process data locally and share only digested updates. As with differential privacy, the companies have discussed using federated learning only in limited cases. Google has used the technique to keep its mobile typing predictions up to date with language trends; Apple has published research on using it to update speech-recognition models.

Rachel Cummings, an assistant professor at Columbia who has previously consulted on privacy for Apple, says the rapid shift to do some machine learning on phones has been striking. “It’s incredibly rare to see something going from the first conception to being deployed at scale in so few years,” she says.

That progress has required not just advances in computer science but for companies to take on the practical challenges of processing data on devices owned by consumers. Google has said that its federated learning system only taps users’ devices when they are plugged in, idle, and on a free Internet connection. The technique was enabled in part by improvements in the power of mobile processors.

Beefier mobile hardware also contributed to Google’s 2019 announcement that voice recognition for its virtual assistant on Pixel devices would be wholly on-device, free from the crutch of the cloud. Apple’s new on-device voice recognition for Siri, announced at WWDC this month, will use the “neural engine” the company added to its mobile processors to power up machine-learning algorithms.

The technical feats are impressive. It’s debatable how much they will meaningfully change users’ relationship with tech giants.

Presenters at Apple’s WWDC said Siri’s new design was a “major update to privacy” that addressed the risk associated with accidentally transmitting audio to the cloud, saying that was users’ largest privacy concern about voice assistants. Some Siri commands—such as setting timers—can be recognized wholly locally, making for a speedy response. Yet in many cases transcribed commands to Siri—presumably including from accidental recordings—will be sent to Apple servers for software to decode and respond. Siri voice transcription will still be cloud-based for HomePod smart speakers commonly installed in bedrooms and kitchens, where accidental recording can be more concerning.

Google also promotes on-device data processing as a privacy win and has signaled it will expand the practice. The company expects partners such as Samsung that use its Android operating system to adopt the new Privacy Compute Core and use it for features that rely on sensitive data.

Google has also made local analysis of browsing data a feature of its proposal for reinventing online ad targeting, dubbed FLoC and claimed to be more private. Academics and some rival tech companies have said the design is likely to help Google consolidate its dominance of online ads by making targeting more difficult for other companies.

Michael Veale, a lecturer in digital rights at University College London, says on-device data processing can be a good thing but adds that the way tech companies promote it shows they are primarily motivated by a desire to keep people tied into lucrative digital ecosystems.

“Privacy gets confused with keeping data confidential, but it’s also about limiting power,” says Veale. “If you’re a big tech company and manage to reframe privacy as only confidentiality of data, that allows you to continue business as normal and gives you license to operate.”

A Google spokesperson said the company “builds for privacy everywhere computing happens” and that data sent to the Private Compute Core for processing “needs to be tied to user value.” Apple did not respond to a request for comment.

Cummings of Columbia says new privacy techniques and the way companies market them add complexity to the trade-offs of digital life. Over recent years, as machine learning has become more widely deployed, tech companies have steadily expanded the range of data they collect and analyze. There is evidence some consumers misunderstand the privacy protections trumpeted by tech giants.

A forthcoming survey study from Cummings and collaborators at Boston University and the Max Planck Institute showed descriptions of differential privacy drawn from tech companies, media, and academics to 675 Americans. Hearing about the technique made people about twice as likely to report they would be willing to share data. But there was evidence that descriptions of differential privacy’s benefits also encouraged unrealistic expectations. One-fifth of respondents expected their data to be protected against law enforcement searches, something differential privacy does not do. Apple’s and Google’s latest proclamations about on-device data processing may bring new opportunities for misunderstandings.

This story originally appeared on wired.com.

https://arstechnica.com/?p=1774415

Researchers have discovered yet another massive trove of sensitive data, a dizzying 1.2TB database containing login credentials, browser cookies, autofill data, and payment information extracted by malware that has yet to be identified.

In all, researchers from NordLocker said on Wednesday, the database contained 26 million login credentials, 1.1 million unique email addresses, more than 2 billion browser cookies, and 6.6 million files. In some cases, victims stored passwords in text files created with the Notepad application.

The stash also included over 1 million images and more than 650,000 Word and .pdf files. Additionally, the malware made a screenshot after it infected the computer and took a picture using the device’s webcam. Stolen data also came from apps for messaging, email, gaming, and file-sharing. The data was extracted between 2018 and 2020 from more than 3 million PCs.

A booming market

The discovery comes amid an epidemic of security breaches involving ransomware and other types of malware hitting large companies. In some cases, including the May ransomware attack on Colonial Pipeline, hackers first gained access using compromised accounts. Many such credentials are available for sale online.

Alon Gal, co-founder and CTO of security firm Hudson Rock, said that such data is often first collected by stealer malware installed by an attacker attempting to steal cryptocurrency or commit a similar type of crime.

The attacker “will likely then try to steal cryptocurrencies, and once he is done with the information, he will sell to groups whose expertise is ransomware, data breaches, and corporate espionage,” Gal told me. “These stealers are capturing browser passwords, cookies, files, and much more and sending it to the [command and control server] of the attacker.”

NordLocker researchers said there’s no shortage of sources for attackers to secure such information.

“The truth is, anyone can get their hands on custom malware,” the researchers wrote. “It’s cheap, customizable, and can be found all over the web. Dark web ads for these viruses uncover even more truth about this market. For instance, anyone can get their own custom malware and even lessons on how to use the stolen data for as little as $100. And custom does mean custom—advertisers promise that they can build a virus to attack virtually any app the buyer needs.”

NordLocker hasn’t been able to identify the malware used in this case. Gal said that from 2018 to 2019, widely used malware included Azorult and, more recently, an info stealer known as Raccoon. Once infected, a PC will regularly send pilfered data to a command and control server operated by the attacker.

In all, the malware collected account credentials for almost 1 million sites, including Facebook, Twitter, Amazon, and Gmail. Of the 2 billion cookies extracted, 22 percent remained valid at the time of the discovery. The files can be useful in piecing together the habits and interests of the victims, and if the cookies are used for authentication, they give access to the person’s online accounts. NordLocker provides other figures here.

People who want to determine if their data was swept up by the malware can check the Have I Been Pwned breach notification service, which has just uploaded a list compromised accounts.

https://arstechnica.com/?p=1771883

Exabeam, a late-stage startup in the data analytics and SIEM space, has landed a new $200 million funding round that values the company at $2.4 billion.

The announcement of Exabeam’s latest Series F funding, described as a “growth round,” coincides with news that co-founder and CEO Nir Polak will be replaced by former ForeScout chief executive Michael DeCesare.

Polak, who was Exabeam’s first CEO, will remain with the company and assume the role of board chairman.

DeCesare, a veteran cybersecurity executive who did leadership stints at McAfee and ForeScout Technologies, where he guided the company to a public markets exit in 2017.

Exabeam, founded in 2013 to jostle for market share in the SIEM (Security Information and Event Management) space, competes with the likes of Splunk, LogRhythm and IBM to help defenders store, log and parse corporate data at scale.

The company says it expects to use the new money to “fuel scale, product innovation and extend the company’s leadership” in what is described as a trusted cloud SecOps platform.

The latest investment was led by the Owl Rock division of Blue Owl Capital and supported by existing investors Acrew Capital, Lightspeed Venture Partners and Norwest Venture Partners. 

[ ANALYSIS: Inside the Battle to Control Enterprise Security Data Lakes ]

Entrepreneurs and investors are competing aggressively for ownership and control of the massive data lakes powering enterprise security programs and Exabeam is among a wave of entrenched companies providing realtime data monitoring and visibility to defenders.

“[This investment gives us the opportunity to triple down on our R&D efforts and continue engineering the most advanced UEBA, XDR and SIEM cloud security products,” the company said in a statement.

Exabeam says it has more than 400 resellers and about 500 technology integrations with leading IT and security companies including cloud network, data lake and endpoint vendors such as CrowdStrike, Okta and Snowflake.

RELATED: Microsoft’s 10 Billion Cybersecurity Business

RELATED: SIEM Platform Provider Raises $50 Million 

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. Ryan is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends. He is a regular speaker at cybersecurity conferences around the world.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/S-V2L7s7PIQ/exabeam-lands-200m-investment-replaces-ceo

Looking to build stronger responses against cyberattacks in the Asia Pacific (APAC) region, Microsoft on Monday announced the creation of a cybersecurity council for the public sector in the region.

The Asia Pacific Public Sector Cybersecurity Executive Council consists of policy makers and influencers from Brunei, Indonesia, Korea, Malaysia, Philippines, Singapore, and Thailand.  It seeks seeks to accelerate collaboration between public and private cybersecurity organizations.

Policy makers from government and state agencies and cybersecurity experts from the public sector that form the council will work together to ensure improved communication and to promote the sharing of threat intelligence and technology, in an effort to battle evolving cyber threats in the region.

[ MORE AT: SecurityWeek’s 2021 Singapore ICS Cyber Security Virtual Conference ]

According to Microsoft, the initiative builds on the need for governments to build cyber-defense strategies and keep the region protected from attacks through strong collaboration with tech companies, given that private organizations own most of the necessary technology infrastructure.

“Cyberthreats and attacks are inevitable in this interconnected world, which is why our collective strength and collaboration as a community is imperative. [This is] the first step towards defending our communities in cyberspace with the founding members that include government leaders, policymakers, regulators, industry stakeholders across the region,” said Sherie Ng, General Manager, Public Sector, Microsoft Asia Pacific.

Related: Ransomware Takedowns Underscore Need for Private-Public Cybersecurity Collaboration

Related: Securing Today’s Networks Requires Consolidation and Collaboration

Related: The Positive Impact of the Pandemic on SecOps Collaboration

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/Qyw6ZrNda8c/microsoft-creates-cybersecurity-council-public-sector-apac

A group of online privacy activists said Monday it is taking action against hundreds of websites over their use of pop-up banners asking users to consent to “cookies”, the files that track users’ activity.

The Vienna-based NOYB group (an acronym of “none of your business”) said it would be presenting more than 500 draft complaints to companies over what it calls the “cookie banner terror” which has turned the internet into “a frustrating experience for users all over Europe”.

NOYB says many of the consent pop-ups which have become almost ubiquitous on the internet do not conform to EU laws, including the landmark General Data Protection Regulation (GDPR).

The group says the pop-ups in question do not give the user the simple “yes or no” to data collection that the law requires.

It says the banners are often designed in a way that make it “extremely complicated to click anything but the ‘accept’ button”.

The draft complaints are being lodged with companies in 33 countries, among them every European Economic Area (EEA) member state except Malta and Liechtenstein.

NOYB says it will file the complaints to regulatory authorities in a month’s time if the sites haven’t taken action to make the cookie banners comply with the requirements of privacy laws and rectify what NOYB calls their “unfair” and “frustrating” design.

The founders of NOYB include Austrian activists Max Schrems, who has notched up a series of legal victories over online privacy, including scuppering major EU-US data exchange arrangements.

“Frustrating people into clicking ‘okay’ is a clear violation of the GDPR’s principles,” Schrems said in a statement, adding: “Under the law, companies must facilitate users to express their choice and design systems fairly.”

NOYB says it has devised an automated system for identifying cookie banners that violate privacy regulations which could enable the group to file up to 10,000 complaints over the course of a year.

The group hopes that if its action is successful, “users should see simple and clear “yes or no” options” for data collection on more and more websites over the coming months.

Search giant Google has pledged to steer clear of tracking individual online activity when it begins implementing a new system for targeting ads without the use of cookies.

The company’s widely used Chrome browser recently began testing an alternative to the tracking practice that it believes could improve online privacy while still enabling advertisers to serve up relevant messages.

Related: EU Privacy Groups Set Sights on Facial Recognition Firm

Related: Privacy Activists in EU File Complaints Over iPhone Tracking

Related: Austria Privacy NGO Takes on Apple Over ‘Tracking Code’

© AFP 2020

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/lbf_ALEcxU0/activists-launch-action-against-cookie-banner-terror

L’invadenza dei cookie, la difficoltà di rifiutarli

Navigare internet dovrebbe essere un’esperienza soddisfacente per tutti gli utenti, piena di sorprese e scoperte, tutte positive ovviamente, ma nella realtà dei fatti ognuno di noi è costretto a surfare tra mille difficoltà, tra un sito e l’altro, cercando di schivare annunci di ogni tipo, richieste di contatto, inviti ad iscriversi a chat, newsletter e altri servizi per potenziali clienti, fino all’invadente moda dei banner cookie in modalità popup.

Così in un articolo dell’anno scorso abbiamo definito questa novità, un’improvvisa moda del popup per il consenso o meno ai cookie, cioè stringe di testo di piccole dimensioni inviate da un sito web al nostro browser, che li memorizza in automatico e da cui sono estrapolate informazioni specifiche sul nostro tipo di navigazione, sulle nostre esperienze online, con l’obiettivo di trasformarle poi in servizi personalizzati.

<!-- LARGE RECTANGLE POST - CORPO TESTO

Nel tempo, le Autorità nazionali per la tutela della privacy, sono intervenute sull’argomento facendo presente che prima di tutto andava chiesto all’utente in questione un permesso ufficiale, un consenso alla condivisione dei dati definito “informato”, cioè pienamente cosciente delle conseguenze che ne sarebbero derivate.

Le trappole al consenso

Una richiesta ineludibile, anche alla luce della Regolamento europeo per il trattamento dei dati o Gdpr, che assicura all’utente di rete il pieno controllo dei propri dati. Eppure, come ricordato sopra, non sembra essere così semplice gestire i propri dati in piena libertà, perché in molti casi rifiutare i cookie banner non è per niente facile.

Ci chiedono di accettare una serie di richieste, magari di personalizzare il trattamento dei dati, ma in un modo ambiguo, che è definito in gergo “dark patterns”, specie di trappole cognitive pensate appositamente per far accettare le condizioni del sito e quindi i cookie al maggior numero di persone possibile (sfruttandone superficialità, ingenuità e non conoscenza del problema legato alla violazione della privacy).

Di fatto, solo in rarissimi casi è messa in evidenza sia l’opzione accetto, sia quella di rifiuto.

Sotto la lente più di 10 mila siti web

La piattaforma europea non profit Noyb, per i diritti digitali e la difesa della privacy (Noyb è l’acronimo di “None of your business”, come dire che “la mia privacy o quello che faccio online non è affar tuo”), ha deciso di affrontare la questione in due modi: sviluppando un software che ogni volta che accediamo ad un sito web riconosce eventualmente la violazione della privacy e genera in automatico un reclamo all’Autorità nazionale competente; comunicando contestualmente al maggior numero possibile di aziende proprietarie di piattaforme e siti web la richiesta di modificare le proprie impostazioni in relazione alla privacy e conformarsi alle indicazioni del Gdpr.

L’obiettivo dell’iniziativa è coinvolgere fino a 10 mila tra i siti web più visitati d’Europa in questa campagna per la difesa dei diritti digitali e della privacy dei cittadini utenti di internet, per arrivare ad un accordo molto semplice quanto efficace: ogni cookie banner deve solamente chiedere, in maniera chiara e trasparente, se l’utente vuole “accettare” o “rifiutare” di esser tracciato e profilato.

Ogni volta che ci si para davanti il cookie banner, la stragrande maggioranza di noi non fa altro che accettare in automatico le condizioni proposte per navigare sul sito, senza informarsi correttamente sulle conseguenze reali per i nostri dati, perché oggi navigare internet deve essere fluida e veloce come esperienza.

Pronti 560 reclami

Noyb si dice pronta a far partire più di 560 reclami tutti assieme se le aziende contattate non si conformeranno rapidamente al Gdpr (tempo limite un mese).

In concomitanza con l’individuazione di una violazione del Regolamento in automatico partirà una mail che arriverà all’azienda con la richiesta di adeguamento al Gdpr e anche con una breve guida su come procedere per reimpostare il software e conformarsi alla legge.

In caso contrario Noyb procederà a presentare reclamo presso l’Autorità competente, con possibili sanzioni fino ad un massimo di 20 milioni di euro.

Nell’80% dei casi non è offerta subito l’opzione di rifiuto dei cookie

In un sondaggio Noyb è risultato che delle centinaia di siti web esaminati l’81% non offriva nessuna opzione di rifiuto per i cookie nel primo messaggio all’utente. Per rifiutare ilo trattamento bisognava inoltrarsi nel sito, perché l’opzione era di fatto nascosta.

Addirittura nel 73% dei casi, anche se l’opzione rifiuta era presente nel primo messaggio all’utente, la grandezza dei caratteri, il gioco dei colori e altri sotterfugi grafici, spingevano l’utente a cliccare su accetta.

Una volta dato il proprio consenso ai cookie, anche se per errore, nel 90% dei casi i siti web non spiegavano in che modo fosse possibile ritirarlo.

Tutte pratiche illegali, perché i dati sono nostri e solo noi possiamo decidere quando vogliamo dare o meno ed eventualmente ritirare il consenso al loro trattamento. Un concetto chiaro, che soprattutto le Big Tech sembrano voler rifiutare, o comunque non accettare fino in fondo, perché i nostri dati valgono tanto, sono il nuovo oro, e nessuno vuole rinunciarci.

https://www.key4biz.it/azione-contro-i-cookie-banner-pronti-560-reclami-gdpr-in-europa-anche-contro-le-big-tech/362670/

If you use Alexa, Echo, or any other Amazon device, you have only 10 days to opt out of an experiment that leaves your personal privacy and security hanging in the balance.

On June 8, the merchant, Web host, and entertainment behemoth will automatically enroll the devices in Amazon Sidewalk. The new wireless mesh service will share a small slice of your Internet bandwidth with nearby neighbors who don’t have connectivity and help you to their bandwidth when you don’t have a connection.

By default, Amazon devices including Alexa, Echo, Ring, security cams, outdoor lights, motion sensors, and Tile trackers will enroll in the system. And since only a tiny fraction of people take the time to change default settings, that means millions of people will be co-opted into the program whether they know anything about it or not. The Amazon webpage linked above says Sidewalk “is currently only available in the US.”

The webpage also states:

What is Amazon Sidewalk?

Amazon Sidewalk is a shared network that helps devices work better. Operated by Amazon at no charge to customers, Sidewalk can help simplify new device setup, extend the low-bandwidth working range of devices to help find pets or valuables with Tile trackers, and help devices stay online even if they are outside the range of their home wifi. In the future, Sidewalk will support a range of experiences from using Sidewalk-enabled devices, such as smart security and lighting and diagnostics for appliances and tools.

How will Amazon Sidewalk impact my personal wireless bandwidth and data usage?

The maximum bandwidth of a Sidewalk Bridge to the Sidewalk server is 80Kbps, which is about 1/40th of the bandwidth used to stream a typical high definition video. Today, when you share your Bridge’s connection with Sidewalk, total monthly data used by Sidewalk, per account, is capped at 500MB, which is equivalent to streaming about 10 minutes of high definition video.

Why should I participate in Amazon Sidewalk?

Amazon Sidewalk helps your devices get connected and stay connected. For example, if your Echo device loses its wifi connection, Sidewalk can simplify reconnecting to your router. For select Ring devices, you can continue to receive motion alerts from your Ring Security Cams and customer support can still troubleshoot problems even if your devices lose their wifi connection. Sidewalk can also extend the working range for your Sidewalk-enabled devices, such as Ring smart lights, pet locators or smart locks, so they can stay connected and continue to work over longer distances. Amazon does not charge any fees to join Sidewalk.

Amazon has published a white paper detailing the technical underpinnings and service terms that it says will protect the privacy and security of this bold undertaking. To be fair, the paper is fairly comprehensive, and so far no one has pointed out specific flaws that undermine the encryption or other safeguards being put in place. But there are enough theoretical risks to give users pause.

Wireless technologies like Wi-Fi and Bluetooth have a history of being insecure. Remember WEP, the encryption scheme that protected Wi-Fi traffic from being monitored by nearby parties? It was widely used for four years before researchers exposed flaws that made decrypting data relatively easy for attackers. WPA, the technology that replaced WEP, is much more robust, but it also has a checkered history.
Bluetooth has had its share of similar vulnerabilities over the years, too, either in the Bluetooth standard or in the way it’s implemented in various products.

If industry-standard wireless technologies have such a poor track record, why are we to believe a proprietary wireless scheme will have one that’s any better?

The omnipotent juggernaut

Next, consider the wealth of intimate details Amazon devices are privy to. They see who knocks on our doors, and in some homes they peer into our living rooms. They hear the conversations we’re having with friends and family. They control locks and other security systems in our home.

Extending the reach of all this encrypted data to the sidewalk and living rooms of neighbors requires a level of confidence that’s not warranted for a technology that’s never seen widespread testing.

Last, let’s not forget who’s providing this new way for everyone to share and share alike. As independent privacy researcher Ashkan Soltani puts it: “In addition to capturing everyone’s shopping habits (from amazon.com) and their internet activity (as AWS is one of the most dominant web hosting services)… now they are also effectively becoming a global ISP with a flick of a switch, all without even having to lay a single foot of fiber.”

Amazon’s decision to make Sidewalk an opt-out service rather than an opt-in one is also telling. The company knows the only chance of the service gaining critical mass is to turn it on by default, so that’s what it’s doing. Fortunately, turning Sidewalk off is relatively painless. It involves:

1. Opening the Alexa app
2. Opening More and selecting Settings
3. Selecting Account Settings
4. Selecting Amazon Sidewalk
5. Turning Amazon Sidewalk Off

No doubt, the benefits of Sidewalk for some people will outweigh the risks. But for the many, if not the vast majority of users, there’s little upside and plenty of downside. Amazon representatives didn’t respond to a request for comment.

https://arstechnica.com/?p=1768704

The U.S. Justice Department this week announced indictments against 22 individuals who allegedly purchased and used payment cards stolen from a national retail chain.

Using point-of-sale malware installed at multiple retail locations of the target company, threat actors stole information of over three million payment cards, including credit, debit, and gift cards used at over 400 of the company’s retail stores.

According to the indictment, the co-conspirators then sold the hijacked data for $4 million in Bitcoin to an individual who sold it to thousands of other people, including the 22 now facing charges by the U.S. Department of Justice.

Twenty of the defendants have been arrested while the other two remain are large, likely abroad, the authorities said.

The 22 individuals are charged with using the payment card information to make various purchases, including at gas stations, hotels, and restaurants.

The indictment alleges that one of the defendants purchased more than 13,000 payment cards stolen from the retail chain, while another purchased more than 6,000 such cards. Others purchased between 2,000 and 4,000 payment cards. 

According to the Justice Department, each defendant faces up to 20 years in federal prison for charges of wire fraud and a two-year mandatory, consecutive prison sentence for aggravated identity theft.

Related: US Charges Swiss ‘Hacktivist’ for Data Theft and Leaks

Related: U.S. Charges North Korean Hackers Over $1.3B Bank Heists

Related: US Indicts Head of Alleged Crime Chat Comms Service

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/bwDeoUDUfuY/us-charges-22-stolen-payment-cards-crackdown