A storage server configured for public access was found to expose terabytes of data belonging to the Oklahoma Department of Securities, UpGuard reveals.

The server was found on December 7 and Oklahoma was notified of the exposure on December 8, when public access was removed. While it’s uncertain for how long the data store was exposed, the server first appeared on Shodan (a search engine for Internet-facing IP addresses) on November 30.

The data on the server totaled three terabytes and millions of files, containing personal information, system credentials, internal documentation, and communications intended for the Oklahoma Securities Commission, among others.

“The amount, and reach, of administrative and staff credentials represents a significant impact to the Oklahoma Department of Securities’ network integrity,” UpGuard says.

While analyzing the exposed data, UpGuard security researchers discovered that it was generated over the course of three decades, “with the oldest data originating in 1986 and the most recent modified in 2016.”

The server was exposed because of an unsecured rsync service at an IP address registered to the Oklahoma Office of Management and Enterprise Services, which allowed any user worldwide to download all of the stored files.

The researchers also note that the website for the Securities Commission uses outdated software, such as the web server IIS 6.0, which reached end of life in July 2015, which also represents a major security risk.

The server contained tens of file types, including over one hundred gigabytes (GB) of Outlook data files, nearly 60 GB of virtual machine disk files, nearly 50 GB of PDF files, 30 GB of log files, 23 GB of Outlook items, and 17 GB of ZIP archives.

The researchers found email backups from 1999 to 2016 on the server, and note that these PST files often include plaintext passwords, images of identification cards, tax documents, and internal strategic deliberations.

“Storing backups of email mailboxes is a common practice required by data detention policies. The contents of those backups rarely includes concentrated sensitive data, like in a user database, but over the course of thousands of emails people invariably reveal information intended to be private,” UpGuard notes.

One database included information on around ten thousand brokers, including their social security numbers. A CSV file contained date of birth, state of birth, country of birth, gender, height, weight, hair color, and eye color for over a hundred thousand brokers.

Credentials found on the server included VNC credentials for remote access to Department of Securities workstations, a BlueExpress database of credentials for third parties submitting securities filings, and a spreadsheet of IT services with the usernames and passwords for accounts with Thawte, Symantec Protection Suite, Tivoli, and others.

UpGuard also notes that “the scale of the data makes it impractical to perform any kind of exhaustive documentation of the exposed information.”

“Leaking three terabytes of the FBI’s data due to leaving a server unsecured without a password is a critical error and indicates the need for the Oklahoma Securities Commission, as well as other government agencies, to strengthen their current security measures to ensure future breaches can be avoided in the first place,” Jonathan Bensen, interim CISO and senior director of product management, Balbix, told SecurityWeek in an emailed comment.

“Leaving a database containing such critical information unsecured is an elementary mistake for which there is no excuse,” Bensen added.

Matan Or-El, co-founder and CEO of Panoarays, commented, “Data security is not necessarily always about protecting from attackers; quite often it’s about protecting against mistakes. The Oklahoma data leak is the latest in a long series of incidents in which sensitive data was exposed to the internet by mistake, where anyone could access it. By continuously monitoring the attack surface of an organization, one can learn a lot about the security and data hygiene practices of an organization.

Related: More .gov Domains Hit by Government Shutdown

Related: Elasticsearch Instances Expose Data of 82 Million U.S. Users

http://feedproxy.google.com/~r/Securityweek/~3/GS1FZ2B5M74/misconfigured-server-leaks-oklahoma-department-securities-data

A vulnerability discovered in a reservation system used by hundreds of airlines around the world could expose the details of millions of their customers, researchers warned this week.

Researcher Noam Rotem and Safety Detective discovered the flaw after booking a flight with El Al, the flag carrier of Israel. They noticed that a link sent to customers when booking a flight contained a parameter whose value could be modified to access other people’s flights – this is known as an insecure direct object reference (IDOR) vulnerability.

An attacker can exploit this vulnerability to obtain passenger name records (PNRs), names, and details on associated flights. A PNR is a record stored by global distribution systems (GDS) and it can include names, contact information, ticket data, itinerary, passport numbers, dates of birth and even payment information. PNRs are at the root of many security weaknesses involving GDS.

While Rotem and Safety Detective found the flaw in El Al services, they soon discovered that the issue actually affected the reservation system provided by Spain-based GDS provider Amadeus, whose services are used by more than 200 airlines, including American Airlines, United Airlines, Air France, Singapore Airlines, Qantas, Lufthansa, and British Airways.

Someone who is in possession of a passenger’s PNR and name can access an airline’s customer portal and make changes to flight options (e.g. seats and meals), claim frequent flyer miles, and update the phone number and email address, which can then be leveraged to cancel or change a reservation via customer support services.

PNR codes can often be obtained from social media websites, where unknowing individuals post pictures of their boarding pass. However, researchers also discovered that the lack of brute-force protections on the Amadeus system allows an attacker to obtain the PNRs of random individuals through a brute-force attack.

Rotem and Safety Detective believe nearly half of all airlines worldwide may be affected.

They notified Amadeus of their findings and the company rolled out a patch, according to a blog post published on Tuesday. However, The Register has reported that the fix is incomplete and the vulnerability can still be exploited.

SecurityWeek has reached out to Safety Detective for confirmation on the incomplete patch, but we have yet to hear back.

Related: Travel Booking Systems Expose User Data

Related: Pentagon Reveals Cyber Breach of Travel Records

Related: Travel Tech Giant Sabre Investigating Data Breach

http://feedproxy.google.com/~r/Securityweek/~3/hmSPt8X3jXU/flaw-reservation-system-impacts-many-airlines

Consumer advocates and the data-hungry technology industry are drawing early battle lines in advance of an expected fight this year over what kind of federal privacy law the U.S. should have.

On Thursday, more than a dozen privacy organizations unveiled a plan that would create a new federal data-protection agency focused on regulating the way businesses and other organizations collect and make use of personal data, even if aggregated or anonymized. The proposal would sideline the Federal Trade Commission, which has limited powers and a mixed record of holding companies to account for privacy problems.

On the other side, a think tank backed by Google, Amazon, Microsoft and other major tech companies proposed changes that would still give the industry broad authority to collect and use customer data. The Information Technology and Innovation Foundation called for national legislation that would repeal and replace existing privacy laws with a “common set of protections” intended to encourage innovation while also quashing tougher state laws.

Unlike many industrialized nations, the U.S. has no overarching national law governing data collection and privacy. Instead, it has a patchwork of federal laws that protect specific types of data, such as consumer health and financial information and the personal data generated by younger children.

States have also started to pass their own tougher restrictions. A California measure set to take effect next year, for instance, will let consumers request the data collected from them and to opt out of future collection.

Calls for a national privacy law gained force after Facebook’s Cambridge Analytica scandal last year, in which the social media giant was forced to admit that onetime political consultants for the 2016 Trump campaign had improperly accessed the personal information of as many as 87 million users.

Continuing revelations of data missteps at Facebook and other big tech companies have bolstered a U.S. reform movement. Its advocates take heart from recent developments in Europe, which last year enacted sweeping privacy regulations that, among other things, require companies to obtain permission before collecting most data. Several U.S. senators — including Ron Wyden, an Oregon Democrat, Brian Schatz, a Hawaii Democrat, and Marco Rubio, a Florida Republican — have already introduced draft privacy legislation.

“Privacy advocates are fed up with the FTC and with Washington failing to reign in the immense power the big data giants hold,” said Jeffrey Chester, the executive director of the Center for Digital Democracy, which helped author the reform proposal.

Their proposal would set limits on what data companies can collect and would require firms to consider correcting or deleting personal data upon request. It would also prevent companies from giving customer data to the government unless criminal investigations necessitated it.

By contrast, the ITIF report calls for a “grand bargain” that would accept a national privacy law long opposed by industry. In the foundation’s proposal, however, this law would establish “baseline” privacy protections across all industries — and would prevent states from enacting stronger measures.

“A lot of privacy activists are entrenched in creating ever more complicated rules,” Daniel Castro, a co-author of the ITIF report’s, said by email. “The only way to simplify these rules is to rewrite them.”

Privacy experts say the baseline protections in the ITIF proposal still leave consumers at the mercy of big corporations. For instance, its “limited” consumer protections would require individuals to track the companies that collect their data in order to request access or corrections, rather than shifting that burden to companies themselves, said Eric Null, senior policy counsel at the New America think tank’s Open Technology Institute.

The ITIF proposal would also prevent individual lawsuits against companies accused of misrepresenting or misusing their data, primarily to shield corporations from legal risk. Instead, only government would be empowered to protect individual rights. “A federal privacy law should include the power of a private individual to bring legal action,” said Adam Schwartz, a lawyer with the Electronic Freedom Foundation, a digital-rights advocacy group.

ITIF’s plan could potentially start a conversation in Congress over repealing existing federal privacy laws, Null said, but several Democratic lawmakers strongly oppose that. “We should build upon — not dismantle — existing safeguards,” said Sen. Ed Markey, a Massachusetts Democrat, in an emailed statement from his office.

Chris Hoofnagle, another privacy researcher at the University of California at Berkeley, called the ITIF offer “laughable,” noting that it falls short of the voluntary privacy commitments companies such as Google, Microsoft and Amazon have already made.

Related: State vs. Federal Privacy Laws: The Battle for Consumer Data Protection

http://feedproxy.google.com/~r/Securityweek/~3/ZJaj0d0FWMQ/battle-lines-forming-ahead-looming-us-privacy-law-fight

The number of US government domains for which TLS certificates were left to expire due to the government shutdown has now exceeded 130, UK-based cybersecurity solutions provider Netcraft reported on Wednesday.

A deadlock between President Donald Trump and the Democratic Party over funding for the controversial Mexico border wall has led to a partial government shutdown. The shutdown – the longest in US history – started on December 22 and it has entered its 26th day.

In addition to some online government services becoming unavailable – NIST’s Computer Security Resource Center (CSRC) is just one example – Netcraft revealed last week that agencies had failed to renew expired certificates for over 80 .gov domains, including ones belonging to NASA, the Department of Justice, the Court of Appeals, and the Lawrence Berkeley National Laboratory.

Allowing security certificates to expire not only makes websites inaccessible, it also makes them vulnerable to man-in-the-middle (MitM) attacks.

Netcraft says the number of impacted domains has now exceeded 130 and the list includes one belonging to the White House, pages.mail.whitehouse.gov, for which the certificate expired on January 15. Since this domain does not host any public services, the main problem is not that the address is inaccessible, rather that it could be leveraged by malicious actors in attacks aimed at White House staff.

Manufacturing.gov and manufacturingusa.com, which host information on manufacturing programs, have also become inaccessible due to their shared certificate expiring on January 14. However, it’s worth noting that the websites can still be accessed if “www” is added to the address.

Other domains whose certificates have expired since Netcraft’s initial report belong to the Federal Aviation Authority, the National Archives and Records Administration, the Federal Financial Institutions Examination Council, and the Department of Agriculture.

Some of the impacted domains are on the HTTPS Strict Transport Security (HSTS) preload list, which means that web browsers such as Chrome, Safari, Firefox, Edge, Internet Explorer and Opera prevent users from accessing them if their certificate has expired. Websites that are not on the HSTS list can still be accessed by users by adding an exception in the browser’s “advanced” menu.

“Expired TLS certificates do not directly expose data, but when users visit the pages, they will be presented with an interstitial warning that the certificate is not valid,” Tripwire researcher Craig Young told SecurityWeek. “If strict transport security is not enabled, the user is able to click through the warning and visit the site. Since users are being told to expect these warnings, it makes the perfect opportunity for an attacker to intercept connections using a fake TLS certificate. The error message may have different details, but most users will not recognize this.”

“National adversaries are uniquely positioned to exploit this as they may have access to manipulate BGP records or otherwise influence telecom operations at a low level to redirect victim connections. In the last year, we’ve also seen evidence indicating that Russia has been developing and spreading router malware dubbed VPNFilter. This type of router implant is perfect for surreptitiously hijacking HTTPS connections to US government web sites,” Young added.

Related:Security of U.S. Government Sites Improved Only Slightly

Related: Many Federal Agencies Fail to Meet DMARC Implementation Deadline

Related: DMARC Use is Growing, But Difficult to Configure Correctly and Completely

http://feedproxy.google.com/~r/Securityweek/~3/b3ynAEqxDLo/more-gov-domains-hit-government-shutdown

The founder of Huawei said Tuesday his company would refuse to disclose secrets about its customers and their communication networks, trying to lay to rest concerns the Chinese tech giant might spy for the Communist government.

Ren Zhengfei spoke in a rare meeting with foreign reporters as Huawei Technologies Ltd., China’s first global tech brand, tries to protect its access to global telecom carriers that are investing heavily in next-generation technology.

Ren’s comments were the 74-year-old former military engineer’s most direct public response to accusations the world’s biggest maker of telecom network gear is controlled by the ruling Communist Party or is required to facilitate Chinese spying.

The United States, Australia, Japan and some other governments have imposed curbs on use of its technology over such concerns.

“We would definitely say no to such a request,” Ren said when asked how the company would respond to a government demand for confidential information about a foreign customer.

Asked whether Huawei would challenge such an order in court, Ren chuckled and said it would be up to Chinese authorities to “file litigation.”

Ren said neither he nor the company have ever received a government request for “improper information” about anyone.

Huawei is facing heightened scrutiny as phone carriers prepare to roll out fifth-generation technology in which the company is a leading competitor. 5G is designed to support a vast expansion of networks to serve medical devices, self-driving cars and other technology. That increases the cost of potential security failures and has prompted governments increasingly to treat telecoms communications networks as strategic assets.

The company’s image suffered a new blow last week when Polish authorities announced one of its Chinese employees was arrested on spying charges. Huawei announced it fired the employee and said the allegations had nothing to do with the company.

Ren is the father of Huawei’s chief financial officer, Meng Wanzhou, who was arrested Dec. 1 in Canada on U.S. charges related to possible violations of trade sanctions on Iran.

Ren said he couldn’t discuss Meng’s case while it still was before a court. But he said Huawei obeys the law, including export restrictions, in every country where it operates.

“After all the evidence is made public, we will rely on the justice system,” he said. “We are sure there will be a just conclusion to this matter.”

Two Canadians were arrested by Chinese authorities on national security charges, prompting suggestions abroad they might be hostages to secure Meng’s release. On Monday, a Chinese court sentenced a Canadian to death in a drug case after he was ordered retried.

Asked how he felt about suggestions Beijing took hostages in a case linked to Huawei, Ren said he saw no connection between the Canadians and Meng.

Ren, one of the oldest Chinese executives still working, was jovial and animated during the two hour and 20 minute meeting. Dressed in a blue sport coat and an open-necked light blue shirt, he was accompanied by two Huawei board members, Chen Lifang and William Xu, and other company managers.

Ren said he became a Communist Party member in the early 1980s after the state press published reports about his development of a measuring tool for an engineering project. Before then, he could not join because his father was deemed a “capitalist roader,” but the party was trying to promote young, technologically capable people following the end of the violent, ultra-radical Cultural Revolution in 1976.

Ren founded Huawei in 1987 to sell imported telecom switching gear to Chinese phone companies after the People’s Liberation Army disbanded his engineering unit, according to the company.

Ren said that despite his party membership, Huawei makes decisions based on its customers’ needs.

“I don’t see a close connection between my personal political beliefs and our commercial decisions,” he said.

Huawei’s U.S. market evaporated in 2012 after a congressional panel said the company and its smaller Chinese rival, ZTE Corp., were security risks and urged phone companies to avoid them.

Despite that, Huawei says it expects last year’s revenue to exceed $100 billion. Ren said this year’s target is $125 billion.

Huawei says it is employee-owned. Ren said no government entity or any other investor who isn’t a current or former employee owns “once cent of Huawei shares.”

Ren said Huawei has no research cooperation with the ruling party’s military wing, the PLA. He said the company has no dedicated unit for military sales and he knew of no purchases of civilian technology by the PLA.

Ren cited comments by Chinese government spokespeople who rejected suggestions, including by a vice president of the European Union, that Huawei and other vendors might be required to install secret “backdoors” to facilitate eavesdropping under a law enacted last year that requires them to cooperate with intelligence agencies.

Huawei has plenty of opportunities even if it faces higher barriers in some markets, Ren said. He said the company has signed 5G contracts with 30 carriers and has shipped 25,000 base stations.

Ren also warned against allowing security concerns to divide the globe into isolated markets with incompatible technology standards — a scenario some people have suggested might result from U.S.-Chinese tensions.

“Arbitrarily dividing the world into two technology camps can only harm the interests of all society,” he said.

Asked about U.S. President Donald Trump’s suggestion he might intervene in Meng’s case if that facilitated a resolution of Washington’s tariff battle with Beijing, Ren said he would wait to see whether Trump takes action.

“As for President Trump as president, I still believe he is a great president,” Ren said. He said Trump was elected to cut taxes, which he believed was beneficial for American industry.

However, he said, “If companies are getting frightened by the detention of certain individuals, then investors might be scared away, and that is not in the interests of the United States.”

Ren said he didn’t believe Huawei would face U.S. penalties similar to those that nearly drove ZTE Corp. out of business. Washington barred ZTE from buying American technology over its exports to Iran and North Korea but restored access after the company paid a $1 billion fine, replaced its executive team and installed U.S.-selected compliance monitors.

“If it did happen to Huawei, I don’t believe the impact would be very significant,” he said. “I believe telecom operators would continue to trust Huawei.”

Ren said Huawei doesn’t want Beijing to retaliate for foreign restrictions by hampering market access for Apple Inc. and other rivals.

“In spite of setbacks in some countries, we are still supportive of China becoming a more open country,” he said.

http://feedproxy.google.com/~r/Securityweek/~3/skQGrdrncHU/huawei-founder-says-company-would-not-share-user-secrets

Many TLS certificates for .gov domains have not been renewed due to the ongoing shutdown of the United States government, making them insecure or inaccessible.

A standoff between U.S. President Donald Trump and the country’s Democratic Party over the controversial Mexico border wall has led to a partial government shutdown. The shutdown started on December 22 and it has entered its 20th day.

As a result, some government services, including ones related to cybersecurity, such as NIST’s Computer Security Resource Center (CSRC), are unavailable until further notice. According to Netcraft, the shutdown has also led to over 80 TLS certificates for .gov domains expiring without being renewed.

The expired certificates are for domains belong to organizations such as NASA, the Department of Justice, the Court of Appeals, and the Lawrence Berkeley National Laboratory.

For example, the HTTPS certificate for ows2.usdoj.gov expired on December 17, just days before the shutdown, and it has not been renewed. When users try to access the website, they are presented with a warning that their connection is not secure due to the use of an invalid certificate.

Since usdoj.gov domains are on the HTTPS Strict Transport Security (HSTS) preload list, web browsers such as Chrome, Safari, Firefox, Edge, Internet Explorer and Opera prevent users from accessing them if their certificate has expired.

Websites that are not on the HSTS list can normally still be accessed by users as the browser’s “advanced” menu allows them to add an exception even if the security certificate is invalid. However, this option is not available for HSTS domains.

“Most of the affected sites will display an interstitial security warning that the user will be able to bypass,” explained Netcraft’s Paul Mutton. “This introduces some realistic security concerns, as task-oriented users are more likely to ignore these security warnings, and will therefore render themselves vulnerable to man-in-the-middle attacks.”

As an example of websites on which the security warning can be bypassed, Mutton provided rockettest.nasa.gov, for which the certificate expired on January 5, and d2l.lbl.gov, for which the certificate expired on January 8.

“As more and more certificates used by government websites inevitably expire over the following days, weeks — or maybe even months — there could be some realistic opportunities to undermine the security of all U.S. citizens,” Mutton said.

Related: Security of U.S. Government Sites Improved Only Slightly

Related: Many Federal Agencies Fail to Meet DMARC Implementation Deadline

Related: DMARC Use is Growing, But Difficult to Configure Correctly and Completely

http://feedproxy.google.com/~r/Securityweek/~3/wq3Wdq7kMsU/tls-certificates-many-gov-domains-not-renewed-due-government-shutdown

A vulnerability in Skype for Android allows an unauthenticated attacker to view photos and contacts, and even open links in the browser, a security researcher has discovered.

Found by Florian Kunushevci, a 19-year-old researcher from Kosovo, the vulnerability requires for the attacker to have physical access to the target device. Next, they would need to receive a Skype call and answer it, which would then allow them to access user data even if the device is locked.

Normally, with the device locked, a user should not have access to data such as photos and contacts without authenticating with a password, a PIN, a lock-screen pattern, or a fingerprint.

Kunushevci, however, discovered that a code error in Skype for Android led to the application not following the rule, thus providing an attacker with the possibility to access photos, view contacts, and even send messages without having to authenticate first.

Furthermore, the young security researcher discovered that it was also possible to launch the browser on the device, straight from Skype. For that, the attacker would only need to type a link in a new message, send the message, and then click the link.

The security researcher discovered the vulnerability in October and reported it to Microsoft immediately. The company responded fast and addressed the issue in a new version of Skype released on December 23.

According to Kunushevci, the vulnerability likely impacts all Android devices using a Skype version without the patch (the app version differs depending on the Android iteration running on the device).

A video demonstrating the lockscreen bypass can be seen embedded below.

[embedded content]

Related: Microsoft Rolls Out End-to-End Encryption in Skype

Related: Vulnerability in Chrome for Android Patched Three Years After Disclosure

http://feedproxy.google.com/~r/Securityweek/~3/Gz6azlh91ZM/vulnerability-skype-android-exposes-user-data

Hundreds of German politicians, including Chancellor Angela Merkel, have fallen victim to a massive online leak of private data, the government said Friday.

“Personal data and documents belonging to hundreds of politicians and public figures were published on the internet,” government spokeswoman Martina Fietz told reporters.

“The government is taking this incident very seriously.”

She said the political officials included members of the Bundestag lower house of parliament, the European Parliament as well as regional and local assemblies.

Deputies from all parties represented in the Bundestag were affected, she added.

But Fietz said that a preliminary investigation indicated that “no sensitive information or data” from Merkel’s office had been leaked.

The stolen data, which comprised personal addresses, mobile phone numbers, letters, invoices and copies of identity documents, was published online via Twitter in December but inexplicably only came to light this week.

Beyond politicians, who also included President Frank-Walter Steinmeier, celebrities and journalists were also targeted.

The daily Bild and public broadcaster RBB first reported the leak.

Bild said the theft of the data continued until the end of October but it was not clear when it started.

“At first glance it does not seem that politically sensitive material was included,” RBB said.

– ‘Satire and irony’ –

“However the damage is likely to be massive given the volume of personal data published.”

Given the vast range of data hoovered up, RBB said it seemed unlikely that it was taken from a single source.

Parliamentary group leaders were notified of the attack late Thursday and the Federal Office for Information Security (BSI) and the domestic intelligence service said they were investigating.

“According to our current information, government networks have not been targeted,” BSI tweeted.

The Twitter account @_0rbit published the links daily in the style of an advent calendar, with each entry representing a “door”, behind which was a link to new information.

The account, calling itself G0d, was opened in mid-2017 and purportedly has more then 18,000 followers.

It described its activities as “security researching”, “artist” and “satire and irony” and said it was based in Hamburg.

The domestic intelligence service, the Office for the Protection of the Constitution, reported repeated cyberattacks last year against MPs, the military and several embassies allegedly carried out by Russian cyber espionage group “Snake”.

Also known as “Turla” or “Uruburos”, the group, which targets state departments and embassies worldwide, is believed to have links to Russian intelligence.

Last March, computer networks belonging to the German government came under sustained attack and data from foreign ministry staff were stolen.

The Russian government at the time denied that Russian hackers were involved.

http://feedproxy.google.com/~r/Securityweek/~3/yegfncNBhrI/massive-data-leak-targets-german-officials-including-merkel

Roughly 2.4 million Blur users had their information exposed online as a result of a misconfigured AWS S3 bucket, the application’s developer, online privacy company Abine, revealed this week.

Blur is a popular application that provides password management, masked email, and private browsing capabilities.

In a blog post published on Monday, Abine informed customers that some information of Blur users was potentially exposed. The information included email addresses, IP addresses used to access Blur, password hashes and, in some cases, first and last names and password hints.

“Importantly, there is no evidence that our users’ most critical data has been exposed, and we believe it is secure. There is no evidence that the usernames and passwords stored by our users in Blur, auto-fill credit card details, Masked Emails, Masked Phone numbers, and Masked Credit Card numbers were exposed. There is no evidence that user payment information was exposed,” Abine said.

The company’s representatives told SecurityWeek that roughly 2.4 million users were impacted by the security incident, which was the result of a misconfigured AWS S3 bucket used for data processing.

Abine said the exposed file stored information on users who had registered an account prior to January 6, 2018. The company became aware of the exposure on December 13.

While the company says the passwords were hashed using bcrypt with a unique salt for each user, it has still advised users to change their passwords.

“As a privacy and security focused company this incident is embarrassing and frustrating. These incidents should not happen and we let our users down. We apologize and are working very hard to ensure we respond quickly and effectively to this incident and make sure we do everything we can to not let anything like it happen again,” Abine said.

Related: Amazon S3 Bucket Exposed GoDaddy Server Information

Related: AWS Adds New Feature for Preventing Data Leaks

Related: Robocalling Firm Exposes U.S. Voter Records

http://feedproxy.google.com/~r/Securityweek/~3/oQ1MZNAZtfQ/blur-exposes-information-24-million-users

Dic 28, 2018 Marco Schiaffino News, Privacy, RSS, Scenario 0

---

La norma affida a 10 enti statali il potere di monitorare intercettare e decrittare i dati inviati e ricevuti da qualsiasi computer.

Non solo i pirati informatici legati alla criminalità organizzata e i gruppi hacker al soldo dei servizi segreti di mezzo mondo. A indebolire i sistemi di protezione utilizzati per garantire l’integrità dei dati e la riservatezza delle comunicazioni ora ci si mettono anche i governi.

Dopo il caso dell’Australia, che ha promulgato una controversa legge che prevede l’obbligo per le aziende IT di consentire alle forze di polizia l’accesso alle comunicazioni (anche crittografate) su computer e dispositivi mobili, un segnale nella stessa direzione arriva anche dall’India.

Con un provvedimento che molti esponenti delle opposizioni considerano addirittura anticostituzionale, il governo indiano ha infatti previsto che 10 enti governativi (tra cui i servizi segreti, l’agenzia antidroga e la polizia di Delhi) abbiano l’autorità di “intercettare, monitorare e decrittare qualsiasi informazione generata, trasmessa o conservata su qualsiasi computer”.

Anche se il ministro competente ha chiarito che qualsiasi procedura del genere dovrà essere autorizzata da un tribunale, il provvedimento rischia di avere conseguenze decisamente pesanti.

Una previsione del genere, in buona sostanza, significa che il governo indiano sta avviando un programma di sorveglianza globale delle comunicazioni sul suo territorio.

Il decreto non specifica se questa “autorità” preveda strumenti per forzare alla collaborazione soggetti terzi (per esempio gli Internet Provider) o addirittura ricalchi la logica della normativa australiana, che dovrebbe addirittura imporre un obbligo per le aziende tecnologiche di fornire gli strumenti per scardinare la crittografia delle comunicazioni.

Di certo da oggi sappiamo che una delle più importanti tra le potenze emergenti, che tra le altre cose si è guadagnata uno spazio a livello internazionale proprio come provider di servizi informatici, sta lavorando attivamente per creare un sistema di “monitoraggio” delle comunicazioni.

Tradotto: c’è un governo che dichiaratamente sta investendo ingenti somme di denaro per indebolire la sicurezza delle comunicazioni. E se vi sembra che in tutto questo ci sia qualcosa di profondamente sbagliato, non possiamo darvi torto.

---

---

---

https://www.securityinfo.it/2018/12/28/anche-lindia-fa-una-legge-per-intercettare-i-dati-su-internet/