a Quinta 's weblog : un Blog di Stefano Quintarelli

7 million Dropbox username/password pairs apparently leaked [Update] | Ars Technica

Popular online locker service Dropbox appears to have been hacked. A series of posts have been made to Pastebin purporting to contain login credentials for hundreds of Dropbox accounts, with the poster claiming that altogether 6,937,081 account credentials have been compromised.

Reddit users who have tested some of the leaked credentials have confirmed that at least some of them work. Dropbox seems to have bulk reset all the accounts listed in the Pastebin postings, though thus far other accounts do not appear to have had their passwords reset.

The hackers claim that they will release more username/password pairs if they receive donations to their bitcoin address.

We've asked Dropbox for comment. In the meantime, it's probably a wise idea to change your Dropbox password to a strong password, and if practical enable two-factor authentication. The service currently appears to be struggling to process password changes in a timely manner, however.

Update: Dropbox has sent us the following statement:

Dropbox has not been hacked. These usernames and passwords were unfortunately stolen from other services and used in attempts to log in to Dropbox accounts. We'd previously detected these attacks and the vast majority of the passwords posted have been expired for some time now. All other remaining passwords have been expired as well.

via arstechnica.com

Russian 'Sandworm' Hack Has Been Spying on Foreign Governments for Years | WIRED

A cyberespionage campaign believed to be based in Russia has been targeting government leaders and institutions for nearly five years, according to researchers with iSight Partners who have examined code used in the attacks.

The campaign, dubbed “Sandworm” is believed to have been running since 2009, and used a wide-reaching zero-day exploit uncovered by the researchers that affects nearly every version of the Windows operating system released since Windows Vista.

Although iSight only has a small view of the number of victims targeted in the campaign, the victims include among others, the North Atlantic Treaty Organization, Ukrainian and European Union governments, energy and telecommunications firms, defense companies, as well as at least one academic in the US who was singled out for his focus on Ukrainian issues. The attackers also targeted attendees of this year’s GlobSec conference, a high-level national security gathering that attracts foreign ministers and other top leaders from Europe and elsewhere each year.

It appears Sandworm is focused on nabbing documents and emails containing intelligence and diplomatic information about Ukraine, Russia and other topics of importance in the region. But it also attempts to steal SSL keys and code-signing certificates, which iSight says the attackers probably use to further their campaign and breach other systems

via www.wired.com

Internet dei soldi

I bitcoin sono una "internet of money".

un registro condiviso e distribuito in cui tutte, tutte le transazioni vengono registrate.

per fare bene una roba come BTC servono competenze rilevantissime di economia, teoria monetaria, tecnologia, marketing...

e con quelle competenze schierate, è progetto che richiede molto, molto tempo.

non riesco proprio a pensare che sia stato fatto da una sola persona e mi sembra strano che un team di geek cosi' articolato possa tenere segreta cosi' a lungo la propria attività e composizione...

secondo voi, quale interesse avrebbe potuto spingere a realizzare (e finanziare) un progetto del genere ?

è già passato un anno.

Obama pro net neutrality. (meglio tardi che mai)

“There are a lot of aspects to net neutrality,” Obama said in response to a question at an event hosted by Cross Campus in Santa Monica, CA. “I know one of the things people are most concerned about is paid prioritization, the notion that somehow, some folks can pay a little more money and get better service, more exclusive access to customers through the Internet. That’s something I oppose. I was opposed to it when I ran; I continue to be opposed to it now.”

Obama pointed out that the FCC is “an independent agency” but said he wants the commission to prevent paid prioritization.

“My appointee, [FCC Chairman] Tom Wheeler, knows my position,” Obama said. “Now that he’s there, I can’t just call him up and tell him exactly what to do. But what I’ve been clear about, what the White House has been clear about, is that we expect whatever final rules to emerge to make sure that we’re not creating two or three or four tiers of Internet.”

via arstechnica.com

How an Internet-connected Samsung TV can spill your deepest secrets | Ars Technica

If you use a Samsung "Smart TV" that's connected to the Internet, there's a good chance Luigi Auriemma can hack into the device and access files stored on connected USB drives.

The researcher with Malta-based security firm ReVuln says he has uncovered a vulnerability in most Samsung models that makes it easy for him to locate their IP address on the Internet. From there, he can remotely access the device and exercise the same control someone in the same room would have. That includes gaining root access and installing malicious software. The attack exploits bugs in features that allow end users to install Skype, Pandora, and other types of apps. The TVs can be controlled using smartphone and tablet apps and in some cases by voice commands.

"At this point the attacker has complete control over the device," he wrote in an e-mail to Ars. "So we are talking about applying custom firmwares, spying on the victim if camera and microphone are available, stealing any credential and account stored... on the device, using his own certificates when accessing https websites, and tracking any activity of the victim (movies, photos, music, and websites seen) and so on. You become the TV."

via arstechnica.com

L'erba del vicino: a novembre inizia il blocco di Skype in India

Fixed-line and mobile phone users will no longer be able to use Skype to make domestic calls in India from next month, the Internet telephony specialist announced this week.

"As of 10 November 2014, if you are in India, calling from Skype to mobiles and landlines within India will unfortunately no longer be available," Skype said in a statement.

It did not give a reason for the move, but it is likely a regulatory issue. Indeed, a blogger on Skype parent Microsoft's site suggested that the ban is probably "due to telecom policies of [the] Indian government".

The ban does not apply to Skype-to-Skype calls, nor to international calls, Skype said. Its WiFi and SMS services are also unaffected.

via www.totaltele.com

non un blocco totale, ma un blocco della interoperabilita' con la rete telefonica fissa e mobile.

per la verità dovrebbe essere così anche in europa; l'india ha rotto il ghiaccio.

l'uso della numerazione è soggetta ad obblighi per questioni di sicurezza, procompetitive e pro-consumatori. (certo, e' difficile spiegare che non è pro-consumatori chi ti regala la cioccolata...)

Art. 3 comma 4 del Piano nazionale della numerazione:

In ogni caso, è fatto divieto, oltre che ai soggetti assegnatari di numerazione, anche ai soggetti che offrono servizi su numerazioni messe a disposizione dagli operatori ed agli utenti finali di utilizzare le numerazioni in maniera difforme da quanto definito nel presente piano di numerazione, sia con riferimento ai servizi svolti sulle numerazioni sia per quanto riguarda la struttura stessa della numerazione.
mentre il comma 6 del medesimo articolo

Art. 6

6. L’utilizzo delle numerazioni in difformità del presente piano e della normativa vigente comporta, ai sensi del successivo art. 4, comma 9, la sospensione e la revoca, anche in via d’urgenza, dei relativi diritti d’uso delle numerazioni nonché l’irrogazione delle sanzioni previste dalla normativa vigente.

Diritto d'autore: è 'sproporzionato' bloccare un intero sito per dei file. (Tribunale di Roma)

Il Tribunale, preso atto dell’ordine di sequestro e conseguente ordine di inibizione all’accesso ai provider, ai sensi dell’art 14 eseguenti del decreto legislativo 70 /2003 e dell’art 321 del codice di procedura penale, ha annullato l’ordine di disabilitazione di accesso al sito estero, per sproporzione tra i fatti contestati e l’ordine di inibizione dell’intero sito.

L’ordine di disabilitazione all’accesso era stato impugnato da uno dei leader mondiali di file hosting, che aveva lamentato di fronte al Tribunale la sproporzione tra l’ordine di blocco per i link originariamente presenti sul proprio sito, e per altri link rilevati anche in seguito dall’organo di polizia giudiziaria, e la misura di disabilitazione all’accesso attuata attraverso i provider italiani di accesso (cd mere conduit). Il Tribunale ha evidenziato come apparisse “del tutto sproporzionato sottoporre a sequestro l’intero sito che offre servizi di hosting  all’estero, ndr) con milioni di utilizzatori legittimi quando la violazione del diritto d’autore riguarda alcuni link.”

Il Tribunale ha quindi chiarito che, anche in caso di siti residenti fisicamente all’estero per i quali deve operare il blocco all’accesso attraverso i provider per violazione della legge sul diritto d’autore, il sequestro e quindi l’inibizione ad opera dei provider, deve, in linea di principio, essere limitato solo ai file che consentono la visione dei filmati protetti dal diritto d’autore.

via aiip.presstoday.com

Vodafone vorrebbe acquisire Fastweb per 5Bn (Reuters)

(Reuters) - Telecom operator Swisscom (SCMN.VX) is considering a possible sale of its Italian broadband firm Fastweb, which is worth up to 5 billion euros ($6.3 billion) and has been a target for Vodafone (VOD.L), sources familiar with the situation said.

The Swiss majority state-owned firm, which has already rebuffed several takeover approaches from Vodafone (VOD.L) for Fastweb, is now working with UBS (UBSN.VX), Vodafone's long-term adviser, to facilitate a deal, said the sources who could not be named because the matter is private.

via www.reuters.com

Causa contro Apple per uso norme sul copyright per bloccare la concorrenza

Apple will soon have to face a trial over accusations it used digital rights management, or DRM, to unlawfully maintain a lead in the iPod market, a federal judge has ruled. The plaintiffs' lawyers, representing a class of consumers who bought iPods between 2006 and 2009, are asking for $350 million.

Last week, US District Judge Yvonne Gonzales Rogers gave the green light (PDF) to sending a long-running antitrust lawsuit against Apple to trial. Plaintiffs in the case say that Apple used its FairPlay DRM system to "lock in" its customers and make it costly to switch to technology built by competitors, like Real Networks. They describe how Apple kept updating iTunes to make sure songs bought from Real's competing digital music store couldn't be used on iPods. As a result of this lock-in, Apple was able to overcharge its customers to the tune of tens of millions of dollars.

via arstechnica.com

(come dal mio saggio...)