Update: Apple says the security vulnerability has been fixed in the beta versions of the next software updates to iOS, macOS, watchOS, and tvOS. These releases are expected this month (based on Apple Watch scheduled to gain Apple Music streaming in watchOS 4.1 in October.)
WPA2 – the encryption standard that secures all modern wifi networks – has been cracked. An attacker could now read all information passing over any wifi network secured by WPA2, which is most routers, both public and private.
Android and Linux are particularly vulnerable, being described as ‘trivial’ to attack, but all other platforms are vulnerable too, including iOS and macOS …
The flaw in WPA2 was discovered by Mathy Vanhoef, a postdoc security researcher in the computer science department of the Belgian university KU Leuven.
We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks […] Attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks […]The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected […] If your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks
A proof of concept shows an attack against an Android smartphone, as devices running Android 6.0 or higher are especially vulnerable. In addition to allowing data to be decrypted, they can also be easily fooled into resetting the encryption key to all zeroes.
However, Vanhoef emphasizes that all platforms are vulnerable, and that although attacking Macs proved a tougher challenge initially, he has since found a much easier way to do it.
We can take some comfort from the fact that the attack only decrypts data encrypted by the wifi connection itself. If you are accessing a secure website, that data will still be encrypted by the HTTPS protocol. However, there are separate attacks against HTTPS that could be employed.
The attack works by exploiting the comms that goes on when a device joins a wifi network. There is a 4-step process used to confirm first that the device is using the correct password for the wifi router, and then to agree an encryption key that will be used for all the data sent between them during the connection.
In a key reinstallation attack, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying cryptographic handshake messages. When the victim reinstalls the key, associated parameters such as the incremental transmit packet number (i.e. nonce) and receive packet number (i.e. replay counter) are reset to their initial value. Essentially, to guarantee security, a key should only be installed and used once. Unfortunately, we found this is not guaranteed by the WPA2 protocol. By manipulating cryptographic handshakes, we can abuse this weakness in practice.
The practical implication of this is, if you know any of the contents of the data that have been sent between the device and the router, you can use that known data to work out the encryption key. As Vanhoef points out, there is almost always going to be known data being passed at some point, so you have to assume that the encryption can always be cracked. Even if you don’t know any of the content, a sufficient volume of English text would be enough to break the encryption.
With Android and Linux, an attacker doesn’t even have to do that much work: the attacker can simply reset the encryption key.
The good news is that Vanhoef says that WPA2 can be patched to block the attack, and the patch will be backward compatible. Once a patch is available for your router, you should update the firmware without delay.
The Wi-Fi Alliance has issued a security advisory thanking Vanhoef for his work, stating that it is aware of the issue and that major platform providers have already started deploying patches. It says there is no evidence that the attack has been used in the wild, though the research paper notes that such attacks would be difficult to detect.
Une page se tourne chez Danone. Selon nos informations, Franck Riboud, 61 ans, s’apprêterait à quitter, vingt mois avant l’échéance de son mandat, la présidence de l’entreprise fondée par son père Antoine. Un conseil d’administration convoqué mercredi 18 octobre devrait entériner une nouvelle gouvernance. Trois ans après avoir pris la direction générale du géant agro-alimentaire, Emmanuel Faber devrait récupérer les pleins pouvoirs.
Une confirmation de l’emprise que le dirigeant exerce déjà sur Danone. Comme un symbole, Pierre-André Térisse, responsable de l’Afrique et de l’Inde, un des tout derniers représentants de la garde rapprochée de Franck Riboud, serait également sur le départ.
Le départ de M. Riboud de la présidence constitue une surprise. Non sur le fond, puisqu’il a lui-même organisé sa succession, mais plutôt sur son calendrier. Jusque-là, en effet, il avait laissé entendre qu’il quitterait ses fonctions en deux temps : en abandonnant d’abord la partie « renforcée » de son mandat de président, consistant à tenir les rênes de la stratégie, pour se cantonner à un rôle de président non exécutif classique.
European Retail and Luxury
Shoptalk Europe 2017: The Future of Retail is Tech
Last week our European Retail & Luxury teams were at Shoptalk Europe. This inaugural
event featured >220 speakers including established retailers & brands, start ups and
tech companies. Participating companies included: Tesco, Dixons Carphone, Zalando,
Farfetch, MatchesFashion.com, Amazon, eBay & Alibaba. On page 2 we summarise our
key takeaways by sub-sector and from page 8 onwards we share our session notes.
Theme #1: How retailers and brands can drive consumer spend
Personalising the retail experience is at the centre of improving the customer journey:
consumers think in terms of product, not channel, so retailers need to offer a seamless
transition between offline & online and physical stores have to create experiences
which reward in-store visits. Increasing the pace at which customers can locate and
purchase products is a core focus both offline & online. Social platforms are becoming
more important for generating demand and the most effective brands in this area are
already keenly focused on micro-influencers, online communities & Instagram stories.
Theme #2: How business needs to adapt internally to the new world
The hot topic is how to harness Artificial Intelligence to improve conversion. As a prerequisite,
this means: 1) being able to capture and cleanse data to ensure relevance, 2)
having a culture that is prepared to act on the intelligence, and 3) having the human
talent in the business to use the data effectively. Consumer companies are starting to
"think digital" with the technology team dispersed into the normal operational
functions such as buying and merchandising.
Theme #3: Amazon vs. other retailers + Google?
So far it has been the tech giants that have been driving the majority of innovation.
Sub-scale investment by traditional offline retailers, it seems, has left them so far
behind on the innovation curve that catching up could be unrealistic. If Amazon's scale
and tech-led dominance is to be countered then traditional retailers will likely need to
act in partnership with the likes of Google and other providers to access their
technologies. Commentators call for increased data sharing between, and across,
retailers and brands in order to compete in areas such as personalisation and targeted
advertising. The Amazon threat looks set to continue, bringing together previously
unlikely bedfellows.
Systematic Internalisers - How Much Risk do They Pose to the Exchanges?
* Impact of Systematic Internalisers to be one of the Great Unknowns of MiFID II
MiFID II means change for cash equity infrastructure in Europe. The two biggest changes will be the implementation of the Double Volume Cap (DVC) on the amount of trading that occurs at dark venues and the impact of the expanded systematic internaliser (SI) regime. We expect the DVC will be a positive catalyst to exchangetraded volumes in the near-term. But these near-term share gains are likely to be reversed as the importance of SI's grows and their market share expands to 600bp of total trading volumes in Europe. We believe it could take several years for SI to achieve their equilibrium market share.
* Net impact of DVCs & the SI Regime to be Moderately Negative for Exchanges
We forecast the long-term net impact of DVCs and SI regime will be a moderate loss of market share for the exchanges (-170bp). That said, there is a high level of uncertainty with regards to the market share gains the systematic internalisers will generate.
* Earnings at Euronext & BME are most Exposed to Market Share Changes
Given the uncertainty surrounding how the cash equity market will be impacted by MiFID II, especially with regards to the market share gains of systematic internalisers, we have examined both upside and downside scenarios to stress the EPS impact to the exchanges of differing outcomes. Looking at our downside scenario, where SI's achieve 15% market share in a 24 month time frame, ENXT's 2019-20 EPS is most negatively exposed (5-6% EPS hit), followed by BME (3% hit), LSE (2% hit) and DB1 (<1% hit). Among the US Exchanges with European cash equity exposure (NDAQ & CBOE), the
EPS impact would be <1%.
* We Continue to Prefer ENXT, DB1 & NDAQ (All Buy-Rated)
In our neutral (base) case scenario, we expect the SI's to gain 6% market share of cash equity trading in 2020. But in a scenario where they gain more, ENXT would be most negatively impacted. Investors who expect the SI's to gain more market share than our Neutral case scenario should consider DB1 (rated Buy), as they are the least impacted by
potential market share gains from SI's. Among the US exchanges with exposure to European cash equities, we prefer NDAQ (rated Buy) over CBOE (Neutral).
L’artiste russe Pavlenski arrêté à Paris pour avoir mis le feu à la Banque de France
Video :
Le performeur, qui se revendique de « l’art politique », s’est attaqué à une antenne de l’institution, place de la Bastille. Il est réfugié en France depuis le mois de janvier.
L’artiste performeur russe Piotr Pavlenski a été arrêté par la police, lundi 16 octobre à l’aube, pour avoir mis le feu à une antenne de la Banque de France place de la Bastille à Paris. Peu après 4 heures du matin, l’artiste a aspergé d’essence deux fenêtres encadrant l’entrée du bâtiment, puis y a mis le feu.
La police est arrivée rapidement sur les lieux et a emmené M. Pavlenski et la femme qui l’accompagnait au commissariat voisin, vers 4 h 15. Tous deux ont été placés en garde à vue pour dégradations volontaires de biens par l’effet d’une substance incendiaire.
Pavlenski, réfugié en France depuis le mois de janvier, a utilisé la même méthode que pour les actions qui l’ont rendu célèbre en Russie : convoquer, au dernier moment, des photographes et des caméras. « Nous étions quatre ou cinq, dont deux cartes de presse, relate le photographe Marc Chaumeil, de l’agence Divergence Images. Je ne le connaissais pas avant, et un contact m’a proposé hier de venir à Bastille dans la nuit. »
Piotr Pavlenski a distribué aux journalistes présents un communiqué de quelques lignes, censé expliquer cette action baptisée Eclairage :
« La Bastille a été détruite par le peuple révolté ; le peuple l’a détruite comme symbole du despotisme et du pouvoir. Sur ce même lieu, un nouveau foyer d’esclavage a été bâti. (…) La Banque de France a pris la place de la Bastille, les banquiers ont pris la place des monarques. (…) La renaissance de la France révolutionnaire déclenchera l’incendie mondial des révolutions. »
Un soutien des Pussy Riot
Les photos prises sur les lieux rappellent fortement la dernière action d’envergure menée en Russie par l’artiste : l’incendie, en novembre 2015, de la porte principale de la Loubianka, le siège historique des services de sécurité russes.
Cette action lui avait valu de passer sept mois en détention préventive, avant d’être finalement condamné à une simple amende. L’artiste, qui se revendique de « l’art politique », avait transformé son procès en performance en invitant des prostituées à y témoigner, pour moquer la soumission de la justice russe au pouvoir politique.
Piotr Pavlenski, 33 ans, qui s’inscrit dans la tradition déjà ancienne de l’actionnisme russe, est aussi connu pour s’être enroulé nu dans du fil barbelé ou s’être cloué les testicules sur les pavés de la place Rouge, une « métaphore de l’apathie, de l’indifférence politique et du fatalisme de la société russe ».
Il s’était aussi cousu les lèvres en soutien aux Pussy Riot, un groupe de jeunes femmes condamnées à deux ans de camp pour avoir « profané » la cathédrale du Christ-Sauveur, à Moscou, au cours d’une prière punk.Interné à plusieurs reprises en asile psychiatrique, aucune expertise ne l’a jamais déclaré fou.
Procédure judiciaire en Russie
C’est une tout autre affaire qui a finalement précipité son départ de Russie, en janvier. L’artiste et sa femme, Oksana Chaliguina, ont obtenu début mai le statut de réfugiés politiques en France, où ils avaient fui avec leurs deux enfants à la suite du déclenchement d’une procédure judiciaire pour agression sexuelle, en décembre 2016. A l’origine des accusations, une jeune comédienne du Teatr.Doc, qui dit avoir été violentée, blessée et avoir eu ses vêtements lacérés par Pavlenski et sa compagne.
Ces accusations avaient causé la stupeur dans les milieux artistiques et d’opposition russes, le Teatr.Doc étant lui-même considéré comme proche de l’opposition. M. Pavlenski, lui, a toujours contesté les faits, et a dénoncé dans les poursuites une persécution politique. Après son interpellation à l’aéroport de Moscou, en décembre 2016, il avait raconté :
« On nous a expliqué qu’on avait en gros deux possibilités (…), aller en prison dans un camp pour dix ans, avec tout le loisir d’expliquer aux autres prisonniers qu’on avait été victimes d’une sale intrigue, ou partir de Russie. »
Refus des aides sociales
Depuis son installation en France, la famille Pavlenski vivait pauvrement, changeant souvent d’appartement. En mai, dans un entretien à Radio Svoboda, l’artiste avait expliqué avoir refusé toute aide sociale et tout logement, disant travailler « pour les gens et pas pour l’Etat ». Il estimait aussi, en pleine campagne présidentielle, qu’« on laisse le choix aux gens entre libéralisme et fascisme ».
Dans un autre entretien, accordé en septembre à la radio allemande Deutsche Welle, il expliquait squatter un appartement et voler de la nourriture dans les magasins, disant « vivre comme la plupart des Français ».
Quelle qu’elle soit, la réaction des autorités françaises fera les choux gras de la presse russe, trop heureuse de moquer une éventuelle bienveillance passive, ou à l’inverse de pointer une sévérité qui était justement critiquée quand l’artiste opérait en Russie.
Pour l’heure, l’enquête a été confiée à la sûreté territoriale par le parquet de Paris, et la Banque de France a fait part à Franceinfo son intention de porter plainte.
Pearson shares rise after optimistic trading statement
Cost cuts by education publisher help offset decline in core US textbook business
Shares in Pearson rose after the educational publisher issued a more optimistic forecast on its full-year profits as cost savings help to offset tough trading in its core US division.
John Fallon, chief executive, cautioned on the outlook for the US business where the company is battling a trend for students to rent textbooks instead of buying them.
“US higher education continues to be a tough environment and we expect to see declines in US higher education courseware for another couple of years,” he said in a trading update for the first nine months of the year.
But the group forecast that operating profits would be at least £576m — having previously guided analysts to expect earnings to be as low as £546m — as it ploughed ahead with cost savings, and trading in its US higher education courseware business was less bad than feared. The upper end of its profit forecast has stayed at £606m.
The shares rose 5.3 per cent to 655p, having risen as much as 10 per cent in early trading.
Mr Fallon said: “We are encouraged by our progress and our competitive performance.” He added there was “still a lot to do” but that he was “confident we are on a path to return Pearson to long term sustainable growth”.
The group’s underlying revenues fell 2 per cent in the first nine months of its financial year compared with the same period in 2016. Sales in the US fell by 4 per cent because of contract losses in its school exam business and what it called “weakness in school and higher education courseware”.
“Today’s release provides a degree of comfort on trading [and] that management has grasped the nettle on cost savings following several false starts,” Roddy Davidson of Shore Capital said.
The former owner of the Financial Times earlier this year issued its fifth in a series of profit warnings after what it described as an unprecedented decline in its US education business. The company has been on an economy drive since 2013, when it vowed to remove £1bn of costs from the business by 2020.
A record loss in 2016 prompted around two-thirds of investors to oppose a 20 per cent pay rise awarded to Mr Fallon last year.
Since that protest vote in March, Pearson has sold its 22 per cent stake in Penguin Random House, slashed its dividend and said it would cut another 3,000 jobs. By 2020, Pearson aims to reduce its workforce by 10,000.
Pearson added in the trading statement that its tax rate for the full year would fall to 17 per cent from the previously expected 21 per cent “as a result of the favourable outcome of certain historical tax issues”.
To offset the structural decline in textbook purchases, Pearson is now focused on publishing more ebooks and has launched a pilot programme to rent out its own print books.
Mr Fallon said on Tuesday that both strategies were working well, with increased sales generated by cuts of 20 per cent to 50 per cent in its ebook prices.
Selling individual ebooks is less lucrative for Pearson than its legacy business of selling printed titles, although the company has responded to this challenge by building a digital subscription model.
“The difference to remember here is that unlike in journalism this is not an advertising supported model,” Mr Fallon said of the publisher’s transition away from analogue.
“It is people paying for content and services. We are going from selling a $300 dollar textbook where we get paid once to a digital courseware model where people buy access rather than ownership and we could get close to $100 every time people use it.”
Mr Fallon added that Pearson expected to bolster its profit margins by cutting costs in its digital unit, after a series of acquisitions meant its online businesses were operating on different platforms and had overlapping costs.
The publisher added it had agreed a deal to insure a third of its pension scheme liabilities — totalling £1.2bn — with insurers Legal & General and Aviva. This “substantially reduces” the risk that Pearson would be unable to fund future retiree benefits and was agreed at no further cost to the company.
Uber likely to agree on Softbank's investment next week; Uber board member says
Softbank Group Corp. [TYO:9984] and Uber Technologies are likely to reach an agreement on an investment from Softbank Group in the world's largest provider of ride sharing software as early as next week, the Nihon Keizai Shimbun reported.
The timing was disclosed by Arianna Huffington, a board member of Uber and the founder of Huffington Post, as she made a comment in a media event on the talks between the two companies, the Japanese newspaper report said, quoting Huffington herself.
Although Huffington did not mention the size of the investment, she was quoted in the report as saying that the agreement is highly likely to be reached sometime next week, and that Softbank is to take a stake of 14% to 20% of Uber, according to the report.
--> Link : original source
Lithium prices surge as China pushes e-vehicles
Sharp price rises for the key battery material could make cars more costly
TOKYO -- Propelled by demand for batteries used in electric vehicles, spot prices of lithium have climbed more than 30% since the start of the year and will likely drive up the cost of the autos.
The Chinese spot price of lithium carbonate, the bellwether for lithium trades, came to around 152,000 yuan (around $23,000) a ton in mid-October -- up from 110,000 yuan at the beginning of the year and 18% higher than in late August.
The rare metal is used as cathode material in lithium-ion rechargeable batteries. The increase in prices owes to growing consumption in China, which accounts for 40% of global demand. To combat air pollution, the Chinese government is working to strengthen environmental regulations and popularize electric vehicles. Recently relaxed eco-car regulations make such autos easier to manufacture and sell.
Chinese sales of electric vehicles are projected to rise 20% from last year to around 290,000 units in 2017, according to market research company Fuji Keizai. The nation's lithium carbonate demand is thus seen climbing 30-50% to between 80,000 tons and 90,000 tons.
Reduced supply is also driving prices higher. In South America, a leading production region, the metal is produced by sun-drying saltwater containing lithium. But heavy rains in Chile and Argentina this May and June slowed evaporation, cutting yields.
Most cathode materials producers import lithium under six-month to one-year contracts. With lithium demand widely expected to continue climbing, some are already preparing for 10% price hikes next year.
Cobalt, another metal used in lithium-ion batteries, has doubled in price on growing demand and now goes for roughly $30 a pound. Brisk demand could drive the price to $50, some suggest.
Lithium and cobalt are thought to constitute 10-20% of battery production costs. Some battery producers say continued high prices could force them to raise battery prices, which in turn would make electric vehicles more expensive to build.