DOCSLIB.ORG

Software Security - 2017 Gencyber Camp

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Software Security - 2017 Gencyber Camp Software Security - 2017 GenCyber Camp Bo Luo Associate Professor Director, Information Assurance Lab, ITTC The University of Kansas, Lawrence, KS, USA [email protected]; http://www.ittc.ku.edu/~bluo Software Security Modularization Abstraction Information hiding Simplicity Minimization Software Security .What is “secure” program? . Means different things to different people .Is it secure if ? . takes too long to break through security controls . runs for a long time without failure . it conforms to specification . free from all faults 3 Software Security .Complete Program Security . Can we make programs completely secure? . Not easy .Why? .Software testing: make sure that code does what it's supposed to do .Software security: verify that code doesn't do anything it isn't supposed to do. Much harder .Program errors could be exploited by adversaries to: gain control of the system, deploy Trojan horses, etc. 4 Software Security .IEEE Terminology . error – human action that causes an incorrect result . fault – incorrect step, process or data definition in a program . failure – system doesn’t behave according to requirements . a fault is an inside view - seen by developers . a failure is an outside view - seen by users 5 Software Security .Faults in Programs . Program errors could be exploited by adversaries to: gain control of the system, deploy Trojan horses, etc. .Which is better: . finding and fixing 20 faults in a module? . finding and fixing 100 faults? .Finding 100 could mean . you have better testing methods OR . code is really bad; 100 were just the tip of the iceberg .Software testing literature: . finding many errors early → probably find many more 6 Software Security .Types of flaws . validation error . domain error . serialization and aliasing . inadequate authentication . boundary condition violation . other exploitable logic errors .From Landwehr: Taxonomy of Security Flaws .Let’s see an example. 7 Software Security .TOCTTOU: Time of Check to Time of Use .Real world example, purchase at a store: Time of check . Costs $100 . You count out the money on the counter . Cashier turns around, you take $20 back Time of use . Cashier doesn't notice . Still get the $100 item 8 Software Security .Software security example: pseudocode for opening file stuff.txt: Time of check if (permission(user, stuff.txt)) open(stuff.txt) else return failure Time of use 9 Software Security .Software security example: pseudocode for opening file stuff.txt: Time of check if (permission(user, stuff.txt)) open(stuff.txt) else return failure Time of use . Suppose that stuff.txt is a symlink . What would happen if we switched the link to a different file? 10 Software Security .TOCTTOU is unlikely? . Timing would have to be perfect. .But: . can run program over and over . only have to get it right once . can run many other programs to lengthen time between check and open 11 Software Security .Malicious code: designed to do things “it isn’t supposed to do” . virus . trojan horse . logic bomb . time bomb (special case of logic bomb) . worm 12 Software Security .Trojan horses: program with . Open, known effect . And a secret effect .Example: game that searches hard drive for passwords .Propagating Trojans: Trojans which make copies of themselves 13 Software Security .The secret effects of Trojan horses . Control the computer (Zombie computers) . Steal information: passwords, bank accounts, credit card numbers, SSN, etc. Install (malicious) software . Monitor and control hardware: key logger, watch screen, view webcam . More? 14 Software Security .Ransomware . Holds a computer system, or the data it contains, hostage against its user by demanding a ransom. Disable an essential system service or lock the display at system startup . Encrypt some of the user's personal files, originally referred to as cryptoviruses, cryptotrojans or cryptoworms . Victim user has to . enter a code obtainable only after wiring payment to the attacker or sending an SMS message . buy a decryption or removal tool CS426 Fall 2010/Lecture 15 15 Software Security .Ransomware CS426 Fall 2010/Lecture 15 16 Software Security .Viruses: program which . infects other files (inserts itself into) . performs some action .Many types: . boot sector . executable file infector . multipartite (different targets e.g. either boot sector or exe) . encrypted viruses . polymorphic viruses . macro virus 17 Software Security .Software Security Controls? .Patching OS and applications . Importance of patching . Timing: vulnerability window . 0-day vulnerabilities . Vulnerability scanning 18 Software Security .Operating Systems Controls . trusted software . protection, confinement . limited privilege . logging 19 Software Security .Developmental Controls . Good software engineering practice! . Modularity . Abstraction . Encapsulation, information hiding . Separation, isolation . Simplicity . Minimization . Least astonishment . Testing . Peer reviews . Designing good specs . Fail safe mechanisms 20 Abstraction .Abstraction: representation of an object or concept that includes only the most significant attributes . Something such as a door, a speedometer, or a data structure in computer science. Abstraction decouples the design from the implementation. A map is an abstraction of the earth. .The concept of abstraction is fundamental in programming (and computer science) Abstraction .The goal in abstraction, from a computer security viewpoint is to remove any clutter that can distract and possibly be used in an incorrect way. .Abstraction only provides the essential details of what is being modeled and provide the minimum information necessary to accomplish the task. Modularity .Process abstraction .Modular programming . software design technique . separating the functionality of a program into independent, interchangeable modules. Modularity .Process abstraction .Modular programming . software design technique . separating the functionality of a program into independent, interchangeable modules. .Each module (sub-program) . Everything necessary to execute a unique part of the desired functionality . A single entry point . Well designed interfaces: provide all the detail needed for one module to replace another and achieve the needed results. Modularity .Hardware modularity . 1980s and 1990s: desktop computers were more of a hobbyist effort. Computers could be modified to add hardware and increase performance. Memory could be added. There were different sound and video cards available. Disk drives came in different sizes. All of the components depended on having a well defined interface. Thus if a component from one manufacturer failed, it was easy to get another part from another manufacturer and replace it. Modularity allowed parts with the same interfaces to be interchangeable with others. Information Hiding .Information hiding: does not allow certain aspects of an object to be observed or accessed. .Data and information hiding keeps the programmer from having complete access to data structures. .It allows access to only what is necessary. Information Hiding .Example: . Manipulating a stack requires three operations: . Push, pop and view the data item on the top of the stack. Information hiding allows the programmer to not be concerned with how the stack is implemented. The stack could be a linked list, tree structure, or an array. None of the details of how the stack is implemented are necessary. Simplicity of Design .Simplicity as a design goal. Simplicity is a design principle at Apple, especially with the iPhone. There is a single button. People understand how to use the device without having to read a manual. All unnecessary complexity has been removed. Simplicity of Design .Computers enable highly complex system . Today’s systems have large, high-dimensional state spaces and highly non-linear behavior Simplicity of Design .Computers enable highly complex system . Today’s systems have large, high-dimensional state spaces and highly non-linear behavior Complexity is the enemy of security! Simplicity of Design .Why? . Simple systems with linearity, continuity and small state spaces are easy to analyze and easy to test . Complex systems are less predictable . Complexity breeds bugs . Simplicity is especially important when human users are involved .Value simplicity and remove unnecessary complexity For example: . Build code that only does what you need . Reuse components that are considered secure . Consistent in implementation of encryption especially those “tried and true” Minimization .Attack surface: places in a program where users and other programs can enter and extract data. .Secure the program is difficult . the sheer size . increased complexity .Goal of minimization: simplify and decrease the number of ways that software can be exploited. Turning off ports that are not needed . Reduce the amount of code running . Use the concept of least privilege . Turn off unneeded features..
Load more

Recommended publications
  • Security , Hacking, Threats & Tools for Security
    SECURITY , HACKING, THREATS & TOOLS FOR SECURITY N.Anupama Asst Professor ANUCET ANU CONTENT Introduction to security Features of security Hacking Security threats Tools to provide security Conclusion SECURITY Security is the protection of assets. The three main aspects are: Prevention Detection re-action Information can be stolen – how to prevent it. Confidential information may be copied and sold - but the theft might not be detected The criminals try to attack and the system should react to stop it. TYPES OF SECURITY Computer Security deals with the prevention and detection of unauthorised actions by users of a computer system. Network security prevent and monitor unauthorized access, misuse, modification, or denial of a computer network and network- accessible resources. Web security deals specifically with security of websites, web applications and web service. Features of security Confidentiality Integrity Availability Non-repudiation Authentication Access Controls Accountability FEATURES OF SECURITY Confidentiality Confidentiality is keeping information secret or private. The prevention of unauthorized disclosure of information. Confidentiality might be important for military, business or personal reasons. Integrity Integrity means that there is consistency in the system - everything is as it is expected to be. Integrity is the authorised writing or modification of information. Data integrity means that the data stored on a computer is the same as the source documents. FEATURES OF SECURITY Availability Information should be accessible and useable upon appropriate demand by an authorized user. Availability is the prevention of unauthorized withholding of information. Non-repudiation Non repudiation is a method of guaranteeing message transmission between parties via digital signature and/or encryption. Non repudiation is often used for digital contracts, signatures and email messages.
    [Show full text]
  • Address Munging: the Practice of Disguising, Or Munging, an E-Mail Address to Prevent It Being Automatically Collected and Used
    Address Munging: the practice of disguising, or munging, an e-mail address to prevent it being automatically collected and used as a target for people and organizations that send unsolicited bulk e-mail address. Adware: or advertising-supported software is any software package which automatically plays, displays, or downloads advertising material to a computer after the software is installed on it or while the application is being used. Some types of adware are also spyware and can be classified as privacy-invasive software. Adware is software designed to force pre-chosen ads to display on your system. Some adware is designed to be malicious and will pop up ads with such speed and frequency that they seem to be taking over everything, slowing down your system and tying up all of your system resources. When adware is coupled with spyware, it can be a frustrating ride, to say the least. Backdoor: in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing remote access to a computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back Orifice), or could be a modification to an existing program or hardware device. A back door is a point of entry that circumvents normal security and can be used by a cracker to access a network or computer system. Usually back doors are created by system developers as shortcuts to speed access through security during the development stage and then are overlooked and never properly removed during final implementation.
    [Show full text]
  • Malware Xiaowei Yang Previous Lecture
    590.05 Lecture 5: Malware Xiaowei Yang Previous lecture • Accountability • OS security Today • Malware Malware: Malicious Software 10/21/13 Malware 4 Viruses, Worms, Trojans, Rootkits • Malware can be classified into several categories, depending on propagaon and concealment • Propagaon 10/21/13 • Virus: human-assisted propagaon (e.g., open email aachment) • Worm: automac propagaon without human assistance Malware • Concealment • Rootkit: modifies operang system to hide its existence • Trojan: provides desirable funcBonality but hides malicious operaon • Various types of payloads, ranging from annoyance to crime 5 Insider Attacks • An insider a)ack is a security breach that is caused or facilitated by someone who is a part of the very organizaon that controls or builds the asset that should be protected. • In the case of malware, an insider aack refers to a security 10/21/13 hole that is created in a soXware system by one of its programmers. Malware 6 Backdoors • A backdoor, which is also someBmes called a trapdoor, is a hidden feature or command in a program that allows a user to perform acBons he or she would not normally be allowed to do. • When used in a normal way, this program performs completely as 10/21/13 expected and adverBsed. • But if the hidden feature is acBvated, the program does something Malware unexpected, oXen in violaon of security policies, such as performing a privilege escalaon. • Benign example: Easter Eggs in DVDs and soXware An Easter egg is an intenBonal inside joke, hidden message, or feature in a work such as a computer program, movie, book, or 7 crossword.
    [Show full text]
  • Information Security Software Flaws
    CS 166: Information Security Software Flaws Prof. Tom Austin San José State University If automobiles had followed the same development cycle as the computer, a Rolls- Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside. ¾ Robert X. Cringely My software never has bugs. It just develops random features. ¾ Anonymous Why Software? • Why is software as important to security as crypto, access control, protocols? • Virtually all of information security is implemented in software • If your software is subject to attack, your security can be broken – Regardless of strength of crypto, access control or protocols • Software is a poor foundation for security Bad Software is Ubiquitous • NASA Mars Lander (cost $165 million) – Crashed into Mars due to… – …error in converting English and metric units • Denver airport – Baggage handling system --- very buggy software – Delayed airport opening by 11 months – Cost of delay exceeded $1 million/day • MV-22 Osprey – Advanced military aircraft – Faulty software can be fatal Software Issues Alice and Bob Trudy • Find bugs and flaws by • Actively looks for bugs accident and flaws • Hate bad software… • Likes bad software… • …but must learn to live • …and tries to make it with it misbehave • Must make bad • Attacks systems via bad software work software Complexity “Complexity is the enemy of security”, Paul Kocher, Cryptography Research, Inc. System Lines of Code (LOC) Netscape 17 million Space Shuttle 10 million Linux kernel 2.6.0 5 million Windows XP
    [Show full text]
  • Towards Semi-Automated Detection of Trigger-Based Behavior for Software Security Assurance
    Towards Semi-automated Detection of Trigger-based Behavior for Software Security Assurance Dorottya Papp Levente Buttyán Zhendong Ma CrySyS Lab, Dept. of Networked CrySyS Lab, Dept. of Networked Center of Digital Safety and Security, Systems and Services, BME Systems and Services, BME Austrian Institute of Technology Magyar tudósok krt 2. Magyar tudósok krt 2. Donau-City-Straβe 1. Budapest 1117, Hungary Budapest 1117, Hungary Vienna, Austria Center of Digital Safety and Security, [email protected] [email protected] Austrian Institute of Technology Donau-City-Straβe 1. Vienna, Austria [email protected] ABSTRACT 1 INTRODUCTION A program exhibits trigger-based behavior if it performs undocu- Trigger-based behavior in software refers to execution of code that mented, often malicious, functions when the environmental condi- is activated on specific input values (the so called trigger inputs) tions and/or specific input values match some pre-specified criteria. and that performs some undocumented functions. Often, the users Checking whether such hidden functions exist in the program is are not aware of the existence of those undocumented functions important for increasing trustworthiness of software. In this paper, in the software. It is clear that using an application that has such we propose a framework to effectively detect trigger-based behav- hidden functions, which can be triggered by non-legitimate par- ior at the source code level. Our approach is semi-automated: We ties, is dangerous, as those functions can potentially implement use automated source code instrumentation and mixed concrete malicious actions. Indeed, the best examples for trigger-based be- and symbolic execution to generate potentially suspicious test cases havior include backdoors and logic bombs hidden in applications that may trigger hidden, potentially malicious functions.
    [Show full text]
  • “Cybersecurity in the Workplace”
    “Cybersecurity in the Workplace” How to Strengthen and Protect Your Business in an Era of Easy Computer System Access © 2018 Hinshaw & Culbertson LLP, an Illinois Limited Liability Partnership. All rights reserved. Meet Today’s Presenters Ambrose McCall advises businesses on a range of Ken Yeadon uses his experience as a former Assistant U.S. employment issues, including regulatory, compliance and Attorney and SEC Enforcement Attorney to provide defense, employee program matters; he also counsels employers on representation, and advice to individuals and corporations on employee social media and digital workplace policies. criminal, securities, health care, and civil regulatory matters. Cybersecurity in the Workplace: Learning Objectives 1 2 Review relevant law that Demonstrate cybercrime promotes cybersecurity and potential recourses and protects businesses through case studies 3 Best practices that promote cybersecurity and protect your business Insert Copy Recent Examples Andrew Auernheimer – exploited vulnerability in AT&T website to obtain email addresses of AT&T iPad users Matthew Keys – disgruntled employee gave log-on info to hacker, who used info to alter an LA Times news story David Nosal – talked former colleagues into accessing their company's database to give him trade secrets to launch a competing company Cybersecurity Overview • Computer Fraud and Abuse Act (1984) Federal • Electronic Communications Privacy Act (1986) vs. State • State Laws • Civil Remedies for Employers • Criminal Penalties for Civil vs. Employees Criminal
    [Show full text]
  • Cybercrime: an Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws
    Cybercrime: An Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws Charles Doyle Senior Specialist in American Public Law October 15, 2014 Congressional Research Service 7-5700 www.crs.gov 97-1025 Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws Summary The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, outlaws conduct that victimizes computer systems. It is a cyber security law. It protects federal computers, bank computers, and computers connected to the Internet. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud. It is not a comprehensive provision, but instead it fills cracks and gaps in the protection afforded by other federal criminal laws. This is a brief sketch of CFAA and some of its federal statutory companions, including the amendments found in the Identity Theft Enforcement and Restitution Act, P.L. 110-326, 122 Stat. 3560 (2008). In their present form, the seven paragraphs of subsection 1030(a) outlaw • computer trespassing (e.g., hacking) in a government computer, 18 U.S.C. 1030(a)(3); • computer trespassing (e.g., hacking) resulting in exposure to certain governmental, credit, financial, or computer-housed information, 18 U.S.C. 1030(a)(2); • damaging a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce (e.g., a worm, computer virus, Trojan horse, time bomb, a denial of service attack, and other forms of cyber attack, cyber crime, or cyber terrorism), 18 U.S.C.
    [Show full text]
  • Software Assurance for Executives Definitions
    Definitions Term Definition acquisition Process of obtaining a system, software product, or software service. Software products may include commercial, off-the- shelf (COTS) products; modified, off-the-shelf (MOTS) products; open source products; or fully developed products. The above definition was derived from these references: [IEEE-CS 2008, IEEE-CS 1998] active attack An attack that alters a system or data. [CNSS 2010] Agile An iterative and incremental (evolutionary) approach to software development which is performed in a highly collaborative manner by self-organizing teams within an effective governance framework with “just enough” ceremony that produces high quality software in a cost effective and timely manner which meets the changing needs of its stakeholders. [Ambler 2013] antivirus software Wikipedia: Software used to prevent, detect and remove malware. http://en.wikipedia.org/wiki/Anti-virus attack Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself. [CNSS 2010] authentication 1. Authentication is the process of determining whether someone or something is who or what it declares itself to be. Passwords, security cards, and biometric solutions are often employed as methods to provide user authentication. With respect to computer systems, the use of digital certificates, which include a digital signature and are issued and verified by a certificate authority (CA) as part of a public key infrastructure, are a way to perform authentication on the Internet. There are three classic ways to authenticate: something you know, something you have, something you are. 2. The process of verifying the identity or other attributes claimed by or assumed of an entity (user, process, or device), or to verify the source and integrity of data.
    [Show full text]
  • Virus Bulletin, May 1994
    ISSN 0956-9979 MAY 1994 THE INTERNATIONAL PUBLICATION ON COMPUTER VIRUS PREVENTION, RECOGNITION AND REMOVAL Editor: Richard Ford CONTENTS Technical Editor: Fridrik Skulason EDITORIAL Consulting Editor: Edward Wilding, Network Security Management, UK Do Not Trust the Horse, Trojans… 2 VIRUS PREVALENCE TABLE 3 NEWS Symantec Acquires Central Point 3 The HDZap Trojan 4 Nordic Naughtiness 4 Virus Exchange - No Thank You 4 IN THIS ISSUE: IBM PC VIRUSES (UPDATE) 5 • Investigating Computer Crime. UK Fraud Squad INSIGHT detectives start making inroads into the most puzzling Tipping the Scales 7 ‘Whodunnit’ since the Great Train Robbery. Has an outbreak of computer crime swept Britain? No, it is all VIRUS ANALYSES part of a training program. For more about Operation 1. Pathogenic Killer 9 Skye, turn to page 15. 2. AMSE - A Rite of Passage? 11 • Pathogen on the loose. A new virus is in the wild in 3. The Pink Panther 13 the UK. It is highly polymorphic and (at this time) not FEATURE detected by many vendors’ software. Jim Bates dissects The Thin Blue Line 15 the latest virus ‘in the wild’. PRODUCT REVIEWS • In Defence of the Realm. Dr Solomon’s Anti-Virus Toolkit for DOS is one of the best known products in the 1. Norman Virus Control 17 industry. Does the NetWare version live up to the same 2. The AVTK for NetWare 20 high standards set by its predecessors? CONFERENCE REPORT IVPC ’94 - Alive and Well in the USA 23 END NOTES & NEWS 24 VIRUS BULLETIN ©1994 Virus Bulletin Ltd, 21 The Quadrant, Abingdon, Oxfordshire, OX14 3YS, England.
    [Show full text]
  • Ellevation Inc. Order Form - Q-26361
    Ellevation Inc. Order Form - Q-26361 This Order Form is being entered into between Ellevation Inc., having an address at 38 Chauncy Street, Boston, Massachusetts 02111 (“Ellevation”) and the Company Name identified as “Customer” below, pursuant to the parties' Master Services Agreement dated 7/31/2021 ("MSA"). In the event of any conflict between this Order Form and the MSA, the terms of this Order Form shall control. This Order Form is effective as of the Subscription Start Date set forth below. Company: Ellevation Education Customer: Quincy School District, WA Representative: Alex Mukherjee Contact Name: Victoria Hodge Email: [email protected] Email: [email protected] Phone: 617-307-5755 Phone: (509) 787-8992 Address: 38 Chauncy St, 9th Floor, Boston, MA Address: 119 J St SW, Quincy, WA 98848 02111 Start Date: 8/1/2021 End Date: 7/31/2022 Subscription Fees Product Quantity Unit Price Total Fees Ellevation Platform (Start Date: 08/01/2021) 1,282 $13.50 $17,307.00 Strategies (Start Date: 08/01/2021) 1,282 $13.25 $16,986.50 Subscription Total: $34,293.50 Services Fees Services Total: $0.00 Total Investment - Q-26361 Grand Total: $34,293.50 Invoicing Schedule: Up Front, In Full Payment Term: Net 30 Contract Term: 12 ELLEVATION INC. Quincy School District, WA \s1\ By (Signature): \s2\ By (Signature): \n2\ \n1\ Name (Print): Name (Print): \signer_2_title\ \signer_1_title\ Title: Title: \d2\ \d1\ Date: Date: 1/5 This Master Services Agreement (this "Agreement") is dated as of 7/31/2021 ("Effective Date") by and between Ellevation Inc., a Delaware corporation ("Ellevation"), and Quincy School District, WA ("Customer").
    [Show full text]
  • Unforgivable Vulnerabilities Steve Christey the MITRE Corporation [email protected] August 2, 2007
    Unforgivable Vulnerabilities Steve Christey The MITRE Corporation [email protected] August 2, 2007 Abstract For some products, it's just too easy to find vulnerabilities. First, find the most heavily used functionality, including the first points of entry into the product. Then, perform the most obvious attacks against the most common types of vulnerabilities. Using this crude method, even unskilled attackers can break into an insecure application within minutes. The developer likely faces a long road ahead before the product can become tolerably secure; the customer is sitting on a ticking time bomb. These “Unforgivable Vulnerabilities” act like canaries in a coal mine. They are beacons of a systematic disregard for secure development practices. They simply should not appear in software that has been designed, developed, and tested with security in mind. This paper highlights the most common of the unforgivable vulnerabilities, followed by a proposal that the research community establish a set of Vulnerability Assessment Assurance Levels (VAAL) that can be used as indicators for the relative security of software products. Unforgivable vulnerabilities would be exemplars of VAAL-0. Background With the number of publicly reported vulnerabilities steadily increasing year by year [Lemos] [Martin2007a], it seems like there’s no end in sight. The same high-profile software continues to be battered. There is now enough history to try to compare products based on the number of disclosed vulnerabilities [Jones] [Cox], but these crude metrics have a number of important limitations, such as the varying skills of the researchers who analyze these products; the differences in disclosure practices by vendors; inadvertent or intentional biases by researchers and the tools they use; the continuing rapid advances in analysis, such as the discovery of new vulnerability classes and the growth of fuzzing; and the lack of consistent details in public advisories [Christey2006a].
    [Show full text]
  • These Terms and Conditions (“Terms”) Are the Conditions That Govern the Use of the Services (“Services”) of Safesky. Th
    SafeSky Terms and Conditions These Terms and Conditions (“Terms”) are the conditions that govern the use of the Services (“Services”) of SafeSky. These “Terms” apply to updates, supplements, add-on components, or Internet-based services components of the software that SafeSky may provide to you or make available to you after the date you obtain your initial copy of the software, unless SafeSky provides other terms along with the update, supplement, add-on component, or Internet-based services component. In the event any provision of these “Terms” is held to be void, invalid, unenforceable or illegal, the remaining provisions shall continue in full force and effect. SafeSky reserves the right to discontinue any Internet-based “Services” provided to you or made available to you through the use of the “Services”. SafeSky name and SafeSky logo are registered trademarks of SafeSky SRL, a company under Belgian Law, registered nr 0761852549. These “Terms” start as from the moment you install, copy and or use the “Services” of SafeSky. You may use SafeSky “Services” as far as you comply with all terms and conditions of this Agreement. By using the SafeSky “Services”, you signify your assent to these Terms. While using the “Services”, personal information may be provided by you or collected by SafeSky as detailed in our Privacy Policy. This Policy explains our practices pertaining to the use of your personal information and we ask that you read this Privacy Policy carefully. By accepting these Terms, you hereby acknowledge and agree to the collection, storage and use of your personal information by SafeSky, subject to this section, the Privacy Policy and any applicable laws and regulation.
    [Show full text]