July 2016 - wlug - list.wlug.org.nz

HTTPS crypto’s days are numbered. Here’s how Google wants to save it
by Peter Reutemann 09 Jul '16

09 Jul '16

'Like many forms of encryption in use today, HTTPS protections are on the brink of a collapse that could bring down the world as we know it. Hanging in the balance are most encrypted communications sent over the last several decades. On Thursday, Google unveiled an experiment designed to head off, or at least lessen, the catastrophe. In the coming months, Google servers will add a new, experimental cryptographic algorithm to the more established elliptic curve algorithm it has been using for the past few years to help encrypt HTTPS communications. The algorithm—which goes by the wonky name "Ring Learning With Errors"—is a method of exchanging cryptographic keys that's currently considered one of the great new hopes in the age of quantum computing. Like other forms of public key encryption, it allows two parties who have never met to encrypt their communications, making it ideal for Internet usage.' -- source: http://arstechnica.com/security/2016/07/https-crypto-is-on-the-brink-of-col… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mesa 12.0 Released With OpenGL 4.3 Support, Intel Vulkan and More
by Peter Reutemann 09 Jul '16

09 Jul '16

'Mesa3D developers have announced the release of Mesa 12.0. Mesa 12 notably adds open-source OpenGL 4.3 drivers for Intel, Radeon, and NVIDIA on Linux, and it also integrates the previously open-sourced Intel Vulkan graphics API driver. From the Phoronix analysis, "Mesa 12.0 is easily one of the biggest updates to this important open-source user-space OpenGL driver stack in quite some time and will offer much better support and features especially for Intel, Radeon, and NVIDIA open-source Linux desktop users/gamers."' -- source: https://linux.slashdot.org/story/16/07/08/2135213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services
by Peter Reutemann 08 Jul '16

08 Jul '16

'Two researchers have discovered over 100 Tor nodes that are spying on hidden services. Cory Doctorow from Boing Boing reports: "These nodes -- ordinary nodes, not exit nodes -- sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over. The researchers used 'honeypot' .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions' existence. They didn't advertise the honions' existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits. No one knows who is running the spying nodes: they could be run by criminals, governments, private suppliers of 'infowar' weapons to governments, independent researchers, or other scholars (though scholarly research would not normally include attempts to hack the servers once they were discovered)." The Tor project is aware of the attack and is working to redesign its system to try and block it.' -- source: https://yro.slashdot.org/story/16/07/08/2034209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Antivirus Software Is 'Increasingly Useless' and May Make Your Computer Less Safe
by Peter Reutemann 08 Jul '16

08 Jul '16

'Is your antivirus protecting your computer or making it more hackable? Internet security experts are warning that anti-malware technology is becoming less and less effective at protecting your data and devices, and there's evidence that security software can sometimes even make your computer more vulnerable to security breaches. This week, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) issued a warning about popular antivirus software made by Symantec, some of it under the Norton brand, after security researchers with Google's Project Zero found critical vulnerabilities. "These vulnerabilities are as bad as it gets. They don't require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible," wrote Google researcher Tavis Ormandy in a blog post. Symantec said it had verified and addressed the issues in updates that users are advised to install. It's not the only instance of security software potentially making your computer less safe. Concordia University professor Mohammad Mannan and his PhD student Xavier de Carne de Carnavalet recently presented research on antivirus and parental control software packages, including popular brands like AVG, Kaspersky and BitDefender, that bypass some security features built into internet browsers to verify whether sites are safe or not in order to be able to scan encrypted connections for potential threats. In theory, they should make up for it with their own content verification systems. But Mannan's research, presented at the Network and Distributed System Security Symposium in California earlier this year, found they didn't do a very good job. "We were surprised at how bad they were," he said in an interview. "Some of them, they did not even make it secure in any sense."' -- source: https://it.slashdot.org/story/16/07/08/145245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android KeyStore Encryption Scheme Broken
by Peter Reutemann 08 Jul '16

08 Jul '16

'The default implementation for KeyStore, the system in Android designed to store user credentials and cryptographic keys, is broken, researchers say.>In an academic paper published this week, researchers argue that the particular encryption scheme that KeyStore uses fails to protect the integrity of keys and could be exploited to allow an attacker to modify stored keys through a forgery attack. KeyStore, which performs key-specific actions through the OpenSSL library, allows Android apps to store and generate their own cryptographic keys. By storing keys in a container, KeyStore makes it more difficult to remove them from the device. Mohamed Sabt and Jacques Traore, two researchers with the French telecom Orange Labs, claim the scheme associated with the system is "non-provably secure," and could have "severe consequences." The two point out in their paper "Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore," that it's the hash-then-encrypt (HtE) authenticated encryption (AE) scheme in cipher block chaining mode (CBC) in KeyStore that fails to guarantee the integrity of keys.' -- source: https://tech.slashdot.org/story/16/07/07/1819233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 million Android phones infected by all-powerful auto-rooting apps
by Peter Reutemann 07 Jul '16

07 Jul '16

"Security experts have documented a disturbing spike in a particularly virulent family of Android malware, with more than 10 million handsets infected and more than 286,000 of them in the US. Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day, displays 20 million malicious advertisements, and generates more than $300,000 per month in revenue. The success is largely the result of the malware's ability to silently root a large percentage of the phones it infects by exploiting vulnerabilities that remain unfixed in older versions of Android. The Check Point researchers have dubbed the malware family "HummingBad," but researchers from mobile security company Lookout say HummingBad is in fact Shedun, a family of auto-rooting malware that came to light last November and had already infected a large number of devices." -- source: http://arstechnica.com/security/2016/07/virulent-auto-rooting-malware-takes… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of systemd In Debian
by Lawrence D'Oliveiro 07 Jul '16

07 Jul '16

Presentation from DebConf, slides and video <http://phoronix.com/scan.php?page=news_item&px=Debian-systemd-Status-2016>.

1 1

Yet Another Next-Generation Filesystem
by Lawrence D'Oliveiro 06 Jul '16

06 Jul '16

As if btrfs and ZFS aren’t enough, here’s another next-generation filesystem being developed for Linux: <http://phoronix.com/scan.php?page=news_item&px=Bcachefs-Still-Rolling>. It apparently originated from “Bcache”, which was a filesystem developed for use on SSDs.

1 0

32 bit
by Ian Young 06 Jul '16

06 Jul '16

See also Linux Mint 18 in 32-bit version, and Bodhi complete with Enlightenment. NOW WHAT ABOUT TRIMMING THOSE POSTS!!! OTHERWISE I MAY BE FORCED TO DIG OUT SOME ARCHAIC INTERNET ETIQUETTE FAQ AND POST IT IN FULL ALL IN CAPS. Just joshing people. But puhleeze???! A word for Michelle and the quest for perfection. Sometimes in this life there is a dichotomy between what we wish for and what we can actually accomplish. Maybe near enough is good enough. Is there actually such a thing as complete security on the internet? Possibly, but probably not for the average citizen. "You have zero privacy anyway. Get over it." Scott McNealy, formerly of Sun Microsystems. Sad but probably true.

8 14

puppy or qubes
by Michelle 06 Jul '16

06 Jul '16

Well, I give up. I have tried for months and invested dozens of hours to get a machine that runs qubes and it hasn't happened. So would somebody be willing to go into say pb tech with different live puppy's on stick (or DVD) and finding what computers run it. Puppy was the distro I was wanting to run on my brand new computer I bought last year. I have been told that it is hard to find a new computer that won't rtun puppy. My new computer didn't. Hopefully it is just a freak. So if you are prepared to do that, could you then let me know at least two of those computers that should be able to run qubes according to the hardware specifications at the qubes website. If nobody is prepared to do that it is more than fine. I will just buy a computer that runs a windows legacy os.

5 11