August 2016 - wlug - list.wlug.org.nz

How Windows Handles Pathnames
by Lawrence D'Oliveiro 08 Sep '16

08 Sep '16

A Google engineer has published a detailed exposé on how Microsoft Windows handles file and directory pathnames (as opposed to how it is documented to handle them) <http://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32…> (found from <http://www.theregister.co.uk/2016/03/01/windows_path_hacks/>). Most of it, it could be argued, makes some sort of sense from a backward-compatibility rationale. Except for the reserved device names (PRN, NUL, CON etc): Now if just specifying these paths explicitly was all that this process handled it would be annoying but not the end of the world. However it’s much worse. The conversion process actively tries to convert any path with the device name last, even if the path is a Drive Absolute path. To make matters even worse the device name can have arbitrary trailing characters as long the trailing characters are separated from the device by a dot or a colon. The name can then also have trailing spaces. ... Why it does the check is beyond me as it seems to serve no actual purpose. Also note the removal of trailing suffixes, which can come in handy if something is actively trying to guard against this behavior. For example, if an application was mindful and was checking for a filename that matched one of the reserved names you can just bypass that check by appending an arbitrary suffix.

1 1

Fujitsu’s Upcoming 64-Bit-ARM-Based Super
by Lawrence D'Oliveiro 07 Sep '16

07 Sep '16

Some discussion about why Fujitsu chose ARM over SPARC or x86 for its “Post-K” machine: <http://www.theregister.co.uk/2016/08/23/fujitsu_arm_post_k/>. Basically, it offers a much more customizable platform. Goes without saying it will be running Linux...

1 1

New cloud attack takes full control of virtual machines with little effort
by Peter Reutemann 31 Aug '16

31 Aug '16

'The world has seen the most unsettling attack yet resulting from the so-called Rowhammer exploit, which flips individual bits in computer memory. It's a technique that's so surgical and controlled that it allows one machine to effectively steal the cryptographic keys of another machine hosted in the same cloud environment. Cutting-edge hack gives super user status by exploiting DRAM weakness Until now, Rowhammer has been a somewhat clumsy and unpredictable attack tool because it was hard to control exactly where data-corrupting bit flips happened. While previous research demonstrated that it could be used to elevate user privileges and break security sandboxes, most people studying Rowhammer said there was little immediate danger of it being exploited maliciously to hijack the security of computers that use vulnerable chips. The odds of crucial data being stored in a susceptible memory location made such hacks largely a matter of chance that was stacked against the attacker. In effect, Rowhammer was more a glitch than an exploit. Now, computer scientists have developed a significantly more refined Rowhammer technique they call Flip Feng Shui. It manipulates deduplication operations that many cloud hosts use to save memory resources by sharing identical chunks of data used by two or more virtual machines. Just as traditional Feng Shui aims to create alignment or harmony in a home or office, Flip Feng Shui can massage physical memory in a way that causes crypto keys and other sensitive data to be stored in locations known to be susceptible to Rowhammer.' -- source: http://arstechnica.com/security/2016/08/new-attack-steals-private-crypto-ke… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Building a new Tor that can resist next-generation state surveillance
by Peter Reutemann 31 Aug '16

31 Aug '16

'Since Edward Snowden stepped into the limelight from a hotel room in Hong Kong three years ago, use of the Tor anonymity network has grown massively. Journalists and activists have embraced the anonymity the network provides as a way to evade the mass surveillance under which we all now live, while citizens in countries with restrictive Internet censorship, like Turkey or Saudi Arabia, have turned to Tor in order to circumvent national firewalls. Law enforcement has been less enthusiastic, worrying that online anonymity also enables criminal activity. Tor's growth in users has not gone unnoticed, and today the network first dubbed "The Onion Router" is under constant strain from those wishing to identify anonymous Web users. The NSA and GCHQ have been studying Tor for a decade, looking for ways to penetrate online anonymity, at least according to these Snowden docs. In 2014, the US government paid Carnegie Mellon University to run a series of poisoned Tor relays to de-anonymise Tor users. A 2015 research paper outlined an attack effective, under certain circumstances, at decloaking Tor hidden services (now rebranded as "onion services"). Most recently, 110 poisoned Tor hidden service directories were discovered probing .onion sites for vulnerabilities, most likely in an attempt to de-anonymise both the servers and their visitors.' -- source: http://arstechnica.com/security/2016/08/building-a-new-tor-that-withstands-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Hacbook”: Refurbished HP EliteBooks
by Lawrence D'Oliveiro 31 Aug '16

31 Aug '16

For US$329 <http://www.theregister.co.uk/2016/08/30/329_for_a_macbook_well_really_a_hac…>: ““It's optimized to run OS X, but you can install Linux or Windows on it and use it however you want - that's completely up to the user.”

2 1

Cool Linux Command-Line Image Management Hacks
by Peter Reutemann 30 Aug '16

30 Aug '16

"Feh and the identify command are two of the tools I use for viewing and managing images on Linux. They are fast, flexible, and can be stuffed into scripts for automating operations, which is especially valuable when you work with artists or marketing people who have large image galleries to maintain. For me, they are faster and better for managing large numbers of images than graphical image managers, which tend to require too much clicking and poking through nested menus to find what I want, if they even have it." -- source: https://www.linux.com/learn/cool-linux-command-line-image-management-hacks Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Maru OS: Marrying the Phone and the PC
by Peter Reutemann 30 Aug '16

30 Aug '16

"In case you haven't heard of Preetam D’Souza, he is noted in developer circles for exploring how to bring full-blown PC capabilities to smartphones and mobile devices. Maru OS is an operating system that he has created toward that end, and now this interesting platform has gone open source. Have you followed Canonical's efforts to marry computing and smartphone capabilities with its Ubuntu Unity phone OS that can dock into a monitor? Maru OS is in a similar space. Maru marries an Android base on a phone and Debian Linux on the desktop." -- source: http://ostatic.com/blog/maru-os-marrying-the-phone-and-the-pc Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Nougat Arrives on the Raspberry Pi
by Peter Reutemann 30 Aug '16

30 Aug '16

"As we've noted here before, when it comes to top open source stories of the past couple of years, it's clear that one of the biggest is the proliferation of tiny, inexpensive Linux-based computers at some of the smallest form factors ever seen. The diminutive, credit card-sized Raspberry Pi, which has been priced at only $25 and $35, has grabbed most of the headlines in this space. And, just a few months ago, code repositories started appearing online that showed that the Android operating system would be heading for the Pi. Now, Android 7.0 Nougat has been ported to the Pi, which potentially opens up a whole ecosystem of new apps and applications. Google's latest mobile OS is shown running on the $35 Pi in this YouTube video. " -- source: http://ostatic.com/blog/android-nougat-arrives-on-the-raspberry-pi Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researching information on local body candidates
by Roderick Aldridge 30 Aug '16

30 Aug '16

Hi everybody I am researching information on local body election candidates, concentrating on sustainable environmental and social policies. I am particularly interested in the track record of councillors who are standing again. It is proving difficult to extract information from the Waikato Regional Council website, though the Hamilton City Council one is much better. Would anybody like to share their expertise on ferreting information from websites, and for gathering relevant information from public sources on websites, social media and anywhere. Or do you know anybody who ma be willing to share their skills. Any help much appreciated. Rod

4 7

Fedora 24 review: The year’s best Linux distro is puzzlingly hard to recommend
by Peter Reutemann 30 Aug '16

30 Aug '16

"Fedora 24 is very near the best Linux distro release I've used, and certainly the best release I have tested this year. Considering 2016 has welcomed new offerings like Mint 18 and Ubuntu 16.04 LTS, that says a great deal about the Fedora project's latest work. But like many Fedora releases before it, even Fedora 24 got off to a rocky start." -- source: http://arstechnica.com/information-technology/2016/08/fedora-24-review-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0