November 2017 - wlug - list.wlug.org.nz

Improve your bash/sh shell script with ShellCheck lint script analysis tool
by Peter Reutemann 07 Nov '17

07 Nov '17

'ShellCheck is a static analysis tool for shell scripts. One can use it to finds bugs in your shell scripts. It is written in Haskell. You can find warnings and suggestions for bash/sh shell scripts with this tool. Let us see how to install and use ShellCheck on a Linux or Unix-like system to enhance your shell scripts, avoid errors and productivity.' -- source: https://www.cyberciti.biz/programming/improve-your-bashsh-shell-script-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Maltese Law Enforcement Trying To Decrypt Slain Journalist’s Phone
by Lawrence D'Oliveiro 06 Nov '17

06 Nov '17

Daphne Caruana Galizia, the journalist recently killed by a car bomb in Malta, used WhatsApp to communicate securely with her sources. It appears part of her smartphone was salvaged from the wreck, and now the police are enlisting the help of the US FBI to see if they can decrypt whatever information can be found on it. Quoth Bruce: “It will be interesting to see if WhatsApp's security survives this.” <https://www.schneier.com/blog/archives/2017/11/daphne_caruana_.html>

1 0

No, the Linux Desktop Hasn't Jumped in Popularity
by Peter Reutemann 06 Nov '17

06 Nov '17

'Stories have been circulating that the Linux desktop had jumped in popularity and was used more than macOS. Alas, it's not so... These reports have been based on NetMarketShare's desktop operating system analysis, which showed Linux leaping from 2.5 percent in July, to almost 5 percent in September. But unfortunately for Linux fans, it's not true... It seems to be merely a mistake. Vince Vizzaccaro, NetMarketShare's executive marketing share of marketing told me, "The Linux share being reported is not correct. We are aware of the issue and are currently looking into it"... For the most accurate, albeit US-centric operating system and browser numbers, I prefer to use data from the federal government's Digital Analytics Program (DAP). Unlike the others, DAP's numbers come from billions of visits over the past 90 days to over 400 US executive branch government domains... DAP gets its raw data from a Google Analytics account. DAP has open-sourced the code, which displays the data on the web and its data-collection code... In the US Analytics site, which summarizes DAP's data, you will find desktop Linux, as usual, hanging out in "other" at 1.5 percent. Windows, as always, is on top with 45.9 percent, followed by Apple iOS, at 25.5 percent, Android at 18.6 percent, and macOS at 8.5 percent. The article does, however, acknowledge that Linux's real market share is probably a little higher simply because "no one, not even DAP, seems to do a good job of pulling out the Linux-based Chrome OS data' -- source: https://linux.slashdot.org/story/17/11/05/202232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Walkthrough Of The Windows Subsystem For Linux
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Here <https://www.youtube.com/watch?v=VSqAyOY5huQ> is a nice intro to the Linux compatibility layer that Microsoft has added to Windows 10. Their app store gives you a choice of Ubuntu or two flavours of SuSE. But while these omit any X server functionality, they do include all the GUI X clients. So it is perfectly possible to install a Windows-native X server, such as the open-source VcXsrv <https://sourceforge.net/projects/vcxsrv/>. And then he uses this to demonstrate running a full XFCE desktop side-by-side with the regular Windows desktop.

1 0

Mozilla Might Distrust Dutch Government Certs Over 'False Keys'
by Peter Reutemann 05 Nov '17

05 Nov '17

'Mozilla engineers are discussing plans to remove support for a state-operated Dutch TLS/HTTPS provider after the Dutch government has voted a new law that grants local authorities the power to intercept Internet communications using "false keys". If the plan is approved, Firefox will not trust certificates issued by the Staat der Nederlanden (State of the Netherlands) Certificate Authority (CA)... This new law gives Dutch authorities the powers to intercept and analyze Internet traffic. While other countries have similar laws, what makes this one special is that authorities will have authorization to carry out covert technical attacks to access encrypted traffic. Such covert technical capabilities include the use of "false keys," as mentioned in Article 45 1.b, a broad term that includes TLS certificates. "Fears arise of mass Dutch Internet surveillance," reads a subhead on the article, citing a bug report which notes, among other things, the potential for man-in-the-middle attacks and the fact that the Netherlands hosts a major internet transit point' -- source: https://tech.slashdot.org/story/17/11/05/1845240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CyberSquirrel1: Tracking Infrastructure Damage Caused By Wildlife
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Interesting Twitter account <https://twitter.com/CyberSquirrel1> including the following item from a couple of days ago: Bird trips power supply to 4000 http://gisborneherald.co.nz/localnews/3069802-135/bird-trips-power-supply-t… … - Te Hapara, New Zealand

1 0

OnionShare – A Tool To Share Any Size Of Files Securely And Anonymously
by Peter Reutemann 05 Nov '17

05 Nov '17

'When we wrote an article about file sharing utilities such as Magic Womhole & transfer.sh most of the users asked is it secure? and where the files are stored. So, we decided to bring one of the best utility that stores and share files securely over the Internet. When we dig on that, we came to know about OnionShare which fulfill all this requirements. How are you saying, it falls under this category? Yes, it’s true because most of us know about Tor Browser which allows users to browse securely, privately and anonymously by implementing Onion routing in the application layer. Onion routing is a technique for anonymous communication over a computer network. OnionShare also developed in the same manner and allows you to use the Tor network to send files anywhere in the world.' -- source: https://www.2daygeek.com/onionshare-secure-way-to-share-files-sharing-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Easy guide to secure VNC server with TLS encryption
by Peter Reutemann 05 Nov '17

05 Nov '17

'In this tutorial, we will learn to install VNC server & secure VNC server sessions with TLS encryption. This method has been tested on CentOS 6 & 7 but should work on other versions/OS as well (RHEL, Scientific Linux etc).' -- source: http://linuxtechlab.com/secure-vnc-server-tls-encryption/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TorMoil Vulnerability Leaks Real IP Address From Tor Browser Users; Security Update Released
by Peter Reutemann 04 Nov '17

04 Nov '17

'The Tor Project has released a security update for the Tor Browser on Mac and Linux to fix a vulnerability that leaks users' real IP addresses. The vulnerability was spotted by Filippo Cavallarin, CEO of We Are Segment, an Italian company specialized in cyber-security and ethical hacking. Cavallarin privately reported the issue -- which he codenamed TorMoil -- to the Tor Project last week. Tor Project developers worked with the Firefox team (Tor Browser is based on the Firefox browser) to release a fix. Today, the Tor team released version 7.0.9 to address the vulnerability. Tor Browser 7.0.9 is only available for Mac and Linux users. Tor Browser on Windows is not affected.' -- source: https://it.slashdot.org/story/17/11/03/2127235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lots Of Digitally-Signed Malware Out There
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

One of the security weaknesses exploited by the “Stuxnet” worm that sabotaged Iran’s nuclear enrichment program was that it had a valid digital signature from a recognized issuer of certificates for Windows software. Of course, the issuer would never knowingly have validated a piece of malware, but the certificate had been compromised so it could be used without their permission. Turns out this sort of thing is not only quite common, there is a further problem in that anti-malware software, which is supposed to pick up revoked certificates and reject signatures that use them, frequently has bugs in their implementation of the signature-checking protocol, so they can let these bad signatures through. <https://arstechnica.com/information-technology/2017/11/evasive-code-signed-…>

1 0