May 2017 - wlug - list.wlug.org.nz

Re: [wlug] The hijacking flaw that lurked in Intel chips is worse than anyone thought
by rowan schischka 09 May '17

09 May '17

I went through Intel's press release and document on how to detect the exploit. https://downloadmirror.intel.com/26754/eng/Intel-SA-00075%20Mitigation%20Gu… Intel says this to detect: netstat -na | findstr "\<16993\> \<16992\> \<16994\> \<16995\> \<623\> \<664\>" Is that all we can do? just scan for port numbers and throw them into our firewalls?

1 0

Google’s “Fuchsia” smartphone OS dumps Linux, has a wild new UI
by Peter Reutemann 09 May '17

09 May '17

'Google, never one to compete in a market with a single product, is apparently hard at work on a third operating system after Android and Chrome OS. This one is an open source, real-time OS called "Fuchsia." The OS first popped up in August last year, but back then it was just a command line. Now the mysterious project has a crazy new UI we can look at, so let's dive in. Unlike Android and Chrome OS, Fuchsia is not based on Linux—it uses a new, Google-developed microkernel called "Magenta." With Fuchsia, Google would not only be dumping the Linux kernel, but also the GPL: the OS is licensed under a mix of BSD 3 clause, MIT, and Apache 2.0. Dumping Linux might come as a bit of a shock, but the Android ecosystem seems to have no desire to keep up with upstream Linux releases. Even the Google Pixel is still stuck on Linux Kernel 3.18, which was first released at the end of 2014.' -- source: https://arstechnica.com/gadgets/2017/05/googles-fuchsia-smartphone-os-dumps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Psychology Today Sees Richard Stallman
by Peter Reutemann 08 May '17

08 May '17

'After our article about Richard Stallman's new video interview, Slashdot reader silverjacket shared this recent profile from Psychology Today that describes Richard Stallman's quest "to save us from a web of spyware -- and from ourselves." By using proprietary software, Stallman believes, we are forfeiting control of our computers, and thus of our digital lives. In his denunciation of all nonfree software as inherently abusive and unethical, he has alienated many possible allies and followers. But he is not here to make friends. He is here to save us from a software industry he considers predatory in ways we've yet to recognize... for Stallman, moralism is the whole point. If you write or use free software only for practical reasons, you'll stop when it's inconvenient, and freedom will disappear. Stallman collaborator Eben Moglen -- a law professor at Columbia, as well as the FSF's general counsel -- assesses Stallman's legacy by saying "the idea of copyleft and the proposition that social and political freedom can't happen in a society without technological freedom -- those are his long-term meanings. And humanity will be aware of those meanings for centuries, whatever it does about them." The article also includes quotes from Linus Torvalds and Eric S. Raymond -- along with some great artwork. In addition to insisting the reporter refer to Linux as "GNU/Linux," Stallman also required that the article describe free software without using the term open source, a phrase he sees as "a way that people who disagree with me try to cause the ethical issues to be forgotten." And he ultimately got Psychology Today to tell its readers that "Nearly all the software on our phones and computers, as well as on other machines, is nonfree or 'proprietary' software and is riddled with spyware and back doors installed by Apple, Google, Microsoft, and the like."' -- source: https://news.slashdot.org/story/17/05/06/0258204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The hijacking flaw that lurked in Intel chips is worse than anyone thought
by Peter Reutemann 08 May '17

08 May '17

'A remote hijacking flaw that lurked in Intel chips for seven years was more severe than many people imagined, because it allowed hackers to remotely gain administrative control over huge fleets of computers without entering a password. This is according to technical analyses published Friday. As Ars reported Monday, the authentication bypass vulnerability resides in a feature known as Active Management Technology. AMT, as it's usually called, allows system administrators to perform a variety of powerful tasks over a remote connection. Among the capabilities: changing the code that boots up computers, accessing the computer's mouse, keyboard, and monitor, loading and executing programs, and remotely powering on computers that are turned off. In short, AMT makes it possible to log into a computer and exercise the same control enjoyed by administrators with physical access. AMT, which is available with many vPro processors, was set up to require a password before it could be remotely accessed over a Web browser interface. But, remarkably, that authentication mechanism can be bypassed by entering any text string—or no text at all. According to a blog post published Friday by Tenable Network Security, the cryptographic hash that the interface's digest access authentication requires to verify someone is authorized to log in can be anything at all, including no string at all.' -- source: https://arstechnica.com/security/2017/05/the-hijacking-flaw-that-lurked-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Debian 8.8 Released
by Peter Reutemann 07 May '17

07 May '17

'The Debian Project announced today Debian GNU/Linux 8.8, the most advanced stable version of the Jessie series, which brings corrections for numerous packages and various security flaws discovered and patched since the release of the Debian GNU/Linux 8.7 maintenance update back in mid-January 2017... "This update mainly adds corrections for security problems to the stable release, along with a few adjustments for serious problems. Security advisories were already published separately and are referenced where available," reads today's announcement. "Please note that this update does not constitute a new version of Debian 8 but only updates some of the packages included. There is no need to throw away old 'jessie' CDs or DVDs but only to update via an up-to-date Debian mirror after an installation, to cause any out of date packages to be updated." Debian 8.8 contains more than 150 bug fixes and security updates.' -- source: https://linux.slashdot.org/story/17/05/06/2243254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Docs phishing problem
by Ian Young 05 May '17

05 May '17

As seen in an ITP weekly update. Spear phishing This one will definitely leave a mark and I suspect we'll be seeing waves from it for years to come. Google Docs have become a default mechanism for sharing and collaborating on single documents. For those of you not in the realm of writing stuff for a living, you possibly don't know about the special circle of hell reserved for those who don't track changes or for the group email that results in 50 different versions of the same document that need to be subsumed into one. Google Docs has meant everyone can work on the one piece at the same time and when they've exhausted their pedantic nit-picking about fonts, Oxford commas or whether Kiwi needs to be upper or lower case (upper case for New Zealanders, lower case for the bird or the dollar) then you can simply print it off and be done. Now some bugger has gone and ruined it for all by releasing a nasty phishing attack which sends out a spam inviting you to edit a Google Doc, then raiding your contacts and spamming all of them with the same message. By now it will have more email addresses than there are grains of sand on Whangapoua beach. Google has rushed out the big guns to take on the phish and says it has managed to shut it down (I haven't seen it at all, so I'm pleased about that) but already the damage will be done. These kinds of attacks simply undermine what makes the internet so useful - the openness of it all. One day soon the whole thing will be locked down (I see the newest version of Windows only allows apps to be installed from Microsoft's own app store) and the value and character that makes the internet what it is will be gone. The Verge - Google Docs users hit with sophisticated phishing attack Wired - Don't Open That Google Doc Unless You're Positive It's Legit CNN - Major phishing attack targets Google Docs users

1 0

Google Releases DIY Open Source Raspberry Pi Voice Kit Hardware
by Peter Reutemann 05 May '17

05 May '17

'Google has decided to take artificial intelligence to the maker community with a new initiative called AIY. This initiative will introduce open source AI projects to the public that makers can leverage in a simple way. Today, Google announces the first-ever AIY project. Called "Voice Kit," it is designed to work with a Raspberry Pi 3 Model B to create a voice-based virtual assistant. Billy Rutledge, Director of AIY Projects for Google, explains, "The first open source reference project is the Voice Kit: instructions to build a Voice User Interface (VUI) that can use cloud services (like the new Google Assistant SDK or Cloud Speech API) or run completely on-device. This project extends the functionality of the most popular single board computer used for digital making -- the Raspberry Pi. The included Voice Hardware Accessory on Top (HAT) contains hardware for audio capture and playback: easy-to-use connectors for the dual mic daughter board and speaker, GPIO pins to connect low-voltage components like micro-servos and sensors, and an optional barrel connector for dedicated power supply. It was designed and tested with the Raspberry Pi 3 Model B."' -- source: https://hardware.slashdot.org/story/17/05/04/208240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No More FTP At Debian
by Peter Reutemann 04 May '17

04 May '17

'It looks like anonymous FTP is officially on its way out. While many public repositories have deprecated it in favor of HTTP, I was rather surprised to see Debian completely drop it on their public site. In a blog post, the team cited the FTP's lack of support for caching or acceleration, and declining usage as some of the reasons for their decision.' -- source: https://tech.slashdot.org/story/17/05/04/1731227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distro Count
by Lawrence D'Oliveiro 03 May '17

03 May '17

I can remember reports from several years ago that distrowatch.com was tracking about 350 different Linux distros. Curious to know what the situation is like now, I went to their home page a few minutes ago, and counted the number of “<option ...>” entries in the “Select Distribution” popup menu at the top, and got 290. This figure also includes a few non-Linux OSes. But even so, I think it’s fair to say the sheer variety of Linux distros has scarcely abated over the last decade.

1 0

Linux Kernel 4.11 Officially Released
by Peter Reutemann 02 May '17

02 May '17

'Linux kernel 4.11 has been in development for the past two months, since very early March, when the first Release Candidate arrived for public testing. Eight RCs later, we're now able to download and compile the final release of Linux 4.11 on our favorite GNU/Linux distributions and enjoy its new features. Prominent ones include scalable swapping for SSDs, a brand new perf ftrace tool, support for OPAL drives, support for the SMC-R (Shared Memory Communications-RDMA) protocol, journalling support for MD RAID5, all new statx() system call to replace stat(2), and persistent scrollback buffers for VGA consoles... The Linux 4.11 kernel also introduces initial support for Intel Gemini Lake chips, which is an Atom-based, low-cost computer processor family developed using Intel's 14-nanometer technology, and better power management for AMD Radeon GPUs when the AMDGPU open-source graphics driver is used.' -- source: https://linux.slashdot.org/story/17/05/01/0534253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0