July 2017 - wlug - list.wlug.org.nz

'Devil's Ivy' Is Another Wake-Up Call for IoT Security
by Peter Reutemann 26 Jul '17

26 Jul '17

'The vulnerability -- called Devil's Ivy or CVE-2017-9765 -- was made public last week by Senrio, a company that specializes in IoT security. It initially found the bug in the M3004 model security camera marketed by Axis Communications, but further research found that 249 of Axis's 251 surveillance camera models are affected. Although that's of lot of devices, it's only the tip of the iceberg, as the problem isn't with code that's native to Axis products but is in gSOAP, an open source web services library that's used by many developers. Media outlets are reporting that 34 companies use gSOAP -- a list that includes Microsoft, IBM, Xerox and Adobe.' -- source: http://windowsitpro.com/internet-things-iot/devils-ivy-another-wake-call-io… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using Gnome Disk Utility - "Disks" - to install distro iso to USB stick.
by Ian Stewart 24 Jul '17

24 Jul '17

Hi, I mentioned this at last nights meeting, so here is the link info. You might be used to burning distro iso image files to USB sticks using the dd command line utility, or Ubuntu's Startup Disk Creator gui application. The Fedora 21 Installation Guide<https://docs.fedoraproject.org/en-US/Fedora/21/html/Installation_Guide/inde…> describes another way<https://docs.fedoraproject.org/en-US/Fedora/21/html/Installation_Guide/sect…>. You launch the Gnome Disk Utility by clicking on the Disks application icon, or from the command line as gnome-disks, and follow these instructions... Procedure 3.4. Creating USB media with GNOME Disks 1. On a system with GNOME, or with the gnome-disk-utility package installed, open Disks using the system menu. 2. Click your USB device in the left column. 3. Click the menu icon in the upper right corner of the window, and choose the Restore Disk Image option. 4. Navigate to your image file and click Start Restoring. After a few minutes, it will report the process is complete and your installation media will be ready to use. cheers, Ian.

2 1

How a VC-Funded Company Is Undermining the Open-Source Community
by Peter Reutemann 24 Jul '17

24 Jul '17

'Is a $4 million venture capital-funded startup stealthily taking over popular coding tools and injecting ads and spyware into them? That's what some programmers fear may be happening. It is one of the most troubling scandals to hit the open-source community -- a robust network of programmers who work on shared tools for free -- in recent memory. It started back in April, when a programmer noticed a strange change to an open-source tool called Minimap. Minimap has had more than 3.5 million downloads, but like many open-source tools, it was maintained by a single person who no one knew much about other than their username: @abe33. At some point, @abe33, whose real name is Cedric Nehemie, was hired by Kite. Kite was started by Adam Smith, a successful tech entrepreneur who raised funding from a slew of big names including the CEO of Dropbox and the creator of WordPress. It is unclear what Kite's business model is, but it says it uses machine-learning techniques to make coding tools. Its tools are not open source. After being hired by Kite, @abe33 made an update to Minimap. The update was titled "Implement Kite promotion," and it appeared to look at a user's code and insert links to related pages on Kite's website. Kite called this a useful feature. Programmers said it was not useful and was therefore just an ad for an unrelated service, something many programmers would consider a violation of the open-source spirit. "It's not a feature, it's advertising -- and people don't want it, you want it," wrote user @p-e-w. "The least you can do is own up to that." "I have to wonder if your goal was to upset enough people that you'd generate real attention on various news sites and get Kite a ton of free publicity before your next funding round," @DevOpsJohn wrote. "That's the only sane explanation I can find for suddenly dropping ads into the core of one of the oldest and most useful Atom plugins." [...] Although Kite has no business model yet, it's widely thought in Silicon Valley that having users is the first step toward profitability. Adding users potentially benefits the company in another way, by giving it access to precious data. Kite says it uses machine learning tactics to make the best coding helper tools possible. In order to do that, it needs tons of data to learn from. The more code it can look at, the better its autocomplete suggestions will get, for example.' -- source: https://developers.slashdot.org/story/17/07/24/0118202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DNS Lib Underscore Bug Bites Everyone's Favorite Init Tool, Blanks Netflix
by Peter Reutemann 24 Jul '17

24 Jul '17

'Systemd doing what it does best. From a report on The Register: A few Penguinistas spent a weekend working out why they can't get through to Netflix from their Linux machines, because when they tried, their DNS lookups failed. The issue emerged over the weekend, when Gentoo user Dennis Schridde submitted a bug report to the Systemd project. Essentially, he described a failure within systemd-resolve, a Systemd component that turns human-readable domain names into IP addresses for software, like web browsers, to connect to. The Systemd resolver couldn't look up Netflix's servers for Schridde's web browser, according to the report. In his detailed post, Schridde said he expected this to happen: ipv6_1-cxl0-c088.1.lhr004.ix.nflxvideo.net gets resolved to 37.77.187.142 or 2a00:86c0:5:5::142. When in reality, that wasn't happening, so Netflix couldn't be reached on his box. His speculation that libidn2, which adds internationalised domain names support to the resolver, was at fault turned out to be accurate. Rebuilding Systemd without that library cleared the problem.' -- source: https://linux.slashdot.org/story/17/07/24/1558259 Please, no flame war... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mysterious Mac Malware Has Infected Hundreds of Victims For Years
by Peter Reutemann 24 Jul '17

24 Jul '17

'A mysterious piece of malware has been infecting hundreds of Mac computers for years -- and no one noticed until a few months ago. The malware is called "FruitFly," and one of its variants, "FruitFly 2" has infected at least 400 victims over the years. FruitFly 2 is intriguing and mysterious: its goals, who's behind it, and how it infects victims, are all unknown. Earlier this year, an ex-NSA hacker started looking into a piece of malware he described to me as "unique" and "intriguing." It was a slightly different strain of a malware discovered on four computers earlier this year by security firm Malwarebytes, known as "FruitFly." This first strain had researchers scratching their heads. On the surface, the malware seemed "simplistic." It was programmed mainly to surreptitiously monitor victims through their webcams, capture their screens, and log keystrokes. But, strangely, it went undetected since at least 2015. There was no indication of who could be behind it, and it contained "ancient" functions and "rudimentary" remote control capabilities, Malwarebytes's Thomas Reed wrote at the time.' -- source: https://it.slashdot.org/story/17/07/24/1719255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's New Open Source Voice-Recognition Project Wants Your Voice
by Peter Reutemann 23 Jul '17

23 Jul '17

'Mozilla is building a massive repository of voice recordings for the voice apps of the future -- and it wants you to add yours to the collection. The organization behind the Firefox browser is launching Common Voice, a project to crowdsource audio samples from the public. The goal is to collect about 10,000 hours of audio in various accents and make it publicly available for everyone... Mozilla hopes to hand over the public dataset to independent developers so they can harness the crowdsourced audio to build the next generation of voice-powered apps and speech-to-text programs... You can also help train the speech-to-text capabilities by validating the recordings already submitted to the project. Just listen to a short clip, and report back if text on the screen matches what you heard... Mozilla says it aims is to expand the tech beyond just a standard voice recognition experience, including multiple accents, demographics and eventually languages for more accessible programs. Past open source voice-recognition projects have included Sphinx 4 and VoxForge, but unfortunately most of today's systems are still "locked up behind proprietary code at various companies, such as Amazon, Apple, and Microsoft."' -- source: https://news.slashdot.org/story/17/07/22/2026208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian, Gnome Patched 'Bad Taste' VBScript-Injection Vulnerabilities
by Peter Reutemann 23 Jul '17

23 Jul '17

'A now-patched vulnerability in the "GNOME Files" file manager was recently discovered which allowed hackers to create dodgy MSI files which would run malicious VBScript code on Linux... Once Nils Dagsson Moskopp discovered the bug, he reported it to the Debian Project which fixed it very rapidly. The GNOME Project also patched the gnome-exe-thumbnailer file which is responsible for parsing MSI and EXE files inside the GNOME Files app... If you run a Linux distribution with the GNOME desktop it's advisable to run the update manager and check for updates as soon as possible before you become affected by this critical vulnerability.' -- source: https://tech.slashdot.org/story/17/07/22/1911237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 'Stretch' Updated With 9.1 Release
by Peter Reutemann 23 Jul '17

23 Jul '17

'The Debian project is pleased to announce the first update of its stable distribution Debian 9 (codename "stretch"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems... Please note that the point release does not constitute a new version of Debian 9 but only updates some of the packages included. There is no need to throw away old "stretch" media... Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release.' -- source: https://linux.slashdot.org/story/17/07/23/1930253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next week?
by Peter Reutemann 22 Jul '17

22 Jul '17

Hi everyone We don't have any topics lined up yet for next Monday's meeting. Any ideas? A new Fedora release (https://getfedora.org/) is out - give it a spin? Maybe an introduction on how to use man pages efficiently? For commands and programming? Introduction to useful basic commands: ls, cat/tac/zcat, less, column, grep, find, sort, sed, ... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

next lug meet -fedora 26
by Ian Young 22 Jul '17

22 Jul '17

I will bring a live version of Fedora 26 if there is time available at the meeting ~ Ian Y

2 1