July 2017 - wlug - list.wlug.org.nz

Let’s Encrypt: Wildcard Certs Coming Soon
by Lawrence D'Oliveiro 07 Jul '17

07 Jul '17

Anybody using Let’s Encrypt? Having recently set it up for a client, I’m really impressed with it. It gives you HTTPS certs for your web servers at no cost, and with very little effort, since the entire process is automated (with authentication via the “ACME” protocol). The certs are only valid for 90 days, to try to minimize potential damage from any compromises, but the renewal process is equally easy to automate. The one service they haven’t offered up to now is certs for wildcard domains (e.g. “*.example.com”). Looks like they will soon have a procedure for this, too <https://arstechnica.com/information-technology/2017/07/lets-encrypt-to-star…>.

2 1

OneDrive Has Stopped Working On Non-NTFS Drives
by Peter Reutemann 07 Jul '17

07 Jul '17

'OneDrive users around the world have been upset to discover that with its latest update, Microsoft's cloud file syncing and storage system no longer works with anything other than disks formatted with the NTFS file system. Both older file systems, such as FAT32 and exFAT, and newer ones, such as ReFS, will now provoke an error message when OneDrive starts up. To continue to use the software, files will have to be stored on an NTFS volume. While FAT disks can be converted, ReFS volumes must be reformatted and wiped. This has left various OneDrive users unhappy. While NTFS is the default file system in Windows, people using SD cards to extend the storage on small laptops and tablets will typically use exFAT. Similarly, people using Storage Spaces to manage large, redundant storage volumes will often use ReFS. The new policy doesn't change anything for most Windows users, but those at the margins will feel hard done by. Microsoft said in a statement that it "discovered a warning message that should have existed was missing when a user attempted to store their OneDrive folder on a non-NTFS filesystem -- which was immediately remedied." According to Ars, Microsoft's position, apparently, is that OneDrive should always have warned about these usage scenarios and that it's only a bug or an oversight that allowed non-NTFS volumes to work.' -- source: https://hardware.slashdot.org/story/17/07/06/2012255 Time to switch to ownCloud! :-) https://owncloud.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WikiLeaks Unveils CIA Implants That Steal SSH Credentials From Windows, Linux PCs
by Peter Reutemann 07 Jul '17

07 Jul '17

'WikiLeaks has today published the 15th batch of its ongoing Vault 7 leak, this time detailing two alleged CIA implants that allowed the agency to intercept and exfiltrate SSH (Secure Shell) credentials from targeted Windows and Linux operating systems using different attack vectors. Secure Shell or SSH is a cryptographic network protocol used for remote login to machines and servers securely over an unsecured network. Dubbed BothanSpy -- implant for Microsoft Windows Xshell client, and Gyrfalcon -- targets the OpenSSH client on various distributions of Linux OS, including CentOS, Debian, RHEL (Red Hat), openSUSE and Ubuntu. Both implants steal user credentials for all active SSH sessions and then sends them to a CIA-controlled server. ' -- source: https://linux.slashdot.org/story/17/07/06/224211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Bugs Are Too Valuable To Report To Apple
by Peter Reutemann 07 Jul '17

07 Jul '17

'Last year, Apple launched a long-awaited bug bounty program to reward friendly hackers who report flaws in the iPhone to the company. Despite inviting some of the best hackers in the world to join, it's a bit of a flop so far. The iPhone's security is so tight that it's hard to find any flaws at all, which leads to sky-high prices for bugs on the grey market. Researchers I spoke to are reluctant to report bugs both because they are so valuable and because reporting some bugs may actually prevent them from doing more research. "People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly." Patrick Wardle, a former NSA hacker who now specializes in MacOS research and was invited to the Apple bug bounty program, agreed. He said that iOS bugs are "too valuable to report to Apple."' -- source: https://apple.slashdot.org/story/17/07/06/1551210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Severe' Systemd Bug Allowed Remote Code Execution For Two Years
by Peter Reutemann 06 Jul '17

06 Jul '17

'A flaw in systemd, the init system used on many Linux systems, can be exploited using a malicious DNS query to either crash a system or to run code remotely. The vulnerability resides in the daemon systemd-resolved and can be triggered using a TCP payload, according to Ubuntu developer Chris Coulson. This component can be tricked into allocating less memory than needed for a look-up. When the reply is bigger it overflows the buffer allowing an attacker to overwrite memory. This would result in the process either crashing or it could allow for code execution remotely. "A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it," is how Coulson put it. Affected Linux vendors have pushed out patches -- but the bug has apparently been present in systemd code since June of 2015. And long-time Slashdot reader walterbyrd also reports a recently-discovered bug where systemd unit files that contain illegal usernames get defaulted to root.' -- source: https://it.slashdot.org/story/17/07/03/0343258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Raspberry Pi's Smaller, Cheaper Rival: NanoPi Neo Plus2 Weighs in at $25
by Peter Reutemann 05 Jul '17

05 Jul '17

'FriendlyARM, the maker of compact NanoPi developer boards, has released the NanoPi Neo Plus2 for $25. From a report: This board is an update to the recently released NanoPi Neo 2, a $15 cookie-sized developer board measuring 40mm x 40mm (1.6in) with a 64-bit Allwinner H5 processor, 512MB RAM, and one USB port. The NanoPi Neo Plus2 is slightly larger at 52mm x 40mm (2in x 1.6in) and has two USB ports. It has the same H5 quad-core A53 ARM Cortex processor, but comes with 1GB RAM and 8GB eMMC storage. The NeoPlus2's storage in addition to Gigabit Ethernet puts it ahead of the Raspberry Pi 3 on paper, and at $25 undercuts the better-known board by $10.' -- source: https://hardware.slashdot.org/story/17/07/05/0211212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Parlatype - A Manual Audio Transcription App for Linux
by Peter Reutemann 05 Jul '17

05 Jul '17

'Parlatype is a minimal GNOME audio player for manual speech transcription. It plays audio sources to transcribe them in your favorite text application. It features a simple themeable GUI with a track timeline (with a waveform view) and clearly visible buttons and a playback speed tuner. It doesn't come with that many settings but then again, remember - it is a simple audio transcriber.' -- source: https://www.fossmint.com/parlatype-a-audio-transcription-tool-for-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lollypop – A New Modern Music Player for Linux
by Peter Reutemann 05 Jul '17

05 Jul '17

'Lollypop is a lightweight modern and material design-inspired music player designed to work excellently on the GNOME desktop environment. It has a focus on an intuitive minimal design which makes it easy to pick it up and begin using right away. It features all the functions you would expect from a music player like browsing and searching through your collection of music files, fetching lyrics and artist biography from the internet, as well as automatically fetching cover arts for music files.' -- source: https://www.fossmint.com/lollypop-a-new-modern-music-player-for-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GnuPG crypto library cracked, look for patches
by Lawrence D'Oliveiro 05 Jul '17

05 Jul '17

What they found is that the libgcrypt library used what's called “sliding windows”, a method for carrying out the mathematics of cryptography – but one that's known to leak data. ... What they found was an unpleasant surprise: a complete break of the library's RSA-1024... <https://www.theregister.co.uk/2017/07/04/gnupg_crypto_library_cracked_look_…> Cue the conspiracy theorists lining up to say “Given the controversy surrounding GnuPG and the way they operate, one just has to wonder "bug or backdoor?"”

2 2

Latte Dock – An Elegant and Intuitive Dock for Your Tasks and Plasmoids
by Peter Reutemann 03 Jul '17

03 Jul '17

'Latte Dock is arguably the best dock app for KDE Plasma especially since the release of its stable version 0.6 in April. It is based on plasma frameworks, that working together to provide users with an elegant and intuitive experience while going about their everyday PC tasks. Latte Dock is unlike some dock apps in the market in the sense that it lets you replace your desktop panels completely. You can use it to run multiple docks on one screen, mimic several panel layouts including that of Unity and Plasma, set animation styles especially using its parabolic zoom effects, and organize Plasmoids.' -- source: https://www.fossmint.com/latte-dock-an-elegant-and-intuitive-dock-for-kde-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0