September 2017 - wlug - list.wlug.org.nz

The Community bash Style Guide
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

A collection of dos and don’ts for writing bash scripts: <https://github.com/azet/community_bash_style_guide>. Some tips are not bash-specific, but are about external commands usable with any shell: e.g. awk, sed, grep, pgrep, xargs. Also some builtins should be available with any POSIX-compliant shell, e.g. getopts, printf. Most surprising bit of information: that someone has written a “ctypes” (foreign-function interface) addon for bash <https://github.com/taviso/ctypes.sh>.

1 0

Yellow Rebrands, Celebrates Turnaround
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

The former Yellow Pages Group is getting over a rough patch by finding new business opportunities: Its work with SMEs, however, was the focus [acting CEO] Linton said, with companies able to use Yellow to set up a basic website, through to advertising, adding on e-commerce solutions, booking widgets and other add-on products for an additional regular cost. Yellow is also one of New Zealand's largest resellers of Google Adwords - helping boost customer profile online. ... “Almost 50 per cent of small businesses have no digital presence so you can't even find them on Google.” <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11922410>

1 0

Free Software, Open Access, And Open Science Groups Join Fight Against EU Copyright Directive's Terrible Ideas
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

>From an item by the always-excellent Glyn Moody <https://www.techdirt.com/articles/20170912/08434938194/free-software-open-a…>: The problem they identified is that widely-used version control systems (VCS) like GitHub seem to meet the definition of "information society services" laid down by the proposed EU Copyright Directive, and as such would be required to filter all uploads to block copyright infringements. Moreover, as the white paper points out, developer Web sites would not only be held responsible for any material uploaded by users without permission of the copyright holders, but would also seem liable for illegitimate distributions of derivative works in violation of the applicable license. At which I can hear groups affiliated with Big Content™ responding “Yeah? So?”. Sites like YouTube are full of user-generated content, too (what is YouTube most famous for showing? Cat videos!), but that hasn’t stopped them being forced into granting special privileges to major film studios and the like <https://www.techdirt.com/search-g.php?num=20&q=youtube+dmca&search=Search>. If software is not the same as videos, pictures or music, why should the same principles of copyright apply to it?

1 0

Backdoor Found In WordPress Plugin With More Than 200, 000 Installations
by Peter Reutemann 14 Sep '17

14 Sep '17

'According to Bleeping Computer, a WordPress plug that goes by the name Display Widgets has been used to install a backdoor on WordPress sites across the internet for the past two and a half months. While the WordPress.org team removed the plugin from the official WordPress Plugins repository, the plugin managed to be installed on more than 200,000 sites at the time of its removal. The good news is that the backdoor code was only found between Display Widgets version 2.6.1 (released June 30) and version 2.6.3 (released September 2), so it's unlikely everyone who installed the plugin is affected. WordPress.org staff members reportedly removed the plugin three times before for similar violations. Bleeping Computer has compiled a history of events in its report, put together with data aggregated from three different investigations by David Law, White Fir Design, and Wordfence. The report adds: The original Display Widgets is a plugin that allowed WordPress site owners to control which, how, and when WordPress widgets appear on their sites. Stephanie Wells of Strategy11 developed the plugin, but after switching her focus to a premium version of the plugin, she decided to sell the open source version to a new developer who would have had the time to cater to its userbase. A month after buying the plugin in May, its new owner released a first new version -- v2.6.0 -- on June 21' -- source: https://it.slashdot.org/story/17/09/13/2152234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software In Use At Animation College
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Seeing their ads in various places prompted me to check out their site. There is a list of software that they use in their Bachelor of Animation degree here <http://www.animationcollege.co.nz/bachelor-of-animation/bachelor-faq/>, but it’s just a table of product logos, no names. Interesting to see one open-source product in that list, namely Audacity. Also note that “GitKraken”, which appears to be a GUI for the Git version-control system. I wonder how they use it in studio workflows? Purely to keep track of a linear sequence of revisions of assets? Because I can’t imagine that branching and merging would work very well with binary (e.g. still-image, audio, video) files. The faux-chemical symbols are all Adobe products, I believe; but I can’t find anything at Adobe’s site that has the “An” logo. My best guess for the product denoted by “xN” is this company <http://www.realityvirtual.co/>. And that purple one that looks like a purple pixelated landslide, I can’t identify at all.

1 0

Hacking Voice Assistant Systems With Inaudible Voice Commands
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Turns out that all the major voice assistants -- Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana and Alexa -- listen at audio frequencies the human ear can't hear. Which means somebody could send commands to your device that you have no idea about. <https://www.schneier.com/blog/archives/2017/09/hacking_voice_a.html>

1 0

AT HOP: Pitfalls In Electronic Transaction Systems
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

There seems to be a subtle issue with topping up the balance on AT HOP cards used by Auckland Transport: you actually have to use the card somewhere within 60 days of the topup, otherwise the deposit will get taken out again. It appears this has to do with the terminals having to be refreshed daily with their own copies of details about valid cards, and these uploads only include active cards. But try explaining that to the customers... <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11921624>

2 1

Researchers Catch Microsoft Zero-Day Used To Install Government Spyware
by Peter Reutemann 13 Sep '17

13 Sep '17

'Government hackers were using a previously-unknown vulnerability in Microsoft's .NET Framework, a development platform for building apps, to hack targets and infect them with spyware, according to security firm FireEye. The firm revealed the espionage campaign on Tuesday, on the same day Microsoft patched the vulnerability. According to FireEye, the bug, which until today was a zero-day, was being used by a customer of FinFisher, a company that sells surveillance and hacking technologies to governments around the world. The hackers sent a malicious Word RTF document to a "Russian speaker," according to Ben Read, FireEye's manager of cyber espionage research. The document was programmed to take advantage of the recently-patched vulnerability to install FinSpy, spyware designed by FinFisher. The spyware masqueraded as an image file called "left.jpg," according to FireEye.' -- source: https://it.slashdot.org/story/17/09/12/2022235 For Windows, there seems to be Detekt (written in Python) which can detect some versions of FinSpy apparently: https://www.kubuntuforums.net/archive/index.php/t-66896.html Maybe we should finally look at demoing some security tools at the next meeting? - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis - ... (other suggestions?) In other words, I'd need volunteers to do a short show and tell. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Only Safe Email is Text-Only Email
by Peter Reutemann 13 Sep '17

13 Sep '17

'Sergey Bratus, Research Associate Professor of Computer Science, Dartmouth College, and Anna Shubina, Post-doctoral Associate in Computer Science, Dartmouth College write: The real issue is that today's web-based email systems are electronic minefields filled with demands and enticements to click and engage in an increasingly responsive and interactive online experience. It's not just Gmail, Yahoo mail and similar services: Desktop-computer-based email programs like Outlook display messages in the same unsafe way. Simply put, safe email is plain-text email -- showing only the plain words of the message exactly as they arrived, without embedded links or images. Webmail is convenient for advertisers (and lets you write good-looking emails with images and nice fonts), but carries with it unnecessary -- and serious -- danger, because a webpage (or an email) can easily show one thing but do another. Returning email to its origins in plain text may seem radical, but it provides radically better security. Even the federal government's top cybersecurity experts have come to the startling, but important, conclusion that any person, organization or government serious about web security should return to plain-text email (PDF).' -- source: https://yro.slashdot.org/story/17/09/12/0436206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BlueBorne Vulnerabilities Impact Over 5 Billion Bluetooth-Enabled Devices
by Peter Reutemann 13 Sep '17

13 Sep '17

'Security researchers have discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. Researchers say the vulnerabilities are undetectable and unstoppable by traditional security solutions. No user interaction is needed for an attacker to use the BleuBorne flaws, nor does the attacker need to pair with a target device. They affect the Bluetooth implementations in Android, iOS, Microsoft, and Linux, impacting almost all Bluetooth device types, from smartphones to laptops, and from IoT devices to smart cars. Furthermore, the vulnerabilities can be concocted into a self-spreading BlueTooth worm that could wreak havoc inside a company's network or even across the world. "These vulnerabilities are the most serious Bluetooth vulnerabilities identified to date," an Armis spokesperson told Bleeping Computer via email. "Previously identified flaws found in Bluetooth were primarily at the protocol level," he added. "These new vulnerabilities are at the implementation level, bypassing the various authentication mechanisms, and enabling a complete takeover of the target device." Consumers are recommended to disable Bluetooth unless you need to use it, but then turn it off immediately. When a patch or update is issued and installed on your device, you should be able to turn Bluetooth back on and leave it on safely. The BlueBorne Android App on the Google Play Store will be able to determine if a user's Android device is vulnerable. A technical report on the BlueBorne flaws is available here (PDF).' -- source: https://mobile.slashdot.org/story/17/09/12/2030213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0