October 2018 - wlug - list.wlug.org.nz

After $5 billion EU antitrust fine, Google will start charging for Android apps
by Peter Reutemann 17 Oct '18

17 Oct '18

'Google is adjusting to life in the EU after the $5.05 billion (€4.34 billion) antitrust fine levied against it by the European Commission earlier this year. Google is still appealing the initial ruling, which found that Google used Android to illegally dominate the search market, but for now Google will comply with the ruling and offer looser licensing agreements to Android device makers. In a post on the official Google Blog titled "Complying with the EC’s Android decision," Google outlined a few changes coming to the Google app licensing agreements that it offers to Android OEMs. As you might recall from the numerous times we've written about it, this announcement is a change to the secretive "Mobile Application Distribution Agreement" (MADA) document that is a requirement for getting access to the Play Store and other Google apps. What we think of as a commercial "Android" device comes in two parts. The core Android OS is free and open source—anyone can take it and do whatever they want with it without Google's involvement. If you want the Play Store, Google Maps, Gmail, and all the other Google apps you need to make a viable commercial smartphone, though, you need to talk to Google and sign a MADA, which comes with a ton of restrictions. Google's new MADA makes three big changes. First, Google's blog states "Android partners wishing to distribute Google apps may also build non-compatible, or forked, smartphones and tablets for the European Economic Area (EEA)." [...] Google says it will also unbundle Search and Chrome from the rest of the Google apps. [...] The last change is definitely a shocker. Breaking up Google's licensing agreement is going to have a financial impact on OEMs. As Google puts it, "Since the pre-installation of Google Search and Chrome together with our other apps helped us fund the development and free distribution of Android, we will introduce a new paid licensing agreement for smartphones and tablets shipped into the EEA." That's right, OEMs now have to pay to access the Google apps, but Google doesn't say how much. The core Android OS, Google says "will remain free and open source." [...]' -- source: https://arstechnica.com/gadgets/2018/10/google-to-charge-oems-for-android-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher Finds Simple Way of Backdooring Windows PCs and Nobody Notices for Ten Months
by Peter Reutemann 17 Oct '18

17 Oct '18

' A security researcher from Colombia has found a way of gaining admin rights and boot persistence on Windows PCs that's simple to execute and hard to stop -- all the features that hackers and malware authors are looking for from an exploitation technique. From a report: What's more surprising, is that the technique was first detailed way back in December 2017, but despite its numerous benefits and ease of exploitation, it has not received either media coverage nor has it been seen employed in malware campaigns. Discovered by Sebastian Castro, a security researcher for CSL, the technique targets one of the parameters of Windows user accounts known as the Relative Identifier (RID). The RID is a code added at the end of account security identifiers (SIDs) that describes that user's permissions group. There are several RIDs available, but the most common ones are 501 for the standard guest account, and 500 for admin accounts. Castro, with help from CSL CEO Pedro Garcia, discovered that by tinkering with registry keys that store information about each Windows account, he could modify the RID associated with a specific account and grant it a different RID, for another account group. The technique does not allow a hacker to remotely infect a computer unless that computer has been foolishly left exposed on the Internet without a password. But in cases where a hacker has a foothold on a system -- via either malware or by brute-forcing an account with a weak password -- the hacker can give admin permissions to a compromised low-level account, and gain a permanent backdoor with full SYSTEM access on a Windows PC.' -- source: https://it.slashdot.org/story/18/10/17/1849255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Former Top Waymo Engineer Altered Code To Go on 'Forbidden Routes', Report Says
by Peter Reutemann 17 Oct '18

17 Oct '18

'In the early days of what ultimately became Waymo, Google's self-driving car division (known at the time as "Project Chauffeur"), there were "more than a dozen accidents, at least three of which were serious," according to a new article in The New Yorker . From a report: The magazine profiled Anthony Levandowski, the former Google engineer who was at the center of the Waymo v. Uber trade secrets lawsuit. According to the article, back in 2011, Levandowski also modified the autonomous software to take the prototype Priuses on "otherwise forbidden routes." Citing an anonymous source, The New Yorker reports that Levandowski sat behind the wheel as the safety driver, along with Isaac Taylor, a Google executive. But while they were in the car, the Prius "accidentally boxed in another vehicle," a Camry. As The New Yorker wrote: "A human driver could easily have handled the situation by slowing down and letting the Camry merge into traffic, but Google's software wasn't prepared for this scenario. The cars continued speeding down the freeway side by side. The Camry's driver jerked his car onto the right shoulder. Then, apparently trying to avoid a guard rail, he veered to the left; the Camry pinwheeled across the freeway and into the median. Levandowski, who was acting as the safety driver, swerved hard to avoid colliding with the Camry, causing Taylor to injure his spine so severely that he eventually required multiple surgeries." This was apparently just one of several accidents in Project Chauffeur's early days.' -- source: https://tech.slashdot.org/story/18/10/17/204215 Just another reason why self-driving cars should be open-sourced... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MongoDB Switches Up Its Open-Source License
by Peter Reutemann 17 Oct '18

17 Oct '18

'MongoDB is taking action against cloud giants who are taking its open-source code and offering a hosted commercial version of its database to their users without playing by the open-source rules. The company announced today that it has issued a new software license, the Server Side Public License (SSPL), "that will apply to all new releases of its MongoDB Community Server, as well as all patch fixes for prior versions," reports TechCrunch. From the report: For virtually all regular users who are currently using the community server, nothing changes because the changes to the license don't apply to them. Instead, this is about what MongoDB sees as the misuse of the AGPLv3 license. "MongoDB was previously licensed under the GNU AGPLv3, which meant companies who wanted to run MongoDB as a publicly available service had to open source their software or obtain a commercial license from MongoDB," the company explains. "However, MongoDB's popularity has led some organizations to test the boundaries of the GNU AGPLv3." So while the SSPL isn't all that different from the GNU GPLv3, with all the usual freedoms to use, modify and redistribute the code (and virtually the same language), the SSPL explicitly states that anybody who wants to offer MongoDB as a service -- or really any other software that uses this license -- needs to either get a commercial license or open source the service to give back the community. "The market is increasingly consuming software as a service, creating an incredible opportunity to foster a new wave of great open source server-side software. Unfortunately, once an open source project becomes interesting, it is too easy for cloud vendors who have not developed the software to capture all of the value but contribute nothing back to the community," said Eliot Horowitz, the CTO and co-founder of MongoDB, in a statement. "We have greatly contributed to -- and benefited from -- open source and we are in a unique position to lead on an issue impacting many organizations. We hope this will help inspire more projects and protect open source innovation."' -- source: https://developers.slashdot.org/story/18/10/16/2039253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

libssh 0.8.4 and 0.7.6 security and bugfix release
by Peter Reutemann 16 Oct '18

16 Oct '18

'This is an important security and maintenance release in order to address CVE-2018-10933. libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials. The bug was discovered by Peter Winter-Smith of NCC Group.' -- source: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfi… -- via twitter: https://twitter.com/FioraAeterna/status/1052294419607506944 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So It’s Not Just Me
by Lawrence D'Oliveiro 16 Oct '18

16 Oct '18

Given the number of tech-support scam calls I’ve been getting, I was starting to feel picked on. But it turns out it’s New Zealand as a whole that’s being picked on, with “more than three-quarters” of Kiwis sampled in a Microsoft study reporting that they had been targeted by these scammers <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121434…>. We are also more likely than any other nation (out of the 16 that took part in the survey) to experience fake popup browser notifications. But then, thinking about it, the “global average” of 62% of respondents getting the scam attempts smells rather strongly of sampling bias to me. It’s hard to believe that nearly two-thirds of the entire world population has been getting these calls ...

1 0

Paul Allen Has Died
by Lawrence D'Oliveiro 15 Oct '18

15 Oct '18

The Microsoft co-founder you didn’t hear so much about has lost his decades-long battle with cancer <https://www.aljazeera.com/news/2018/10/microsoft-founder-paul-allen-dies-ag…>. He was a philanthropist who quietly supported many causes with his riches. One of these was the Seattle Living Computer Museum <https://www.youtube.com/watch?v=Jk4J6y37OkY>, which has been working on getting various old classic machines back in working condition.

1 0

Rivals ARM and Intel Make Peace To Secure Internet of Things
by Peter Reutemann 15 Oct '18

15 Oct '18

'Rival semiconductor giants ARM and Intel have agreed to work together to manage networks of connected devices from both firms, clearing a major stumbling block to market growth of the so-called Internet of Things (IoT). From a report: Britain's ARM, a unit of Japan's Softbank, said on Monday it had struck a strategic partnership with Intel to use common standards developed by Intel for managing IoT devices, connections and data. The IoT involves connecting simple chips that detect distance, motion, temperature, pressure and images to be used in an ever wider range of electronics such as lights, parking meters or refrigerators. Some of the world's dumbest electronics devices get smarter by becoming connected into cloud networks, but also harder to protect. ARM's agreement to adopt Intel standards for securely managing such networks marks a breakthrough that promises to drive the spread of IoT across many industries, the two companies said.' -- source: https://it.slashdot.org/story/18/10/15/1338259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Shares Thoughts on Microsoft Joining Open Invention Network's Patent Non-Aggression Pact
by Peter Reutemann 14 Oct '18

14 Oct '18

'Earlier this week, Microsoft announced that it was joining the open-source patent consortium Open Invention Network (OIN). The press release the two shared this week was short on details on how the two organizations intend to work together and what does the move mean to, for instance, the billions of dollars Microsoft earns each year from its Android patents (since Google is a member of OIN, too.) Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software, has weighed in on the subject: While [this week's] announcement is a step forward, we call on Microsoft to make this just the beginning of their efforts to stop their patent aggression efforts against the software freedom community. The OIN patent non-aggression pact is governed by something called the Linux System Definition. This is the most important component of the OIN non-aggression pact, because it's often surprising what is not included in that Definition especially when compared with Microsoft's patent aggression activities. Most importantly, the non-aggression pact only applies to the upstream versions of software, including Linux itself. We know that Microsoft has done patent troll shakedowns in the past on Linux products related to the exfat filesystem. While we at Conservancy were successful in getting the code that implements exfat for Linux released under GPL (by Samsung), that code has not been upstreamed into Linux. So, Microsoft has not included any patents they might hold on exfat into the patent non-aggression pact. We now ask Microsoft, as a sign of good faith and to confirm its intention to end all patent aggression against Linux and its users, to now submit to upstream the exfat code themselves under GPLv2-or-later. This would provide two important protections to Linux users regarding exfat: (a) it would include any patents that read on exfat as part of OIN's non-aggression pact while Microsoft participates in OIN, and (b) it would provide the various benefits that GPLv2-or-later provides regarding patents, including an implied patent license and those protections provided by GPLv2 (and possibly other GPL protections and assurances as well).' -- source: https://yro.slashdot.org/story/18/10/14/2140221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The OS That Did Too Much
by Lawrence D'Oliveiro 13 Oct '18

13 Oct '18

You may have heard of the recent Windows 10 update (now withdrawn) that was causing some users to lose their files. There is an analysis of the problem, reported here <https://www.theregister.co.uk/2018/10/10/microsoft_windows_deletion_bug/>. It was a consequence of a feature known as “Known Folder Redirection”, which it seems only exists because of the drive-letter limitations of Windows. The closest analogue might be Linux mount points or symlinks, only the Windows version is more complicated, in usual Microsoft fashion. One mystery is that the bug was reported by multiple testers months before release, yet it seems their reports were ignored.

1 0