November 2018 - wlug - list.wlug.org.nz

USB Hardware Firewall
by Lawrence D'Oliveiro 14 Nov '18

14 Nov '18

You may know that it is possible for USB devices to be created that do malicious things to your PC by committing deceptions right at the USB protocol level. This kind of thing cannot be defeated by antivirus software or erased by, for example, reformatting a USB stick. For example, a device that is labelled as a USB storage stick could actually identify to the PC as two devices, one the actual storage device and the other a keyboard, that feeds malicious keystrokes at carefully-chosen times. Alternatively, it can detect when the PC is booting, and activate a separate partition containing a virus, which is otherwise invisible to antivirus software, at only that point. More details about such possibilities are available here <https://opensource.srlabs.de/projects/badusb>. Here <https://github.com/robertfisk/USG/wiki> is an interesting project to create a hardware device that will act as a “firewall” for untrusted USB devices, to prevent malicious protocol exchanges from occurring between them and your PC. If you don’t want to build your own, there’s a link in the readme to buy NZ-made ones.

1 0

World’s Top Three Most Powerful Supercomputers Are Non-Intel
by Lawrence D'Oliveiro 13 Nov '18

13 Nov '18

Machines based on IBM’s Power9 architecture have taken the top two spots in the list of the world’s most powerful (publicly-known) supercomputers <https://www.theregister.co.uk/2018/11/13/500_supercomputers_list/>. China’s Sunway TaihuLight machine, which is based on some derivative of MIPS, is in third place, with another Chinese machine, the highest-ranking Intel-based one, coming next. There is also the first ARM-based beastie, built by HP Enterprises, appearing on the list, at number 203.

1 0

Windows 10 Spontaneous Downgrade
by Lawrence D'Oliveiro 08 Nov '18

08 Nov '18

Some users of Windows 10 Pro are discovering that their machines are suddenly claiming to only have a Windows 10 Home licence <https://www.theregister.co.uk/2018/11/08/windows_10_activation/>. This isn’t confined to the “Insider” prereleases, but production releases as well (both upgrades and fresh installs). Seems some Microsoft support staff have confirmed that there is a “temporary issue” with the licence servers, which may take 1-2 days to fix.

2 1

WLinux, the First Paid-for Linux Distro for Windows 10, Goes On Sale on Microsoft Store
by Peter Reutemann 07 Nov '18

07 Nov '18

'WLinux is a $20 open-source, Debian-based distribution, designed to run on Windows 10's Windows Subsystem for Linux (WSL). The WSL allows Windows 10 to run various GNU/Linux distros inside Windows as Microsoft Store apps, providing access to Ubuntu, openSUSE, Debian, Fedora, Kali Linux, and others. The WSL has disadvantages over a running a dedicated GNU/Linux system. For example, there's no official support for desktop environments or graphical applications, and I/O performance bottlenecks, but it is being improved over time. The developers of WLinux describe it as a "fast Linux terminal environment for developers", saying it is the first distribution to be "pre-configured and optimized to run specifically on Windows Subsystem for Linux". Announcing WLinux's availability, Microsoft program manager Tara Raj, called out the wlinux-setup tool, "which allows users to easily set up common developer toolchains, and removes unsupported features like systemd."' -- source: https://linux.slashdot.org/story/18/11/07/1510223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How New, Polite Linus Torvalds Points Out Bad Kernel Code
by Peter Reutemann 06 Nov '18

06 Nov '18

'Linus Torvalds "has shown already for the new Linux 4.20~5.0 cycle he isn't relaxing his standards but is communicating better when it comes to bringing up coding," reports Phoronix, adding "So far it looks like Linus' brief retreat is paying off with still addressing code quality issues -- and not blatantly accepting new code into the kernel as some feared -- but in doing so in a professional manner compared to his past manner of exclaiming himself over capitalized sentences and profanity that at time put him at odds with some in the Linux kernel community." AmiMoJo quotes their report: Last Saturday he took issue with the HID pull request and its introduction of the BigBen game controller driver that was introduced: the developer enabled this new driver by default. Linus Torvalds has always frowned upon random new drivers being enabled by default in the kernel configuration driver. [H]e still voiced his opinion over this driver's default "Y" build configuration, but did so in a more professional manner than he has done in the past: We do *not* enable new random drivers by default. And we most *definitely* don't do it when they are odd-ball ones that most people have never heard of. Yet the new "BigBen Interactive" driver that was added this merge window did exactly that. Just don't do it. Yes, yes, every developer always thinks that _their_ driver is so special and so magically important that it should be enabled by default. But no. When we have thousands of drivers, we don't randomly pick one new driver to be enabled by default just because some developer thinks it is special. It's not.... Please don't do things like this. Phoronix also describes another "kernel oops" testing Torvalds' patience, in which Linus responded tactfully that "What makes me *very* unhappy about this is that if I'm right, I think it means that code was literally not tested at all by anybody who didn't have one of the entries in that list."' -- source: https://linux.slashdot.org/story/18/11/03/1833213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Explicating Neural Networks
by Lawrence D'Oliveiro 06 Nov '18

06 Nov '18

The usual problem with neural nets is, once you have trained them, you have no actual idea why they come to the decisions that they do. One classic example was a net that was being trained to distinguish between pictures of huskies and wolves, where it turned out it was actually assigning the highest weight to the area of snow in the background of the pictures. Enter LIME, which is a Python-based toolkit that tries to analyze the trained net to show you how each part of the dataset is being interpreted <https://www.theregister.co.uk/2018/11/05/hands_on_with_lime/>. The article shows example pictures where areas are colour-coded green or red to indicate whether they make a positive or negative contribution to a particular classification decision. This way, you can spot if any parts that should be ignored are being given an anomalously high weight. Or vice versa.

1 0

Microsoft Microsoft Working on Porting Sysinternals To Linux
by Peter Reutemann 05 Nov '18

05 Nov '18

'A Microsoft exec has confirmed yesterday that the company's engineers are working on porting the highly popular Sysinternals software package to Linux. Microsoft engineers have already ported the ProcDump utility and are currently working on porting ProcMon as well. More tools to follow. Microsoft's decision to port this highly popular debugging utility to Linux comes after two months ago, in September, Scott Guthrie, Microsoft's executive vice president of the cloud and enterprise group, revealed that "sometimes slightly over half of Azure VMs are Linux." With Linux's growing adoption as the preferred OS for running Azure VMs, it's only natural that Azure engineers are now looking into porting their favorite debugging utilities to Linux, for both themselves but also for the company's customers.' -- source: https://linux.slashdot.org/story/18/11/05/157226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaws in Self-Encrypting SSDs Let Attackers Bypass Disk Encryption
by Peter Reutemann 05 Nov '18

05 Nov '18

'Researchers have found flaws that can be exploited to bypass hardware encryption in well known and popular SSD drives. Master passwords and faulty standards implementations allow attackers access to encrypted data without needing to know the user-chosen password. SSDs from Micron (Crucial) and Samsung are affected. These are SSDs that support hardware-level encryption via a local built-in chip, separate from the main CPU. Some of these devices have a factory-set master password that bypasses the user-set password, while other SSDs store the encryption key on the hard drive, from where it can be retrieved. The issue is worse on Windows, where BitLocker defers software-level encryption to hardware encryption-capable SSDs, meaning user data is vulnerable to attacks without the user's knowledge. More in the research paper.' -- source: https://it.slashdot.org/story/18/11/05/213255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot poll: What do you make of programming languages and open source organizations adopting a code of conduct?
by Peter Reutemann 05 Nov '18

05 Nov '18

See this link for poll: https://slashdot.org/poll/3103 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Old School 'Sniffing' Attacks Can Still Reveal Your Browsing History
by Peter Reutemann 04 Nov '18

04 Nov '18

'Most modern browsers -- such as Chrome, Firefox, and Edge, and even browsers such as FuzzyFox and DeterFox (different, security-focused versions of Firefox) -- have vulnerabilities that allow hosts of malicious websites to extract hundreds to thousands of URLs in a user's web history, per new research from the University of California San Diego. What's worse, the vulnerabilities are built into the way they structure links, meaning that major structural changes will have to take place in these browsers in order to protect user privacy. The only browser that was immune to the attacks was Tor Browser, as the browser does not keep track of a user's internet history. The vulnerabilities have to do with why, for instance, unclicked links appear blue while visited links appear violet: there's a different set of rules and style that apply to links depending on whether they've been visited or not. However, a bad actor building a web page can manipulate this faster loading time for visited links by "sniffing," or inferting your browsing history. In essence, sniffing is finding and exploiting proxies that reveal your web history. As outlined in the UC San Diego report, this sniffing could happen in a couple of ways: they could force the browser to reload multiple complex images or image transformations that differ based on whether you've visited a link or not, which would create drastic differences in the loading time for each. With this strategy, actors can test 60 sensitive URLs per second. Bad actors could exploit a "bytecode cache," which speeds up the loading time for revisiting a link that you've already visited. "By embedding a special script in a web page, the actor can test how long it takes for a web page to load and infer whether you've visited it or not," reports Motherboard. "Actors can probe 3,000 URLs per second with this method. When the vulnerability was reported to Google, the company marked the issue as "security-sensitive" but "low-priority."' -- source: https://it.slashdot.org/story/18/11/04/0426252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs fall to new hyperthreading exploit that pilfers crypto keys
by Peter Reutemann 04 Nov '18

04 Nov '18

'Over the past 11 months, the processors running our computers, and in some cases phones, have succumbed to a host of attacks. Bearing names such as Meltdown and Spectre, BranchScope, TLBleed, and Foreshadow, the exploits threaten to siphon some of our most sensitive secrets—say passwords or cryptographic keys—out of the silicon microarchitecture in ways that can’t be detected or stopped by traditional security defenses. On Friday, researchers disclosed yet another leak that has already been shown to exist on a wide range of Intel chips and may also affect other makers, too. PortSmash, as the new attack is being called, exploits a largely overlooked side-channel in Intel’s hyperthreading technology. A proprietary implementation of simultaneous multithreading, hyperthreading reduces the amount of time needed to carry out parallel computing tasks, in which large numbers of calculations or executions are carried out simultaneously. The performance boost is the result of two logical processor cores sharing the hardware of a single physical processor. The added logical cores make it easier to divide large tasks into smaller ones that can be completed more quickly.' -- source: https://arstechnica.com/information-technology/2018/11/intel-cpus-fall-to-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Paper Books Still Legal?
by Lawrence D'Oliveiro 04 Nov '18

04 Nov '18

But how do they charge you the streaming fees? <http://www.dieselsweeties.com/ics/500/>

1 0

Booting a Raspberry-Pi 3B without using a SD-Card
by Ian Stewart 02 Nov '18

02 Nov '18

Hi, If you have a Raspberry Pi Model 3B, then you may be able use it with no micro SD-Card and have it boot Raspbian off a USB flash drive stick. I have found this possible with an Apacer AH356 64GB USB 3.1 Flash Drive<https://www.pbtech.co.nz/product/MEMAPC11464/Apacer-AH356-64GB-USB-31-Flash…> stick that I bought from PB-Tech a couple of weeks ago for $21.85. Admittedly you can buy a micro SD-card like the Apacer 64GB microSDXC UHS-I Class10<https://www.pbtech.co.nz/product/MEMAPC81064/Apacer-64GB-microSDXC-UHS-I-Cl…> from PB-Tech for $28.75 and put Raspbian onto it. So using the USB flash drive stick only saves a few dollars. However, there may be other advantages over using a USB flash drive vs. a micro SD-Card for the Raspbian OS. For example, you can shutdown the Raspberry Pi and remove the USB stick, take it to another computer, and backup your data. I also installed the Raspbian distro onto WD Elements Portable 2TB 2.5" USB 3.0 External HDD<https://www.pbtech.co.nz/product/HDDWDX2621/WD-Elements-Portable-2TB-25-USB…> which PB-Tech sell for $129. The R-Pi (with no SD-Card) would not boot this drive. Possibly because the USB drive is too slow to initialize after power on??? I also found that the R-Pi would not boot up Raspbian on an old 8GB Kingston USB flash drive. Maybe its too slow to initialize??? All the above tests were done using the current latest Raspbian release which is dated 2018_10_09. FYI: Below are details on how to install the Raspbian distro image onto a USB flash drive stick. cheers, Ian. Installing the Raspbian distro onto USB flash drive... Download the latest 1.4GB Raspbian distribution file: 2018-10-09-raspbian-stretch.zip Unzip the file to create a 4.1GB image file: 2018-10-09-raspbian-stretch.img Copy the 4.1GB image to a USB flash drive stick... $ sudo dd bs=4M if=2018-10-09-raspbian-stretch.img of=/dev/sdX status=progress conv=fsync Note: For the device /dev/sdX replace the X with the drive letter of your USB flash drive stick. e.g. /dev/sdc Insert the USB flash drive stick into the R-Pi model 3B. Remove any SD-Card that may be installed in the Raspberry Pi. Power on the R-Pi. After about 10 seconds the colourful POST display will appear, and the USB stick will commence its first boot. It will detect that it is a 4.1GB partition, expand to being a partition that fills the whole of the USB flash drive stick and reboot. The second reboot will be slow and takes about one minute. I assume it is expanding the squashed file system??? Subsequent reboots are faster.

3 6

Blockchain For International Trade
by Lawrence D'Oliveiro 01 Nov '18

01 Nov '18

ASB is close to offering a general blockchain-based service for international trading payments, starting with this <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121526…>: ... the transaction was a landmark because the blockchain-based service meant digital payment and paperwork for the deal were wrapped up in an hour - compared to the two to four days it would take to process using more traditional means. Also: Trade is currently paperwork-heavy, Beehre says, making it susceptible to fraud or human error. Which is odd, because isn’t it precisely the point of all that paperwork to reduce the chance of fraud or human error? However: ... blockchain also appealed because of[sic] the technology was created to be unhackable. Every time I hear the word “unhackable”, I reach for my ... never mind.

1 0