December 2018 - wlug - list.wlug.org.nz

Windows Server 2019 Officially Supports OpenSSH For the First Time
by Peter Reutemann 13 Dec '18

13 Dec '18

'Microsoft said in 2015 that it would build OpenSSH, a set of utilities that allow clients and servers to connect securely, into Windows, while also making contributions to its development. Neowin: Since then, the company has delivered on that promise in recent releases of Windows 10, being introduced as a feature-on-demand in version 1803. However, Windows Server hadn't received the feature until now, at least not in an officially supported way -- Windows Server version 1709 included it as a pre-release feature. But that's finally changed, as Microsoft this week revealed that Windows Server 2019, which was made available (again) in November, includes OpenSSH as a supported feature.' -- source: https://slashdot.org/story/18/12/13/1947257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

In a Test, 3D Model of a Head Was Able To Fool Facial Recognition System of Several Popular Android Smartphones
by Peter Reutemann 13 Dec '18

13 Dec '18

'Forbes magazine tested four of the most popular handsets running Google's operating systems and Apple's iPhone to see how easy it'd be to break into them with a 3D-printed head. All of the Android handsets opened with the fake. Apple's phone, however, was impenetrable. From the report: For our tests, we used my own real-life head to register for facial recognition across five phones. An iPhone X and four Android devices: an LG G7 Linq, a Samsung S9, a Samsung Note 8 and a OnePlus 6. I then held up my fake head to the devices to see if the device would unlock. For all four Android phones, the spoof face was able to open the phone, though with differing degrees of ease. The iPhone X was the only one to never be fooled. There were some disparities between the Android devices' security against the hack. For instance, when first turning on a brand new G7 Linq, LG actually warns the user against turning facial recognition on at all. No surprise then that, on initial testing, the 3D-printed head opened it straightaway. [...] The OnePlus 6 came with neither the warnings of the other Android phones nor the choice of slower but more secure recognition.' -- source: https://apple.slashdot.org/story/18/12/13/1438218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Developers Discuss Dropping x32 Support
by Peter Reutemann 12 Dec '18

12 Dec '18

'It was just several years ago that the open-source ecosystem began supporting the x32 ABI, but already kernel developers are talking of potentially deprecating the support and for it to be ultimately removed.. [...] While the x32 support was plumbed through the Linux landscape, it really hasn't been used much. Kernel developers are now discussing the future of the x32 ABI due to the maintenance cost involved in still supporting this code but with minimal users. Linus Torvalds is in favor of sunsetting x32 and many other upstream contributors in favor of seeing it deprecated and removed.' -- source: https://linux.slashdot.org/story/18/12/12/1336210 More information on x32 ABI: https://en.wikipedia.org/wiki/X32_ABI Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Getting Shown Pregnancy Ads After Child Was Stillborn
by Lawrence D'Oliveiro 12 Dec '18

12 Dec '18

An op-ed on the pitfalls of algorithmically-targeted advertising, originally from the Washington Post <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121760…>: Please, Tech Companies, I implore you: If your algorithms are smart enough to realize that I was pregnant, or that I've given birth, then surely they can be smart enough to realize that my baby died, and advertise to me accordingly - or maybe, just maybe, not at all. Unfortunately, the old adage “if you’re not paying for the product, then you are the product” applies yet again. Notwithstanding a personal reply from a high-up Facebook exec at the end of the above article, don’t expect these algorithms to be “smart enough” to do anything more than maximize advertising revenue. Anything more ends up counting as “unnecessary expenditure”.

2 1

FreeBSD 12 Released
by Peter Reutemann 12 Dec '18

12 Dec '18

'The 12th version of the FreeBSD has been released, bringing support for updated hardware. Some of the highlights include: OpenSSL has been updated to version 1.1.1a (LTS). Unbound has been updated to version 1.8.1, and DANE-TA has been enabled by default. OpenSSH has been updated to version 7.8p1. Additonal capsicum(4) support has been added to sshd(8). Clang, LLVM, LLD, LLDB, compiler-rt and libc++ has been updated to version 6.0.1. The vt(4) Terminus BSD Console font has been updated to version 4.46. The bsdinstall(8) utility now supports UEFI+GELI as an installation option. The VIMAGE kernel configuration option has been enabled by default. The NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations. The netdump(4) driver has been added, providing a facility through which kernel crash dumps can be transmitted to a remote host after a system panic. The vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster. Various improvements to graphics support for current generation hardware. Support for capsicum(4) has been enabled on armv6 and armv7 by default. The UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously. The NFS version 4.1 server has been updated to include pNFS server support. The pf(4) packet filter is now usable within a jail(8) using vnet(9). The bhyve(8) utility has been updated to add NVMe device emulation. The bhyve(8) utility is now able to be run within a jail(8). Various Lua loader(8) improvements. KDE has been updated to version 5.12.' -- source: https://bsd.slashdot.org/story/18/12/12/1510202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Could NZ Get Its Own “Assistance and Access” Law?
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

The ever-perceptive Juha Saarinen gives his commentary <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121750…> on the law recently passed in Australia to compel access to decrypted forms of encrypted communications. Thanks to the new law requiring them to quietly add that backdoor that mustn't be called a backdoor into their code, Aussie developers can no longer be trusted by their international peers. You can't say no when government agencies issue a notice, saying absolutely do not tell your employer about it or you'll cop a hefty punishment. But the law is not supposed to achieve this by introducing “systemic weaknesses” into the encryption. Can you use that as a defence against having to weaken the encryption? Not a chance. The not-so-fine irony is that the Aussie Government is doing the same thing it alleges the Chinese spies would force Huawei to do, and which was considered dangerous enough to ban the telco equipment vendor from national communications networks. This gets pointed out repeatedly about similar discussions in the US, UK etc. But there seems to be a mentality among politicians, law enforcement, spies etc that “we’re the good guys, they’re the bad guys, therefore what we do cannot be classed in the same league as what they do”. Forgetting that what makes us good is that we don’t act like bad guys. And the kicker: The risk now is that other Five-Eyes countries, including New Zealand, follow Australia into making the same monumental mistake. What are the odds?

1 0

New Firefox Suggests Ways To Get More Out of the Web
by Peter Reutemann 11 Dec '18

11 Dec '18

'Starting Tuesday, Firefox will nudge you to try out options designed to make the web more interesting, more useful or more productive. From a report: Mozilla's new Firefox 64 keeps an eye on what you're up to and prompts you to try extensions and features that could help you with that activity, the browser maker said. For example, if you open the same tab lots of times, it could suggest you pin it to your tab strip for easier future access. Other suggestions include installing the Facebook Container extension to curtail the social network's snooping, a Google Translate extension to tap into Google's service, and the Enhancer for YouTube extension to do things like block ads and control playback on Google's video site. The feature could help you customize Firefox more to your liking -- something that could help you stick with the browser in the face of Google Chrome's dominance. And that, in turn, could help Mozilla pursue its push toward a privacy-respecting web that's not just effectively controlled by Chrome.' -- source: https://news.slashdot.org/story/18/12/11/1756217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Super Micro Says Review Found No Malicious Chips in Motherboards
by Peter Reutemann 11 Dec '18

11 Dec '18

'Computer hardware maker Super Micro Computer told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards. >From a report: In a letter to customers, the San Jose, California, company said it was not surprised by the result of the review it commissioned in October after a Bloomberg article reported that spies for the Chinese government had tainted Super Micro equipment to eavesdrop on its clients.' -- source: https://hardware.slashdot.org/story/18/12/11/1410200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Trojan Steals Money From PayPal Accounts Even With 2FA On
by Peter Reutemann 11 Dec '18

11 Dec '18

'ESET researchers have discovered a new Android Trojan using a novel Accessibility-abusing technique that targets the official PayPal app, and is capable of bypassing PayPal's two-factor authentication. A report elaborates: At the time of writing, the malware is masquerading as a battery optimization tool, and is distributed via third-party app stores. After being launched, the malicious app terminates without offering any functionality and hides its icon. This video, courtesy of ESET, demonstrates the process in practice.' -- source: https://it.slashdot.org/story/18/12/11/1722251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Fixes Notepad
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Windows Notepad has never been able to handle any newline convention other than the old DOS/Windows/CP/M one (CR-LF). Now, after so many decades, Microsoft has finally decided to give it “universal newline” capability, so it can handle lines ending in LF-only (Unix/Linux) and CR-only (old MacOS) <http://www.theregister.co.uk/2018/05/08/windows_notepad_unix_macos_line_end…>. Gee, I wonder how many lines of code that took...

2 2