December 2018 - wlug - list.wlug.org.nz

Report: Microsoft is scrapping Edge, switching to just another Chrome clone
by Peter Reutemann 06 Dec '18

06 Dec '18

'Windows Central reports that Microsoft is planning to replace its Edge browser, which uses Microsoft's own EdgeHTML rendering engine and Chakra JavaScript engine, with a new browser built on Chromium, the open source counterpart to Google's Chrome. The new browser has the codename Anaheim. The report is short on details. The easiest thing for Microsoft to do would be to use Chromium's code wholesale—the Blink rendering engine, the V8 JavaScript engine, and the Chrome user interface with the Google Account parts omitted—to produce something that looks, works, and feels almost identical to Chrome. Alternatively, Redmond could use Blink and V8 but wrap them in Edge's user interface (or some derivative thereof), to retain its own appearance. It might even be possible to do something weird, such as use Blink with the Chakra JavaScript engine. We'll have to wait and see.' -- source: https://arstechnica.com/gadgets/2018/12/report-microsoft-is-scrapping-edge-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

White House Cybersecurity Advisor Gets Hacked
by Lawrence D'Oliveiro 05 Dec '18

05 Dec '18

Rudy Giuliani, the White House cybersecurity advisor, has posted a tweet <https://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=12172128> <https://www.techdirt.com/articles/20181205/07205841164/rudy-giulianis-paran…> where he meant to say “... just as the President left for G-20. In July...” Unfortunately he left out the space in “G-20. In”, turning it into “G-20.In”, which Twitter automatically formatted as a link. Someone noticed that the domain name in question was available, and promptly snapped it up and used it to post an anti-Trump message. This has made Mr Giuliani somewhat angry. He has tried to blame Twitter for the slipup, claiming the social media service “allowed someone to invade my text with a disgusting anti-President message”, as though he was not the one who created the link in the first place. Remember, this man has the job of advising the entire executive arm of the US government on keeping people’s computer usage secure. I wonder if he’s figured out how to delete a tweet yet?

1 0

Google Personalizes Search Results Even When You're Logged Out, a DuckDuckGo Study Finds
by Peter Reutemann 05 Dec '18

05 Dec '18

'According to a new study conducted by Google competitor DuckDuckGo, it does not seem possible to avoid personalization when using Google search, even by logging out of your Google account and using the private browsing "incognito" mode. From a report: DuckDuckGo conducted the study in June of this year, at the height of the US midterm election season. It did so with the ostensible goal of confirming whether Google's search results exacerbate ideological bubbles by feeding you only information you've signaled you want to consume via past behavior and the data collected about you. It's not clear whether that question can be reliably answered with these findings, and it's also obvious DuckDuckGo is a biased source with something to gain by pointing out how flawed Google's approach may be. But the study's findings are nonetheless interesting because they highlight just how much variance there are in Google search results, even when controlling for factors like location.' -- source: https://search.slashdot.org/story/18/12/04/1610237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kubernetes' First Major Security Hole Discovered
by Peter Reutemann 05 Dec '18

05 Dec '18

'Kubernetes has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered. And the bug, CVE-2018-1002105, aka the Kubernetes privilege escalation flaw, is a doozy. It's a CVSS 9.8 critical security hole. From a report: With a specially crafted network request, any user can establish a connection through the Kubernetes application programming interface (API) server to a backend server. Once established, an attacker can send arbitrary requests over the network connection directly to that backend. Adding insult to injury, these requests are authenticated with the Kubernetes API server's Transport Layer Security (TLS) credentials. Can you say root? I knew you could. Worse still, "In default configurations, all users (authenticated and unauthenticated) are allowed to perform discovery API calls that allow this escalation." So, yes, anyone who knows about this hole can take command of your Kubernetes cluster.' -- source: https://it.slashdot.org/story/18/12/04/1958222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers breach Quora.com and steal password data for 100 million users
by Peter Reutemann 04 Dec '18

04 Dec '18

'Brace yourself for yet another massive data breach. Quora.com, a site where people ask and answer questions on a range of topics, said hackers breached its computer network and accessed a variety of potentially sensitive personal data for about 100 million users. Compromised information includes cryptographically protected passwords, full names, email addresses, data imported from linked networks, and a variety of non-public content and actions, including direct messages, answer requests, and downvotes. The breached data also included public content and actions, such as questions, answers, comments, and upvotes. In a post published late Monday afternoon, Quora officials said they discovered the unauthorized access on Friday. They have since hired a digital forensics and security firm to investigate and have also reported the breach to law enforcement officials.' -- source: https://arstechnica.com/information-technology/2018/12/quora-says-hackers-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blockchain Study Finds 0% Success Rate and Vendors Don't Call Back When Asked For Evidence
by Peter Reutemann 04 Dec '18

04 Dec '18

'Though Blockchain has been touted as the answer to everything, a study of 43 solutions advanced in the international development sector has found exactly no evidence of success. From a report: Three practitioners including erstwhile blockchain enthusiast John Burg, a Fellow at the US Agency for International Development (USAID), looked at instances of the distributed crypto ledger being used in a wide range of situations by NGOs, contractors and agencies. But they drew a complete blank. "We found a proliferation of press releases, white papers, and persuasively written articles," Burg et al wrote. "However, we found no documentation or evidence of the results blockchain was purported to have achieved in these claims. We also did not find lessons learned or practical insights, as are available for other technologies in development." Blockchain vendors were keen to puff the merits of the technology, but when the three asked for proof of success in the field, it all went very quiet. "We fared no better when we reached out directly to several blockchain firms, via email, phone, and in person. Not one was willing to share data on program results, MERL [monitoring, evaluation, research and learning] processes, or adaptive management for potential scale-up. Despite all the hype about how blockchain will bring unheralded transparency to processes and operations in low-trust environments, the industry is itself opaque." Burg was an enthusiastic advocate for blockchain until recently -- as he explained in this Medium post.' -- source: https://news.slashdot.org/story/18/12/03/2058244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Twitter User Hacks 50, 000 Printers To Tell People To Subscribe To a YouTube Channel
by Peter Reutemann 03 Dec '18

03 Dec '18

'A Twitter user using the pseudonym of @TheHackerGiraffe has hacked over 50,000 printers to print out flyers telling people to subscribe to PewDiePie's YouTube channel. The message the printers received was a simple one. It urged people to subscribe to PewDiePie's YouTube channel in order for PewDiePie -- a famous YouTuber from Sweden, real name Felix Kjellberg -- to keep the crown of most subscribed to YouTube channel. If this sounds ...odd... it's because over the past month, an Indian record label called T-Series has caught up and surpassed PewDiePie, once considered untouchable in terms of YouTube followers. The Swedish Youtube star made a comeback after his fans banded together in various social media campaigns, but T-Series is catching up with PewDiePie again.' -- source: https://hardware.slashdot.org/story/18/12/02/2241230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Linux Taking Over The World?
by Peter Reutemann 02 Dec '18

02 Dec '18

'"2019 just might be the Year of Linux -- the year in which Linux is fully recognized as the powerhouse it has become," writes Network World's "Unix dweeb." The fact is that most people today are using Linux without ever knowing it -- whether on their phones, online when using Google, Facebook, Twitter, GPS devices, and maybe even in their cars, or when using cloud storage for personal or business use. While the presence of Linux on all of these systems may go largely unnoticed by consumers, the role that Linux plays in this market is a sign of how critical it has become. Most IoT and embedded devices -- those small, limited functionality devices that require good security and a small footprint and fill so many niches in our technology-driven lives -- run some variety of Linux, and this isn't likely to change. Instead, we'll just be seeing more devices and a continued reliance on open source to drive them. According to the Cloud Industry Forum, for the first time, businesses are spending more on cloud than on internal infrastructure. The cloud is taking over the role that data centers used to play, and it's largely Linux that's making the transition so advantageous. Even on Microsoft's Azure, the most popular operating system is Linux. In its first Voice of the Enterprise survey, 451 Research predicted that 60 percent of nearly 1,000 IT leaders surveyed plan to run the majority of their IT off premises by 2019. That equates to a lot of IT efforts relying on Linux. Gartner states that 80 percent of internally developed software is now either cloud-enabled or cloud-native. The article also cites Linux's use in AI, data lakes, and in the Sierra supercomputer that monitors America's nuclear stockpile, concluding that "In its domination of IoT, cloud technology, supercomputing and AI, Linux is heading into 2019 with a lot of momentum." And there's even a long list of upcoming Linux conferences...' -- source: https://linux.slashdot.org/story/18/12/01/2018223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Node.js Event-Stream Hack Reveals Open Source 'Developer Infrastructure' Exploit
by Peter Reutemann 02 Dec '18

02 Dec '18

'"[O]n Nov. 26 it was publicly revealed that a widely deployed open-source Node.js programming language module known as event-stream had been injected with malicious code that looked to steal cryptocurrency wallets," reports eWeek, adding "The event-stream library has over two million downloads." An anonymous reader quotes Ars Technica: The backdoor came to light [November 20th] with this report from Github user Ayrton Sparling. Officials with the NPM, the open source project manager that hosted event-stream, didn't issue an advisory until six days later.... "This compromise was not targeting module developers in general or really even developers," an NPM official told Ars in an email. "It targeted a select few developers at a company, Copay, that had a very specific development environment set up. Even then, the payload itself didn't run on those developers' computers; rather, it would be packaged into a consumer-facing app when the developers built a release. The goal was to steal Bitcoin from this application's end users...." According to the Github discussion that exposed the backdoor, the longtime event-stream developer no longer had time to provide updates. So several months ago, he accepted the help of an unknown developer. The new developer took care to keep the backdoor from being discovered. Besides being gradually implemented in stages, it also narrowly targeted only the Copay wallet app. The malicious code was also hard to spot because the flatmap-stream module was encrypted. The attack is the latest to exploit weaknesses in a widely used supply chain to target downstream end users... The supply-chain attacks show one of the weaknesses of open source code. Because of its openness and the lack of funds of many of its hobbyist developers and users, open source code can be subject to malicious modifications that often escape notice. "The time has come," concludes Ars Technica, "for maintainers and users of open source software to devise new measures to better police the millions of packages being used all around us." Sophos' security blog also asks why so many developers "immediately and blindly trusted the new maintainer," and shared a concerned comment from developer named Chris Northwood.' -- source: https://it.slashdot.org/story/18/12/01/2217231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0