February 2018 - wlug - list.wlug.org.nz

uTorrent Client Affected by Some Pretty Severe Security Flaws
by Peter Reutemann 21 Feb '18

21 Feb '18

'A Google security researcher has found multiple security flaws affecting the uTorrent web and desktop client that allow an attacker to infect a victim with malware or collect data on the users' past downloads, reports BleepingComputer. From the report: The vulnerabilities have been discovered by Google Project Zero security researcher Tavis Ormandy, and they impact uTorrent Web, a new web-based version of the uTorrent BitTorrent client, and uTorrent Classic, the old uTorrent client that most people know. Ormandy says that both uTorrent clients are exposing an RPC server -- on port 10000 (uTorrent Classic) and 19575 (uTorrent Web). The expert says that attackers can hide commands inside web pages that interact with this open RPC server. The attacker only needs to trick a user with a vulnerable uTorrent client to access a malicious web page. Furthermore, the uTorrent clients are also vulnerable to DNS rebinding -- a vulnerability that allows the attacker to legitimize his requests to the RPC server.' -- source: https://it.slashdot.org/story/18/02/21/180206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Has a New Spectre and Meltdown Firmware Patch For You To Try Out
by Peter Reutemann 21 Feb '18

21 Feb '18

'The Spectre/Meltdown debacle continues to rumble on, and now the chip manufacturer has announced the availability of a new 'microcode solution' to the vulnerability. The updated firmware applies to 6th, 7th and 8th Generation Intel Core devices, and the release sees the company crossing its fingers and hoping that everything works out this time. This is Intel's second attempt at patching the vulnerability, and this time around both the company and its customers will be praying that the fix for Skylake, Kaby Lake and Coffee Lake chips actually does the job.' -- source: https://it.slashdot.org/story/18/02/21/186257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD's New Code of Conduct
by Peter Reutemann 21 Feb '18

21 Feb '18

'FreeBSD has a new code of conduct, which is making several people angry. From the blog post: This code of conduct applies to all spaces used by the FreeBSD Project, including our mailing lists, IRC channels, and social media, both online and off. Anyone who is found to violate this code of conduct may be sanctioned or expelled from FreeBSD Project controlled spaces at the discretion of the FreeBSD Code of Conduct Committee. Participants are responsible for knowing and abiding by these rules. Harassment includes but is not limited to: Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion. Unwelcome comments regarding a person's lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment. Deliberate misgendering. Deliberate use of "dead" or rejected names. Gratuitous or off-topic sexual images or behaviour in spaces where they're not appropriate. Physical contact and simulated physical contact (e.g., textual descriptions like "hug" or "backrub") without consent or after a request to stop. Threats of violence. Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm. Deliberate intimidation. Stalking or following. Harassing photography or recording, including logging online activity for harassment purposes. Sustained disruption of discussion. Unwelcome sexual attention. Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others. Continued one-on-one communication after requests to cease. Deliberate "outing" of any private aspect of a person's identity without their consent except as necessary to protect vulnerable people from intentional abuse. Publication of non-harassing private communication without consent. Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning). Knowingly making harmful false claims about a person.' -- source: https://yro.slashdot.org/story/18/02/17/0826206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to Get Started Using WSL in Windows 10
by Peter Reutemann 20 Feb '18

20 Feb '18

'In this article, we will walk through the process of getting started with WSL on your Windows 10 machine. You must be running the latest version of Windows 10 with Fall Creator Update installed. Then, check which version of Windows 10 is installed on your system by searching on “About” in the search box of the Start menu. You should be running version 1709 or the latest to use WSL. If an older version is installed, you need to download and install the Windows 10 Fall Creator Update (FCU) from this page. Once FCU is installed, go to Update Settings (just search for “updates” in the search box of the Start menu) and install any available updates.' -- source: https://www.linux.com/blog/learn/2018/2/how-get-started-using-wsl-windows-10 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 20 Feb '18

20 Feb '18

Hi everyone Just to let you know that we have a meeting next Monday: 'Ian Young will be demoing Manjaro (https://manjaro.org/) a Linux distribution that has become very popular recently according to the Linux Journal's poll (https://linux.slashdot.org/story/18/02/14/1850259) General discussion on backup tools and strategies: What tool do you use? What approach is working for you? What should you stay away from at all costs?' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246736977/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cron Is Becoming Obsolete
by Lawrence D'Oliveiro 20 Feb '18

20 Feb '18

I have to get out of the habit of (only) checking various /etc/cron* locations for periodic system tasks. Debian is making more and more use of systemd timer tasks. The nice thing is, you can see them all with a simple command: systemctl status \*.timer Got caught out with this on a client’s machine the other day: when you install the certbot package (for managing certificates issued by Let’s Encrypt) on Debian, it also automatically adds a systemd timer to run certificate renewals twice a day, you don’t need to set up your own cron task to manage this.

1 0

Chrome Extension Brings 'View Image' Button Back
by Peter Reutemann 19 Feb '18

19 Feb '18

'Google recently removed the convenient "view image" button from its search results as a result of a lawsuit with stock-photo agency Getty. Thankfully, one day later, a developer created an extension that brings it back. 9to5Google reports: It's unfortunate to see that button gone, but an easy to use Chrome extension brings it back. Simply install the extension from the Chrome Web Store, and then any time you view an image on Google Image Search, you'll be able to open that source image. You can see the functionality in action in the video below. The only difference we can see with this extension versus the original functionality is that instead of opening the image on the same page, it opens it in a new tab. The extension is free, and it will work with Chrome for Windows, Mac, Chrome OS, or anywhere else the full version of Chrome can be used. 9to5Google has a separate post with step-by-step instructions to get the Google Images "view image" button back.' -- source: https://tech.slashdot.org/story/18/02/19/0334208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite
by Peter Reutemann 15 Feb '18

15 Feb '18

'ZDNet reports of a security flaw in Skype's updater process that "can allow an attacker to gain system-level privileges to a vulnerable computer." If the bug is exploited, it "can escalate a local unprivileged user to the full 'system' level rights -- granting them access to every corner of the operating system." What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client. From the report: Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder. ' -- source: https://it.slashdot.org/story/18/02/12/2319257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Ubuntu Wants To Collect Data About Your System -- Starting With 18.04 LTS
by Peter Reutemann 15 Feb '18

15 Feb '18

' In an announcement on Ubuntu mailing list, Will Cooke, on behalf of the Ubuntu Desktop team, announced Canonical's plans to collect some data related to the users' system configuration and the packages installed on their machines. From a report: Before you read anything further, it's important to note that users will have the option to opt-out of this data collection. The company plans to add a checkbox to the installer, which would be checked by default. The option could be like: "Send diagnostics information to help improve Ubuntu." As per your convenience, you can opt-out during the installation. An option to do the same will also be made available in the Privacy panel of GNOME Settings. With this data collection, the team wishes to improve the daily experiences of the Ubuntu users. It's worth noting that the collected data will be sent over encrypted connections and no IP addresses will be tracked. To be precise, the collected data will include: flavour and version of Ubuntu, network connectivity or not, CPU family, RAM, disk(s) size, screen(s) resolution, GPU vendor and model, OEM manufacturer, location (based on the location selection made during install), no IP information, time taken for Installation, auto-login enabled or not, disk layout selected, third party software selected or not, download updates during install or not, livePatch enabled or not.' -- source: https://news.slashdot.org/story/18/02/15/1410203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DeepFakes Explained
by Lawrence D'Oliveiro 15 Feb '18

15 Feb '18

Heard about the latest hot new trend on the Internet? Slightly disturbing, even? It’s splicing someone’s face into a video in place of that of an entirely unrelated person, to make it look like they’re the one in the scene. Except that the result doesn’t look fake at all--you’d think it was real. Naturally, Rule 34 applies. But here <https://www.youtube.com/watch?v=7XchCsYtYMQ> is a watchable, and entirely SFW, overview of how it all works. Oh, and the software for doing this is all over GitHub.

2 2