March 2018 - wlug - list.wlug.org.nz

Apple Seems OK With Overt Cryptocurrency-Mining App
by Lawrence D'Oliveiro 14 Mar '18

14 Mar '18

<https://arstechnica.com/information-technology/2018/03/theres-a-currency-mi…>: In recent days, Calendar 2 developer Qbix endowed it with code that mines the digital coin known as Monero. The xmr-stack miner isn't supposed to run unless users specifically approve it in a dialog that says the mining will be in exchange for turning on a set of premium features. If users approve the arrangement, the miner will then run. Users can bypass this default action by selecting an option to keep the premium features turned off or to pay a fee to turn on the premium features. But there were one or two bugs that kept things from working smoothly. However, in an update to the article, it seems the developer has had second thoughts, and is removing the miner function from the app.

1 0

Let’s Encrypt takes free “wildcard” certificates live
by Peter Reutemann 14 Mar '18

14 Mar '18

'In July of 2017, the nonprofit certificate authority Let's Encrypt promised to deliver something that would put secure websites and Web applications within reach of any Internet user: free "wildcard" certificates to enable secure HTTP connections for entire domains. Today, Let's Encrypt took that promised service live, in addition to a new version of the Automated Certificate Management Environment (ACME) protocol, an interface that can be used by a variety of client software packages to automate verification of certificate requests. ACME version 2 "has gone through the IETF standards process," said Josh Aas, executive director of the Internet Security Research Group (ISRG), the group behind Let's Encrypt, in a blog post on the release. ACME v2 is currently a draft Internet Engineering Task Force standard, so it may not yet be in its final form. But the current version is the result of significant feedback from the industry. And its use is required to obtain wildcard certificates. In addition to the ACME v2 requirement, requests for wildcard certificates require the modification of a Domain Name Service "TXT" record to verify control over the domain—a similar method to that used by Google and other service providers to prove domain ownership. But much of this can be automated by hosting providers that provide DNS services. A single Let's Encrypt account can request up to 300 wildcard certificates over a period of three hours, allowing a hosting provider to handle requests for customers who may not have shell access to their sites.' -- source: https://arstechnica.com/information-technology/2018/03/lets-encrypt-takes-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Rowan Schischka 13 Mar '18

13 Mar '18

>And yet here we are, watching prosecutorial discretion morph into >putting someone's head on a platter over recovery disks any one of us >could download hundreds of times from Microsoft's website without a >single murmur about "lost sales" from the tech giant. Just because something is available online without a fee does not mean it can be treated as public domain. The punishment may not appear to reasonably fit the crime, but this is what was laid out by lawmakers. I would hope a reasonable fine would be equivalent to what an OEM would profit from selling a disc. I worked in anti-piracy a few years back, I should have given a lecture on licensing while I was in Hamilton. Microsoft is very smart in taking money.

2 1

Researchers Find Critical Vulnerabilities in AMD's Ryzen and EPYC Processors, But They Gave the Chipmaker Only 24 Hours Before Making the Findings Public
by Peter Reutemann 13 Mar '18

13 Mar '18

'Alfred Ng, reporting for CNET: Researchers have discovered critical security flaws in AMD chips that could allow attackers to access sensitive data from highly guarded processors across millions of devices. Particularly worrisome is the fact that the vulnerabilities lie in the so-called secure part of the processors -- typically where your device stores sensitive data like passwords and encryption keys. It's also where your processor makes sure nothing malicious is running when you start your computer. CTS-Labs, a security company based in Israel, announced Tuesday that its researchers had found 13 critical security vulnerabilities that would let attackers access data stored on AMD's Ryzen and EPYC processors, as well as install malware on them. Ryzen chips power desktop and laptop computers, while EPYC processors are found in servers. The researchers gave AMD less than 24 hours to look at the vulnerabilities and respond before publishing the report. Standard vulnerability disclosure calls for 90 days' notice so that companies have time to address flaws properly. An AMD spokesperson said, "At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise. We are investigating this report, which we just received, to understand the methodology and merit of the findings," an AMD spokesman said. Zack Whittaker, a security reporter at CBS, said: Here's the catch: AMD had less than a day to look at the research. No wonder why its response is so vague.' -- source: https://it.slashdot.org/story/18/03/13/1558221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 59, 'By Far the Biggest Update Since Firefox 1.0', Arrives With Faster Page Loads and Improved Private Browsing
by Peter Reutemann 13 Mar '18

13 Mar '18

'Mozilla today launched Firefox 59 for Windows, Mac, Linux, and Android. The release builds on Firefox Quantum, which the company calls "by far the biggest update since Firefox 1.0 in 2004." Version 59 brings faster page load times, private browsing mode that strips path information, and Android Assist. In related news, Mozilla is giving Amazon Fire TV owners a new design later this week that lets them save their preferred websites by pinning them to the Firefox home screen. Enterprise users also have something to look forward to: On Wednesday, Firefox Quantum for Enterprise is entering the beta phase. Firefox 59 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play.' -- source: https://tech.slashdot.org/story/18/03/13/1623251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Busting Bugs Found in Popular VPN Services Hotspot Shield, Zenmate and PureVPN
by Peter Reutemann 13 Mar '18

13 Mar '18

'A report by VpnMentor, a website which ranks VPN services, reveals several vulnerabilities in Hotspot Shield, Zenmate, and PureVPN -- all of which promise to provide privacy for their users. VpnMentor says it hired a team of three external ethical hackers to find vulnerabilities in three random popular VPNs. While one hacker wants to keep his identity private, the other two are known as File Descriptor and Paulos Yibelo. ZDNet: The research reveals bugs that can leak real-world IP addresses, which in some cases can identify individual users and determine a user's location. In the case of Hotspot Shield, three separate bugs in how the company's Chrome extension handles proxy auto-config scripts -- used to direct traffic to the right places -- leaked both IP and DNS addresses, which undermines the effectiveness of privacy and anonymity services. [...] AnchorFree, which makes Hotspot Shield, fixed the bugs, and noted that its mobile and desktop apps were not affected by the bugs. The researchers also reported similar IP leaking bugs to Zenmate and PureVPN.' -- source: https://yro.slashdot.org/story/18/03/13/1836218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs
by Peter Reutemann 12 Mar '18

12 Mar '18

'Stating with Firefox 60 -- expected to be released in May 2018 -- websites won't be able to use Firefox to access data from sensors that provide proximity distances and ambient light information. >From a report: Firefox was allowing websites to access this data via the W3C Proximity and Ambient Light APIs. But at the start of the month, Mozilla engineers decided to disable access to these two APIs by default. The APIs won't be removed, but their status is now controlled by two Firefox flags that will ship disabled by default. This means users will have to manually enable the two flags before any website can use Firefox to extract proximity and ambient light data from the device's underlying sensors. The two flags will be available in Firefox's about:config settings page. The screenshot below shows the latest Firefox Nightly version, where the two flags are now disabled, while other sensor APIs are enabled.' -- source: https://news.slashdot.org/story/18/03/12/1641205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Lawrence D'Oliveiro 12 Mar '18

12 Mar '18

<https://www.techdirt.com/articles/20180223/17294539295/microsoft-helps-get-…>: Someone dedicates his life to keeping landfills free of harmful material and the government wants to send him to prison. And it's all based on Microsoft's assertion it would have sold as many recovery disks as Lundgren created if only Lundgren hadn't created them. Ignored is the fact they never were distributed. Also ignored is the dubiousness of "lost sales" assertions, which are always 100% conjecture and always presented as a simplistic equation: "1 Piracy = 1 Lost Sale." But in this case, no sales were lost because no sales were replaced with bootleg boot disks. And "sales" must be a legal term of art. Microsoft allows anyone to download a recovery disk for free. But in court, these are suddenly worth money because infringement. To ensure someone gets tossed in jail for breaking the chain of planned obsolescence, Microsoft (and prosecutors) want the court to believe the existence of recovery disks that do nothing unless a person already has a licensed copy of Windows has somehow made the company $700,000 poorer. Given the limitations of burned recovery disks, it's impossible to see where infringement even comes into play. And yet here we are, watching prosecutorial discretion morph into putting someone's head on a platter over recovery disks any one of us could download hundreds of times from Microsoft's website without a single murmur about "lost sales" from the tech giant.

1 0

Command Line Text Processing
by Peter Reutemann 11 Mar '18

11 Mar '18

Useful tutorials: https://github.com/learnbyexample/Command-line-text-processing Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz

1 0

SgxSpectre Attack Can Extract Data From Intel SGX Enclaves
by Peter Reutemann 11 Mar '18

11 Mar '18

'A new variation of the Spectre attack has been revealed this week by six scientists from the Ohio State University. Named SgxSpectre, researchers say this attack can extract information from Intel SGX enclaves. Intel Software Guard eXtensions (SGX) is a feature of modern Intel processors that allow an application to create so-called enclaves. This enclave is a hardware-isolated section of the CPU's processing memory where applications can run operations that deal with extremely sensitive details, such as encryption keys, passwords, user data, and more... Neither Meltdown and Spectre were able to extract data from SGX enclaves. This is where SgxSpectre comes in. According to researchers, SgxSpectre works because of specific code patterns in software libraries that allow developers to implement SGX support into their apps. Vulnerable SGX development kits include the Intel SGX SDK, Rust-SGX, and Graphene-SGX. Academics say an attacker can leverage the repetitive code execution patterns that these SDKs introduce in SGX enclaves and watch for small variations of cache size. This allows for side-channel attacks that allow a threat actor to infer and slowly recover data from secure enclaves. Intel's recent Spectre patches don't necessarily help, as an attacker can work around these fixes. Intel says an update for the Intel SGX SDK that adds SgxSpectre mitigations will be released on March 16. Apps that implement Google's Retpoline anti-Spectre coding techniques are safe, researchers say.' -- source: https://it.slashdot.org/story/18/03/10/0446211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0