May 2019 - wlug - list.wlug.org.nz

First Official Version of Tor Browser for Android Released on Play Store
by Peter Reutemann 21 May '19

21 May '19

'The Tor Project today made the first stable version of its privacy-focused browser available on the Google Play Store. From a report: This new mobile browser integrates the Tor protocol stack into a standalone browser and replaces Orfox as the main way to navigate the Tor network from an Android device. Tor Project developers have been working on this browser for eight months now, since September 2018, when they first released an alpha version for public testing. "We made it a priority to reach the rising number of users who only browse the web with a mobile device," said Isabela Bagueros, Executive Director of the Tor Project. "These users often face heavy surveillance and censorship online, so it is critical for us to reach them. We made sure there are no proxy bypasses, that first-party isolation is enabled to protect you from cross-site tracking, and that most of the fingerprinting defenses are working," the Tor team added.' -- source: https://yro.slashdot.org/story/19/05/21/1835256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Performance Hit 5x Harder Than AMD After Spectre, Meltdown Patches
by Peter Reutemann 21 May '19

21 May '19

'Phoronix has conducted a series of tests to show just how much the Spectre and Meltdown patches have impacted the raw performance of Intel and AMD CPUs. While the patches have resulted in performance decreases across the board, ranging from virtually nothing to significant depending on the application, it appears that Intel received the short end of the stick as its CPUs have been hit five times harder than AMD, according to ExtremeTech. From the report: The collective impact of enabling all patches is not a positive for Intel. While the impacts vary tremendously from virtually nothing to significant on an application-by-application level, the collective whack is about 15-16 percent on all Intel CPUs without Hyper-Threading disabled. Disabling increases the overall performance impact to 20 percent (for the 7980XE), 24.8 percent (8700K) and 20.5 percent (6800K). The AMD CPUs are not tested with HT disabled, because disabling SMT isn't a required fix for the situation on AMD chips, but the cumulative impact of the decline is much smaller. AMD loses ~3 percent with all fixes enabled. The impact of these changes is enough to change the relative performance weighting between the tested solutions. With no fixes applied, across its entire test suite, the CPU performance ranking is (from fastest to slowest): 7980XE (288), 8700K (271), 2990WX (245), 2700X (219), 6800K. (200). With the full suite of mitigations enabled, the CPU performance ranking is (from fastest to slowest): 2990WX (238), 7980XE (231), 2700X (213), 8700K (204), 6800K (159). In closing, ExtremeTech writes: "AMD, in other words, now leads the aggregate performance metrics, moving from 3rd and 4th to 1st and 3rd. This isn't the same as winning every test, and since the degree to which each test responds to these changes varies, you can't claim that the 2990WX is now across-the-board faster than the 7980XE in the Phoronix benchmark suite. It isn't. But the cumulative impact of these patches could result in more tests where Intel and AMD switch rankings as a result of performance impacts that only hit one vendor."' -- source: https://hardware.slashdot.org/story/19/05/20/228218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

>20, 000 Linksys routers leak historic record of every device ever connected
by Peter Reutemann 21 May '19

21 May '19

'This post has been updated to add comments Linksys made online, which says company researchers couldn't reproduce the information disclosure exploit on routers that installed a patch released in 2014. Representatives of Belkin, the company that acquired Linksys in 2013, didn't respond to the request for comment that Ars sent on Monday. Ars saw the statement only after this article went live. More than 20,000 Linksys wireless routers are regularly leaking full historic records of every device that has ever connected to them, including devices' unique identifiers, names, and the operating systems they use. The data can be used by snoops or hackers in either targeted or opportunistic attacks. Independent researcher Troy Mursch said the leak is the result of a flaw in almost three dozen models of Linksys routers. It took about 25 minutes for the Binary Edge search engine of Internet-connected devices to find 21,401 vulnerable devices on Friday. A scan earlier in the week found 25,617. They were leaking a total of 756,565 unique MAC addresses. Exploiting the flaw requires only a few lines of code that harvest every MAC address, device name, and operating system that has ever connected to each of them. The flaw allows snoops or hackers to assemble disparate pieces of information that most people assume aren’t public. By combining a historical record of devices that have connected to a public IP addresses, marketers, abusive spouses, and investigators can track the movements of people they want to track. The disclosure can also be useful to hackers. The Shadowhammer group, for instance, recently infected as many as 1 million people after hacking the software update mechanism of computer maker ASUS. The hackers then used a list of about 600 MAC addresses of specific targets that, if infected, would receive advanced stages of the malware.' -- source: https://arstechnica.com/information-technology/2019/05/33-linksys-router-mo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distros Without Systemd (2019)
by Peter Reutemann 20 May '19

20 May '19

'It's 2019 -- who has switched to systemd, who hasn't and what can I use if I don't like systemd? Here's the answer in short. >From the blog post: If you are reading this post you're very much likely not a fan of systemd already. So we won't preach on why systemd is bad, but today we'll focus more on what are the alternatives out there. Our approach is obviously not for settling for less but for changing things for the better. We have started the world after systemd project some time ago and the search isn't over. So what are the non-systemd distros out there? The author makes a case for why you should consider the suggested distros, but here's the list: Devuan, Alpine Linux, Artixlinux, Void, Slackware, Gentoo, and GNU GUIX.' -- source: https://linux.slashdot.org/story/19/05/20/1916226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Opera Reborn 3: No modern browser is perfect, but this may be as close as it gets
by Peter Reutemann 20 May '19

20 May '19

'When Opera Software unveiled a new look and feel for its browser earlier this year, the company made a big deal of the impending changes. "We put Web content at center stage," the Opera team declared on its blog. And early previews of the design appeared to be quite pared down, allowing users to browse "unhindered by unnecessary distractions" as the Opera team put it. Well Opera recently released what the company refers to as Reborn 3, the latest version of its flagship desktop browser, and it's tempting to dismiss the name as little more than marketing hype. But given the relentless and utterly unspectacular updates that the Chromium project releases every six weeks, it can also be hard to denote actual big releases of browsers based on Chromium—hence the "Reborn" moniker. After spending some time with Reborn 3, however, the name seems accurate. For Opera, this is a significant update that goes far beyond what arrived with the move to Chromium 60. Opera Reborn 3—or Opera 60 if you want to stick with version numbers—transitions a slew of features that recently debuted in Opera's mobile browsers to the desktop. The big three in this release are support for blockchain-secured transactions, a crypto wallet to go with the mobile version, and a new overall look with light and dark themes available. So if you haven't checked out Opera lately, it's worth revisiting, especially for those older Opera fans still smarting about the switch from Opera's Presto rendering engine to Google's Blink rendering engine.' -- source: https://arstechnica.com/information-technology/2019/05/review-opera-once-le… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is The Global Internet Disintegrating?
by Peter Reutemann 20 May '19

20 May '19

''The global internet is disintegrating," argues BBC Future, calling Russia "one of a growing number of countries that has had enough of the Western-built, Western-controlled internet backbone...aided as much by advances in technology as by growing global misgivings about whether the open internet was ever such a good idea to start with." "The new methods raise the possibility not only of countries pulling up their own drawbridges, but of alliances between like-minded countries building on these architectures to establish a parallel internet..." It's DNS that Russia has been setting its sights on... The plan -- which was met with skepticism from much of the engineering community, if not dismissed outright -- was to create a Russia-only copy of the DNS servers (the internet's address book, currently headquartered in California) so that citizens' traffic would be exclusively directed to Russian sites, or Russian versions of external sites. It would send Russian internet users to Yandex if they typed in Google, or the social network VK instead of Facebook. To lay the groundwork for this, Russia spent years enacting laws that force international companies to store all Russian citizens' data inside the country -- leading some companies such as LinkedIn to be blocked when they refused to comply... According to estimates from the International Institute for Strategic Studies in London, China is now engaged in some 80 telecommunications projects around the world -- from laying cables to building core networks in other countries, contributing to a significant and growing Chinese-owned global network... One possibility is a scenario where enough countries join Russia and China to develop a similar infrastructure to a point where they could sustain each other economically without doing business with the rest of the world, meaning they could shut themselves off the Western internet. Smaller countries might prefer an internet built around a non-Western standard, and an economic infrastructure built around China might be the "third way" that allows countries to participate in a semi-global economy while being able to control certain aspects of their populations' internet experience. Maria Farrell of the Open Rights Group (an internet freedom organisation) tells BBC Future that "Nations like Zimbabwe and Djibouti, and Uganda, they don't want to join an internet that's just a gateway for Google and Facebook" to colonise their digital spaces. And there's also fears about western espionage. "Along with every other expert interviewed for this article, Farrell reiterated how unwise it would be underestimate the ongoing reverberations of the Snowden revelations..."' -- source: https://tech.slashdot.org/story/19/05/19/1652253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Ends Android Collaboration With Huawei. No Gmail, Play Store For Future Huawei Phones
by Peter Reutemann 19 May '19

19 May '19

'Alphabet Inc's Google has suspended business with Huawei that requires the transfer of hardware and software products except those covered by open source licenses, a source close to the matter told Reuters on Sunday, in a blow to the Chinese technology company that the U.S. government has sought to blacklist around the world. Huawei Technologies Co Ltd will immediately lose access to updates to the Android operating system, and the next version of its smartphones outside of China will also lose access to popular applications and services including the Google Play Store and Gmail app... Huawei will continue to have access to the version of the Android operating system available through the open source license that is freely open to anyone who wishes to use it. But Google will stop providing any technical support and collaboration for Android and Google services to Huawei going forward, the source said.' -- source: https://mobile.slashdot.org/story/19/05/19/1829216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Pushes Kotlin Over Java for Android Development
by Peter Reutemann 18 May '19

18 May '19

'Google "officially declared Kotlin the go-to language for Android development last week at its Google I/O developer conference," reports Mike Melanson's "This Week in Programming" column, "and the company is backing that up with a couple of initiatives around making it easier (and free) to learn the language now used by a majority of Android developers." Google teamed up with Udacity to offer Developing Android Apps with Kotlin , a free, self-paced online course on how to build Android apps with Jetpack and Kotlin, meant for people who have programming experience and are comfortable with Kotlin basics. Google also announced "Kotlin/Everywhere, a series of community-driven events focussing on the potential of Kotlin on all platforms," which it is putting on in conjunction with JetBrains. Of course, this leaves the question that has been asked many times before -- why Kotlin? -- and IT consultant Kristen Carter offers a take on how Android app development became Kotlin-first. Carter offers some business angles, such as the 2010 lawsuit against Google by Oracle, which predates Kotlin by just a year, and she speculates may have been the impetus behind the language's development as "Google has always wanted to get away from the [Java] ecosystem." At the same time, Carter offers some language-specific reasoning too, such as the comparably succinct nature of Kotlin, the absence of Java's NullPointerExceptions, and the ease with which Java developers could transition to Kotlin. Carter ends her piece by posing the possibility that Oracle "knows the significance of Java in android app development" and could "ship Java with a few upgrades in its next version to take on Kotlin."' -- source: https://developers.slashdot.org/story/19/05/17/2355248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New John the Ripper Cracks Passwords On FPGAs
by Peter Reutemann 18 May '19

18 May '19

'Long-time Slashdot reader solardiz has long bring an advocate for bringing security to open environments. Wednesday he contacted Slashdot to share this update about a piece of software he's authored called John the Ripper: John the Ripper is the oldest still evolving password cracker program (and Open Source project), first released in 1996. John the Ripper 1.9.0-jumbo-1, which has just been announced with a lengthy list of changes, is the first release to include FPGA support (in addition to CPU, GPU, and Xeon Phi). This is a long-awaited (or long-delayed) major release, encompassing 4.5 years of development and 6000+ commits by 80+ contributors. From the announcement: "Added FPGA support for 7 hash types for ZTEX 1.15y boards [...] we support: bcrypt, descrypt (including its bigcrypt extension), sha512crypt & Drupal7, sha256crypt, md5crypt (including its Apache apr1 and AIX smd5 variations) & phpass. As far as we're aware, several of these are implemented on FPGA for the very first time. For bcrypt, our ~119k c/s at cost 5 in ~27W greatly outperforms latest high-end GPUs per board, per dollar, and per Watt. [...] We also support multi-board clusters (tested [...] for up to 16 boards, thus 64 FPGAs, [...] on a Raspberry Pi 2 host)' -- source: https://it.slashdot.org/story/19/05/18/1841245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Severe Linux Kernel Flaw Found In RDS
by Peter Reutemann 18 May '19

18 May '19

'Linux systems running kernels prior to 5.0.8 require patching after news emerged of a high-severity flaw that could be remotely exploited. According to the NIST advisory, CVE-2019-1181 is a race condition affecting the kernel's rds_tcp_kill_sock in net/rds/tcp.c "leading to a use-after-free, related to net namespace cleanup." The RDS bit refers to systems running the Reliable Datagram Sockets (RDS) for the TCP module, which means only systems that run applications using this are affected. The attention-grabbing part is that this opens unpatched systems to remote compromise and denial of service without the need for system privileges or user interaction. On the other hand, the attack complexity is described as 'high', and any such attack would need to be launched from the local network.' -- source: https://linux.slashdot.org/story/19/05/18/2122204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0