May 2019 - wlug - list.wlug.org.nz

Huawei Says It is Willing To Sign 'No-Spy' Agreements With Governments
by Peter Reutemann 14 May '19

14 May '19

'Huawei is willing to sign no-spy agreements with governments, including Britain, the Chinese telecommunications company's chairman said on Tuesday as the United States pressures European countries to shun the firm over spying concerns. From a report: Washington has told allies not to use Huawei's technology to build new 5G telecommunications networks because of worries it could be a vehicle for Chinese spying, an accusation the firm has denied.' -- source: https://tech.slashdot.org/story/19/05/14/1531257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs Released in Last 8 Years Impacted by New Zombieload Side-Channel Attack
by Peter Reutemann 14 May '19

14 May '19

'Academics have discovered a new class of vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. From a report: The leading attack in this new vulnerability class is a security flaw named Zombieload, which is another side-channel attack in the same category as Meltdown, Spectre, and Foreshadow. Just like the first three, Zombieload is exploited by taking advantage of the speculative execution process, which is an optimization technique that Intel added to its CPUs to improve data processing speeds and performance. For more than a year, academics have been poking holes in various components of the speculative execution process, revealing ways to leak data from various CPU buffer zones and data processing operations. Meltdown, Spectre, and Foreshadow have shown how various CPU components leak data during the speculative execution process. Today, an international team of academics -- including some of the people involved in the original Meltdown and Spectre research -- along with security researchers from Bitdefender have disclosed a new attack impacting the speculative execution process. This one is what researchers have named a Microarchitectural Data Sampling (MDS) attack, and targets a CPU's microarchitectural data structures, such as the load, store, and line fill buffers, which the CPU uses for fast reads/writes of data being processed inside the CPU. [...] In a research paper published today, academics say that all Intel CPUs released since 2011 are most likely vulnerable. Processors for desktops, laptops, and (cloud) servers are all impacted, researchers said on a special website they've set up with information about the Zombieload flaws.' -- source: https://tech.slashdot.org/story/19/05/14/1721242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Academics Improve SHA-1 Collision Attack, Make It Actually Dangerous
by Peter Reutemann 14 May '19

14 May '19

'"Attacks on the SHA-1 hashing algorithm just got a lot more dangerous last week with the discovery of the first-ever 'chosen-prefix collision attack,' a more practical version of the SHA-1 collision attack first carried out by Google two years ago," reports ZDNet. Google's original research allowed attackers to force duplicates for specific files, but this process was often at random. A new SHA-1 collision attack variation (a chosen-prefix attack) detailed last week allows attackers to choose what SHA-1-signed files or data streams they want to forge on demand, making SHA-1 an attack that is now practical in the real world, albeit at a price tag of $100,000 per collision.' -- source: https://it.slashdot.org/story/19/05/13/2255229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Is It Finally the Year of 'Linux on the Desktop' ?
by Peter Reutemann 13 May '19

13 May '19

'"2019 is truly, finally shaping up to be the year of Linux on the desktop," writes PC World's senior editor, adding "Laptops, too!" But most people won't know it. That's because the bones of the open-source operating system kernel will soon be baked into Windows 10 and Chrome OS, as Microsoft and Google revealed at their respective developer conferences this week... Between lurking in Windows 10 and Chrome OS, and the tiny portion of actual Linux distro installs, pretty much any PC you pick up will run a Linux kernel and Linux software. Macs won't, but it's based on a Unix-like BSD system that already runs many Linux apps with relative ease (hence Apple's popularity with developers). You have to wonder where that leaves proper Linux distributions like Ubuntu and Linux Mint, though. They already suffer from a minuscule user share, and developers may shift toward Windows and Chrome if the Linux kernels in those operating systems get the same job done. Could this fruit wind up poisonous over the long term? We'll have to see. That said, Linux is healthier than ever. The major distros are far more polished than they used to be, with far fewer hardware woes than installs of yesteryear. You can even get your game on relatively well thanks to Valve's Proton technology, which gets many (but not all) Steam games working on Linux systems. And hey, Linux is free. Normal users may never be aware of it, but 2019 may finally be the year of Linux on the desktop -- just not Linux operating systems on the desktop. ' -- source: https://linux.slashdot.org/story/19/05/13/0336224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting *next* Monday (May 20th)
by Peter Reutemann 13 May '19

13 May '19

Hi everyone Due to lining up with Techweek 2019, we shifted our monthly WLUG meeting to next week (May 20th). 'Lawrence D'Oliveiro will give an intro to Nagios (https://www.nagios.org/) an extensible system for monitoring all kinds of behaviour on a Linux box. He will also discuss writing your own plugins, to add monitoring of system characteristics that Nagios does not already provide as standard. The examples will be in Python, though they can be done in any language. This Meetup is part of the Techweek19 Waikato festival of innovation.' More details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884277/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 19.04: The Disco Dingo arrives and will really make your IT dept. happy
by Peter Reutemann 12 May '19

12 May '19

'Canonical recently released Ubuntu 19.04, the latest version of its flagship GNOME-based Linux desktop. But if you're a desktop user, you might be feeling a little left out. The big points of emphasis in this latest release are on Ubuntu as a tool for infrastructure development, server deployment, and the good old Internet of Things. For the server version of Ubuntu, the OS ships with all the latest cloud computing tools. In fact, that's already available in optimized builds on the major cloud services. Elsewhere, the latest version of the venerable Ubuntu desktop packs quite a few additional, tempting reasons to upgrade for Linux gamers. Ubuntu 19.04 makes the leap to the Linux kernel 5.x series, for instance, which offers much improved graphics support. Despite all the talk of developer tools and enterprise deployment stacks—Canonical has even taken to calling Ubuntu the "leading OS for cloud operations" lately—Ubuntu 19.04 is ultimately a worthwhile upgrade for all. After spending some time with it recently, we found some nice updates to the desktop, too. So no matter your Ubuntu use case, 19.04 seems to offer users a faster, more polished desktop than its predecessors.' -- source: https://arstechnica.com/gadgets/2019/05/ubuntu-19-04-review-the-disco-dingo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ImageMagick "not authorized" PDF errors
by Peter Reutemann 12 May '19

12 May '19

Hi there I was trying to convert some images into PDFs using ImageMagick's "convert" tool and encountered a "not authorized" error, something similar to the following: convert-im6.q16: not authorized `scan.pdf' @ error/constitute.c/WriteImage/1037. Took me a while figuring that one out. As it turns out, this is due to ImageMagick's security policy being tightened up (no default rights for PDF/PS): /etc/ImageMagick-6/policy.xml You can, of course, re-enable support for PDF/PS. See the following post: https://cromwell-intl.com/open-source/pdf-not-authorized.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Firefox 66.0.3 disabled all your plugins?
by Peter Reutemann 11 May '19

11 May '19

Hi there I just updated my Firefox to 66.0.3 and all of a sudden, all my installed plugins were disabled (eg uBlock). Turns out that the release was buggy and they are working on a fix. In the meantime, you can get things going again through a trick: by enabling "participating in studies" you can get access to their hotfix to remedy this problem (though it can take some time before you get notified once you enabled this option - up to 6 hours; it only took a minute for me). For more information, see the official blog post: https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-fire… If you haven't updated to 66.0.3, then I'd strongly advice to wait for the next version to become available. Will safe you some pain. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

New Intel Firmware Boot Verification Bypass Enables Low-Level Backdoors
by Peter Reutemann 11 May '19

11 May '19

'At the Hack in the Box conference in Amsterdam this week, researchers Peter Bosch and Trammell Hudson presented a new attack against the Boot Guard feature of Intel's reference UEFI implementation, known as Tianocore. The attack, which can give an attacker full, persistent access, involves replacing a PC's SPI flash chip with one that contains rogue code, reports Lucian Constantin for CSO. "Even though such physical attacks require a targeted approach and will never be a widespread threat, they can pose a serious risk to businesses and users who have access to valuable information," writes Constantin. Intel has patches available for Tianocore, but as we all remember from the Meltdown and Spectre vulnerabilities, distributing UEFI patches isn't an easy process.' -- source: https://it.slashdot.org/story/19/05/10/2335225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is Starting To Reveal the Secrets of Its Experimental Fuchsia OS
by Peter Reutemann 10 May '19

10 May '19

'At Google's I/O developer conference this past week, Android and Chrome chief Hiroshi Lockheimer offered some rare insight into Fuchsia, albeit at a very high level, in front of public audiences. The Verge reports: What we do know about Fuchsia is that it's an open source project, similar to AOSP, but could run all manner of devices, from smart home gadgets to laptops to phones. It's also known to be built on an all-new, Google-built kernel called "zircon," formerly known as "magenta," and not the Linux kernel that forms the foundation of Android and Chrome OS. "We're looking at what a new take on an operating system could be like. And so I know out there people are getting pretty excited saying, 'Oh this is the new Android,' or, 'This is the new Chrome OS,'" Lockheimer said. "Fuchsia is really not about that. Fuchsia is about just pushing the state of the art in terms of operating systems and things that we learn from Fuchsia we can incorporate into other products." He says the point of the experimental OS is to also experiment with different form factors, a hint toward the possibility that Fuchsia is designed to run on smart home devices, wearables, or possibly even augmented or virtual reality devices. "You know Android works really well on phones and and you know in the context of Chrome OS as a runtime for apps there. But Fuchsia may be optimized for certain other form factors as well. So we're experimenting." Lockheimer provided some additional details at a separate Android fireside chat held at Google I/O today. "It's not just phones and PCs. In the world of [the Internet of Things], there are increasing number of devices that require operating systems and new runtimes and so on. I think there's a lot of room for multiple operating systems with different strengths and specializations. Fuchsia is one of those things and so, stay tuned," he told the audience.' -- source: https://mobile.slashdot.org/story/19/05/10/0021243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0