June 2019 - wlug - list.wlug.org.nz

Yubico To Replace Vulnerable YubiKey FIPS Security Keys
by Peter Reutemann 13 Jun '19

13 Jun '19

'Yubico said today it plans to replace certain hardware security keys because of a firmware flaw that reduces the randomness of cryptographic keys generated by its devices. From a report: Affected products include models part of the YubiKey FIPS Series, a line of YubiKey authentication keys certified for use on US government networks (and others) according to the US government's Federal Information Processing Standards (FIPS). According to a Yubico security advisory published today, YubiKey FIPS Series devices that run firmware version 4.4.2 and 4.4.4 contain a bug that keeps "some predictable content" inside the device's data buffer after the power-up operation. This "predictable content" will influence the randomness of cryptographic keys generated on the device for a short period after the boot-up, until the "predictable content" is all used up, and true random data is present in the buffer. This means that for a short period after booting up YubiKey FIPS Series devices with the affected 4.4.2 and 4.4.4 versions will generate keys that can be either recovered partially, or in full, depending on the cryptographic algorithm the key is working with for a particular authentication operation.' -- source: https://tech.slashdot.org/story/19/06/13/1844232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If you haven’t patched Vim or NeoVim text editors, you really, really should
by Peter Reutemann 13 Jun '19

13 Jun '19

'A recently patched vulnerability in text editors preinstalled in a variety of Linux distributions allows hackers to take control of computers when users open a malicious text file. The latest version of Apple’s macOS is continuing to use a vulnerable version, although attacks only work when users have changed a default setting that enables a feature called modelines. Vim and its forked derivative, NeoVim, contained a flaw that resided in modelines. This feature lets users specify window dimensions and other custom options near the start or end of a text file. While modelines restricts the commands available and runs them inside a sandbox that’s cordoned off from the operating system, researcher Armin Razmjou noticed the source! command (including the bang on the end) bypassed that protection.' -- source: https://arstechnica.com/information-technology/2019/06/if-you-havent-patche… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress.com VIP Platform Outage Reverts Sites To Default Themes
by Peter Reutemann 12 Jun '19

12 Jun '19

'Web blog hosting platform WordPress.com is currently facing a significant technical issue that has resulted in premium blogs going down or reverting to using default themes. Impacted sites include major news outlets like BBC America, TechCrunch, 9to5Mac, 9to5Google, VentureBeat, DroneDJ, and Electrek; but also many companies that were using the WordPress.com's VIP offering to host corporate blogs, such as Facebook, the Wikimedia Foundation, and others. Automattic, the company behind the WordPress.com service has admitted to the technical issue in a series of tweets and a blog post from its engineering staff.' -- source: https://it.slashdot.org/story/19/06/11/1812219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'RAMBleed' Rowhammer Attack Can Now Steal Data, Not Just Alter It
by Peter Reutemann 12 Jun '19

12 Jun '19

' A team of academics from the US, Austria, and Australia, has published new research today detailing yet another variation of the Rowhammer attack. From a report: The novelty in this new Rowhammer variety -- which the research team has named RAMBleed -- is that it can be used to steal information from a targeted device, as opposed to altering existing data or to elevate an attacker's privileges, like all previous Rowhammer attacks, have done in the past. [...] In a research paper [PDF] published today, academics unveiled RAMBleed, the first Rowhammer attack that can actively deduce and steal data from a RAM card. To do this, researchers had to come up and combine different techniques, which, when assembled, would permit a RAMBleed attack to take place.' -- source: https://tech.slashdot.org/story/19/06/11/1931214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Biggest Data Breach Archive On the Internet Is For Sale
by Peter Reutemann 12 Jun '19

12 Jun '19

'Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced today that he's actively looking for a buyer. "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat," Hunt wrote. "It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own." Motherboard reports: Over the years, Have I Been Pwned has become the repository for data breaches on the internet, a place where users can search for their email address and see whether they have been part of a data breach. It's now also a service where people can sign up to get notified whenever their accounts get breached. It's perhaps the most useful, free, cybersecurity service in the world. Hunt said he's already had informal conversations with some organizations that might be interested in buying the service. Hunt said he's engaged the financial consulting firm KPMG to look for a buyer. In the post, Hunt shared some staggering numbers that explain just how big Have I Been Pwned has become: 8 billion breached records, nearly 3 million people subscribed to notifications, who have been emailed about a breach 7 million times, 150,000 unique visitors to the site on a normal day, 10 million on an abnormal day. Regardless of who buys the site, Hunt made a series of commitments on the future of Have I Been Pwned: searches should remain free for consumers, the platform should expand and grow, and, finally, he wants to stay involved in some capacity. ' -- source: https://it.slashdot.org/story/19/06/11/2017231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Is Always Down To The Weakest Link
by Lawrence D'Oliveiro 11 Jun '19

11 Jun '19

Nice non-paywalled report <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12235615> into how the National Party (and others) were able to obtain supposedly-confidential details of today’s Budget announcements. In summary, a “clone” was made of the Treasury website, containing the Budget info, that was supposed to be swapped for the current production site later today. It was not publicly accessible, at least directly. However, the search function on the public site was inadvertently sucking up the confidential info from the clone server as well, and carefully-worded searches would reveal bits of such info as search context, even if the actual documents being indexed were not accessible in full. The Police have decided that, even though such leaks are considered a serious matter, the accesses were “not unlawful”. Which seems a refreshing change from, say, the UK, where someone was prosecuted and jailed some years ago just for putting “../” into a URL ...

2 2

Dotcom’s Lawyer Says Movie Copyright Warnings Are “Propaganda”
by Lawrence D'Oliveiro 11 Jun '19

11 Jun '19

The defence in the Kim Dotcom extradition case carefully explains why the cases of copyright infringement at issue are civil, not criminal matters, why there is a need for “safe harbour” provisions for ISPs (and services like Megaupload), and warns against the US Justice Department trying to shop around NZ law to find more criminal charges to hit him with. <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12239483>

1 0

Opera, Brave, Vivaldi To Ignore Chrome's Anti-Ad-Blocker Changes, Despite Shared Codebase
by Peter Reutemann 11 Jun '19

11 Jun '19

'Despite sharing a common Chromium codebase, browser makers like Brave, Opera, and Vivaldi don't have plans on crippling support for ad blocker extensions in their products -- as Google is currently planning on doing within Chrome. From a report: The three browsers makers have confirmed to ZDNet, or in public comments, of not intending to support a change to the extensions system that Google plans to add to Chromium, the open-source browser project on which Chrome, Brave, Opera, and Vivaldi are all based on.' -- source: https://tech.slashdot.org/story/19/06/10/1651256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Large 'GoldBrute' RDP Botnet Hunts For Exposed Servers With Weak Passwords
by Peter Reutemann 08 Jun '19

08 Jun '19

'The Internet Storm Center reports: RDP, the remote desktop protocol, made the news recently after Microsoft patched a critical remote code execution vulnerability (CVE-2019-0708). While the reporting around this "Bluekeep" vulnerability focused on patching vulnerable servers, exposing RDP to the Internet has never been a good idea. Botnets have been scanning for these servers and are using weak and reused passwords to gain access to them. The latest example of such a botnet is an ongoing malicious campaign we are refering to as "GoldBrute". This botnet is currently brute forcing a list of about 1.5 million RDP servers exposed to the Internet... Each bot will only try one particular username and password per target. This is possibly a strategy to fly under the radar of security tools as each authentication attempt comes from different addresses. Long-time Slashdot reader UnderAttack writes: Infected systems will retrieve target lists from the command and control server and attempt to brute force credentials against the list, while at the same time looking for more exposed servers. With all the attention spent on patching RDP servers for the recent "BlueKeep" vulnerability, users should also make sure to just not expose RDP in the first place. Even patched, it will still be susceptible to brute forcing.' -- source: https://it.slashdot.org/story/19/06/08/0322234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu MATE 19.10 Is Ditching VLC for GNOME MPV
by Peter Reutemann 07 Jun '19

07 Jun '19

'GNOME MPV (now known as Celluloid) will be the default media player in Ubuntu MATE 19.10. From a report: The app supplants the versatile VLC meda player, which the MATE desktop-toting distro has shipped with following the results of a community poll back in 2017. So why the change now? Better desktop integration. That's according to Ubuntu MATE's Martin Wimpress who revealed news of the swap in the latest Ubuntu MATE monthly update on Patreon: "We will be dropping VLC from the pre-installed applications and shipping GNOME MPV instead. GNOME MPV will soon be renamed to Celluloid. The reasons for switching to GNOME MPV are similar to swapping out Thunderbird for Evolution; better desktop integration." Size is another factor. GNOME MPV takes up a comparatively svelte 27MB on the ISO image, whereas Qt5-based VLC requires closer to 70MB.' -- source: https://news.slashdot.org/story/19/06/06/1840240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2