July 2019 - wlug - list.wlug.org.nz

What's New in Linux 5.2?
by Peter Reutemann 14 Jul '19

14 Jul '19

'Linux 5.2 has been released. This release includes Sound Open Firmware, a project that brings open source firmware to DSP audio devices; open firmware for many Intel products is also included. This release also improves the Pressure Stall Information resource monitoring to make it usable by Android; the mount API has been redesigned with new syscalls; the BFQ I/O scheduler has gained some performance improvements; a new CLONE_PIDFD flag lets clone(2) return pidfs usable by pidfd_send_signal(2); Ext4 has gained support for case-insensitive name lookups; there is also a new device mapper target that simulates a device that has failing sectors and/or read failures; open source drivers for the ARM Mali t4xx and newer 6xx/7xx have been added. Many other new drivers, features and changes can be found in the changelog. But there's more besides supporting "a handful of extra ARM-powered single-board computers," according to CRN: The biggest feature in 5.2 is probably support for Intel's forthcoming Comet Lake architecture, which will power the tenth generation of its Core desktop and mobile CPUs due. The new silicon is due to ship late in 2019 and appear in products early the next year. Linux 5.2 also includes many tweaks that improve its performance on laptops.' -- source: https://linux.slashdot.org/story/19/07/13/0436246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Patches Two New Security Flaws
by Peter Reutemann 14 Jul '19

14 Jul '19

'This week Intel announced two new patches, according to Tom's Hardware: The flaw in the processor diagnostic tool (CVE-2019-11133) is rated 8.2 out 10 on the CVSS 3.0 scale, making it a high-severity vulnerability. The flaw [found by security researcher Jesse Michael from Eclypsium] "may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access," according to Intel's latest security advisory. Versions of the tool that are older than 4.1.2.24 are affected. The second vulnerability, found by Intel's internal team, is a medium-severity vulnerability in Intel's SSD DC S4500/S4600 series sold to data center customers. The flaw found in the SSD firmware versions older than SCV10150 obtained a 5.3 score on the CVSS 3.0 scale, so it was labeled medium-severity. The bug may allow an unprivileged user to enable privilege escalation via physical access. As one of the flaws was uncovered by Intel itself and for the other the Eclypsium research coordinated with Intel for its disclosure, Intel was able to have ready the patches in time for the public announcement. ' -- source: https://slashdot.org/story/19/07/13/2027223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PC Sales Are Up--Or Are They?
by Lawrence D'Oliveiro 12 Jul '19

12 Jul '19

Another report highlighting the usual discrepancy in analysis of PC sales between IDC and Gartner <https://arstechnica.com/information-technology/2019/07/gartner-idc-agree-th…>: the difference seems down to the fact that one includes Chromebooks in their definition of a “PC”, while the other one counts Microsoft Surface tablets instead. Obvious conclusion: if it weren’t for Chromebooks, the PC market would be a pretty gloomy place indeed.

1 0

The Most Clever 'Zip Bomb' Ever Made Explodes a 46MB File To 4.5 Petabytes
by Peter Reutemann 11 Jul '19

11 Jul '19

'Programmer and engineer David Fifield has unveiled a brand-new Zip bomb that explodes a 46-megabyte file to 4.5 petabytes of data. Fifield's new type of "Zip bomb" or "compression bomb" is particularly novel because he "figured out how to 'overlap' files inside of a Zip archive, allowing for compression rates far beyond those of a traditional archive," reports Motherboard. From the report: In an email interview, Fifield noted that, while 42.zip (which has a 106 billion-to-one compression ratio and has been hosted on the same single-serving website for at least 15 years) gets much of the attention, he finds later attempts more technically interesting. "eI find 42.zip inspiring on an aesthetic level -- not so much the file itself but the circumstances around it," Fifield said. "It's like folklore. There must have been many examples of the same basic idea, but for whatever reason 42.zip is the one that had staying power." Fifield noted that part of what makes his process possible was by coming up with ways to handle cyclic redundancy checks, or CRCs, a basic error-correction functionality baked into Zip, PNG, Ethernet, and numerous other technical standards. Messing around with CRC -- 32 checksums, as they're called, was where Fifield said he learned the most. Fifield, who will present his findings at the USENIX Workshop on Offensive Technologies (WOOT) conference next month, noted that while the work itself adds to a history of research and likely will be superseded in the future, its benefit from an awareness standpoint is importan' -- source: https://hardware.slashdot.org/story/19/07/10/2341251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linode Democratizes Cloud GPUs: Brings Powerful Nvidia GPUs To Its Linux Cloud
by Peter Reutemann 11 Jul '19

11 Jul '19

'Linode today launched new GPU-optimized cloud computing instances tailored specifically for developers and businesses requiring massive parallel computational power. The new instances are built on NVIDIA Quadro RTX 6000 GPU cards with all three major types of processing cores (CUDA, Tensor, and Real-Time Ray Tracing) available to users. Linode is one of the first cloud providers to deploy NVIDIA's latest GPU architecture. These new GPU instances give scientists, artists, and engineers working on artificial intelligence, graphic visualization, and complex modeling a cost-competitive alternative to hyperscale cloud providers.' -- source: https://linux.slashdot.org/story/19/07/10/1826238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Academics Steal Data From Air-Gapped Systems Via a Keyboard's LEDs
by Peter Reutemann 11 Jul '19

11 Jul '19

'The Caps Lock, Num Lock, and Scroll Lock LEDs on a keyboard can be used to exfiltrate data from a secure air-gapped system, academics from an Israeli university have proved. From a report: The attack, which they named CTRL-ALT-LED, is nothing that regular users should worry about but is a danger for highly secure environments such as government networks that store top-secret documents or enterprise networks dedicated to storing non-public proprietary information. he attack requires some pre-requisites, such as the malicious actor finding a way to infect an air-gapped system with malware beforehand. CTRL-ALT-LED is only an exfiltration method. But once these prerequisites are met, the malware running on a system can make the LEDs of an USB-connected keyboard blink at rapid speeds, using a custom transmission protocol and modulation scheme to encode the transmitted data. A nearby attacker can record these tiny light flickers, which they can decode at a later point, using the same modulation scheme used to encode it.' -- source: https://it.slashdot.org/story/19/07/10/1836232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samba 4.11 Removes SMB1 File-Sharing Protocol Version By Default
by Peter Reutemann 11 Jul '19

11 Jul '19

'Samba says version 4.11.0 will switch off previously on-by-default support for the aging and easily subverted SMB1 protocol. Slashdot reader Jeremy Allison - Sam shares a report from The Register detailing the new changes: The open-source SMB toolkit's developers say the Samba 4.11 build, currently in preview, will by default set SMB2_02 as the earliest supported version of the Windows file-sharing protocol. Admins will still have the option to allow SMB1 on their servers if they so choose, but support will be turned off by default. The move by Samba to drop SMB1 can be seen as long overdue, given that Microsoft has been moving to get rid of the file-server protocol version from its operating systems for several years now, even before it was revealed to be one of the NSA's favorite weak points to exploit. ' -- source: https://tech.slashdot.org/story/19/07/10/2119238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Contractors Are Secretly Listening To Your Assistant Recordings
by Peter Reutemann 11 Jul '19

11 Jul '19

'A new report from Belgian broadcaster VRT News describes the process by which Google Home recordings end up being listened to by contractors -- and the scary part is that it apparently doesn't take much, if anything, to start a recording. While the recordings are not listened to live, audio clips are sent to subcontractors. The Next Web reports: VRT, with the help of a whistleblower, was able to listen to some of these clips and subsequently heard enough to discern the addresses of several Dutch and Belgian people using Google Home -- in spite of the fact some hadn't even uttered the words "Hey Google," which are supposed to be the device's listening trigger. The person who leaked the recordings was working as a subcontractor to Google, transcribing the audio files for subsequent use in improving its speech recognition. They got in touch with VRT after reading about Amazon Alexa keeping recordings indefinitely. According to the whistleblower, the recordings presented to them are meant to be carefully annotated, with notes included about the speakers presumed identity and age. From the sound of the report, these transcribers have heard just about everything. Personal information? Bedroom activities? Domestic violence? Yes, yes, and yes. While VRT only listened to recordings from Dutch and Belgian users, the platform the whistleblower showed them had recordings from all over the world -- which means there are probably thousands of other contractors listening to Assistant recordings. The VRT report states that the Google Home Terms of Service don't mention that recordings might be listened to by other humans. The report says that the recordings are identified by numbers rather than user names, but VRT "was able to pick up enough data from the recordings to find the addresses of the users in question, and even confront some of the users in the recordings -- to their great dismay," reports The Next Web. What does Google have to say about all this? That they only transcribe and use "about 0.2% of all audio clips" to improve their voice recognition technology.' -- source: https://yro.slashdot.org/story/19/07/10/2153210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet group brands Mozilla ‘internet villain’ for supporting DNS privacy feature
by Peter Reutemann 10 Jul '19

10 Jul '19

'An industry group of internet service providers has branded Firefox browser maker Mozilla an “internet villain” for supporting a DNS security standard. The U.K.’s Internet Services Providers’ Association (ISPA), the trade group for U.K. internet service providers, nominated the browser maker for its proposed effort to roll out the security feature, which they say will allow users to “bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK.” Mozilla said late last year it was planning to test DNS-over-HTTPS to a small number of users.' -- source: https://techcrunch.com/2019/07/05/isp-group-mozilla-internet-villain-dns-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Snap App Remains Hopelessly Outdated
by Peter Reutemann 10 Jul '19

10 Jul '19

'The official Skype Snap app for Linux has not been updated in nearly six months, and Microsoft is yet to say why. When introducing the cross-distro build in early 2018, the company said the Skype Snap app would give it the "... ability to push the latest features straight to our users, no matter which device or distribution they happen to use." Clearly, not. Because at the time of writing this post the Skype Snap app sits on version 8.34.0.78, which the Snapcraft store reports was 'last updated' in November 2018. However, the "regular" Linux version available to download from the Skype website is on version 8.47.0.73, released June 2019.' -- source: https://linux.slashdot.org/story/19/07/09/2014250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0