July 2019 - wlug - list.wlug.org.nz

IBM Closes Its $34 Billion Acquisition of Red Hat
by Peter Reutemann 09 Jul '19

09 Jul '19

'IBM closed its $34 billion acquisition of Red Hat, the companies announced Tuesday. From a report: The deal was originally announced in October, when the companies said IBM would buy all shares in Red Hat for $190 each in cash. The acquisition of Red Hat, an open-source, enterprise software maker, marks the close of IBM's largest deal ever. It's one of the biggest in U.S. tech history. Excluding the AOL-Time Warner merger, it follows the $67 billion deal between Dell and EMC in 2016 and JDS Uniphase's $41 billion acquisition of optical-component supplier SDL in 2000. Under the deal, Red Hat will now be a unit of IBM's hybrid cloud division, according to the original announcement. The companies said Red Hat's CEO, Jim Whitehurst, would join IBM's senior management team and report to CEO Ginni Rometty. IBM previously said it hoped its acquisition of Red Hat will help it do more work in the cloud, one of its four key growth drivers, which are also social, mobile and analytics. The company lags behind Amazon and Microsoft in the cloud infrastructure business. IBM has seen three consecutive quarters of declining year-over-year revenue. But some analysts are hopeful about the Red Hat deal's opportunity to bring in new business.' -- source: https://linux.slashdot.org/story/19/07/09/1740223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Logitech Wireless USB Dongles Vulnerable To New Hijacking Flaws
by Peter Reutemann 09 Jul '19

09 Jul '19

'A security researcher has publicly disclosed new vulnerabilities in the USB dongles (receivers) used by Logitech wireless keyboards, mice, and presentation clickers. New submitter raikoseagle shares a report: The vulnerabilities allow attackers to sniff on keyboard traffic, but also inject keystrokes (even into dongles not connected to a wireless keyboard) and take over the computer to which a dongle has been connected. When encryption is used to protect the connection between the dongle and its paired device, the vulnerabilities also allow attackers to recover the encryption key. Furthermore, if the USB dongle uses a "key blacklist" to prevent the paired device from injecting keystrokes, the vulnerabilities allow the bypassing of this security protection system. Marcus Mengs, the researcher who discovered these vulnerabilities, said he notified Logitech about his findings, and the vendor plans to patch some of the reported issues, but not all.' -- source: https://it.slashdot.org/story/19/07/09/182246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Admits To Faulty USB-C Design On the Pi 4
by Peter Reutemann 09 Jul '19

09 Jul '19

'The Raspberry Pi 4 was announced two weeks ago as a major new upgrade to the line of cheap single-board hobbyist computers. The Pi 4 featured a faster CPU, options for up to 4GB of RAM, and a new, modern USB-C port for power delivery. The Pi 4 was the Raspberry Pi Foundation's first ever USB-C device, and, well, they screwed it up. As detailed by Tyler Ward, the Raspberry Pi 4 has a non-compliant USB-C charging port and doesn't work with as many chargers as it should. Thanks to the open nature of Raspberry Pi (even the schematics are online!), Ward was able to discover that Raspberry Pi just didn't design its USB-C port correctly. Two "CC" pins on a USB-C port are supposed to each get their own 5.1K ohms resistor, but Raspberry Pi came up with its own circuit design that allows them to share a single resistor. This is not a compliant design and breaks compatibility with some of the more powerful USB-C chargers out there. Whether your USB-C charger works with the Pi 4 has to do with whether it uses an "e-marked" cable. E-marked cables are fully featured USB-C cables with chips inside that negotiate power management, accessory modes, data rates, and other communication specs. Since the Pi 4 USB-C port is wired incorrectly, these smart cables will detect the Pi 4 as an "Audio Adaptor Accessory" and refuse to charge them. Usually, e-marked cables are more expensive and come with larger, higher-powered items, like a USB-C laptop. After reports started popping up on the Internet, Raspberry Pi cofounder Eben Upton admitted to TechRepublic that "A smart charger with an e-marked cable will incorrectly identify the Raspberry Pi 4 as an audio adapter accessory and refuse to provide power." Upton went on to say, "I expect this will be fixed in a future board revision, but for now users will need to apply one of the suggested workarounds. It's surprising this didn't show up in our (quite extensive) field testing program."' -- source: https://hardware.slashdot.org/story/19/07/09/1934205 I'll stick with my RPi3 for the time being... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Blocks UAE Bid To Become an Internet Security Guardian After Hacking Reports
by Peter Reutemann 09 Jul '19

09 Jul '19

'Firefox browser maker Mozilla is blocking the United Arab Emirates' government from serving as one of its internet security gatekeepers, citing Reuters reports on a UAE cyber espionage program. From a report: Mozilla said in a statement on Tuesday it was rejecting the UAE's bid to become a globally recognized internet security watchdog, empowered to certify the safety of websites for Firefox users. Mozilla said it made the decision because cybersecurity firm DarkMatter would have administered the gatekeeper role and it had been linked by Reuters and other reports to a state-run hacking program. Reuters reported in January that Abu Dhabi-based DarkMatter provided staff for a secret hacking operation, codenamed Project Raven, on behalf of an Emirati intelligence agency. The unit was largely comprised of former U.S. intelligence officials who conducted offensive cyber operations for the UAE government. Former Raven operatives told Reuters that many DarkMatter executives were unaware of the secretive program, which operated from a converted Abu Dhabi mansion away from DarkMatter's headquarters.' -- source: https://tech.slashdot.org/story/19/07/09/1945241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 68 Arrives With Darker Reader View, Recommended Extensions, and IT Customizations
by Peter Reutemann 09 Jul '19

09 Jul '19

'Mozilla today launched Firefox 68 for Windows, Mac, Linux, Android, and iOS. Firefox 68 includes a darker reader view, recommended extensions, IT Pro customizations, and more. From a report: As part of this release, Mozilla has curated a list of recommended extensions "that have been thoroughly reviewed for security, usability, and usefulness." You can find the list on the Get Add-ons page in the Firefox Add-ons Manager (about:addons). While Firefox has had dark mode for months, the Reader View's dark contrast only covered the text area. Now, when you change the contrast to dark, all sections of the site (including sidebars and toolbars) will be immersed in dark mode. With Firefox 60, Mozilla introduced an enterprise version of the browser that employers can customize. This let IT professionals configure Firefox for their organization, either using Group Policy on Windows or a JSON file that works across Windows, Mac, and Linux. With Firefox 68, Mozilla has added more enterprise policies -- to configure or remove the new tab page, turn off search suggestions, and so on.' -- source: https://news.slashdot.org/story/19/07/09/1959238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After 25 Months, Debian 10 'buster' Released
by Peter Reutemann 07 Jul '19

07 Jul '19

'"After 25 months of development the Debian project is proud to present its new stable version 10 (code name 'buster'), which will be supported for the next 5 years thanks to the combined work of the Debian Security team and of the Debian Long Term Support team." In this release, GNOME defaults to using the Wayland display server instead of Xorg. Wayland has a simpler and more modern design, which has advantages for security. However, the Xorg display server is still installed by default and the default display manager allows users to choose Xorg as the display server for their next session. Thanks to the Reproducible Builds project, over 91% of the source packages included in Debian 10 will build bit-for-bit identical binary packages. This is an important verification feature which protects users against malicious attempts to tamper with compilers and build networks. Future Debian releases will include tools and metadata so that end-users can validate the provenance of packages within the archive. For those in security-sensitive environments AppArmor, a mandatory access control framework for restricting programs' capabilities, is installed and enabled by default. Furthermore, all methods provided by APT (except cdrom, gpgv, and rsh) can optionally make use of "seccomp-BPF" sandboxing. The https method for APT is included in the apt package and does not need to be installed separately... Secure Boot support is included in this release for amd64, i386 and arm64 architectures and should work out of the box on most Secure Boot-enabled machines. The announcement touts Debian's "traditional wide architecture support," arguing that it shows Debian "once again stays true to its goal of being the universal operating system." It ships with several desktop applications and environments, including the following: - Cinnamon 3.8 - GNOME 3.30 - KDE Plasma 5.14 - LXDE 0.99.2 - LXQt 0.14 - MATE 1.20 - Xfce 4.12 "If you simply want to try Debian 10 'buster' without installing it, you can use one of the available live images which load and run the complete operating system in a read-only state via your computer's memory... Should you enjoy the operating system you have the option of installing from the live image onto your computer's hard disk."' -- source: https://linux.slashdot.org/story/19/07/07/0426205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This Week On GitHub
by Lawrence D'Oliveiro 07 Jul '19

07 Jul '19

Just some random things I found: * BOOTSTRA.386 <https://github.com/kristopolous/BOOTSTRA.386> -- a Bootstrap theme to make your website look like a text display from the 1980s. Does require JavaScript. * GitHarvester <https://github.com/metac0rtex/GitHarvester> -- scans through GitHub repos for wp-config.php files that people might have “accidentally” published. Those familiar with WordPress may realize that this file can contain such sensitive things username and password information for connecting to a MySQL database. * Arduino-TV-B-Gone <https://github.com/shirriff/Arduino-TV-B-Gone>. TV-B-Gone was intended as a universal remote that could switch off any TV. This project implements the same thing on an Arduino. And they wonder why we can’t have nice things ...

1 0

Privacy-First Browsers Look To Take the Shine Off Google's Chrome
by Peter Reutemann 06 Jul '19

06 Jul '19

'Google's Chrome now reigns as the biggest browser on the block, and the company is facing challenges similar to Microsoft's from competitors, as well as government scrutiny. But Google faces a new wrinkle -- a growing realization among consumers that their every digital move is tracked. "I think Cambridge Analytica acted as a catalyst to get people aware that their data could be used in ways they didn't expect," said Peter Dolanjski, the product lead for Mozilla's Firefox web browser, referring to the scandal in which a political consulting firm obtained data on millions of Facebook users and their friends. And in something of a poetic role reversal, Microsoft is positioning itself to pick up the slack from people who may be fed up with Google's Chrome browser and its questionable privacy practices. Microsoft is expected to release an overhaul of its latest browser, called Edge, in the coming months. Microsoft is just one of a number of companies and organizations looking to take a piece out of Google -- some using the company's own open-source software. One name that might be familiar to most consumers -- Mozilla's Firefox browser -- is also a veteran of the "browser wars" of two decades ago. The nonprofit Mozilla, which has been biting at the heels of leading browsers for most of its existence, is introducing more aggressive privacy settings to try to stand out and take advantage of the privacy stumbles by Google and other tech giants.' -- source: https://news.slashdot.org/story/19/07/05/152233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Maintains a List of Everything You Ever Bought Using Gmail, Even if You Delete All Your Emails
by Peter Reutemann 06 Jul '19

06 Jul '19

'In May, I wrote up something weird I spotted on Google's account management page. I noticed that Google uses Gmail to store a list of everything you've purchased, if you used Gmail or your Gmail address in any part of the transaction. If you have a confirmation for a prescription you picked up at a pharmacy that went into your Gmail account, Google logs it. If you have a receipt from Macy's, Google keeps it. If you bought food for delivery and the receipt went to your Gmail, Google stores that, too. You get the idea, and you can see your own purchase history by going to Google's Purchases page. Google says it does this so you can use Google Assistant to track packages or reorder things, even if that's not an option for some purchases that aren't mailed or wouldn't be reordered, like something you bought at a store. At the time of my original story, Google said users can delete everything by tapping into a purchase and removing the Gmail. It seemed to work if you did this for each purchase, one by one. This isn't easy -- for years worth of purchases, this would take hours or even days of time. So, since Google doesn't let you bulk-delete this purchases list, I decided to delete everything in my Gmail inbox. That meant removing every last message I've sent or received since I opened my Gmail account more than a decade ago. Despite Google's assurances, it didn't work.' -- source: https://tech.slashdot.org/story/19/07/05/1728200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fake Samsung Firmware Update App Tricks More Than 10 Million Android Users
by Peter Reutemann 06 Jul '19

06 Jul '19

'Over ten million users have been duped in installing a fake Samsung app named "Updates for Samsung" that promises firmware updates, but, in reality, redirects users to an ad-filled website and charges for firmware downloads. From a report: "I have contacted the Google Play Store and asked them to consider removing this app," Aleksejs Kuprins, malware analyst at the CSIS Security Group, told ZDNet this week in an interview, after publishing a report on the app's shady behavior earlier today. The app takes advantage of the difficulty in getting firmware and operating system updates for Samsung phones, hence the high number of users who have installed it. "It would be wrong to judge people for mistakenly going to the official application store for the firmware updates after buying a new Android device," the security researcher said. "Vendors frequently bundle their Android OS builds with an intimidating number of software, and it can easily get confusing."' -- source: https://tech.slashdot.org/story/19/07/05/1456200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0