September 2019 - wlug - list.wlug.org.nz

New Simjacker Attack Exploited In the Wild To Track Users For At Least Two Years
by Peter Reutemann 13 Sep '19

13 Sep '19

'Security researchers have disclosed today a major SMS-based attack method being abused in the real world by a surveillance vendor to track and monitor individuals. An anonymous reader shares a report: "We are quite confident that this exploit has been developed by a specific private company that works with governments to monitor individuals," security researchers from AdaptiveMobile Security said in a report. "We believe this vulnerability has been exploited for at least the last 2 years by a highly sophisticated threat actor in multiple countries, primarily for the purposes of surveillance." The attack, named Simjacker, works by attackers sending SMS messages to victims' phones. The SMS messages contain STK instructions that are run by a victim's SIM card to gather location data and the IMEI code, which is then sent through an SMS message to a logging system. Researchers said they've seen Simjacker being abused to track hundreds of victims for two years, yet it is unclear if the victims are criminals tracked by law enforcement, or dissidents tracked by oppressive regimes. Over one billion smartphone users use SIM cards deemed vulnerable to this attack.' -- source: https://it.slashdot.org/story/19/09/12/1637232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Period Tracker Apps Used By Millions Of Women Are Sharing Incredibly Sensitive Data With Facebook
by Peter Reutemann 11 Sep '19

11 Sep '19

'Period tracker apps are sending deeply personal information about women's health and sexual practices to Facebook, new research has found. From a report: UK-based advocacy group Privacy International, sharing its findings exclusively with BuzzFeed News, discovered period-tracking apps including MIA Fem and Maya sent women's use of contraception, the timings of their monthly periods, symptoms like swelling and cramps, and more, directly to Facebook. Women use such apps for a range of purposes, from tracking their period cycles to maximizing their chances of conceiving a child. On the Google Play store, Maya, owned by India-based Plackal Tech, has more than 5 million downloads. Period Tracker MIA Fem: Ovulation Calculator, owned by Cyprus-based Mobapp Development Limited, says it has more than 2 million users around the world. They are also available on the App Store. The data sharing with Facebook happens via Facebook's Software Development Kit (SDK), which helps app developers incorporate particular features and collect user data so Facebook can show them targeted ads, among other functions. When a user puts personal information into an app, that information may also be sent by the SDK to Facebook.' -- source: https://yro.slashdot.org/story/19/09/10/209208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Will Soon Encrypt DNS Requests By Default
by Peter Reutemann 11 Sep '19

11 Sep '19

'This month Firefox will make DNS over encrypted HTTPS the default for the U.S., with a gradual roll-out starting in late September, reports Engadget: Your online habits should be that much more private and secure, with fewer chances for DNS hijacking and activity monitoring. Not every request will use HTTPS. Mozilla is relying on a "fallback" method that will revert to your operating system's default DNS if there's either a specific need for them (such as some parental controls and enterprise configurations) or an outright lookup failure. This should respect the choices of users and IT managers who need the feature turned off, Mozilla said. The team is watching out for potential abuses, though, and will "revisit" its approach if attackers use a canary domain to disable the technology. Users will be given the option to opt-out, explains Mozilla's official announcement. "After many experiments, we've demonstrated that we have a reliable service whose performance is good, that we can detect and mitigate key deployment problems, and that most of our users will benefit from the greater protections of encrypted DNS traffic." "We feel confident that enabling DNS-over-HTTPS by default is the right next step."' -- source: https://news.slashdot.org/story/19/09/08/0318237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The State Of Windows RT Strike 2
by Lawrence D'Oliveiro 11 Sep '19

11 Sep '19

The IFA show currently on in Berlin <https://www.theregister.co.uk/2019/09/10/windows_on_arm_intel/> has a couple of exhibitors showing off devices running Windows-on-ARM. (Or, more accurately, Windows-on-specific-Qualcomm-ARM-chipsets-only.) While they offer good battery life, they are expensive, and have compatibility issues (no emulation for 64-bit Windows x86 executables, only 32-bit ones). And Intel clearly doesn’t like them.

1 0

Mozilla Launches VPN as Part of Resurrected Firefox Test Pilot Program
by Peter Reutemann 10 Sep '19

10 Sep '19

'Mozilla is resurrecting its recently expunged Test Pilot program with a renewed focus on privacy-focused tools and products. The Firefox developer today lifted the lid on the first product to emerge from the new Test Pilot, and it appears to be something akin to a virtual private network (VPN) in all but name. From a report: Firefox Private Network, as the new tool is called, is available in beta today for logged-in Firefox desktop users in the U.S. only, and is accessible through a browser extension. By way of a quick recap, Mozilla debuted Firefox Test Pilot a decade ago but then relaunched it back in 2016. Test Pilot went on to attain an average of 100,000 daily users, each looking to test Mozilla's latest developments -- including a price-tracking feature for online shoppers, content recommendations based on browsing activity, and more. Some of these became full-fledged features within Firefox and others did not, but back in January Mozilla announced it was killing its Test Pilot program altogether. This came as something of a surprise given Mozilla's own statements about the success of the program. At the time, Mozilla said it was "evolving" its approach to experimentation and suggested it was looking to ideate more widely across the company. Fast-forward nine months, and Firefox Test Pilot is back for a third time.' -- source: https://yro.slashdot.org/story/19/09/10/1514241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Weakness in Intel chips lets researchers steal encrypted SSH keystrokes
by Peter Reutemann 10 Sep '19

10 Sep '19

'In late 2011, Intel introduced a performance enhancement to its line of server processors that allowed network cards and other peripherals to connect directly to a CPU's last-level cache, rather than following the standard (and significantly longer) path through the server's main memory. By avoiding system memory, Intel's DDIO—short for Data-Direct I/O—increased input/output bandwidth and reduced latency and power consumption. Now, researchers are warning that, in certain scenarios, attackers can abuse DDIO to obtain keystrokes and possibly other types of sensitive data that flow through the memory of vulnerable servers. The most serious form of attack can take place in data centers and cloud environments that have both DDIO and remote direct memory access enabled to allow servers to exchange data. A server leased by a malicious hacker could abuse the vulnerability to attack other customers. To prove their point, the researchers devised an attack that allows a server to steal keystrokes typed into the protected SSH (or secure shell session) established between another server and an application server.' -- source: https://arstechnica.com/information-technology/2019/09/weakness-in-intel-ch… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Servers Infected With New Lilocked (Lilu) Ransomware
by Peter Reutemann 10 Sep '19

10 Sep '19

'Thousands of web servers have been infected and had their files encrypted by a new strain of ransomware named Lilocked (or Lilu). Infections have been happening since mid-July, and have intensified in the past two weeks, ZDNet has learned. Based on current evidence, the Lilocked ransomware appears to target Linux-based systems only. The way the Lilocked gang breaches servers and encrypts their content is currently unknown. A thread on a Russian-speaking forum puts forward the theory that crooks might be targeting systems running outdated Exim (email) software. It also mentions that the ransomware managed to get root access to servers by unknown means. Lilocked doesn't encrypt system files, but only a small subset of file extensions, such as HTML, SHTML, JS, CSS, PHP, INI, and various image file formats. This means infected servers continue to run normally. According to French security researcher Benkow, Lilocked has encrypted more than 6,700 servers, many of which have been indexed and cached in Google search results. However, the number of victims is suspected to be much much higher. Not all Linux systems run web servers, and there are many other infected systems that haven't been indexed in Google search results. Why it should scare you: - affects Linux servers - so far the vector of infection / vulnerability is unknown - you can craft a Google search to watch it spread! ' -- source: https://it.slashdot.org/story/19/09/09/2246218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Web Scraping Is Legal--For Now
by Lawrence D'Oliveiro 10 Sep '19

10 Sep '19

LinkedIn has been suing a company called hiQ for scraping information from public user profiles, and so far it has lost, twice <https://www.theregister.co.uk/2019/09/09/hiq_wins_linkedin_appeal/>. But of course LinkedIn, being owned by Microsoft, has much deeper legal pockets, and will simply continue a war of attrition until hiQ gives up.

1 0

Guidemaster: How to buy a Chromebook, plus our best picks
by Peter Reutemann 10 Sep '19

10 Sep '19

'Chromebooks dominated the affordable laptop scene in 2018. The same wasn't true just a few years ago, when most were unclear what to do with Google's browser-based operating system. But now, after Chromebooks have successfully infiltrated the education market, users both young and old are familiar with Chrome OS. Chrome OS runs exclusively on Chromebooks, the name for the laptops, two-in-ones, and now tablets that run Google's operating system. If you've used the Chrome Web browser before, you know how to use Chrome OS—the browser is the portal to nearly everything you can do on Chrome OS. Google created an operating system that's simple to use, efficient, and low maintenance in the sense that it doesn't take a ton of power to run a Chromebook well. All of those factors, plus the recent introduction of Android apps into the ecosystem, have made Chromebooks popular with younger users, teachers, and anyone who works and plays primarily within the confines of the Chrome Web browser. As people gravitate to Chromebooks, OEMs have been producing more and more of them. There is a plethora of Chromebooks available now, some at dirt cheap prices and others at premium prices, making it hard to know which you should buy. Luckily, Ars has tested some of the most popular Chromebooks, and we can offer some insight as to which ones are worth your money.' -- source: https://arstechnica.com/gadgets/2019/09/guidemaster-how-to-buy-a-chromebook… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome OS Bug Started Mistakenly Sending 'Final Update' Notifications
by Peter Reutemann 09 Sep '19

09 Sep '19

'Like it or not, Chromebooks do have something of an expiration date when you purchase them, namely that one day they'll stop receiving updates. Thankfully, that date is typically over five years after the Chromebook's original release. For some, however, Chrome OS has been wrongly indicating this week that their Chromebook has received its "final update" many years too early. Just like the Chrome browser on desktop and Android, Chrome OS has four different update "channels" -- Stable, Beta, Dev, and Canary. Each one of these after Stable trades a level of stability for more rapid updates, with Canary receiving highly unstable updates almost every day. People who are bold enough to put their Chromebook on Dev or Canary have been facing an interesting new issue for the past few days. Upon restarting their device, Chrome OS immediately displays a notification warning that "this is the last automatic software and security update for this Chromebook." Of course, if you're seeing this message this week, there's a decent chance that this is not actually the case. Instead, these final update warnings are caused by a bug in the most recent versions of Chrome OS. ' -- source: https://tech.slashdot.org/story/19/09/09/0113215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Feature-rich Vivaldi Browser Arrives on Android
by Peter Reutemann 09 Sep '19

09 Sep '19

'Almost three years after launching its desktop version, cross-platform browser Vivaldi has finally released its mobile app today. From a report: The brainchild of Opera's co-founder Jon von Tetzchner published an Android beta version today that brings swipe gesture for navigation, built-in note-taking functionality, and privacy controls including a no-tracking option. While the browser is in beta, I've been using it for a few days, and I haven't faced any major hiccups. Here are some of the features I enjoyed in the new mobile version: Easy bookmark management, easy navigation, plenty of option for tab management, and dark mode, screen capture, notes, and no-tracking features.' -- source: https://tech.slashdot.org/story/19/09/09/1610214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Manjaro Linux Tries Forming A Company To Fund Full-Time Development
by Peter Reutemann 09 Sep '19

09 Sep '19

'Forbes.com shares some big Linux news: Since 2011, Arch Linux-based Manjaro has focused on being a simple-to-use, accessible Linux desktop distribution with a friendly community... But as of today, Manjaro Linux is no longer just a Linux distribution -- it's officially transforming into a company with ambitious plans for its future. Say hello to Manjaro GmbH & Co. KG. The announcement happened just hours ago, via Manjaro developer Philip Müller. It's not the catchiest name, but the advantages to this move seem beneficial to the both the Manjaro project and the community using it. Müller says that for quite some time he's been researching "ways to secure the project in its current form and how to allow for activities which can't be undertaken as a 'hobby project.'" Crucially, he and the team wanted to reach new heights and be able to invest considerably more time into the project, without compromising the way its currently operating. To that end, the Manjaro team is announcing the formation of an established company, Manjaro GmbH & Co. KG, "to enable full-time employment of maintainers and exploration of future commercial opportunities." They'll also be taking on Blue Systems -- a German IT company specializing in Free and Libre software -- as an advisor. Additionally, the team will transfer the ownership of all donations -- and the allocation of donations -- to fiscal hosts CommunityBridge and OpenCollective, which will both secure donations and make their use transparent... At this stage is look like there's a distinction between what will change in the immediate future, and what the company will strive for. The biggest immediate change -- one that Manjaro supporters may applaud -- is that developers Philip Müller and Bernhard Landauer can now commit to the distribution in a full-time capacity, with an eye toward taking on even more employees down the road. "One of our main goals is to improve our infrastructure and continuously work on the essentials and requirements of our distro as a professional endeavor," writes Müller. "Our hope is to soon be able to include additional contributors on a paid basis."' -- source: https://linux.slashdot.org/story/19/09/08/2342247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Finally Starts Shipping Its Privacy-Focused 'Librem 5' Smartphone
by Peter Reutemann 09 Sep '19

09 Sep '19

'"It's here! Purism announces shipment of the Librem 5," writes long-time Slashdot reader Ocean Consulting: Librem 5 is a landmark mobile device with a dedicated platform, runs PureOS Linux, and is the first mobile phone to seek hardware certification from the Free Software Foundation. Initially a crowd sourced funding campaign, the phone embraces principles of free software and user privacy. IP native communication is supported via Matrix. Privacy features include hardware kill switches for camera, microphone, cellular, wifi, Bluetooth and GPS. "The Librem 5 phone is built from the ground up to respect the privacy, security, and freedoms of society," reads the site's official announcement. "It is a revolutionary approach to solving the issues that people face today around data exploitation -- putting people in control of their own digital lives." They're adopting an "iterative" shipping schedule -- publishing a detailed schedule defining specific batches and their features with corresponding shipping dates. "Each iteration improves upon the prior in a rapid rolling release throughout the entire first version of the phone... As slots in a particular early batch free up, we will open it up for others in a later batch to join in, according to the date of the order."' -- source: https://mobile.slashdot.org/story/19/09/08/2228201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Google's Chrome Has My Dead Grandpa's Data and He Never Used the Internet'
by Peter Reutemann 08 Sep '19

08 Sep '19

'Forbes article by Joe Toscano, a former experience design consultant for Google who in 2017 "decided to step away from my role consulting with Google, due to ethical concerns." This summer he got a big surprise when he looked in Chrome's "addresses" panel at chrome://settings/addresses It turns out Google has info connecting me to my grandma (on my dad's side) who's alive and well but has never had the internet, and my grandpa (on my mom's side), who recently passed away in March 2019 and also never had the internet. This was disturbing for several reasons, the biggest of which being that neither of them had ever logged onto the internet in their lives. Neither even had the internet in their homes their entire lives! Beyond that, Google knew their exact addresses and their middle initials. I couldn't even have told you those things about my grandparents... [T]he data wasn't manually entered by me or anyone using my account, but yet the data is associated with my account? How did that happen? The only thing I can think of is that at one point in history my grandpa gave his information to someone or some company in real life and his information was sold to Google at one point or another... But then that led me to another question: How did his data get associated with my Google account...? Other questions I have: What other information does Google have about me/my family/others that I don't know about...? He's now asking readers if they have any idea how Google connected him to his dead grandpa -- and whether Google is somehow creating an ancestry database. Toscano also discovered Chrome has been creating a list of "Never Saved" passwords at chrome://settings/passwords?search=credentials even though "At no point did I tell Google to create and store a list of websites I had logged into that they didn't get access to but would like access to at some point in the future. Maybe in the Terms of Service/Privacy Policy I agreed to this, but who knows? Not the majority of us, and it's just creepy." And in an update Toscano writes that he hopes the article will "provoke thought" about "why we willingly allow this to happen": Why is it okay that the internet is designed to be a surveillance machine? Why isn't it designed to be private by design? Is this how we want to carry on? Just because something is legal doesn't mean it's right. What would you like to see done? How would you like to see things changed?' -- source: https://yro.slashdot.org/story/19/09/07/168245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kiwis Seem Skeptical About Streaming
by Lawrence D'Oliveiro 08 Sep '19

08 Sep '19

<https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122652…>: ... according to research conducted by Opinion Compare, more than half of us are unhappy at the prospect of having to stream the six-week tournament, which will be broadcast on Spark Sport. Seems like people have little confidence that Spark Sport will be able to deliver a reliable service, even though ... in the event Spark's streaming falls over during the Rugby World Cup, the telco has said it will transfer coverage to TVNZ "within a few minutes".

1 1

Voice-Mimicking Software Reportedly Used In Major Theft
by Lawrence D'Oliveiro 05 Sep '19

05 Sep '19

>From the “If Mission Impossible* Were Being Remade Today” files <https://www.stuff.co.nz/technology/digital-living/115560260/artificial-inte…>: Thieves used voice-mimicking software to imitate a UK company executive's speech and dupe his subordinate into sending hundreds of thousands of dollars to a secret account, the company's insurer said, in a remarkable case that some researchers are calling one of the world's first publicly reported artificial intelligence heists. How was the scam exposed? After the thieves made a second request, the director grew suspicious and called his boss directly. Then the thieves called back, unravelling the ruse: The fake "'Johannes' was demanding to speak to me whilst I was still on the phone to the real Johannes!" the director wrote in an email the insurer shared with The Washington Post. *That’s the original classic TV series, not the movies, of course.

1 0

Zero-day privilege escalation disclosed for Android
by Peter Reutemann 05 Sep '19

05 Sep '19

'Researchers have disclosed a zero-day vulnerability in the Android operating system that gives a major boost to attackers who already have a toe-hold on an affected device. The privilege-escalation flaw is located in the V4L2 driver, which Android and other Linux-based OSes use to capture real-time video. The vulnerability results from a "lack of validating the existence of an object prior to performing operations on the object," researchers with Trend Micro's Zero Day Initiative said in a blog post published Wednesday. Attackers who already have untrusted code running with low privileges on a device can exploit the bug to access privileged parts of the Android kernel. The severity score is rated a 7.8 out of a possible 10 points.' -- source: https://arstechnica.com/information-technology/2019/09/android-zeroday-give… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Free Software Advocate Richard Stallman Spoke at Microsoft Research This Week
by Peter Reutemann 05 Sep '19

05 Sep '19

'Free Software advocate Richard M. Stallman gave a talk at Microsoft Campus yesterday. Stallman was invited by Microsoft Research. Stallman's talk was related -- as most of his talks -- with Free Software, Privacy and the GPLv3. He also had a list of small requests to Microsoft: "make Github push users to better software license hygiene, make hardware manufacturers to publish their hardware specs, make it easier to workaround Secure Boot." While Microsoft has changed its attitude toward Open Source Software in the last years, this does not mean RMS has made peace with Microsoft: "If you're wondering whether Stallman's distaste for Microsoft has lessened over the years, his personal home page makes it clear that it has not".' -- source: https://news.slashdot.org/story/19/09/05/1720205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 10 Launches Today, and Pixel Phones Get the Day One Update
by Peter Reutemann 04 Sep '19

04 Sep '19

'Android 10 is finally finished! The next big Android update, which we've been examining for most of the year as the "Android Q Beta," starts rolling out to devices today. As usual, Android 10 is arriving on Pixel phones first (even the three-year-old Pixel 1), and Google says it is "working with a number of partners to launch or upgrade devices to Android 10 this year." Google has introduced a new branding strategy for Android, by the way, so there's no "Q" snack name with this release. In 2019, it's just "Android 10." Android 10 brings a number of changes to the world's most popular mobile operating system. First up, devices are getting "fully gestural" navigation, which lets you navigate around the phone with swipe gestures. Just like the implementation on the iPhone X, gesture navigation removed the need for a dedicated space for navigation buttons, allowing for more space for app content. There's finally full support for a dark theme, which will turn the entire system UI and any supported apps from the usual black text on a white background to white text on a black background. (That option significantly reduces the amount of light a phone puts out and saves battery life on OLED displays.) Google has also promised dark mode support for "all" of the Google apps in time for Android 10's launch, so we should be seeing updates to Gmail, Google Play, Google Maps, and a million other Google apps sometime soon. Other features of Android 10 include a faster share sheet, a "bubbles" API for floating apps, 230 new emoji, improved security and privacy options, and smarter notification panel.' -- source: https://tech.slashdot.org/story/19/09/03/218224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

InvizBox 2 redefines what “privacy” routers can do
by Peter Reutemann 04 Sep '19

04 Sep '19

'Four years ago, in the wake of some controversy over another Kickstarter-based launch, a team in Ireland decided to produce a better Wi-Fi router for travel privacy. Called the InvizBox, the router was focused on making connecting to privacy-focused network services such as VPNs and the Tor anonymizing network easier. A lot has happened since then. And now, InvizBox has released a new iteration of its wired Wi-Fi router, the InvizBox 2. Two years ago, the InvizBox team achieved its crowd-funding goals to move ahead with this design. After a long road, that funding has finally paid off. Totally open source, bundled with a VPN service capable of delivering up to 100 megabits per second of traffic (your broadband willing), and painless to configure, this little disc-shaped router is powerful enough to be a primary home router—or it can be used on the road when plugged into a potentially unfriendly local network to tunnel users out to safety. The router can also be used in concert with InvizBox Go—a mobile Wi-Fi router with VPN capability—to create a safe tunnel back to your home network. The base price for InvizBox 2 is $99, but there's a discount available right now for orders through the InvizBox site.' -- source: https://arstechnica.com/information-technology/2019/09/invizbox-2-redefines… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Interview With Eben Upton
by Lawrence D'Oliveiro 03 Sep '19

03 Sep '19

Head of the Raspberry π Foundation, Eben Upton, chats to The Register <https://www.theregister.co.uk/2019/09/03/eben_upton_pi_store/> about his wildly successful brainchild. All models put together are shipping 6 million units per year. Increasing numbers of them are going to system integrators in China, who are building them into commercial products that are then sold worldwide. Asked whether Windows 10 IoT Edition will ever run on the π 4: "We have nothing to share", said Upton, before sighing that it was "a shame." Also: ... back when the original Pi launched, Upton said the questions were: "Can you run Office? Can you run Internet Explorer?" Now, the question (which will be music to Linux fans' ears) is "Can you run Chromium?" as the Microsoft requirement dwindles. Somehow I get the feeling that Windows 10 on Raspberry π is a dying product ...

1 0

Over 47,000 Supermicro Servers Are Exposing BMC Ports on the Internet
by Peter Reutemann 03 Sep '19

03 Sep '19

'Catalin Cimpanu, writing for ZDNet: More than 47,000 workstations and servers, possibly more, running on Supermicro motherboards are currently open to attacks because administrators have left an internal component exposed on the internet. These systems are vulnerable to a new set of vulnerabilities named USBAnywhere that affect the baseboard management controller (BMC) firmware of Supermicro motherboards. Patches are available to fix the USBAnywhere vulnerabilities, but Supermicro and security experts recommend restricting access to BMC management interfaces from the internet, as a precaution and industry best practice.' -- source: https://tech.slashdot.org/story/19/09/03/2029210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Exploits Are Now Worth More Than iOS Exploits for the First Time
by Peter Reutemann 03 Sep '19

03 Sep '19

'Zerodium, a company which claims it buys and then resells software exploits to government and law enforcement agencies, has updated its price list today, and Android exploits are worth more than iOS exploits for the first time ever. From a report: According to the company, starting today, a zero-click (no user interaction) exploit chain for Android can get hackers and security researchers up to $2.5 million in rewards. A similar exploit chain impacting iOS is worth only $2 million. Zerodium's new price for Android exploits is almost twelve times more when compared to the maximum of $200,000 the company was willing to offer a year ago, and even 100 times more than Zerodium was paying for some of the lower-impact Android exploits. Zerodium has timed its announcement with Google's official release for Android 10, scheduled for late' -- source: https://tech.slashdot.org/story/19/09/03/164253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 69 Ratchets Up Tracking Protection, Switching it On by Default
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla has switched on Firefox's tracking protection feature for everyone on Windows and Android, dialing up its effort to protect privacy from website publishers and advertisers that would like to keep tabs on your online behavior. From a report: Mozilla enabled tracking protection for new Firefox users in June, but now it's on for everyone, the nonprofit said Tuesday. Tracking protection is all the rage among browser makers, including Apple's Safari, Brave Software's Brave and Microsoft's new Chromium-based Edge. Even Google's Chrome, long the laggard among major browsers, is starting to tackle the problem. It's a thorny issue for websites and advertisers that seek to improve advertising revenue by targeting ads based on their assessment of your interests. "Currently over 20% of Firefox users have Enhanced Tracking Protection on. With today's release, we expect to provide protection for 100% of ours users by default," Mozilla said in a blog post Tuesday.' -- source: https://news.slashdot.org/story/19/09/03/1322212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming Firefox Update Will Decrease Power Usage on macOS by Up To Three Times
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla teased today an upcoming update for Firefox on macOS that it says will reduce power consumption by a factor of up to three. From a report: The primary beneficiaries of this upcoming update are Macbook users, who can now expect longer battery lives while using Firefox. Firefox's increased battery consumption has been a problem for Mozilla, and a black stain on the Firefox Quantum release -- a revamped, performance-centric version of the older Firefox browser. While Firefox Quantum has received praises for its increased page loading speeds, Macbook users haven't been that delighted, especially when they're mobile and have to rely on the notebook's battery as long as possible.' -- source: https://news.slashdot.org/story/19/09/03/0654202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0