October 2020 - wlug - list.wlug.org.nz

Three npm Packages Opened Remote-Access Shells on Linux and Windows Systems
by Peter Reutemann 19 Oct '20

19 Oct '20

'"Three JavaScript packages have been removed from the npm portal on Thursday for containing malicious code," reports ZDNet. "According to advisories from the npm security team, the three JavaScript libraries opened shells on the computers of developers who imported the packages into their projects." The shells, a technical term used by cyber-security researchers, allowed threat actors to connect remotely to the infected computer and execute malicious operations. The npm security team said the shells could work on both Windows and *nix operating systems, such as Linux, FreeBSD, OpenBSD, and others. All three packages were uploaded on the npm portal in May (first) and September 2018 (last two). Each package had hundreds of downloads since being uploaded on the npm portal. The packages names were: plutov-slack-client nodetest199 nodetest1010 "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," the npm security team said.' -- source: https://it.slashdot.org/story/20/10/18/2321208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.10 Solves the Year 2038 Problem Until 2486
by Peter Reutemann 19 Oct '20

19 Oct '20

'The Linux 5.10 kernel's XFS file-system will have two new on-disk meta-data capabilities, reports Phoronix: 1. The size of inode btrees in the allocation group is now recorded. This is for increasing redundancy checks and also allowing faster mount times. 2. Support for timestamps now until the year 2486. This "big timestamps" feature is the refactoring of their timestamp and inode encoding functions to handle timestamps as a 64-bit nanosecond counter and bit shifting to increase the effective size. This now allows XFS to run well past the Year 2038 problem (where storing the time since 1970 in seconds will no longer fit in a signed 32-bit integer and thus wraparound) to now the Year 2486. Making a new XFS file-system with bigtime enabled allows a timestamp range from December 1901 to July 2486 rather than December 1901 to January 2038. For preserving backwards compatibility, the big timestamps feature is not currently enabled by default. ' -- source: https://linux.slashdot.org/story/20/10/17/2237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Hackers’ Wiki
by Lawrence D'Oliveiro 18 Oct '20

18 Oct '20

Found this useful collection of Bash tips and tricks. May not be all that well maintained, but I found some handy pages, like this list <https://wiki.bash-hackers.org/scripting/bashchanges> of the more interesting features that were introduced in the various versions of Bash. I was looking for something like this because the Bash version in my Debian Unstable installations was just upgraded to 5.1.

1 0

Need A New Computer For Homeschooling? How About a 2007-Vintage MacBook?
by Lawrence D'Oliveiro 17 Oct '20

17 Oct '20

PC sales have been given a boost by, among other things, the need for schooling the young ones from home, but there’s no reason why they need the latest and greatest hardware for this. How about something from over a decade ago? Here a long-time collector of same <https://www.theregister.com/2020/10/16/need_a_new_computer_for/> reports how Apple-branded gear from that era can be obtained quite cheaply, is a lot easier to service and upgrade than the current stuff, and while it is not supported by current versions of Apple’s own OS, something like Linux will work just fine. That way you get a modern web browser, and enough grunt to stream video. What more could you ask for?

1 0

Quote Of The Week: The State Of Microsoft
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

>From this <https://forums.theregister.com/forum/all/2020/10/15/microsoft_adopting_goog…> reader comment: ... today's Microsoft users really are left with best guesses [as to what their software is doing]. It's sad that web searches reveal that everybody's first concern on [Macs]/Linux is installing 3rd party things, but the first concern for everybody on Windows is uninstalling 1st party things. Ironically, nobody on Windows seems to use the term "jailbreak” ... ... yet.

1 0

Should Windows Move To A Linux Kernel?
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

An engineer at Canonical has poured cold water <https://www.theregister.com/2020/10/15/even_2020_cannot_bring_forth/> over the suggestion by Eric Raymond that Microsoft might move to substituting a Linux kernel over its own in the Windows OS. Sure, the idea seems complicated and expensive, and very likely troublesome, too. But since when have Windows upgrades not been troublesome? Even updates between different versions of what is ostensibly all the same OS, Windows 10, have been far from smooth lately. Attempting the level of compatibility needed for every Win32 API and syscall would be a huge undertaking. Consider that the WINE folks have already provided a usable fraction of this, with resources that are only a drop in the bucket compared to those available to Microsoft. And as for the vast array of drivers enjoyed by the NT kernel, Barnes reckoned that shunting them into Linux would cost millions. Sure. But would it cost as much as having to continue maintaining them? Particularly since most of those drivers would not be needed, because Linux already has its own native ones. Furthermore, rebasing Windows on Linux could have the ironic effect of stifling competition should a kernel monoculture take hold. Interesting to discuss this use of the term “monoculture”. Linux is already adaptable to a wider range of platforms and applications than Windows can manage. This in spite of the fact that the Windows NT kernel has been fragmented into a number of different versions, including about 5 or 6 different ones for ARM, with little or no compatibility between them. Linux is able to manager better interoperability than that, even between versions for entirely different architectures.

1 0

Google and Intel Warn of High-Severity Bluetooth Security Bug In Linux
by Peter Reutemann 15 Oct '20

15 Oct '20

'An anonymous reader quotes a report from Ars Technica: Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information. The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it's used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later. So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published "soon." A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth. Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth. "Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure," the advisory states. "BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities." Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can't upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn't immediately respond to emails asking for additional details about this vulnerability. Ars Technica points out that since BleedingTooth requires proximity to a vulnerable device, there's not much reason for people to worry about this vulnerability. "It also requires highly specialized knowledge and works on only a tiny fraction of the world's Bluetooth devices," it adds.' -- source: https://it.slashdot.org/story/20/10/15/0043232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.20 Released
by Peter Reutemann 15 Oct '20

15 Oct '20

'KDE's Plasma 5.20 is now available, bringing a bunch of refinements as well as some larger features. Some of the KDE Plasma 5.20 highlights include (via Phoronix): - Numerous fixes to the KWin window manager / compositor including a number of Wayland fixes. Among the Wayland work in Plasma 5.20 includes Klipper support and middle-click paste, mouse and touchpad support nearly on par to X11, window thumbnails in the task manager, crash fixes, and more. - Improved notifications. - Different redesigns and additions to the KDE System Settings from SMART monitoring to better looking interfaces. - Redesigned on-screen displays. - Various tack manager and system tray improvements. ' -- source: https://tech.slashdot.org/story/20/10/14/0058213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom To Roll Out End-to-End Encrypted (E2EE) Calls
by Peter Reutemann 15 Oct '20

15 Oct '20

'Video conferencing platform Zoom announced today plans to roll out end-to-end encryption (E2EE) capabilities starting next week. From a report: E2EE will allow Zoom users to generate individual encryption keys that will be used to encrypt voice or video calls between them and other conference participants. These keys will be stored locally and will not be shared with Zoom servers, meaning the software company won't be able to access or intercept any ongoing E2EE meetings. Support for E2EE calls will first be part of Zoom clients to be released next week. To use the new feature, users must update theri clients next week and enable support for E2EE calls at the account level. This green shield will contain a lock if E2EE is active. If the lock is absent, Zoom will use its default AES 256-bit GCM encryption scheme, which the company uses to secure current communications, but which the company can also intercept.' -- source: https://yro.slashdot.org/story/20/10/14/1722237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Versus Jamstack
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

Welcome to a new buzzword: “Jamstack”, which stands for “JavaScript, APIs and HTML Markup”. Or, in other words, websites made up of static pages, with all the dynamism implemented by JavaScript running on the browser. Hmm, maybe not quite all--that “APIs” part does still imply server-side dynamism of some sort. Seems the founder of WordPress is less than keen on the idea. WordPress, of course, is built very heavily around PHP code doing dynamic things (like reading and writing databases) server-side. Maybe the difference between the two is more one of degree and centralization rather than anything hard-and-fast. <https://www.theregister.com/2020/10/13/wordpress_matt_vs_netlify_matt/>

1 0