December 2020 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Blender At Cannes
by Lawrence D'Oliveiro 01 Jan '21

01 Jan '21

Just found out about this French-made animation <https://en.wikipedia.org/wiki/I_Lost_My_Body> which was shown at Cannes 2019, and won the “Nespresso Grand Prize”. I mention it because its trivia page at IMDb <https://www.imdb.com/title/tt9806192/trivia> says “Created using the free open-source software Blender”. Note that it is not a typical 3D graphics animation: it is (mostly) drawn/rendered in a style that looks like traditional 2D cel animation. Blender has a feature called the “Grease Pencil” that lets you combine 3D and 2D-style art into the same workflow. This goes beyond simple “toon shaders” as found in other 3D software, to actually let you draw brushstrokes in 3D space, as geometric objects in their own right.

1 0

Should Intel Stop Making Chips?
by Lawrence D'Oliveiro 01 Jan '21

01 Jan '21

Intel has suffered more than one misstep in its recent attempts to move to more advanced chip-fabrication technologies. Performance-wise, AMD has been eating its breakfast. RISC-based alternative architectures like ARM and RISC-V are eating into the x86 market. Now an investor fund <https://arstechnica.com/gadgets/2020/12/activist-hedge-fund-advises-intel-t…> is suggesting that Intel outsource its chip-making facilities altogether (like AMD did years ago). This part was news to me: “Intel has lost some $60 billion in market value over the past year...”. According to Yahoo Finance <https://finance.yahoo.com/quote/INTC/>, its current market cap is just a bit over $200 billion. So that $60 billion represents a huge drop in its share price.

1 0

Mastodon Versus Gab
by Lawrence D'Oliveiro 29 Dec '20

29 Dec '20

(OK, this is an old article, but I just noticed it.) Mastodon is not a social network, but a “federation” of social networks. It is built on open-source protocols and software, which you can use to set up your own social-network node. You can then become part of the “fediverse” by associating with other Mastodon nodes, allowing users of one to interact with users of another. What is allowed on a node is entirely up the policies of the node admins. The Fediverse is intentionally decentralized, and admins of one node do not have the power to control what users do on another node. Contrast this with traditional social-networking sites like Facebook and Twitter, each of which is controlled by a single company. Naturally, such autonomy is a double-edged sword. So what do you do when the neo-Nazis move in? Gab, home of those who have promoted violence against various groups based on ethnicity, sexuality etc, is now a Mastodon node. How is the rest of the Fediverse dealing with them? The answer seems to be: you can’t stop them operating, but you can shun them. <https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-n…>

1 0

Linux Kernel Ported to the Nintendo 64
by Peter Reutemann 29 Dec '20

29 Dec '20

'Phoronix reports: It's been a turbulent year and 2020 is certainly ending interesting in the Linux/open-source space... If it wasn't odd enough seeing Sony providing a new official Linux driver for their PlayStation 5 DualSense controller for ending out the year, there is also a new Linux port to the Nintendo 64 game console... Yes, a brand new port to the game console that launched more than two decades ago. Open-source developer Lauri Kasanen who has contributed to Mesa and the Linux graphics stack took to developing a new Nintendo 64 port and announced it this Christmas day. This isn't the first time Linux has been ported to the N64 but prior attempts weren't aimed at potentially upstreaming it into the mainline Linux kernel... This fresh port to the N64 was pursued in part to help port emulators and frame-buffer or console games. And also, the announcement adds, "Most importantly, because I can."' -- source: https://linux.slashdot.org/story/20/12/28/0024241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Let’s Encrypt comes up with workaround for abandonware Android devices
by Peter Reutemann 29 Dec '20

29 Dec '20

'Things were touch-and-go for a while, but it looks like Let's Encrypt's transition to a standalone certificate authority (CA) isn't going to break a ton of old Android phones. This was a serious concern earlier due to an expiring root certificate, but Let's Encrypt has come up with a workaround. Let's Encrypt is a fairly new certificate authority, but it's also one of the world's leading. The service was a major player in the push to make the entire Web run over HTTPS, and as a free, open issuing authority, it went from zero certs to one billion certs in just four years. For regular users, the list of trusted CAs is usually issued by your operating system or browser vendor, so any new CA has a long rollout that involves getting added to the list of trusted CAs by every OS and browser on Earth as well as getting updates to every user. To get up and running quickly, Let's Encrypt got a cross-signature from an established CA, IdenTrust, so any browser or OS that trusted IdenTrust could now trust Let's Encrypt, and the service could start issuing useful certs. When it launched in 2016, Let's Encrypt also issued its own root certificate ("ISRG Root X1") and applied for it to be trusted by the major software platforms, most of which accepted it sometime that year. Now, several years later, with IdenTrust's "DST Root X3" certificate set to expire in September 2021, the time has come for Let's Encrypt to stand on its own and rely on its own root certificate. Since this was submitted four years ago, surely every Web-capable OS currently in use has gotten an update with Let's Encrypt's cert, right? That's true of every mainstream OS except for one. Sitting in the corner of the room, wearing a dunce cap, is Android, the world's only major consumer operating system that can't be centrally updated by its creator. Believe it or not, there are still quite a lot of people running a version of Android that hasn't been updated in four years. Let's Encrypt says it was added to Android's CA store in version 7.1.1 (released December 2016) and, according to Google's official stats, 33.8 percent of active Android users are on a version older than that. Given Android's 2.5 billion strong monthly active user base, that's 845 million people who have a root store frozen in 2016. Oh no.' -- source: https://arstechnica.com/gadgets/2020/12/lets-encrypt-comes-up-with-workarou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Websites That Won’t Let Go
by Lawrence D'Oliveiro 26 Dec '20

26 Dec '20

A friend asked me for help, saying some kind of “gambling app” had managed to attach itself to his Android phone, and kept popping up all the time. I figured he had been tricked into installing something, and we would probably have to track down the app, which likely had some innocuous name to obscure its purpose. Or possibly even worse, it had managed to take advantage of some vulnerability in his OS version to hide itself. Turned out it was a bit simpler than that. It was a website he had visited in Chrome (most likely following a link from an ad or something), which had an interesting technique to prevent him from getting away: it kept pestering him to allow it to access his location data. The trick was, it had maybe a hundred (maybe more) different site names of the form “«nn».example.com”, so when you blocked one, it would simply ask again, the request coming from a different number for «nn». The expectation obviously was that the user would eventually give up and allow one of these sites access. I was able to close the offending tab, but on quitting and restarting Chrome, it would come back. I figured out that his Chrome setting was to restore the last-visited page(s) when Chrome was restarted, which was why this page kept coming up. So I just turned off that setting. I thought maybe there was some deeper malware that would just bring the problem back when that setting was restored, and that he should consult somebody expert on more recent versions of Android to see about a permanent fix. But he suggested re-enabling that setting, just to confirm the problem was still there. And I did. And it wasn’t! So there was no obvious sign of any malware installation, it was just the website itself, exploiting a quirk of browser behaviour, to gain a lock on the user and blackmail them into giving up their location data.

1 0

Redox OS 0.6 Released With Many Fixes, Rewritten Kernel Memory Manager
by Peter Reutemann 26 Dec '20

26 Dec '20

'Redox OS, the micro-kernel based Rust-written operating system, is out with a new Christmas release. From a report: Redox OS 0.6 was released on Christmas Eve with many bug fixes and new features. Redox OS 0.6 features a complete rewrite of its RMM kernel memory manager, improvements to its Relibc C library implementation, Pkgar as a new package format, and Rust code compatibility updates. It's been the better part of two years since Redox 0.5 was released but moving forward they hope to start releasing new updates more often.' -- source: https://tech.slashdot.org/story/20/12/25/1349219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Citrix Devices Are Being Abused as DDoS Attack Vectors
by Peter Reutemann 26 Dec '20

26 Dec '20

'Threat actors have discovered a way to bounce and amplify junk web traffic against Citrix ADC networking equipment to launch DDoS attacks. From a report: While details about the attackers are still unknown, victims of these Citrix-based DDoS attacks have mostly included online gaming services, such as Steam and Xbox, sources have told ZDNet earlier today. The first of these attacks have been detected last week and documented by German IT systems administrator Marco Hofmann. Hofmann tracked the issue to the DTLS interface on Citrix ADC devices. DTLS, or Datagram Transport Layer Security, is a more version of the TLS protocol implemented on the stream-friendly UDP transfer protocol, rather than the more reliable TCP. Just like all UDP-based protocols, DTLS is spoofable and can be used as a DDoS amplification vector. ' -- source: https://tech.slashdot.org/story/20/12/25/1337207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Up To 3 Million Devices Infected By Malware-Laced Chrome and Edge Add-Ons
by Peter Reutemann 17 Dec '20

17 Dec '20

'As many as 3 million people have been infected by Chrome and Edge browser extensions that steal personal data and redirect users to ad or phishing sites, a security firm said on Wednesday. Ars Technica reports: In all, researchers from Prague-based Avast said they found 28 extensions for the Google Chrome and Microsoft Edge browsers that contained malware. The add-ons billed themselves as a way to download pictures, videos, or other content from sites including Facebook, Instagram, Vimeo, and Spotify. At the time this post went live, some, but not all, of the malicious extensions remained available for download from Google and Microsoft. Avast researchers found malicious code in the JavaScript-based extensions that allows them to download malware onto an infected computer. In a post, the researchers wrote: "Users have also reported that these extensions are manipulating their internet experience and redirecting them to other websites. Anytime a user clicks on a link, the extensions send information about the click to the attacker's control server, which can optionally send a command to redirect the victim from the real link target to a new hijacked URL before later redirecting them to the actual website they wanted to visit. User's privacy is compromised by this procedure since a log of all clicks is being sent to these third party intermediary websites. The actors also exfiltrate and collect the user's birth dates, email addresses, and device information, including first sign in time, last login time, name of the device, operating system, used browser and its version, even IP addresses (which could be used to find the approximate geographical location history of the user)." The researchers don't yet know if the extensions came with the malicious code preinstalled or if the developers waited for the extensions to gain a critical mass of users and only then pushed a malicious update. It's also possible that legitimate developers created the add-ons and then unknowingly sold them to someone who intended to use them maliciously. [...] The list Avast provides in its blog post includes links to download locations for both Chrome and Edge. Anyone who has downloaded one of these add-ons should remove it immediately and run a virus scan. ' -- source: https://it.slashdot.org/story/20/12/16/2138210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Officially Support Running Chrome OS On Old PCs
by Peter Reutemann 17 Dec '20

17 Dec '20

'This week, Google acquired a company called Neverware that allows users to turn their old PCs and Macs into a Chromebook with its CloudReady software. Now, Google is planning to make CloudReady into an official Chrome OS release. Engadget reports: When that happens, Neverware says its existing users will be able to seamlessly upgrade to the updated software. Moreover, once that transition is complete, Google will support CloudReady in the same way that it currently does Chrome OS. In the immediate future, Neverware says it's business as usual. The Home Edition of CloudReady isn't changing, and the company says it's committed to supporting its existing education and enterprise customers. Moreover, there's no plan to change pricing at the moment, and Google will honor any current multi-year licenses. Not only does this acquisition make a lot of sense from Google's perspective, but it's hard to see a downside for CloudReady users. The fact the operating system wasn't officially supported by Google was one of the few downsides to the software. It meant you couldn't install Android apps on CloudReady devices, even though it's based on Chromium OS. With this acquisition, support for Android apps becomes much more likely. Direct support from Google will also make the software more appealing to schools and businesses since they can get help directly from the company if they have any technical issues.' -- source: https://tech.slashdot.org/story/20/12/16/219202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Australia Sues Facebook Over Its Use of Onavo To Snoop
by Peter Reutemann 17 Dec '20

17 Dec '20

'Australia's Competition and Consumer Commission (ACCC) is suing Facebook over its use, in 2016 and 2017, of the Onavo VPN app to spy on users for commercial purposes. From a report: The ACCC's case accuses Facebook of false, misleading or deceptive conduct toward thousands of Australian consumers, after it had promoted the Onavo Protect app -- saying it would keep users personal activity data private, protected and secret and not use it for any other purpose, when it was being used to gather data to help Facebook's business. "Through Onavo Protect, Facebook was collecting and using the very detailed and valuable personal activity data of thousands of Australian consumers for its own commercial purposes, which we believe is completely contrary to the promise of protection, secrecy and privacy that was central to Facebook's promotion of this app," said ACCC chair Rod Sims in a statement. "Consumers often use VPN services because they care about their online privacy, and that is what this Facebook product claimed to offer. In fact, Onavo Protect channelled significant volumes of their personal activity data straight back to Facebook."' -- source: https://yro.slashdot.org/story/20/12/16/1652247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gmail Is Broken Right Now, One Day After a Massive Outage
by Peter Reutemann 16 Dec '20

16 Dec '20

'TechCrunch: While it doesn't appear to be completely down like it was yesterday morning, we're hearing many reports from Gmail users that the email service is having major issues right now. Some users are reporting that Gmail is particularly slow, while others are reporting constant error messages. One TechCrunch writer, meanwhile, noticed that emails he was sending to Gmail accounts appeared to immediately bounce, with Gmail's server responding with an error reading "550-5.1.1 The email account that you tried to reach does not exist." Google confirms the issues on its services dashboard, writing at 1:30 PM Pacific that they're impacting a "significant" number of users: "We're aware of a problem with Gmail affecting a significant subset of users. The affected users are able to access Gmail, but are seeing error messages, high latency, and/or other unexpected behavior." In a second update at 2:30 PM, Google says its teams are "continuing to investigate this issue"; as of 3:30 PM, the company says it expects the issues to be fixed by 4:00 PM while noting that time may change. Google says the problems have been resolved, although encrypted email service ProtonMail tweets that the email bouncing issue is widespread, with many emails sent to Gmail users bouncing permanently.' -- source: https://tech.slashdot.org/story/20/12/16/0231237 Yeah, I'm one of those affected by this outage. Haven't been receiving a bunch of emails (but really random, some come through whilst others don't)... In Gmail's defence, I haven't had many problems over all these years! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Bitcon $19,372.83”
by Lawrence D'Oliveiro 16 Dec '20

16 Dec '20

Been getting a minor barrage of emails with subject lines of this form, complete with that misspelling. Truth in spam, for once?

2 1

Microsoft and Industry Partners Seize Key Domain Used In SolarWinds Hack
by Peter Reutemann 16 Dec '20

16 Dec '20

'ZDNet: Microsoft and a coalition of tech companies have intervened today to seize and sinkhole a domain that played a central role in the SolarWinds hack, ZDNet has learned from sources familiar with the matter. The domain in question is avsvmcloud[.]com, which served as command and control (C&C) server for malware delivered to around 18,000 SolarWinds customers via a trojanized update for the company's Orion app. SolarWinds Orion updates versions 2019.4 through 2020.2.1, released between March 2020 and June 2020, contained a strain of malware named SUNBURST (also known as Solorigate). Once installed on a computer, the malware would sit dormant for 12 to 14 days and then ping a subdomain of avsvmcloud[.]com. According to analysis from security firm FireEye, the C&C domain would reply with a DNS response that contained a CNAME field with information on another domain from where the SUNBURST malware would obtain further instructions and additional payloads to execute on an infected company's network. Earlier today, a coalition of tech companies seized and sinkholed avsvmcloud[.]com, transferring the domain into Microsoft's possession. Sources familiar with today's actions described the takedown as "protective work" done to prevent the threat actor behind the SolarWinds hack from delivering new orders to infected computers.' -- source: https://it.slashdot.org/story/20/12/15/2117255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CloudLinux To Invest More Than a Million Dollars a Year Into CentOS Clone
by Peter Reutemann 16 Dec '20

16 Dec '20

'ZDNet: When Red Hat, CentOS's Linux parent company, announced it was "shifting focus from CentOS Linux, the rebuild of Red Hat Enterprise Linux (RHEL), to CentOS Stream, which tracks just ahead of a current RHEL release," it lost a lot of friends. CentOS co-founder, Gregory Kurtzer, immediately announced he'd create his own RHEL clone and CentOS replacement: Rocky Linux. He wasn't the only one. CloudLinux also proclaimed it would create a new CentOS clone Lenix. And, CloudLinux will be putting over a million dollars a year behind it. Why? Igor Seletskiy, CloudLinux CEO and founder, explained, "Red Hat's announcement has left users looking for an alternative with all that CentOS provides and without the disruption of having to move to alternative distributions. We promise to dedicate the resources required to Project Lenix that will ensure impartiality and a not-for-profit community initiative. CloudLinux already has the assets, infrastructure, and experience to carry out the mission, and we promise to be open about the process of developing Project Lenix." [...] Project Lenix will be a free, open-source, community-driven, 1:1 binary compatible fork of RHEL 8 (and future releases). For CentOS users, the company promises Lenix will provide an uninterrupted way to convert existing CentOS servers with absolutely zero downtime or need to reinstall anything. The company even claims you'll be able to port entire CentOS server fleets with a single command with no reinstallation or reboots required. That's a bold claim. But CloudLinux already does that trick with its commercial Linux distribution. If the company says it can do it, I think it can. Lenix is only a placeholder name, notes ZDNet. "[A] yet to be formed governing board will decide on a permanent name for the distribution. If all goes well, the first software release will appear in the first quarter of 2021."' -- source: https://linux.slashdot.org/story/20/12/15/0218245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Group that hacked SolarWinds can bypass MFA account protections
by Peter Reutemann 15 Dec '20

15 Dec '20

'The hackers behind the supply chain attack that compromised public and private organizations have devised a clever way to bypass multi-factor-authentication systems protecting the networks they target. Researchers from security firm Volexity said on Monday that it had encountered the same attackers in late 2019 and early 2020 as they penetrated deep inside of a think tank organization no fewer than three times. During one of the intrusions, Volexity researchers noticed the hackers using a novel technique to bypass MFA protections provided by Duo. After having gained administrator privileges on the infected network, the hackers used those unfettered rights to steal a Duo secret known as an akey from a server running Outlook Web App, which enterprises use to provide account authentication for various network services.' -- source: https://arstechnica.com/information-technology/2020/12/solarwinds-hackers-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Israeli Spy Tech Firm Says It Can Break Into Signal App
by Peter Reutemann 15 Dec '20

15 Dec '20

'Last Thursday, Israeli phone-hacking firm Cellebrite said in a blog post that it can now break into Signal, an encrypted app considered safe from external snooping. Haaretz reports: Cellebrite's flagship product is the UFED (Universal Forensic Extraction Device), a system that allows authorities to unlock and access the data of any phone in their possession. Another product it offers is the Physical Analyzer, which helps organize and process data lifted from the phone. Last Thursday, the company announced that the analyzer has now been updated with a new capability, developed by the firm, that allows clients to decode information and data from Signal. Signal, owned by the Signal Technology Foundation, uses a special open source encryption system called Signal Protocol, which was thought to make it nigh-on impossible for a third party to break into a conversation or access data being shared on the platform. It does so by employing what's called "end-to-end encryption." According to Cellebrite's announcement last week, "Law enforcement agencies are seeing a rapid rise in the adoption of highly encrypted apps like Signal, which incorporate capabilities like image blurring to stop police from reviewing data. "Criminals are using this application to communicate, send attachments, and making [sic] illegal deals that they want to keep discrete [sic] and out of sight from law enforcement," the blog post added. Despite support for the app's encryption capabilities, Cellebrite noted that "Signal is an encrypted communication application designed to keep sent messages and attachments as safe as possible from 3rd-party programs. "Cellebrite Physical Analyzer now allows lawful access to Signal app data. At Cellebrite, we work tirelessly to empower investigators in the public and private sector to find new ways to accelerate justice, protect communities, and save lives." In an earlier, now deleted, version of the blog post, the company went as far as to say: "Decrypting Signal messages and attachments was not an easy task. It required extensive research on many different fronts to create new capabilities from scratch. At Cellebrite, however, finding new ways to help those who make our world a safer place is what we're dedicated to doing every day." The initial post, which was stored on the Internet Archive, also included a detailed explanation of how Cellebrite "cracked the code" by reviewing Signal's own open source protocol and using it against it. The company noted in the deleted blog post that "because [Signal] encrypts virtually all its metadata to protect its users, efforts have been put forward by legal authorities to require developers of encrypted software to enable a 'backdoor' that makes it possible for them to access people's data. Until such agreements are reached, Cellebrite continues to work diligently with law enforcement to enable agencies to decrypt and decode data from the Signal app."' -- source: https://it.slashdot.org/story/20/12/14/2241230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

~18,000 organizations downloaded backdoor planted by Cozy Bear hackers
by Peter Reutemann 15 Dec '20

15 Dec '20

'About 18,000 organizations around the world downloaded network management tools that contained a backdoor that spies believed to be backed by the Russian government could use to install additional malware that stole sensitive data, the tools provider, SolarWinds, said on Monday. The disclosure from Austin, Texas-based software maker SolarWinds, came a day after the US government revealed a major security breach hitting federal agencies and private companies. The US Departments of Treasury, Commerce, and Homeland Security departments were among the federal agencies on the receiving end of attacks that gave access to email and other sensitive resources. Federal agencies using the software were instructed on Sunday to disconnect systems that run the software and perform a forensic analysis of their networks. Premiere security firm FireEye says it was breached by nation-state hackers Security firm FireEye, which last week disclosed a serious breach of its own network, said that hackers backed by a nation state compromised a SolarWinds software update mechanism and then used it to infect selected customers who installed a backdoored version of the company’s Orion network management tool. The backdoor infected customers who installed an update from March to June of this year, SolarWinds said in a document filed on Monday with the Securities and Exchange Commission. SolarWinds, which said SolarWinds has about 300,000 Orion customers, put the number of affected customers at about 18,000.' -- source: https://arstechnica.com/information-technology/2020/12/18000-organizations-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wormable code-execution flaw in Cisco Jabber has a severity rating of 9.9 out of 10
by Peter Reutemann 14 Dec '20

14 Dec '20

'Cisco has patched its Jabber conferencing and messaging application against a critical vulnerability that made it possible for attackers to execute malicious code that would spread from computer to computer with no user interaction required. Again. A single text is all it took to unleash code-execution worm in Cisco Jabber The vulnerability, which was first disclosed in September, was the result of several flaws discovered by researchers at security firm Watchcom Security. First, the app failed to properly filter potentially malicious elements contained in user-sent messages. The filter was based on an incomplete blocklist that could be bypassed using a programming attribute known as onanimationstart. Messages that contained the attribute passed directly to DOM of an embedded browser. Because the browser was based on the Chromium Embedded Framework, it would execute any scripts that made it through the filter. With the filter bypassed, the researchers still had to find a way to break out of a security sandbox that’s designed to keep user input from reaching sensitive parts of the operating system. The researchers eventually settled on a function called CallCppFunction, which among other things Cisco Jabber uses to open files one user receives from another. [...] The researchers recommended that the updates be installed as soon as possible. Until all employees are patched, organizations should consider disabling all external communications. The vulnerabilities affect all currently supported versions of the Cisco Jabber client (12.1 through 12.9).' -- source: https://arstechnica.com/information-technology/2020/12/wormable-zero-click-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Selling More Than 85,000 MySQL Databases On a Dark Web Portal
by Peter Reutemann 14 Dec '20

14 Dec '20

'For the past year, hackers have been breaking into MySQL databases, downloading tables, deleting the originals, and leaving ransom notes behind, telling server owners to contact the attackers to get their data back. If database owners don't respond and ransom their data back in nine days, the databases are then put up on auction on a dark web portal. "More than 85,000 MySQL databases are currently on sale on a dark web portal for a price of only $550/database," reports ZDNet: This suggests that both the DB intrusions and the ransom/auction web pages are automated and that attackers don't analyze the hacked databases for data that could contain a higher concentration of personal or financial information. Signs of these ransom attacks have been piling up over the course of 2020, with the number of complaints from server owners finding the ransom note inside their databases popping up on Reddit, the MySQL forums, tech support forums, Medium posts, and private blogs.' -- source: https://developers.slashdot.org/story/20/12/12/1943216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Developers Say Securing Their Code Is 'Insufferably Boring' and 'Soul-Withering'
by Peter Reutemann 14 Dec '20

14 Dec '20

'"A new survey of the free and open-source software (FOSS) community conducted by the Linux Foundation suggests that contributors spend less than 3% of their time on security issues and have little desire to increase this," reports TechRepublic: Moreover, responses indicated that many respondents had little interest in increasing time and effort on security. One respondent commented that they "find the enterprise of security a soul-withering chore and a subject best left for the lawyers and process freaks," while another said: "I find security an insufferably boring procedural hindrance." The researchers concluded that a new approach to the security and auditing of FOSS would be needed to improve security practices, while limiting the burden on contributors. Some of the most requested tools from contributors were bug and security fixes, free security audits, and simplified ways to add security-related tools to their continuous integration (CI) pipelines. "There is a clear need to dedicate more effort to the security of FOSS, but the burden should not fall solely on contributors," read the report. "Developers generally do not want to become security auditors; they want to receive the results of audits..." The researchers continued: "One way to improve a rewrite's security is to switch from memory-unsafe languages (such as C or C++ ) into memory-safe languages (such as nearly all other languages)," researchers said. "This would eliminate entire classes of vulnerabilities such as buffer overflows and double-frees." Also interesting: money "scored very low in developers' motivations for contributing to open-source projects, as did a desire for recognition amongst peers," according to TechRepublic. "Instead, developers said they were purely interested in finding features, fixes and solutions to the open-source projects they were working on. Other top motivations included were enjoyment and a desire to contribute back to the FOSS projects that they used."' -- source: https://news.slashdot.org/story/20/12/12/205206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Here Comes the Google Chrome Change that Worries Ad-Blocker Creators
by Peter Reutemann 14 Dec '20

14 Dec '20

'CNET reports: With the next version of Chrome, Google is moving ahead with a plan to improve privacy and security by reining in some abilities of extensions used to customize the browser. The move had angered some developers who expected earlier it would cripple ad blockers. Manifest v3, the programming interface behind Google's security plans, will arrive with Chrome 88 in mid-January, Google said Wednesday at the Chrome Dev Summit. Extensions using the earlier Manifest v2 will still work for at least a year... Among other things, Manifest v3 limits the number of "rules" that extensions may apply to a web page as it loads. Rules are used, for example, to check if a website element comes from an advertiser's server and should therefore be blocked. Google announced the changes two years ago. Reducing the number of rules allowed angered creators of extensions like the uBlock Origin ad blocker and the Ghostery tracking blocker. They said the rules limits will stop their extensions from running their full lists of actions to screen ads or block tracking. That could let websites bypass extensions — and the preferences of people who installed them... The shift brought on by Manifest V3 will spread to all browsers, to the detriment of ad blocking software, predicted Andrey Meshkov, co-founder and chief technology officer of AdGuard, an ad-blocking extension... Ghostery is working to update its extension for Manifest V3 but would rather spend its time on "real privacy innovations," President Jeremy Tillman said in a statement Wednesday. "We still have real misgivings that these changes have more to do with Google protecting its bottom line than it does with improving security for Chrome users...." The importance of the Chrome team's choices are magnified by the fact that other browsers, including Microsoft Edge, Vivaldi , Opera and Brave, are built on its Chromium open-source foundation. Microsoft said it will embrace Manifest v3, too. "Another Manifest v3 change is that extensions no longer may update their abilities by downloading code from third-party sites. "The entire extension now must be distributed through the Chrome Web Store, a measure Google says improves security screens and speeds reviews."' -- source: https://tech.slashdot.org/story/20/12/13/0012217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Accessing Judicial Records Online
by Lawrence D'Oliveiro 13 Dec '20

13 Dec '20

This article <https://arstechnica.com/tech-policy/2020/12/us-house-passes-bill-to-tear-do…> about the ongoing can of worms that is the PACER online judicial records system in the US prompted me to take a look at our own. I found this page <https://www.courtsofnz.govt.nz/judgments/>, which links conveniently to separate areas for the Supreme Court, Court of Appeal and High Courts at the Ministry of Justice <https://forms.justice.govt.nz/jdo/Introduction.jsp>, District Courts <https://www.districtcourts.govt.nz/> and the Legal Information Institute <http://www.nzlii.org/>. In terms of copyright and redistribution, there is this note on the MoJ page: No copyright exists in respect of judgments or decisions of any New Zealand Court or Tribunal. See Copyright Act 1994 s27(g). Also, I like this note on the help page for the nzlii.org site: Emulated Search Languages If you have used one of the popular online legal database systems (or even if you haven't) you probably do not need to learn anything new. Most Lexis, Status, Info-One, (and for the non-lawyers, even C and agrep) style searches are recognised.

1 0

CentOS 8 Ending Next Year To Focus Shift On CentOS Stream
by Peter Reutemann 13 Dec '20

13 Dec '20

'Well here is a surprise for those that have long used CentOS as the community-supported rebuild of Red Hat Enterprise Linux... CentOS 8 will end in 2021 and moving forward CentOS 7 will remain supported until the end of its lifecycle but CentOS Stream will be the focus as the future upstream of RHEL. From a report: For those relying on CentOS 8 to enjoy the reliability and features of Red Hat Enterprise Linux 8 but without the licensing costs, etc, that will end in 2021. At the end of 2021, CentOS 8 will no longer be maintained but CentOS 7 will stick around in a supported maintenance state until 2024. The CentOS Project will be focused moving forward just on CentOS Stream as the upstream/development branch of Red Hat Enterprise Linux. CentOS 8 users are encouraged to begin transitioning to CentOS Stream 8. The CentOS Project announced this shift in focus today via the CentOS Blog. Red Hat's announcement meanwhile is promoting the change as beneficial to CentOS Stream.' -- source: https://linux.slashdot.org/story/20/12/08/2010236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Random Firefox Tweaks
by Lawrence D'Oliveiro 12 Dec '20

12 Dec '20

Been looking at various settings changes you can make in the “about:config” page in Firefox. Here are a couple I have found useful: * keyword.enabled -- set to false to stop Firefox trying to do a search on the contents of the address box if it doesn’t match a URL. This is why I have a search box separate from the address box. * browser.fixup.alternate.enabled -- set to false to stop it helpfully tacking on “www.” and “.com” if the original URL you type doesn’t work. I have occasionally been confused by it complaining about not finding a URL, but showing a different one from the one I typed. By the way, when you first try to view this page, Firefox shows you a warning to ensure you understand the consequences of messing about with settings at this level. It remembers it has shown you this warning by adding the following line to the prefs.js file in your profile: user_pref("browser.aboutConfig.showWarning", false); Firefox seems to overwrite this file when it quits, and reloads it when it is launched again.

2 2

Google Says It is Expanding Fuchsia's Open Source Model
by Peter Reutemann 11 Dec '20

11 Dec '20

'Fuchsia is a long-term project to create a general-purpose, open source operating system, and today we are expanding Fuchsia's open source model to welcome contributions from the public. Fuchsia is designed to prioritize security, updatability, and performance, and is currently under active development by the Fuchsia team. We have been developing Fuchsia in the open, in our git repository for the last four years. You can browse the repository history at fuchsia.googlesource.com to see how Fuchsia has evolved over time. We are laying this foundation from the kernel up to make it easier to create long-lasting, secure products and experiences. Starting today, we are expanding Fuchsia's open source model to make it easier for the public to engage with the project. We have created new public mailing lists for project discussions, added a governance model to clarify how strategic decisions are made, and opened up the issue tracker for public contributors to see what's being worked on. As an open source effort, we welcome high-quality, well-tested contributions from all. There is now a process to become a member to submit patches, or a committer with full write access. In addition, we are also publishing a technical roadmap for Fuchsia to provide better insights for project direction and priorities. Some of the highlights of the roadmap are working on a driver framework for updating the kernel independently of the drivers, improving file systems for performance, and expanding the input pipeline for accessibility.' -- source: https://news.slashdot.org/story/20/12/08/2048257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

South Korea Finally Gets Rid Of ActiveX
by Lawrence D'Oliveiro 11 Dec '20

11 Dec '20

Being just about the first country in the world to introduce secure online banking (in 1999!) came at a cost to the Republic of Korea: because SSL/TLS wasn’t widespread at the time, they had to cobble together a solution based on Microsoft’s ActiveX technology. This made it specific to Windows. It worked OK for a while, but as computing platforms have continued to evolve, this dependency on a “legacy” technology has become increasingly annoying to just about everybody. Then in 2017, it actually became an election campaign promise to get rid of this. And finally, now, the promise is being fulfilled. <https://www.theregister.com/2020/12/10/south_korea_activex_certs_dead/>

1 0

Brave Browser-Maker Launches Privacy-Friendly News Reader
by Peter Reutemann 11 Dec '20

11 Dec '20

'Ars Technica: Brave Software, maker of the Brave Web browser, is introducing a news reader that's designed to protect user privacy by preventing parties -- both internal and third party -- from tracking the sites, articles, and story topics people view. Brave Today, as the service is called, is using technology that the company says sets it apart from news services offered by Google and Facebook. It's designed to deliver personalized news feeds in a way that leaves no trail for Brave, ISPs, and third parties to track. The new service is part of Brave's strategy of differentiating its browser as more privacy-friendly than its competitors'. Key to Brave Today is a new content delivery network the company is unveiling. Typically, news services use a single CDN to cache content and then serve it to users. This allows the CDN or the service using it to see both the IP address and news feed of each user, and over time, that data can help services build detailed profiles of a person's interests. The Brave Today CDN takes a different approach. It's designed in a way that separates a user's IP address from the content they request. One entity offers a load-balancing service that receives TLS-encrypted traffic from the user. The load balancer then passes the traffic on to the CDN that processes the request. The load balancer knows the user's IP address but, because the request is encrypted, has no visibility into the content the user is seeking. The CDN, meanwhile, sees only the request but has no way of knowing the IP address that's making it. Responses are delivered in reverse order. To prevent the data from being combined, Brave says that it will use one provider for load balancing and a different one for content delivery. To prevent the load-balancing provider from using the size of the requests and responses to infer the contents of the encrypted data, the service will also use a technique called padding, which adds characters to the plaintext before it's encrypted. The CDN uses several other techniques to preserve the anonymity of users. Among them: stripping out various headers that could be used to identify the person making the request. Furthermore, Brave is also taking steps to shield user information from its own employees. "... [T]he company has configured its account with the load-balancing provider to restrict access to its logging resources," reports Ars. "The load-balancing provider also doesn't provide the ability for customers to use the proxy protocol to inject the requester's IP address into outgoing requests. In case that changes, however, Brave has also entered into a contract with the load balancer that restricts access to logs or use of the protocol, even if Brave asks."' -- source: https://yro.slashdot.org/story/20/12/10/2151244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Exposes Adrozek, Malware That Hijacks Chrome, Edge, and Firefox
by Peter Reutemann 11 Dec '20

11 Dec '20

'Microsoft has raised the alarm today about a new malware strain that infects users' devices and then proceeds to modify browsers and their settings in order to inject ads into search results pages. From a report: Named Adrozek, the malware has been active since at least May 2020 and reached its absolute peak in August this year when it controlled more than 30,000 browsers each day. But in a report today, the Microsoft 365 Defender Research Team believes the number of infected users is much, much higher. Microsoft researchers said that between May and September 2020, they observed "hundreds of thousands" of Adrozek detections all over the globe. Based on internal telemetry, the highest concentration of victims appears to be located in Europe, followed by South and Southeast Asia. Microsoft says that, currently, the malware is distributed via classic drive-by download schemes. Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software. The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with the help of a registry key.' -- source: https://news.slashdot.org/story/20/12/10/1857222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

arch - low disk space on root partition
by Peter Reutemann 10 Dec '20

10 Dec '20

Hi everyone My experience with EndeavourOS has been really positive so far. However, this morning, after a big upgrade, I received the notification that I was running low on disk space on my root partition (only 1.9GB out of 37GB remaining!). After a bit of looking around the web, I settled on clearing my pacman cache: sudo pacman -Sc And I'm back to having 19GB free disk space. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

The Origins Of T he C Programming Language
by Lawrence D'Oliveiro 10 Dec '20

10 Dec '20

This article <https://arstechnica.com/features/2020/12/a-damn-stupid-thing-to-do-the-orig…> goes a bit more in-depth into the precursors of the C programming language. The story begins with a computer scientist from a well-connected family named Christopher Strachey (I remember the name of his uncle Lytton as the author of a volume of short biographies in my parents’ library called “Eminent Victorians”), who led a group to create a language called “CPL”. CPL proved a bit too ambitious to implement at the time. And it didn’t help that its designers insisted on certain syntactical niceties that might be considered more literary than practical. (Reflecting a certain British public-school background, I suppose ...) But a cut-down subset of this was implemented, with the aim of using it as a “bootstrap” language for writing the compiler for the full language. This was BCPL, and it turned out to be useful for a range of programming projects. The group at AT&T Bell Labs got hold of this after the Labs pulled out of the MULTICS project, and implemented an even more cut-down version called “B”, which could run on the limited memory of the PDP-7 which was all they had at the time. Then a later enhancement of this was called “New B” or “NB”. Several attempts were made to rewrite the fledgling Unix operating system in NB, which didn’t work. After each attempt, the language was revised to add more features. Finally, after the addition of structured types, the result was a language sufficiently useful to write an OS, and sufficiently different to warrant a new name. So it was dubbed “C”.

1 0

Bye-Bye DB2, Bye-Bye Oracle, Hello Postgres
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

A report on how a couple of companies -- German IT outfit BG Phoenics and Indian one TransUnion CIBIL -- migrated their entire mass of internal company database deployments off proprietary DBMSes -- IBM DB2 in one case, Oracle in the other -- to Postgres EDB: <https://www.theregister.com/2020/12/08/leaving_ibm_db2_for_postgres/>. In both cases, a big factor was the licensing conditions, which made it very complicated to do any changes to database usage. The improvement in agility was major: Since going live, the user found the deployment of new instances in Postgres much faster than it had been in Db2, down from around 20 hours spread over two weeks to 40 to 60 minutes. Of course an Oracle advocate has to say “[Postgres] is not as scalable as a proprietary database like Oracle or SQL Server”. But I would suggest they think twice about such a pronouncement. Remember that Facebook runs its entire multi-billion-user operation on MySQL, and I’m sure Postgres can scale to that level as well. Where is there an Oracle or DB2 deployment of that size and throughput requirement? I don’t think such a thing exists.

1 0

Amazon, Amex To Fund Software Developers in New GitHub Program
by Peter Reutemann 09 Dec '20

09 Dec '20

'Amazon.com, American Express, Daimler AG and Stripe are among those joining a new GitHub program that will let companies directly fund open-source projects and software developers that are key to their businesses. From a report: It's an expansion of GitHub's Sponsors program, which previously let individuals support software projects and the millions of developers who use the digital platform to collaborate on, share and store code. GitHub, whose parent company Microsoft will also participate in the new service announced Tuesday, expects the change to dramatically increase the number of contributions. The year-old sponsors service has already generated enough money for some developers to rely on it as full-time work, said Devon Zuegel, GitHub's director of product for the communities department.' -- source: https://developers.slashdot.org/story/20/12/08/1821203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GE Puts Default Password In Radiology Devices, Leaving Healthcare Networks Exposed
by Peter Reutemann 09 Dec '20

09 Dec '20

'Ars Technica: Dozens of radiology products from GE Healthcare contain a critical vulnerability that threatens the networks of hospitals and other health providers that use the devices, officials from the US government and a private security firm said on Tuesday. The devices -- used for CT scans, MRIs, X-Rays, mammograms, ultrasounds, and positron emission tomography -- use a default password to receive regular maintenance. The passwords are available to anyone who knows where on the Internet to look. A lack of proper access restrictions allows the devices to connect to malicious servers rather than only those designated by GE Healthcare. Attackers can exploit these shortcomings by abusing the maintenance protocols to access the devices. From there, the attackers can execute malicious code or view or modify patient data stored on the device or the hospital or healthcare provider servers. Aggravating matters, customers can't fix the vulnerability themselves. Instead, they must request that the GE Healthcare support team change the credentials. Customers who don't make such a request will continue to rely on the default password. Eventually, the device manufacturer will provide patches and additional information. The flaw has a CVSS severity rating of 9.8 out of 10 because of the impact of the vulnerability combined with the ease of exploiting it. Security firm CyberMDX discovered the vulnerability and privately reported it to the manufacturer in May. The US Cyber Security and Infrastructure Security Agency is advising affected healthcare providers to take mitigation steps as soon as possible. In a statement, GE Healthcare officials wrote: "We are not aware of any unauthorized access to data or incident where this potential vulnerability has been exploited in a clinical situation. We have conducted a full risk assessment and concluded that there is no patient safety concern. Maintaining the safety, quality, and security of our devices is our highest priority. We are providing on-site assistance to ensure credentials are changed properly and confirm proper configuration of the product firewall. Additionally, we are advising the facilities where these devices are located to follow network management and security best practices." ' -- source: https://it.slashdot.org/story/20/12/08/2034217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye, a Top Cybersecurity Firm, Says It Was Hacked By a Nation-State
by Peter Reutemann 09 Dec '20

09 Dec '20

'The New York Times : For years, the cybersecurity firm FireEye has been the first call for government agencies and companies around the world who have been hacked by the most sophisticated attackers, or fear they might be. Now it looks like the hackers -- in this case, evidence points to Russia's intelligence agencies -- may be exacting their revenge. FireEye revealed on Tuesday that its own systems were pierced by what it called "a nation with top-tier offensive capabilities." The company said hackers used "novel techniques" to make off with its own tool kit, which could be useful in mounting new attacks around the world. It was a stunning theft, akin to bank robbers who, having cleaned out local vaults, then turned around and stole the F.B.I.'s investigative tools. In fact, FireEye said on Tuesday, moments after the stock market closed, that it had called in the F.B.I. The $3.5 billion company, which partly makes a living by identifying the culprits in some of the world's boldest breaches -- its clients have included Sony and Equifax -- declined to say explicitly who was responsible. But its description, and the fact that the F.B.I. has turned the case over to its Russia specialists, left little doubt who the lead suspects were and that they were after what the company calls "Red Team tools." These are essentially digital tools that replicate the most sophisticated hacking tools in the world. FireEye uses the tools — with the permission of a client company or government agency -- to look for vulnerabilities in their systems. Most of the tools are based in a digital vault that FireEye closely guards. The hack raises the possibility that Russian intelligence agencies saw an advantage in mounting the attack while American attention -- including FireEye's -- was focused on securing the presidential election system. At a moment that the nation's public and private intelligence systems were seeking out breaches of voter registration systems or voting machines, it may have a been a good time for those Russian agencies, which were involved in the 2016 election breaches, to turn their sights on other targets. The hack was the biggest known theft of cybersecurity tools since those of the National Security Agency were purloined in 2016 by a still-unidentified group that calls itself theShadowBrokers. [...] The N.S.A.'s tools were most likely more useful than FireEye's since the U.S. government builds purpose-made digital weapons. FireEye's Red Team tools are essentially built from malware that the company has seen used in a wide range of attacks. Still, the advantage of using stolen weapons is that nation-states can hide their own tracks when they launch attacks.' -- source: https://it.slashdot.org/story/20/12/08/2247219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Next Step In DNS Privacy
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

We already have mechanisms called “DNS-over-HTTPS” (DoH) and “DNS-over-TLS” (DoT) to encrypt your DNS queries so intermediaries cannot eavesdrop on them. However, the DNS server you are querying still knows what you are asking for, and can tie that to the IP address that you are querying from. So the next step is called “Oblivious DNS” (“over HTTPS”?) or “ODoH” <https://arstechnica.com/information-technology/2020/12/cloudflare-apple-and…>. This one interposes a proxy to relay the encrypted query and response between the client machine and DNS server. The proxy cannot decrypt the communications, and its presence hides the client’s IP address from the server, further increasing your privacy. To recap: the DNS server knows what you are asking for, but not who is asking. The proxy knows who is asking, but not what they are asking for. Given the controversy from some parties over the existing mechanisms (remember when the British Internet Service Providers’ Association dubbed Mozilla a “villain” for implementing DoH <https://www.theregister.com/2019/07/10/ispa_clears_mozilla/>?), I wonder what kind of hoo-hah this further development will trigger...

1 0

Will Businesses Make 2021 The Year of the Linux Desktop?
by Peter Reutemann 08 Dec '20

08 Dec '20

'Writing for TechRepublic, open source advocate Jack Wallen predicts 2021 will be a year where open source technology dominates the world of big data even more than 2021 (with a big role predicted for SUSE). But he also sees businesses cutting costs by switching to open source solutions — including a big move to Linux on enterprise desktops, thanks to enterprise-ready options now available from System76, Lenovo, and Dell: This will have the added benefit of even more companies jumping into the mix and offering more and more desktops and laptops, all powered by Linux and open source technology. One added bonus for this movement is that System76 will finally gain the recognition they've deserved for so many years. Linux on the desktop would not be where it is today, had it not been for their stalwart support for open source technology. Year after year, System76 has proved that high-quality, business-class systems, powered by Linux, can be produced at a level befitting the enterprise. That success within the realm of business will start trickling down to consumers. As more and more people start using Linux at their place of business, they'll begin seeing the benefits of the open source operating system and desire to adopt it for their home computers. I suspect that by the end of 2021, we'll see Linux desktop market share to finally break the 10% bubble. It may not sound like much, but given how Linux has hovered around 2% and maxed out at 5%, that 10% figure is like a dream come true. That's only the tip of the iceberg. Although Linux will max out at around 10% by the end of the year, it will lead to continued growth over the coming years.' -- source: https://linux.slashdot.org/story/20/12/07/0332259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Qualcomm Feel Threatened By Apple's M1 Macs?
by Peter Reutemann 07 Dec '20

07 Dec '20

'PCMag.com's lead mobile analyst calls Qualcomm "a little too unbothered by Apple's M1 Macs" Qualcomm executives brushed off a question about Apple's new M1-based Macs during a question-and-answer session at the company's Snapdragon Summit today, where Qualcomm announced a new flagship smartphone chipset but no upgrades to its year-old chips for PCs... In general, reviews of Qualcomm-powered laptops such as the Microsoft Surface Pro X have celebrated the devices' long battery life, but lamented problems with third-party apps that were originally coded for Intel processors. That stands in stark contrast to Apple's new M1-based Macs, which don't seem to be slowed down as badly by older software... "It's a great validation of what we've been doing for the past few years and [Qualcomm's product line] is just going to get stronger and stronger as we broaden our scope," said Alex Katouzian, Qualcomm SVP for mobile. Katouzian made sure to subtly call out ways in which Qualcomm's always-connected PCs are superior to Apple's newest Macs. The Macs lack 4G connectivity and still have poor-quality, 720p front-facing cameras... Katouzian also pointed out that (presumably unlike Apple) Qualcomm addresses "many tiers...and many price points" with its 7c, 8c, and 8cx laptop chipsets, letting Windows laptop makers drive prices well below the MacBook Air's $999 list price. The core problem with Qualcomm's always-connected PC strategy is one that Qualcomm itself can't fix. While Qualcomm could, and probably will, soon announce a laptop chip that's based on the new Snapdragon 888 and has a level of raw power closer to Apple's M1, it's really down to Microsoft, as well as peripheral and app makers to solve the platform incompatibilities that have frustrated PC reviewers. Hot Hardware cites Microsoft's promises of changes come in future updates to Windows 10, arguing that "with the arrival of x64 emulation and a growing library of native Arm64 apps, Windows 10 on Arm is going to be an even more powerful platform." >From a performance perspective, while running Windows 10 on Arm, these [Snapdragon 8cx] chips may currently be at a disadvantage to the Apple M1, but some day in the not so distant future that might not be the case. We have no doubt that Qualcomm is likely working on a new Windows PC-centric SoC that is based on Snapdragon 888 or similar architecture. Qualcomm has promised a 25 percent uplift in CPU and a 35% lift in GPU performance over the Snapdragon 865, with the Snapdragon 888, which already offers a big boost over the previous gen Snapdragon 855/8cx. So, Qualcomm has the potential to put up a strong showing against the Apple M1, whenever its next-generation Snapdragon PC chip launches. That may be, but John Gruber at Daring Fireball argues that currently "M1 Macs embarrass all other PCs — all Intel-based Macs, including automobile-priced Mac Pros, and every single machine running Windows or Linux." Those machines are just standing around in their underwear now because the M1 stole all their pants. Well, that just doesn't happen, your instincts tell you. One company, even a company like Apple, doesn't just embarrass the entire rest of a highly-competitive longstanding industry. But just because something hasn't happened — or hasn't happened in a very long while — doesn't mean it can't happen. And in this case, it just happened... M1 Macs completely upend what we can and should expect from PCs. It's a breakthrough along the lines of the iPhone itself in 2007.' -- source: https://hardware.slashdot.org/story/20/12/06/060238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Richard Stallman Answers Questions at EmacsConf 2020
by Peter Reutemann 07 Dec '20

07 Dec '20

'All the videos have now appeared online for the talks at this year's virtual EmacsConf 2020, "the conference about the joy of Emacs, Emacs Lisp, and memorizing key sequences." And among them are an appearance by 67-year-old Richard Stallman, reminding the audience he'd created the first Emacs editor in 1976 "with some help from Guy Steele," then created GNU Emacs in 1984. Stallman was there to tell the history of the GNU Emacs Lisp Package Archive (and the licensing issues involved) — and how it's ultimately led to the creation of the NonGNU ELPA. "The fundamental plan of NonGNU ELPA is that we won't ask for copyright assignments for those packages, so we won't be able to put them into core Emacs, at least not easily — but we will have some control over how we distribute them. We can put any package into NonGNU ELPA as long as its free software. "If we like it, we can set up that way for users to get it. We can put the package in exactly as it is, if there's no problem at all with it. We can make an arrangement with the package's developers to work on it with us and maintain it directly for distribution by NonGNU ELPA. But if they are not interested, we can put it in ourselves, and if we need to make any changes we can do so. So NonGNU ELPA is not meant to be just a way that others can distribute their packages. Its meant at least in a minimal, technical sense to work with GNU Emacs, and we will make changes if necessary so that it works smoothly with GNU Emacs... "The idea is to have a single Git repository where you can download various packages, but they won't be maintained there. Each of those packages will be copied automatically from some other place, probably some other people have the right access to work on it. This way we can avoid giving a gigantic number of people access to it. "So far NonGNU ELPA is just a plan. We need people to implement the plan, so if you'd like to help, please write to me. I think this is a very important step for progress, and it's got to be implemented. Thanks, and happy hacking." Stallman provided a status update on NonGNU ELPA as part of the 46-minute Q&A that followed. ' -- source: https://news.slashdot.org/story/20/12/06/1957219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenZFS 2.0 release unifies Linux, BSD and adds tons of new features
by Peter Reutemann 04 Dec '20

04 Dec '20

'This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between "ZFS on Linux" and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.' -- source: https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

One of the Internet’s most aggressive threats could take UEFI malware mainstream
by Peter Reutemann 04 Dec '20

04 Dec '20

'One of the Internet’s most aggressive threats has just gotten meaner, with the ability to infect one of the most critical parts of any modern-day computer. Trickbot is a piece of malware that’s notable for its advanced capabilities. Its modular framework excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks and performing reconnaissance that identifies infected computers belonging to high-value targets. It often uses readily available software like Mimikatz or exploits like EternalBlue stolen from the National Security Agency. Once a simple banking fraud trojan, Trickbot over the years has evolved into a full-featured malware-as-a-service platform. Trickbot operators sell access to their vast number of infected machines to other criminals, who use the botnet to spread bank trojans, ransomware, and a host of other malicious software. Rather than having to go through the hassle of ensnaring victims themselves, customers have a ready-made group of computers that will run their crimeware. Now, Trickbot has acquired a new power: the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove.' -- source: https://arstechnica.com/information-technology/2020/12/dangerous-uefi-malwa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FBI Warns of Email Forwarding Rules Being Abused in Recent Hacks
by Peter Reutemann 03 Dec '20

03 Dec '20

'The US Federal Bureau of Investigation says that cyber-criminals are increasingly relying on email forwarding rules in order to disguise their presence inside hacked email accounts. From a report: In a PIN (Private Industry Notification) alert sent last week and made public today, the FBI says the technique has been seen and abused in recent BEC (Business Email Compromise) attacks reported over the summer. The hackers' technique relies on a feature found in some email services called "auto-forwarding email rules." As its name implies, the feature allows the owner of an email address to set up "rules" that forward (redirect) an incoming email to another address if a certain criteria is met. Threat actors absolutely love email auto-forwarding rules as they allow them to receive copies of all incoming emails without having to log into an account each day -- and be at risk of triggering a security warning for a suspicious login.' -- source: https://it.slashdot.org/story/20/12/02/1944205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malicious npm Packages Caught Installing Remote Access Trojans
by Peter Reutemann 03 Dec '20

03 Dec '20

'The security team behind the "npm" repository for JavaScript libraries removed two npm packages this Monday for containing malicious code that installed a remote access trojan (RAT) on the computers of developers working on JavaScript projects. From a report: The name of the two packages was jdb.js and db-json.js., and both were created by the same author and described themselves as tools to help developers work with JSON files typically generated by database applications. Both packages were uploaded on the npm package registry last week and were downloaded more than 100 times before their malicious behavior was detected by Sonatype, a company that scans package repositories on a regular basis. According to Sonatype's Ax Sharma, the two packages contained a malicious script that executed after web developers imported and installed any of the two malicious libraries. The post-install script performed basic reconnaissance of the infected host and then attempted to download and run a file named patch.exe that later installed njRAT, also known as Bladabindi, a very popular remote access trojan that has been used in espionage and data theft operations since 2015.' -- source: https://tech.slashdot.org/story/20/12/02/1939247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Zero-Click Wi-Fi Exploit is One of the Most Breathtaking Hacks Ever
by Peter Reutemann 03 Dec '20

03 Dec '20

'Dan Goodin, writing for ArsTechnica: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device -- over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable -- meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed. This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly. Almost immediately, fellow security researchers took notice. "This is a fantastic piece of work," Chris Evans, a semi-retired security researcher and executive and the founder of Project Zero, said in an interview. "It really is pretty serious. The fact you don't have to really interact with your phone for this to be set off on you is really quite scary. This attack is just you're walking along, the phone is in your pocket, and over Wi-Fi someone just worms in with some dodgy Wi-Fi packets." Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel -- one of the most privileged parts of any operating system -- the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.' -- source: https://apple.slashdot.org/story/20/12/02/1933245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0