June 2020 - wlug - list.wlug.org.nz

Activists Rally To Save Internet Archive as Lawsuit Threatens Site
by Peter Reutemann 12 Jun '20

12 Jun '20

'The Internet Archive is a massive endeavor -- it's an online library aiming to "provide Universal Access to All Knowledge." It has digitized millions of web pages, movies, photos, recordings, software programs, and books that might otherwise be lost to history. But it's neither un-censorable nor outside the bounds of copyright law. And now open internet supporters are wondering how to save it before it disappears. ' -- source: https://yro.slashdot.org/story/20/06/11/194226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 11 Will Help You Rein In Zombie App Permissions
by Peter Reutemann 11 Jun '20

11 Jun '20

'With 2.5 billion users worldwide, Google has a responsibility to make its Android operating system as secure as possible. But the company has at times struggled to adequately vet apps in the Google Play Store, allowing malicious programs through that thousands or millions of users go on to download. With Google's release of the Android 11 Beta on Wednesday, though, the company is taking steps to make it even more difficult for rogue apps to grab your data even when they do slip by. From a report: Google has worked for years to incrementally tighten Android security under the hood. And the release of Android 11 is particularly focused on expanding privacy improvements to give you more control over what your apps can access and giving more ways to distribute software updates across Android's fragmented and disjointed device population. Android 10 addressed some of this as well, requiring that app developers request permissions and then reaffirm user choices more often. Android 11 adds a feature that allows developer to request one-time permissions for things like the microphone, camera, or location as an alternative to all or nothing. You can share your location with a friend through a chat app once, for example, without granting indefinite location access, or having to remember to wade back into settings to revoke the permission later. "We can see that people are actually leveraging these features from Android 10 and thinking about their choices when they're giving apps access to permissions," says Charmaine D'Silva, an Android product manager who works on privacy. "So building on that this time we've added even more controls." Android 11 will also rein in apps that you don't use very often, automatically revoking permissions if you don't open it for a still undetermined period of time. If you start using the app again you can always reinstate its access, but the permission won't be lurking forgotten. Google plans to experiment with different cutoffs after 60-90 days, with the goal of eliminating stray permissions without breaking functionality.' -- source: https://yro.slashdot.org/story/20/06/10/1730228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Playing Around With the Fuchsia OS
by Peter Reutemann 11 Jun '20

11 Jun '20

'Security and software development company Quarkslab played around with Google's new Fuchsia operating system, which could one day replace Android on smartphones and Chrome OS on laptops. The researchers "decided to give a quick look at Fuchsia, learn about its inner design, security properties, strengths and weaknesses, and find ways to attack it." Here's what they concluded: Fuchsia's micro kernel is called Zircon. It is written in C++. [...] Contrary to every other major OS, it appears rather difficult to target the Zircon kernel directly. A successful RCE (Remote Code Execution) on the world-facing parts of the system (USB, Bluetooth, network stack, etc) will only give you control over the targeted components, but they run in independent userland processes, not in the kernel. From a component, you then need to escalate privileges to the kernel using the limited number of syscalls you can access with the handles you have. Overall, it seems easier to target other components rather than the kernel, and to focus on components that you can talk to via IPC and that you know have interesting handles. Overall, Fuchsia exhibits interesting security properties compared to other OSes such as Android. A few days of vulnerability research allowed us to conclude that the common programming bugs found in other OSes can also be found in Fuchsia. However, while these bugs can often be considered as vulnerabilities in other OSes, they turn out to be uninteresting on Fuchsia, because their impact is, for the most part, mitigated by Fuchsia's security properties. We note however that these security properties do not -- and in fact, cannot -- hold in the lowest layers of the kernel related to virtualization, exception handling and scheduling, and that any bug here remains exploitable just like on any other OS. All the bugs we found were reported to Google, and are now fixed. Again, it is not clear where Fuchsia is heading, and whether it is just a research OS as Google claims or a real OS that is vowed to be used on future products. What's clear, though, is that it has the potential to significantly increase the difficulty for attackers to compromise devices. ' -- source: https://tech.slashdot.org/story/20/06/10/008245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.19 Released
by Peter Reutemann 10 Jun '20

10 Jun '20

'The KDE community has released Plasma 5.19, the popular free and open-source desktop environment. "In this release, we have prioritized making Plasma more consistent, correcting and unifying designs of widgets and desktop elements; worked on giving you more control over your desktop by adding configuration options to the System Settings; and improved usability, making Plasma and its components easier to use and an overall more pleasurable experience," reads the announcement. For a complete list of what's new, you can visit the Plasma 5.19 changelog.' -- source: https://tech.slashdot.org/story/20/06/09/2035226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New CrossTalk Attack Impacts Intel's Mobile, Desktop, and Server CPUs
by Peter Reutemann 10 Jun '20

10 Jun '20

'Academics from a university in the Netherlands have published details today about a new vulnerability in Intel processors. From a report: The security bug, which they named CrossTalk, enables attacker-controlled code executing on one CPU core to leak sensitive data from other software running on a different core. The Vrije University's Systems and Network Security Group (VUSec) says the CrossTalk vulnerability is another type of MDS (microarchitectural data sampling) attack. MDS attacks target user data while in a "transient" state, as it's being processed inside the CPU and its many data-caching systems. More specifically, CrossTalk attacks data while it's being processed by the CPU's Line Fill Buffer (LBF), one of these aforementioned CPU cache systems. According to the VUSec team, the LBF cache actually works with a previously undocumented memory "staging buffer" that is shared by all CPU cores.' -- source: https://it.slashdot.org/story/20/06/09/1941205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pinebook Pro review—a $200 FOSS-to-the-hilt magnesium-chassis laptop
by Peter Reutemann 10 Jun '20

10 Jun '20

Since we had our own demo of the Pinebook earlier this year, here is another take: 'In early March of this year, I ordered one of the FOSS-driven Pine64 project's newest designs—the Pinebook Pro. The company's manufacturing efforts have taken an enormous hit due to the impact of COVID-19 on its Chinese manufacturing partners, which kept me from receiving my Pinebook Pro until last week. Unfortunately, COVID-19 didn't merely slow down production. It also made QA impossible, which led to enough problems with my new laptop that it's going to need to be replaced. We'll talk about why that is in much greater detail later, but for right now, keep in mind that some parts of my experience aren't as-designed for the hardware. You should also keep in mind that the Pinebook isn't exactly a consumer product—it's a device aimed squarely at hobbyists and tinkerers with offbeat plans and limited budget. Most people will not want to replace their standard consumer laptop or Chromebook with a Pinebook Pro—but it's a fascinating look at what's possible in inexpensive hardware design with an intense focus on privacy, open source design, and community.' -- source: https://arstechnica.com/gadgets/2020/06/pinebook-pro-review-a-200-foss-to-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Plundering of crypto keys from ultrasecure SGX sends Intel scrambling again
by Peter Reutemann 10 Jun '20

10 Jun '20

'For the past two years, modern CPUs—particularly those made by Intel—have been under siege by an unending series of attacks that make it possible for highly skilled attackers to pluck passwords, encryption keys, and other secrets out of silicon-resident memory. On Tuesday, two separate academic teams disclosed two new and distinctive exploits that pierce Intel’s Software Guard eXtension, by far the most sensitive region of the company’s processors. Abbreviated as SGX, the protection is designed to provide a Fort Knox of sorts for the safekeeping of encryption keys and other sensitive data even when the operating system or a virtual machine running on top is badly and maliciously compromised. SGX works by creating trusted execution environments that protect sensitive code and the data it works with from monitoring or tampering by anything else on the system. Key to the security and authenticity assurances of SGX is its creation of what are called enclaves, or blocks of secure memory. Enclave contents are encrypted before they leave the processor and are written in RAM. They are decrypted only after they return. The job of SGX is to safeguard the enclave memory and block access to its contents by anything other than the trusted part of the CPU. Tuesday’s attacks aren’t the first to defeat SGX. In 2018, a different team of researchers broke into the fortified Intel region after building on an attack known as Meltdown, which, along with a similar attack known as Spectre, ushered in the flurry of processor exploits. A different team of researchers broke SGX earlier this year. Intel mitigated the earlier SGX vulnerability by introducing microcode updates. However, these mitigations did not last, as two new attacks have sent Intel scrambling anew to devise new defenses. Intel released the new updates on Tuesday and expects them to be available to end users in the coming weeks. Depending on the computer, the fix will either be installed automatically or will require manual intervention. Users, particularly those who rely on the SGX, should check with the manufacturer of their machine and ensure that the update is installed as soon as practical. The new SGX attacks are known as SGAxe and CrossTalk. Both break into the fortified CPU region using separate side-channel attacks, a class of hack that infers sensitive data by measuring timing differences, power consumption, electromagnetic radiation, sound, or other information from the systems that store it. The assumptions for both attacks are roughly the same. An attacker has already broken the security of the target machine through a software exploit or a malicious virtual machine that compromises the integrity of the system. While that’s a tall bar, it’s precisely the scenario that SGX is supposed to defend against.' -- source: https://arstechnica.com/information-technology/2020/06/new-exploits-plunder… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bryan Lunduke Explains Why Linux Sucks in 2020
by Peter Reutemann 09 Jun '20

09 Jun '20

'Roblimo once called it "a tradition, not just a speech" -- Bryan Lunduke's annual "Linux Sucks" presentations at various Linux conferences. But before you get too upset, in his 2014 interview with Slashdot Lunduke admitted "I love Linux, I have made my whole life around Linux. I work for Linux companies. I write for Linux magazines, but it really blows..." This year he's releasing a special YouTube version of Linux Sucks 2020, the first time Lunduke has attempted the talk without a live audience, "And it feels really wicked weird." But he's still trying to get a rise out of his audience. "Follow me on this into Journey Into Graphs and Numbers Land," Lunduke says playfully, pulling up one of his 160 x 90 pixel slides showing current market share for Windows, Mac, and then Linux "You might notice that some platforms have a higher market share than Linux does," he says with a laugh, describing one slide showing Linux as "scooping up the bottom of the barrel at 1.6%..." "But here's the thing. These numbers have been either consistent, or for Linux, slowly dropping." And then he puts up a graph showing the number of searches for Linux. "If you look back at 2004 -- the year 2004, 16 years ago -- that was the high point in interest in searching for the word Linux (or Linux plus other things). 2006 it was about half that -- so about two years later it had dropped down to about half. Here in 2020 it is so low, not only does it not fill up the first bar of pixels there, it's like only three pixels in. That doesn't happen -- that sort of decline does not happen -- unless the platform sucks. That's just the truth of the matter. That's just how it goes, right?"' -- source: https://linux.slashdot.org/story/20/06/07/1941256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Vulnerabilities in Popular Open Source Projects Doubled in 2019
by Peter Reutemann 09 Jun '20

09 Jun '20

'A study that analyzed the top 54 open source projects found that security vulnerabilities in these tools doubled in 2019, going from 421 bugs reported in 2018 to 968 last year. From a report: According to RiskSense's "The Dark Reality of Open Source" report, released today, the company found 2,694 bugs reported in popular open source projects between 2015 and March 2020. The report didn't include projects like Linux, WordPress, Drupal, and other super-popular free tools, since these projects are often monitored, and security bugs make the news, ensuring most of these security issues get patched fairly quickly. Instead, RiskSense looked at other popular open source projects that aren't as well known but broadly adopted by the tech and software community. This included tools like Jenkins, MongoDB, Elasticsearch, Chef, GitLab, Spark, Puppet, and others. RiskSense says that one of the main problems they found during their study was that a large number of the security bugs they analyzed had been reported to the National Vulnerability Database (NVD) many weeks after they've been publicly disclosed. The company said it usually took on average around 54 days for bugs found in these 54 projects to be reported to the NVD, with PostgreSQL seeing reporting delays that amounted to eight months.' -- source: https://it.slashdot.org/story/20/06/08/1417259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coffee Run--Blender Open Movie
by Lawrence D'Oliveiro 08 Jun '20

08 Jun '20

The latest annual short-feature project from the Blender Animation Studio came out week before last <https://www.youtube.com/watch?v=PVGeM40dABA>. At just about 3 minutes long, this one is done in the style of a 2D-rendered video game. But beware: there are some less-than-lighthearted elements behind the surface.

2 1