August 2020 - wlug - list.wlug.org.nz

Google Fixes Major Gmail Bug Seven Hours After Exploit Details Go Public
by Peter Reutemann 21 Aug '20

21 Aug '20

'Google has patched on Wednesday a major security bug impacting the Gmail and G Suite email servers. From a report: The bug could have allowed a threat actor to send spoofed emails mimicking any Gmail or G Suite customer. According to security researcher Allison Husain, who found and reported this issue to Google in April, the bug also allowed attachers to pass the spoofed emails as compliant with SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance), two of the most advanced email security standards. However, despite having 137 days to fix the reported issue, Google initially delayed patches past the disclosure deadline, planning to fix the bug somewhere in September. Google engineers changed their mind yesterday after Husain published details about the bug on her blog, including proof-of-concept exploit code.' -- source: https://it.slashdot.org/story/20/08/20/1522226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Some Email Clients Are Vulnerable To Attacks Via 'mailto' Links
by Peter Reutemann 21 Aug '20

21 Aug '20

'A lesser-known technology known as "mailto" links can be abused to launch attacks on the users of email desktop clients. From a report: The new attacks can be used to secretly steal local files and have them emailed as attachments to attackers, according to a research paper published last week by academics from two German universities. The "vulnerability" at the heart of these attacks is how email clients implemented RFC6068 -- the technical standard that describes the 'mailto' URI scheme. Mailto refer to special types of links, usually supported by web browsers or email clients. These are links that, when clicked, they open a new email compose/reply window rather than a new web page (website). RFC6068 says that mailto links can support various parameters. When used with mailto links, these parameters will pre-fill the new email window with predefined content.' -- source: https://it.slashdot.org/story/20/08/20/177204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Legend Of The Melbourne Citadel
by Lawrence D'Oliveiro 21 Aug '20

21 Aug '20

It appears there is a 2300-foot tall building in Melbourne, at least according to the latest version of Microsoft Flight Simulator <https://www.theregister.com/2020/08/20/flight_simulator_bing_fawkner_tower/>. This would make it the second-tallest in the world. It originated from a mistaken entry into the OpenStreetMap database (since corrected), which Flight Simulator nevertheless managed to incorporate into its map data. There’s even a linked video of a player trying to land on it, before a future update deletes it from the game. Spoiler alert: yes, you can land, with the right sort of aircraft and a bit of effort. And you can even take off again. Another amusing item from the report comes from Microsoft’s use of AI to fill in road traffic flows. There is one case where the map data seems to omit the fact that there is a traffic tunnel through a building, with the result that the software has the cars going vertically up and down the sides of the building.

1 0

Linux Is Taking Over
by Lawrence D'Oliveiro 21 Aug '20

21 Aug '20

Seems like The Register’s BorkBorkBork column, featuring public examples of embedded systems falling over, is including more and more Linux-based screwups, e.g. <https://www.theregister.com/2020/08/20/bork/>: RailPoint has form for bork. Its Windows-based signage has already featured in these pages and back then the company told us it was "about to upgrade all of our production machines to a custom Linux build to improve their stability and generally operate with more efficiency". Behold the stability and efficiency. *Sigh*

1 0

'Real' Programming Is an Elitist Myth
by Peter Reutemann 20 Aug '20

20 Aug '20

'When people build a database to manage reading lists or feed their neighbors, that's coding -- and culture. From an essay: We are past the New York City Covid-19 peak. Things have started to reopen, but our neighborhood is in trouble, and people are hungry. There's a church that's opened space for a food pantry, a restaurant owner who has given herself to feeding the neighborhood, and lots of volunteers. [...] It's a complex data model. It involves date fields, text fields, integers, notes. You need lots of people to log in, but you need to protect private data too. You'd think their planning conversations would be about making lots of rice. But that is just a data point. The tool the mutual aid group has settled on to track everything is Airtable, a database-as-a-service program. You log in and there's your database. There are a host of tools like this now, "low-code" or "no-code" software with names like Zapier or Coda or Appy Pie. At first glance these tools look like flowcharts married to spreadsheets, but they're powerful ways to build little data-management apps. Airtable in particular keeps showing up everywhere for managing office supplies or scheduling appointments or tracking who at WIRED has their fingers on this column. The more features you use, the more they charge for it, and it can add up quickly. I know because I see the invoices at my company; we use it to track projects. "Real" coders in my experience have often sneered at this kind of software, even back when it was just FileMaker and Microsoft Access managing the flower shop or tracking the cats at the animal shelter. It's not hard to see why. These tools are just databases with a form-making interface on top, and with no code in between. It reduces software development, in all its complexity and immense profitability, to a set of simple data types and form elements. You wouldn't build a banking system in it or a game. It lacks the features of big, grown-up databases like Oracle or IBM's Db2 or PostgreSQL. And since it is for amateurs, the end result ends up looking amateur. But it sure does work. I've noticed that when software lets nonprogrammers do programmer things, it makes the programmers nervous. Suddenly they stop smiling indulgently and start talking about what "real programming" is. This has been the history of the World Wide Web, for example. Go ahead and tweet "HTML is real programming," and watch programmers show up in your mentions to go, "As if." Except when you write a web page in HTML, you are creating a data model that will be interpreted by the browser. This is what programming is. Code culture can be solipsistic and exhausting. Programmers fight over semicolon placement and the right way to be object-oriented or functional or whatever else will let them feel in control and smarter and more economically safe, and always I want to shout back: Code isn't enough on its own. We throw code away when it runs out its clock; we migrate data to new databases, so as not to lose one precious bit. Code is a story we tell about data.' -- source: https://developers.slashdot.org/story/20/08/19/146204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

235 Million Instagram, TikTok and YouTube User Profiles Exposed In Massive Data Leak
by Peter Reutemann 20 Aug '20

20 Aug '20

'Forbes: The security research team at Comparitech today disclosed how an unsecured database left almost 235 million Instagram, TikTok and YouTube user profiles exposed online in what can only be described as a massive data leak. The data was spread across several datasets; the most significant being two coming in at just under 100 million each and containing profile records apparently scraped from Instagram. The third-largest was a dataset of some 42 million TikTok users, followed by just under 4 million YouTube user profiles. Comparitech says that, based on the samples it collected, one in five records contained either a telephone number or email address. Every record also included at least some, sometimes all, the following information: Profile name; Full real name; Profile photo; and Account description. Statistics about follower engagement, including: Number of followers; Engagement rate; Follower growth rate; Audience gender; Audience age; Audience location; Likes; Last post timestamp; Age; and Gender. "The information would probably be most valuable to spammers and cybercriminals running phishing campaigns," Paul Bischoff, Comparitech editor, says. "Even though the data is publicly accessible, the fact that it was leaked in aggregate as a well-structured database makes it much more valuable than each profile would be in isolation," Bischoff adds. Indeed, Bischoff told me that it would be easy for a bot to use the database to post targeted spam comments on any Instagram profile matching criteria such as gender, age or number of followers. The data appeared to have originated from a company called Deep Social, which was banned by both Facebook and Instagram in 2018 after scraping user profile data. The company was wound down sometime after this. The researchers reached out to Deep Social, which then forwarded the disclosure to a Hong Kong-registered social media influencer data-marketing company called Social Data. Social Data shut down the database about three hours after the researchers' initial email. "Social Data has denied any connection between itself and Deep Social," reports Forbes, citing Comparitech.' -- source: https://yro.slashdot.org/story/20/08/19/212230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More PowerShell Users On Linux Than Windows?!?
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

According to this <https://www.theregister.com/2020/08/18/powershell_71_preview_6/>: While the Linux useragent continues to be responsible for the lion's share of daily usage (and Ubuntu the distro of choice), Windows has continued to rise in popularity, according to the figures. which surprises me just a little bit, considering this was a tool originally designed to bring more advanced command-line facilities to Windows, not Linux. Maybe they should fix those Linux-specific bugs <http://www.theregister.co.uk/2016/08/23/your_wget_is_broken_and_should_die_…> after all...

1 0

Chrome 86 Will Warn Users About Insecure Forms On HTTPS Pages
by Peter Reutemann 19 Aug '20

19 Aug '20

'While there's wide HTTPS adoption today, HTTP content on secure pages still persists. Google has been working to stamp that out, and Chrome is now turning its attention to and warning about insecure forms. "These 'mixed forms' (forms on HTTPS sites that do not submit on HTTPS) are a risk to users' security and privacy," says Google in a blog post. "Information submitted on these forms can be visible to eavesdroppers, allowing malicious parties to read or change sensitive form data." 9to5Google reports: The Google browser today removes the address bar's lock icon from sites with mixed forms. However, this proved to deliver an "unclear" experience that "did not effectively communicate the risks associated with submitting data in insecure forms." Starting in version 86, due to hit stable in October, Chrome will provide a more aggressive warning about insecure forms. Autofill will be disabled, but the built-in password manager will continue to offer "unique passwords." The company argues it's safer than reusing credentials. Next, the form will show red warning text underneath the field: "This form is not secure. Autofill has been turned off. The last measure will throw up a full-page warning communicating the potential risks. It gives users an option to cancel the action, but there will be a "Send anyway" button. ' -- source: https://tech.slashdot.org/story/20/08/18/0033257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel NTFS Driver
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

This article <https://www.theregister.com/2020/08/18/paragon_tries_to_contribute_ntfs/>, about the submission of a new Linux kernel driver for accessing Microsoft NTFS volumes (i.e. the kind of filesystems that are standard among Windows users), had me confused for a moment. It mentions limitations of the current kernel driver, like not being able to create or delete files or directories. I thought this kind of problem had been solved for Linux over a decade ago. And indeed it has, in the form of NTFS-3G, which is a userspace driver that connects via FUSE, and is available as a standard package for Debian and derivatives. I know this works, because just a few weeks ago, for example, I was at some friends’ place, and transferred several dozen gigabytes of files to an external hard drive of theirs from my Debian-Unstable-running laptop, without thinking twice about it, even though they are exclusively Windows users. I suppose a kernel driver offers higher performance, in principle, than one running in userspace. But I can’t imagine many Linux-based workloads that make heavy use of NTFS volumes.

2 1

meeting next Monday
by Peter Reutemann 19 Aug '20

19 Aug '20

Hi everyone We have a meeting coming up next Monday: "With VPNs being in the news frequently (and often for sad reasons like selling logs despite assurances that no such logs would exist), let's have a hands-on session with WireGuard (https://www.wireguard.com/) a VPN tunnel that is easier to use and configure than IPSec and faster than OpenVPN." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792032 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1