September 2020 - wlug - list.wlug.org.nz

Ransomware Accounted For 41% of All Cyber Insurance Claims in H1 2020
by Peter Reutemann 11 Sep '20

11 Sep '20

'Ransomware incidents accounted for 41% of cyber insurance claims filed in the first half of 2020, according to a report published today by Coalition, one of the largest providers of cyber insurance services in North America. From a report: The high number of claims comes to confirm previous reports from multiple cyber-security firms that ransomware is one of today's most prevalent and destructive threats. "Ransomware doesn't discriminate by industry. We've seen an increase in ransom attacks across almost every industry we serve," Coalition added. "In the first half of 2020 alone, we observed a 260% increase in the frequency of ransomware attacks amongst our policyholders, with the average ransom demand increasing 47%," the company added. Among the most aggressive gangs, the cyber insurer listed Maze and DoppelPaymer, which have recently begun exfiltrating data from hacked networks, and threatening to release data on specialized leak sites, as part of double extortion schemes. Based on cyber insurance claims filed by customers who faced a ransomware attack in the first half of 2020, Coalition said the Maze ransomware gang was the most greedy, with the group requesting ransom demands six times larger than the overall average.' -- source: https://it.slashdot.org/story/20/09/10/1829253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi Browser Adds a Pause Button For the Internet
by Peter Reutemann 10 Sep '20

10 Sep '20

'It can be hard to tear yourself away from the never-ending stream of content provided by the internet, so Vivaldi decided to make taking a break easier by introducing a pause button. PCMag reports: Version 3.3 of the Vivaldi browser introduces a new feature called "Break Mode." Rather than having to close your browser, Break Mode allows you to effectively pause your access to the internet with a button press. Once installed, Vivaldi 3.3 displays a pause button on the status bar. When pressed, Break Mode is engaged, which "mutes and stops HTML5 audio and videos, hides all tabs, panels, and other content leaving the screen clean." It's also possible to trigger Break Mode with the keyboard shortcut Ctrl + "." and to activate it via the browser's Quick Commands. The Vivaldi team sees it as a way of allowing you to "interact with the physical world" while at the same time not having to remember which tabs you had open or what you were viewing when you're ready to return. Pressing the pause button again resumes access just as you left it. Break Mode also acts as a very simple and quick way to hide what you were doing on the internet, which could come in very handy seeing as we're spending so much more time at home together. Other new features include more options for customizing themes as well as adding a new "Private" theme, highlighting base domains to help identify malicious web pages, easier cropping of URLs in the address bar making it easier to visit different parts of a website, and enhancements to the built-in tracker and ad blocker allowing whole pages to be easily blocked.' -- source: https://tech.slashdot.org/story/20/09/09/1933207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10 Themes Can Be Abused To Steal Windows Passwords
by Peter Reutemann 09 Sep '20

09 Sep '20

'Specially crafted Windows 10 themes and theme packs can be used in 'Pass-the-Hash' attacks to steal Windows account credentials from unsuspecting users. Windows allows users to create custom themes that contain customized colors, sounds, mouse cursors, and the wallpaper that the operating system will use. Windows users can then switch between different themes as desired to change the appearance of the operating system. A theme's settings are saved under the %AppData%\Microsoft\Windows\Themes folder as a file with a .theme extension, such as 'Custom Dark.theme.' Windows themes can then be shared with other users by right-clicking on an active theme and selecting 'Save theme for sharing,' which will package the theme into a '.deskthemepack' file. These desktop theme packs can then be shared via email or as downloads on websites, and installed by double-clicking them. This weekend security researcher Jimmy Bayne (@bohops) revealed that specially crafted Windows themes could be used to perform Pass-the-Hash attacks. Pass-the-Hash attacks are used to steal Windows login names and password hashes by tricking a user into accessing a remote SMB share that requires authentication. When trying to access the remote resource, Windows will automatically try to login to the remote system by sending the Windows user's login name and an NTLM hash of their password. In a Pass-the-Hash attack, the sent credentials are harvested by the attackers, who then attempt to dehash the password to access the visitors' login name and password.' -- source: https://tech.slashdot.org/story/20/09/08/2017228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Amiga Fast File System Makes Minor Comeback In New Linux Kernel
by Peter Reutemann 09 Sep '20

09 Sep '20

'The Amiga Fast File System (AFFS) is making a minor comeback in the new version of the Linux kernel. The Register reports: As noted by chief penguin Linus Torvalds in his weekly state-of-the-kernel report, a change to AFFS popped up among what he described as a collection of "the usual suspects" in new submissions to the kernel over the last week. The Amiga was ahead of its time, but is now largely a curiosity. However Suse developer David Sterba has noticed that "The basic permission bits (protection bits in AmigaOS) have been broken in Linux' AFFS - it would only set bits, but never delete them. Also, contrary to the documentation, the Archived bit was not handled." "Let's fix this for good, and set the bits such that Linux and classic AmigaOS can coexist in the most peaceful manner," he added. Torvalds appears to have agreed inasmuch as Sterba's code has made it into rc4 of version 5.9 of the Linux kernel. Torvalds said that while rc4 is a big release -- he rated it as "larger than usual" -- it's still "well within the normal range, and not something I'll lose any sleep over."' -- source: https://linux.slashdot.org/story/20/09/08/203224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Begins Rolling Out Android 11
by Peter Reutemann 09 Sep '20

09 Sep '20

'Google today launched Android 11, the latest version of its mobile OS, and pushed the source code to the Android Open Source Project (AOSP). From a report: Unlike previous major versions, Android 11 is not only arriving as an over-the-air update to Pixel phones first, but also on OnePlus, Xiaomi, Oppo, and Realme phones "with more partners launching and upgrading devices over the coming months." That's a major departure for Android, updates for which take months to arrive thanks to carriers and device makers dragging their feet. It doesn't help that Android is the dominant mobile operating system available on thousands of different device configurations, powering over 2.5 billion monthly active devices. [...] Android 11 brings a long list of new features. Google originally split them into three themes: People, Controls, and Privacy. But there is also support for 5G, new screen types, and call screening. There's even a frame rate API for helping apps and games adopt variable refresh rates, which will be a big focus over the next few years as phones and TVs adopt the feature from computer monitors. Google also expanded the Neural Networks API for running computationally intensive machine learning operations.' -- source: https://tech.slashdot.org/story/20/09/08/1710224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Western Digital is trying to redefine the word “RPM”
by Peter Reutemann 08 Sep '20

08 Sep '20

'Last week, the fine Redditors of /r/DataHoarder got upset with Western Digital again—this time, for misrepresenting the rotational speed of their WD Red Network Attached Storage hard drives. (Although the linked post brings things to a head, members of the German-language forum hardwareluxx.de began investigating the issue more than year ago.) We found this controversy reminiscent of earlier complaints that Western Digital was not properly disclosing use of Shingled Magnetic Recording technology in their NAS drives. But the new complaint is that Western Digital calls 7200RPM drives "5400 RPM Class"—and the drives' own firmware report 5400 RPM via the SMART interface. Recently, redditor /u/Amaroko set out to prove or disprove earlier netizens' findings. For each of several drive models, Amoroko placed a sample of that drive on an empty cardboard box, with a Blue Yeti mic held directly above it, then powered the drive on. Spectral analysis of the recorded audio using Adobe Audition showed a baseline frequency of 120Hz for two models of WD 8TB "5400 RPM class" drive. 120 cycles/sec multiplied to 60 secs/min comes to 7,200 cycles/min. So in other words, these "5400 RPM class" drives really were spinning at 7,200rpm.' -- source: https://arstechnica.com/gadgets/2020/09/western-digital-is-trying-to-redefi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Arm's New Linux-Capable Cortex-R82 Processor Will Enable Drives That Both Store and Process Data
by Peter Reutemann 07 Sep '20

07 Sep '20

'"Arm has announced its first 64 bit, Linux-capable Cortex-R processor, designed for computational storage solutions," reports Electronics Weekly. SiliconAngle calls it "a chip designed to enable a new generation of storage devices that will not only hold data but also help process it." Such devices are part of an emerging hardware category known as computational storage. The technology promises to provide a speed boost for latency-sensitive workloads such as machine learning and real-time analytics applications. Normally, the task of storing data and processing it is relegated to separate components inside a system. The disk or flash drive holds onto the information while a separate processor does the processing. Data has to travel from the storage drive to the processor and back every time an operation is carried out, which creates delays that can slow down performance. The emerging computational storage devices Arm targets attempt to do away with these delays to speed up applications. Instead of sending information to a separate chip for processing, the storage drive processes it locally using its built-in controller. A controller is a tiny computing module inside flash and disk drives that normally performs only low-level tasks such as writing and reading data. Arm's new Cortex-R82 is designed to serve as the controller for computational storage devices. It's available as a chip design that hardware makers can license and customize based on their needs. "The extra computing power allows the chip to run a full Linux distribution as well as applications, all directly inside a storage drive."' -- source: https://hardware.slashdot.org/story/20/09/06/0110227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is There A Google-Free Future For Firefox?
by Peter Reutemann 07 Sep '20

07 Sep '20

'Forbes reports: Firefox is exploring subscriptions and other "value exchange" services to ease its financial dependence on rival Google, according to the browser's lead developer. Firefox maker, Mozilla, is in the uneasy position of being financially dependent on its search deal with Google, which accounts for the majority of the organization's revenue. Although Mozilla only last month renewed the search deal, ensuring Google remains the default search engine for Firefox in the U.S. and other territories, the company is keen to explore other ways of raising revenue, including charging users for services. Mozilla's partnership with Google is an uncomfortable alliance, not only because the companies distribute rival browsers, but because their values are markedly different. While Google generates the vast bulk of its revenue from online advertising, Firefox's developers expend much of their effort creating tools that thwart advertisers, including the automatic blocking of third-party tracking tools and social-media trackers. "At Mozilla, we tend to believe things are at their best when users have this transparent value exchange," said Dave Camp, senior vice president of Firefox at Mozilla. "The advertising model has become a default way to fund things on the internet and to fund products, and we're pretty interested — not just for financial reasons, but actually for health of the internet reasons — to explore how can we do better for users than advertising." Mozilla recently began charging users $4.99 per month for its VPN product and Camp says the company is exploring other subscription products. "We don't have any immediate plans in the Firefox team to do add-on services or anything like that at the moment, but we're going to look at other ways to get some value exchange going on," said Camp.' -- source: https://news.slashdot.org/story/20/09/06/0122206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Developers Trust Each Other Too Much?
by Lawrence D'Oliveiro 06 Sep '20

06 Sep '20

From <https://www.theregister.com/2020/09/04/disclosure_developer_targeting/>: ... much of it is down to exploiting the trust developers put into shared code and software stacks. By selecting a developer and studying their projects, an attacker would be able to map out the software stack being used. From there, the attacker would pick out a weak spot in that stack – say, a dependency or GitHub project – and slip poisoned code in. This could be as simple as slipping attack code into StackOverflow. ... "Most developers consider themselves to be moderately intelligent but not stupid," mused Jones. "I have found most developers are highly intelligent, but also highly stupid."

1 0

'Linusgate': Debian Project Leaders Want To Ban Linus Torvalds For His Manners
by Peter Reutemann 06 Sep '20

06 Sep '20

'Artem S. Tashkinov writes: 253 emails have been leaked from private (high-level) mailing lists of Debian, in which its representatives vocally complain about the talk Linus Torvalds gave at the most recent DebConf conference. Some people insist that he should be permanently banned from future conferences because the language he uses is inappropriate and infringes on the project's Code of Conduct. This could set a very bad precedent for the open source community, which has recently seen an influx of various CoC policies applied to a number of high-profile projects mostly after very vocal concerns from the people who barely participate in the open source community. Some observers believe that it's a plot by Microsoft to destroy the open source movement from the inside.' -- source: https://linux.slashdot.org/story/20/09/04/2218239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0