March 2021 - wlug - list.wlug.org.nz

Security Researcher Hides ZIP, MP3 Files Inside PNG Files On Twitter
by Peter Reutemann 19 Mar '21

19 Mar '21

'A security researcher has discovered a novel steganography technique for hiding data inside a Portable Network Graphics (.PNG) image file posted on Twitter, a tactic that could be exploited by threat actors to hide malicious activity. Threatpost reports: Researcher David Buchanan heralded his discovery on Twitter earlier this week, accompanied by a photo declaring: "Save this image and change the extension to .zip!" He made the source code for his method available in a ZIP/PNG file attached to the image as well as on a post on GitHub that explains his methodology. Specifically, Buchanan demonstrated how he could hide both MP3 audio files and ZIP archives within the PNG images hosted on Twitter. The reason he was successful is because while Twitter strips unnecessary data from PNG uploads, they don't remove trailing data from the DEFLATE stream inside the IDAT chunk if the overall image file meets the requirements to avoid being re-encoded, he explained. There are some requirements for both the images used to obscure files and the files being hidden inside them for his method to work, Buchanan explained. "The cover image must compress well, such that the compressed filesize is less than (width * height) -- size_of_embedded_file," he wrote in his post. "If the cover image does not have a palette, then it must have at least 257 unique colors (otherwise Twitter will optimize it to use a palette)." Resolution on images can be up to 4096 x 4096, although Twitter will serve a downscaled version by default for images greater than 680 x 680 depending on certain factors, Buchanan wrote. The image also should not have any unnecessary "metadata chunks," he added. For embedded files, the total output file size must be less than potentially 5MB, but kept under 3MB to be on the safe side, otherwise Twitter will convert the PNG to a JPEG file, Buchanan explained. Moreover, if the embedded file is a ZIP, then the offsets are automatically adjusted so that the overall file is still a valid ZIP, he said. "For any other file formats, you're on your own," Buchanan added, noting that many will work without special parameters, including PDF and MP3 files. ' -- source: https://it.slashdot.org/story/21/03/18/2127257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Topic for next meeting: audio/video
by Peter Reutemann 18 Mar '21

18 Mar '21

Hi everyone Before the last meeting, Ian looked into ffmpeg and was wondering whether it would a good idea for a presentation. I think that widening the topic to general audio/video processing (command line or GUI) would be a rally useful session for people new to Linux (and probably also for more experienced users, finding out about little neat tricks!). Rather than a super in-depth presentation for one application, we can cover a bigger range with a 5-10min show-and-tell per application. I'll assume that Ian will talk about ffmpeg, Lawrence about the other tools that come with ffmpeg, and I will show OBS (Open Broadcaster Software) and Handbrake. Just reply to this thread with your application that you'd like to present. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 5

~4,300 publicly reachable servers are posing a new DDoS hazard to the Internet
by Peter Reutemann 18 Mar '21

18 Mar '21

'Criminals are upping the potency of distributed denial-of-service attacks with a technique that abuses a widely used Internet protocol that drastically increases the amount of junk traffic directed at targeted servers. DDoSes are attacks that flood a website or server with more data than it can handle. The result is a denial of service to people trying to connect to the service. As DDoS-mitigation services develop protections that allow targets to withstand ever-larger torrents of traffic, the criminals respond with new ways to make the most of their limited bandwidth. In so-called amplification attacks, DDoSers send requests of relatively small data sizes to certain types of intermediary servers. The intermediaries then send the targets responses that are tens, hundreds, or thousands of times bigger. The redirection works because the requests replace the IP address of the attacker with the address of the server being targeted. Other well-known amplification vectors include the memcached database caching system with an amplification factor of an astounding 51,000, the Network Time Protocol with a factor of 58, and misconfigured DNS servers with a factor of 50. DDoS mitigation provider Netscout said on Wednesday that it has observed DDoS-for-hire services adopting a new amplification vector. The vector is the Datagram Transport Layer Security, or D/TLS, which (as its name suggests) is essentially the Transport Layer Security for UDP data packets. Just as TLS prevents eavesdropping, tampering, or forgery of TLS packets, D/TLS does the same for UDP data. DDoSes that abuse D/TLS allow attackers to amplify their attacks by a factor of 37. Previously, Netscout saw only advanced attackers using dedicated DDoS infrastructure abusing the vector. Now, so-called booter and stressor services—which use commodity equipment to provide for-hire attacks—have adopted the technique. The company has identified almost 4,300 publicly reachable D/LTS servers that are susceptible to the abuse.' -- source: https://arstechnica.com/gadgets/2021/03/mainstream-ddosers-are-abusing-d-tl… Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In-kernel WireGuard is on its way to FreeBSD and the pfSense router
by Peter Reutemann 18 Mar '21

18 Mar '21

'This morning, WireGuard founding developer Jason Donenfeld announced a working, in-kernel implementation of his WireGuard VPN protocol for the FreeBSD 13 kernel. This is great news for BSD folks—and users of BSD-based routing appliances and distros such as pfSense and opnSense.' -- source: https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-is-on-its-way-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

WeLeakInfo Leaked Customer Payment Info
by Peter Reutemann 16 Mar '21

16 Mar '21

'A lapsed domain registration tied to WeLeakInfo, a wildly popular service that sold access to more than 12 billion usernames and passwords from thousands of hacked websites, "let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card," reports Krebs on Security. This comes after the service was seized a little over a year ago by the FBI and law enforcement partners overseas. From the report: In a post on the database leaking forum Raidforums, a regular contributor using the handle "pompompurin" said he stole the WeLeakInfo payment logs and other data after noticing the domain wli[.]design was no longer listed as registered. "Long story short: FBI let one of weleakinfo's domains expire that they used for the emails/payments," pompompurin wrote. "I registered that domain, & was able to [password] reset the stripe.com account & get all the Data. [It's] only from people that used stripe.com to checkout. If you used paypal or [bitcoin] ur all good." Cyber threat intelligence firm Flashpoint obtained a copy of the data leaked by pompompurin, and said it includes partial credit card data, email addresses, full names, IP addresses, browser user agent string data, physical addresses, phone numbers, and amount paid. One forum member commented that they found their own payment data in the logs. ' -- source: https://it.slashdot.org/story/21/03/15/2117240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Redesign Drops Compact Density Option
by Peter Reutemann 16 Mar '21

16 Mar '21

'Firefox's "Compact density" option, which reduces the size of the user interface, is set to disappear when Mozilla rolls out its Proton visual redesign for the browser later this year. PCMag reports: A bug was posted on Mozilla's bug tracking system entitled "Remove compact mode inside Density menu of customize palette." The reasons given for its removal include the fact it's "currently fairly hard to discover" and "we assume gets low engagement." The development team wants to "make sure that we design defaults that suit most users and we'll be retiring the compact mode for this reason." The Bugzilla thread highlights a desire for compact density to be retained as an option, but it doesn't seem likely to survive right now. When Proton arrives, the Normal and Touch density options are expected to remain, with Touch increasing the size of the user interface to make it more finger-friendly. Meanwhile, the development team is optimizing the Normal density for displays that use 768 pixels for height, while most displays now use a higher resolution than that. Hopefully this doesn't mean the UI will be larger than it is now by default.' -- source: https://news.slashdot.org/story/21/03/15/2122201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners-Lee Says Too Many Young People Are Excluded From Web
by Peter Reutemann 16 Mar '21

16 Mar '21

'Too many young people around the world are excluded from accessing the web, and getting them online should be a priority for the post-Covid era, Tim Berners-Lee has said. From a report: In a letter published to mark the 32nd birthday of the web, its founder says the opportunity "to reimagine our world and create something better" in the aftermath of Covid-19 must be channelled to getting internet access to the third of people aged between 15 and 24 who are offline. "The influence of young people is felt across their communities and online networks," Berners-Lee writes. "But today we're seeing just a fraction of what's possible. Because while we talk about a generation of 'digital natives,' far too many young people remain excluded and unable to use the web to share their talents and ideas. "A third of young people have no internet access at all. Many more lack the data, devices and reliable connection they need to make the most of the web. In fact, only the top third of under-25s have a home internet connection, according to Unicef, leaving 2.2 billion young people without the stable access they need to learn online, which has helped so many others continue their education during the pandemic." Even though young people are more likely than the typical global citizen to have internet access -- roughly half the world is online, but the figure rises to 70% of people aged between 15 and 25 -- Berners-Lee argues that aiming to connect every young person in the world to the web would reap dividends. He also says doing so would be relatively cheap compared with the cost of many government programmes launched over the last 12 months. He estimates that an investment of $428bn over the next decade would provide everyone with a quality broadband connection.' -- source: https://tech.slashdot.org/story/21/03/15/1948259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'A Hacker Got All My Texts For $16'
by Peter Reutemann 16 Mar '21

16 Mar '21

'A report from Motherboard, written by Joseph Cox: I didn't expect it to be that quick. While I was on a Google Hangouts call with a colleague, the hacker sent me screenshots of my Bumble and Postmates accounts, which he had broken into. Then he showed he had received texts that were meant for me that he had intercepted. Later he took over my WhatsApp account, too, and texted a friend pretending to be me. Looking down at my phone, there was no sign it had been hacked. I still had reception; the phone said I was still connected to the T-Mobile network. Nothing was unusual there. But the hacker had swiftly, stealthily, and largely effortlessly redirected my text messages to themselves. And all for just $16. I hadn't been SIM swapped, where hackers trick or bribe telecom employees to port a target's phone number to their own SIM card. Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him. This overlooked attack vector shows not only how unregulated commercial SMS tools are but also how there are gaping holes in our telecommunications infrastructure, with a hacker sometimes just having to pinky swear they have the consent of the target. "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," said Lucky225, the pseudonymous hacker who carried out the attack, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers. In a statement to Motherboard, Senator Ron Wyden said: "Itâ(TM)s not hard to see the enormous threat to safety and security this kind of attack poses. The FCC must use its authority to force phone companies to secure their networks from hackers. Former Chairman Paiâ(TM)s approach of industry self-regulation clearly failed."' -- source: https://yro.slashdot.org/story/21/03/15/1950245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM's Patent Income Slips as Companies Resist 'Godfather' Deals
by Peter Reutemann 15 Mar '21

15 Mar '21

'"Even as IBM has sued an increasing number of companies, its IP income has shrunk," reports Bloomberg: Intellectual property rights historically brought in more than $1 billion a year, on average, helping offset massive research and development costs and shrinking revenue. Last year, IBM's income from intellectual property was $626 million, its lowest point since 1996, and 2019 wasn't much higher. While it continues to secure license deals, they are fewer and harder-won, with companies like Airbnb Inc. and Chewy Inc. waging battles in court... In February, online pet-food seller Chewy requested a court order to block a $36 million patent fee IBM is demanding. Chewy accused IBM of "seeking exorbitant licensing fees for early internet patents having no value." IBM's claims against Chewy include years-old inventions such as targeted advertising and content resizing based on cursor activity, both ubiquitous on the web. Chewy said IBM doesn't make or sell products covered by the vast majority of the thousands of patents it has received over the past 20 years, but instead just threatens to sue if companies don't agree to pay for licenses. IBM has not answered Chewy's complaint, and no trial date has been set. Companies that use their IP licensing aggressively as a way to make money are often referred to as patent trolls. However, IBM's position as the largest aggregator of U.S. intellectual property is more akin to being a patent godfather, says Robin Feldman, a law professor at the University of California, Hastings. With more than 38,000 active patents in its portfolio, and thousands of license agreements bolstering its legitimacy, IBM's demands have traditionally gone unchallenged, Feldman said. Such patent godfathers, with large portfolios, are "able to make offers that can't be refused." Even some of the most innovative technology giants have licensed IBM patents over the years. Alphabet Inc.'s Google, Amazon.com Inc. and LinkedIn are among countless companies that have had to pony up. IBM also has long served as a patent bank for young companies to jump-start their portfolios. Facebook Inc. was not yet public in 2012 when it bought 750 patents on software and networking from IBM. As Instacart Inc. prepares to go public, it purchased almost 300 IBM patents in January ranging from e-commerce to smart shopping bags. Noting a series of Supreme Court verdicts making it easier to invalidate a patent, Feldman, the law professor, told Bloomberg that "Being the godfather isn't what it used to be. It's not that patent aggregation as a business is over. You just make less money."' -- source: https://yro.slashdot.org/story/21/03/13/2120248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Decentralized Routing Protocol Aims To Replace BGP
by Peter Reutemann 15 Mar '21

15 Mar '21

'"The Border Gateway Protocol was first described in 1989...," according to Wikipedia, "and has been in use on the Internet since 1994." But now long-time Slashdot reader jovius reports that a startup named Syntropy "aims to replace BGP as the default routing method of the internet, by using nodes around the world to constantly gather data of the inefficiencies of the current network." The intelligence is then used to route data via the most efficient routes. Actual tests with hundreds of servers have proved that latencies can be reduced by tens to hundreds of milliseconds. The connections are by default encrypted, and jitter is also reduced. Eventually, the company-run servers are augmented with tens of thousands of nodes run by users/smart devices, who are rewarded for their work. The team was recently joined by former SVP at Verizon Shawn Hakl and former Chief Product Officer at AT&T Roman Pacewicz. One of the founders of Syntropy is the co-founder of Equinix and NANOG Bill Norton. Syntropy is an Oracle and Microsoft partner, and transforming into a foundation and DAO to govern the protocol work. Decentralised autonomous routing protocol (or DARP) has just been opened for community testing, and the system is live on https://darp.syntropystack.com/. ' -- source: https://tech.slashdot.org/story/21/03/14/1910257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0