March 2021 - wlug - list.wlug.org.nz

Mozilla Firefox Tweaks Referrer Policy To Shore Up User Privacy
by Peter Reutemann 23 Mar '21

23 Mar '21

'Mozilla Firefox will soon include a revised Referrer Policy to tighten up queries and better protect user information. From a report: Firefox 87, due to ship on March 23, will cut back on path and query string information from referrer headers "to prevent sites from accidentally leaking sensitive user data." In a blog post on Monday, developer Dimi Lee and security infrastructure engineering manager Christoph Kerschbaumer said the latest browser version will include a "stricter, more privacy-preserving default Referrer Policy." Browsers send HTTP Referrer headers to websites to indicate which location has 'referred' a user to a website server. Full URLs of referring documents are often sent in the HTTP Referrer header with other subresource requests, and while this may contain innocent information used for purposes including analytics, private user data may also be included. Referrer policies aim to protect this data, but if no policy is set by a website, this often defaults to "no-referrer-when-downgrade," an element that Firefox says does trim down the referrer when navigating to a less secure resource, but still "sends the full URL including path and query information of the originating document as the referrer."' -- source: https://tech.slashdot.org/story/21/03/22/1959256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Says He Has Returned To the Free Software Foundation Board of Directors and Doesn't Intend To Resign Again
by Peter Reutemann 23 Mar '21

23 Mar '21

'Richard M Stallman, founder and former president of the Free Software Foundation (FSF), announced at the organisation's LibrePlanet virtual event that he has rejoined the board and does not intend to resign again. From a report: Stallman spoke at the event yesterday on the subject of unjust computing -- covering locked-down operating systems, non-free client software, user-restricting app stores, and more. Before the talk he stated: "I have an announcement to make. I'm now on the Free Software Foundation Board of Directors once again. We were working on a video to announce this with, but that turned out to be difficult, we didn't have experience doing that sort of thing so it didn't get finished but here is the announcement. Some of you will be happy at this, and some might be disappointed, but who knows? In any case, that's how it is, and I'm not planning to resign a second time." Stallman resigned both as president and FSF board member in September 2019, saying: "I am doing this due to pressure on the Foundation and me over a series of misunderstandings and mischaracterizations of what I have said." This followed remarks he made concerning MIT professor Marvin Minsky, who died in 2016, and his association with sex offender Jeffrey Epstein. Stallman's resignation was welcomed at the time by some prominent free software advocates including GNOME executive director Neil McGovern and FSF sister organisation FSF Europe.' -- source: https://news.slashdot.org/story/21/03/22/1557250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust Takes 'Tentative First Step' Toward Linux Kernel
by Peter Reutemann 21 Mar '21

21 Mar '21

'In his This Week in Programming column, Mike Melanson writes: Rustaceans' dreams of Rust's inclusion in the Linux kernel are one tiny, ever so slight step closer to becoming a reality, with this week's "intentionally bare-bones" inclusion in Linux-next, the development branch of the Linux kernel... Curb your enthusiasm, however, as this remains a rather tentative first step of many necessary steps before Rust fully lands in the Linux kernel. A rather brief post on LWN.net summarizes where we are rather succinctly: Followers of the linux-next integration tree may have noticed a significant addition: initial support for writing device drivers in the Rust language. There is some documentation in Documentation/rust, while the code itself is in the rust top-level directory. Appearance in linux-next generally implies readiness for the upcoming merge window, but it is not clear if that is the case here; this code has not seen a lot of wider review yet. It is, regardless, an important step toward the ability to write drivers in a safer language. Indeed, Miguel Ojeda, a software developer and maintainer of the Rust for Linux project writes that the proposed inclusion "does not mean we will make it into mainline, of course, but it is a nice step to make things as smooth as possible," with some changes expected before any decision as to Rust's inclusion are made. For those of you less familiar with Rust, part of the appeal here comes with Rust's memory safety features, especially in comparison to C, which the Linux kernel is currently coded in. Part of the problem, however, is that Rust is compiled based on LLVM, as opposed to GCC, and subsequently supports fewer architectures. This is a problem we've seen play out recently, as the Python cryptography library has replaced some old C code with Rust, leading to a situation where certain architectures will not be supported. Presently, the proposal to include Rust in the Linux kernel limits this issue by saying that Rust would be used, at least initially, for writing drivers that, as noted in another LWN.net article on the topic, "would never be used on the more obscure architectures anyway."' -- source: https://linux.slashdot.org/story/21/03/20/0321230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Says Unfair iOS Policies Forced it to Remove Its VPN Tunnel from IOS Store
by Peter Reutemann 21 Mar '21

21 Mar '21

'In 2019 Purism launched a suite of privacy-protecting, no-tracking apps and services named Librem One. And it included an encrypted, no-logging, virtual private network tunnel named Librem Tunnel. Unfortunately, "Recently we've been forced to remove Librem Tunnel from iOS due to their unfair policies," explains a post this week on Purism's blog: Apple's policy is that applications that make in-app purchases or offer subscriptions using Apple's payment platform pay Apple 30% of their revenue. The justification behind that fee is that companies are benefiting from all of the work Apple has put into its payments platform and so the fee helps them maintain that payments infrastructure while saving app developers from having to implement their own payment or subscription infrastructure... Recently our VPN endpoints have changed, which required us to update the Librem Tunnel application. Unfortunately our attempts to push an update were blocked, because Apple saw that the application was a VPN, which flagged it to check whether it was a subscription service (which VPNs frequently are). Even though Librem Tunnel is just part of the overall Librem One offering, because it's part of a subscription service, Apple is requiring us to add the ability to sign up and pay for Librem One subscriptions within the Librem Tunnel app before they will allow updated versions into the App Store. Why are they making that requirement even though we already have our own independent payment infrastructure? Because once that app allows in-app purchases, Apple can then automatically take their 30% cut. We do not accept these kinds of monopolistic practices, nor do we want to fund them through our own customers. Since Apple does not allow alternatives to the App Store on their platform, we have no choice but to remove Librem Tunnel from iOS, until such time Apple changes their policies either on their own, or through government intervention. For their existing users on iOS, "Because Librem Tunnel uses the standard, open, OpenVPN protocol, we have been working with customers to apply their OpenVPN configuration to a different iOS OpenVPN client."' -- source: https://apple.slashdot.org/story/21/03/20/0413228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Audacity 3.0 Released
by Lawrence D'Oliveiro 20 Mar '21

20 Mar '21

One thing that’s new <https://www.theregister.com/2021/03/19/audacity_3/> is the file format is now an SQLite database. This integrates everything, including audio data, into a single file, unlike the older .aup file format. Also I hadn’t heard of the “Nyquist” sound-processing system before. Its home page is here <http://www.cs.cmu.edu/~music/nyquist/>. Might be fair to say it’s the world’s most popular audio editor.

1 0

Security Researcher Hides ZIP, MP3 Files Inside PNG Files On Twitter
by Peter Reutemann 19 Mar '21

19 Mar '21

'A security researcher has discovered a novel steganography technique for hiding data inside a Portable Network Graphics (.PNG) image file posted on Twitter, a tactic that could be exploited by threat actors to hide malicious activity. Threatpost reports: Researcher David Buchanan heralded his discovery on Twitter earlier this week, accompanied by a photo declaring: "Save this image and change the extension to .zip!" He made the source code for his method available in a ZIP/PNG file attached to the image as well as on a post on GitHub that explains his methodology. Specifically, Buchanan demonstrated how he could hide both MP3 audio files and ZIP archives within the PNG images hosted on Twitter. The reason he was successful is because while Twitter strips unnecessary data from PNG uploads, they don't remove trailing data from the DEFLATE stream inside the IDAT chunk if the overall image file meets the requirements to avoid being re-encoded, he explained. There are some requirements for both the images used to obscure files and the files being hidden inside them for his method to work, Buchanan explained. "The cover image must compress well, such that the compressed filesize is less than (width * height) -- size_of_embedded_file," he wrote in his post. "If the cover image does not have a palette, then it must have at least 257 unique colors (otherwise Twitter will optimize it to use a palette)." Resolution on images can be up to 4096 x 4096, although Twitter will serve a downscaled version by default for images greater than 680 x 680 depending on certain factors, Buchanan wrote. The image also should not have any unnecessary "metadata chunks," he added. For embedded files, the total output file size must be less than potentially 5MB, but kept under 3MB to be on the safe side, otherwise Twitter will convert the PNG to a JPEG file, Buchanan explained. Moreover, if the embedded file is a ZIP, then the offsets are automatically adjusted so that the overall file is still a valid ZIP, he said. "For any other file formats, you're on your own," Buchanan added, noting that many will work without special parameters, including PDF and MP3 files. ' -- source: https://it.slashdot.org/story/21/03/18/2127257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Topic for next meeting: audio/video
by Peter Reutemann 18 Mar '21

18 Mar '21

Hi everyone Before the last meeting, Ian looked into ffmpeg and was wondering whether it would a good idea for a presentation. I think that widening the topic to general audio/video processing (command line or GUI) would be a rally useful session for people new to Linux (and probably also for more experienced users, finding out about little neat tricks!). Rather than a super in-depth presentation for one application, we can cover a bigger range with a 5-10min show-and-tell per application. I'll assume that Ian will talk about ffmpeg, Lawrence about the other tools that come with ffmpeg, and I will show OBS (Open Broadcaster Software) and Handbrake. Just reply to this thread with your application that you'd like to present. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 5

~4,300 publicly reachable servers are posing a new DDoS hazard to the Internet
by Peter Reutemann 18 Mar '21

18 Mar '21

'Criminals are upping the potency of distributed denial-of-service attacks with a technique that abuses a widely used Internet protocol that drastically increases the amount of junk traffic directed at targeted servers. DDoSes are attacks that flood a website or server with more data than it can handle. The result is a denial of service to people trying to connect to the service. As DDoS-mitigation services develop protections that allow targets to withstand ever-larger torrents of traffic, the criminals respond with new ways to make the most of their limited bandwidth. In so-called amplification attacks, DDoSers send requests of relatively small data sizes to certain types of intermediary servers. The intermediaries then send the targets responses that are tens, hundreds, or thousands of times bigger. The redirection works because the requests replace the IP address of the attacker with the address of the server being targeted. Other well-known amplification vectors include the memcached database caching system with an amplification factor of an astounding 51,000, the Network Time Protocol with a factor of 58, and misconfigured DNS servers with a factor of 50. DDoS mitigation provider Netscout said on Wednesday that it has observed DDoS-for-hire services adopting a new amplification vector. The vector is the Datagram Transport Layer Security, or D/TLS, which (as its name suggests) is essentially the Transport Layer Security for UDP data packets. Just as TLS prevents eavesdropping, tampering, or forgery of TLS packets, D/TLS does the same for UDP data. DDoSes that abuse D/TLS allow attackers to amplify their attacks by a factor of 37. Previously, Netscout saw only advanced attackers using dedicated DDoS infrastructure abusing the vector. Now, so-called booter and stressor services—which use commodity equipment to provide for-hire attacks—have adopted the technique. The company has identified almost 4,300 publicly reachable D/LTS servers that are susceptible to the abuse.' -- source: https://arstechnica.com/gadgets/2021/03/mainstream-ddosers-are-abusing-d-tl… Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In-kernel WireGuard is on its way to FreeBSD and the pfSense router
by Peter Reutemann 18 Mar '21

18 Mar '21

'This morning, WireGuard founding developer Jason Donenfeld announced a working, in-kernel implementation of his WireGuard VPN protocol for the FreeBSD 13 kernel. This is great news for BSD folks—and users of BSD-based routing appliances and distros such as pfSense and opnSense.' -- source: https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-is-on-its-way-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

WeLeakInfo Leaked Customer Payment Info
by Peter Reutemann 16 Mar '21

16 Mar '21

'A lapsed domain registration tied to WeLeakInfo, a wildly popular service that sold access to more than 12 billion usernames and passwords from thousands of hacked websites, "let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card," reports Krebs on Security. This comes after the service was seized a little over a year ago by the FBI and law enforcement partners overseas. From the report: In a post on the database leaking forum Raidforums, a regular contributor using the handle "pompompurin" said he stole the WeLeakInfo payment logs and other data after noticing the domain wli[.]design was no longer listed as registered. "Long story short: FBI let one of weleakinfo's domains expire that they used for the emails/payments," pompompurin wrote. "I registered that domain, & was able to [password] reset the stripe.com account & get all the Data. [It's] only from people that used stripe.com to checkout. If you used paypal or [bitcoin] ur all good." Cyber threat intelligence firm Flashpoint obtained a copy of the data leaked by pompompurin, and said it includes partial credit card data, email addresses, full names, IP addresses, browser user agent string data, physical addresses, phone numbers, and amount paid. One forum member commented that they found their own payment data in the logs. ' -- source: https://it.slashdot.org/story/21/03/15/2117240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Redesign Drops Compact Density Option
by Peter Reutemann 16 Mar '21

16 Mar '21

'Firefox's "Compact density" option, which reduces the size of the user interface, is set to disappear when Mozilla rolls out its Proton visual redesign for the browser later this year. PCMag reports: A bug was posted on Mozilla's bug tracking system entitled "Remove compact mode inside Density menu of customize palette." The reasons given for its removal include the fact it's "currently fairly hard to discover" and "we assume gets low engagement." The development team wants to "make sure that we design defaults that suit most users and we'll be retiring the compact mode for this reason." The Bugzilla thread highlights a desire for compact density to be retained as an option, but it doesn't seem likely to survive right now. When Proton arrives, the Normal and Touch density options are expected to remain, with Touch increasing the size of the user interface to make it more finger-friendly. Meanwhile, the development team is optimizing the Normal density for displays that use 768 pixels for height, while most displays now use a higher resolution than that. Hopefully this doesn't mean the UI will be larger than it is now by default.' -- source: https://news.slashdot.org/story/21/03/15/2122201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners-Lee Says Too Many Young People Are Excluded From Web
by Peter Reutemann 16 Mar '21

16 Mar '21

'Too many young people around the world are excluded from accessing the web, and getting them online should be a priority for the post-Covid era, Tim Berners-Lee has said. From a report: In a letter published to mark the 32nd birthday of the web, its founder says the opportunity "to reimagine our world and create something better" in the aftermath of Covid-19 must be channelled to getting internet access to the third of people aged between 15 and 24 who are offline. "The influence of young people is felt across their communities and online networks," Berners-Lee writes. "But today we're seeing just a fraction of what's possible. Because while we talk about a generation of 'digital natives,' far too many young people remain excluded and unable to use the web to share their talents and ideas. "A third of young people have no internet access at all. Many more lack the data, devices and reliable connection they need to make the most of the web. In fact, only the top third of under-25s have a home internet connection, according to Unicef, leaving 2.2 billion young people without the stable access they need to learn online, which has helped so many others continue their education during the pandemic." Even though young people are more likely than the typical global citizen to have internet access -- roughly half the world is online, but the figure rises to 70% of people aged between 15 and 25 -- Berners-Lee argues that aiming to connect every young person in the world to the web would reap dividends. He also says doing so would be relatively cheap compared with the cost of many government programmes launched over the last 12 months. He estimates that an investment of $428bn over the next decade would provide everyone with a quality broadband connection.' -- source: https://tech.slashdot.org/story/21/03/15/1948259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'A Hacker Got All My Texts For $16'
by Peter Reutemann 16 Mar '21

16 Mar '21

'A report from Motherboard, written by Joseph Cox: I didn't expect it to be that quick. While I was on a Google Hangouts call with a colleague, the hacker sent me screenshots of my Bumble and Postmates accounts, which he had broken into. Then he showed he had received texts that were meant for me that he had intercepted. Later he took over my WhatsApp account, too, and texted a friend pretending to be me. Looking down at my phone, there was no sign it had been hacked. I still had reception; the phone said I was still connected to the T-Mobile network. Nothing was unusual there. But the hacker had swiftly, stealthily, and largely effortlessly redirected my text messages to themselves. And all for just $16. I hadn't been SIM swapped, where hackers trick or bribe telecom employees to port a target's phone number to their own SIM card. Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him. This overlooked attack vector shows not only how unregulated commercial SMS tools are but also how there are gaping holes in our telecommunications infrastructure, with a hacker sometimes just having to pinky swear they have the consent of the target. "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," said Lucky225, the pseudonymous hacker who carried out the attack, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers. In a statement to Motherboard, Senator Ron Wyden said: "Itâ(TM)s not hard to see the enormous threat to safety and security this kind of attack poses. The FCC must use its authority to force phone companies to secure their networks from hackers. Former Chairman Paiâ(TM)s approach of industry self-regulation clearly failed."' -- source: https://yro.slashdot.org/story/21/03/15/1950245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM's Patent Income Slips as Companies Resist 'Godfather' Deals
by Peter Reutemann 15 Mar '21

15 Mar '21

'"Even as IBM has sued an increasing number of companies, its IP income has shrunk," reports Bloomberg: Intellectual property rights historically brought in more than $1 billion a year, on average, helping offset massive research and development costs and shrinking revenue. Last year, IBM's income from intellectual property was $626 million, its lowest point since 1996, and 2019 wasn't much higher. While it continues to secure license deals, they are fewer and harder-won, with companies like Airbnb Inc. and Chewy Inc. waging battles in court... In February, online pet-food seller Chewy requested a court order to block a $36 million patent fee IBM is demanding. Chewy accused IBM of "seeking exorbitant licensing fees for early internet patents having no value." IBM's claims against Chewy include years-old inventions such as targeted advertising and content resizing based on cursor activity, both ubiquitous on the web. Chewy said IBM doesn't make or sell products covered by the vast majority of the thousands of patents it has received over the past 20 years, but instead just threatens to sue if companies don't agree to pay for licenses. IBM has not answered Chewy's complaint, and no trial date has been set. Companies that use their IP licensing aggressively as a way to make money are often referred to as patent trolls. However, IBM's position as the largest aggregator of U.S. intellectual property is more akin to being a patent godfather, says Robin Feldman, a law professor at the University of California, Hastings. With more than 38,000 active patents in its portfolio, and thousands of license agreements bolstering its legitimacy, IBM's demands have traditionally gone unchallenged, Feldman said. Such patent godfathers, with large portfolios, are "able to make offers that can't be refused." Even some of the most innovative technology giants have licensed IBM patents over the years. Alphabet Inc.'s Google, Amazon.com Inc. and LinkedIn are among countless companies that have had to pony up. IBM also has long served as a patent bank for young companies to jump-start their portfolios. Facebook Inc. was not yet public in 2012 when it bought 750 patents on software and networking from IBM. As Instacart Inc. prepares to go public, it purchased almost 300 IBM patents in January ranging from e-commerce to smart shopping bags. Noting a series of Supreme Court verdicts making it easier to invalidate a patent, Feldman, the law professor, told Bloomberg that "Being the godfather isn't what it used to be. It's not that patent aggregation as a business is over. You just make less money."' -- source: https://yro.slashdot.org/story/21/03/13/2120248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Decentralized Routing Protocol Aims To Replace BGP
by Peter Reutemann 15 Mar '21

15 Mar '21

'"The Border Gateway Protocol was first described in 1989...," according to Wikipedia, "and has been in use on the Internet since 1994." But now long-time Slashdot reader jovius reports that a startup named Syntropy "aims to replace BGP as the default routing method of the internet, by using nodes around the world to constantly gather data of the inefficiencies of the current network." The intelligence is then used to route data via the most efficient routes. Actual tests with hundreds of servers have proved that latencies can be reduced by tens to hundreds of milliseconds. The connections are by default encrypted, and jitter is also reduced. Eventually, the company-run servers are augmented with tens of thousands of nodes run by users/smart devices, who are rewarded for their work. The team was recently joined by former SVP at Verizon Shawn Hakl and former Chief Product Officer at AT&T Roman Pacewicz. One of the founders of Syntropy is the co-founder of Equinix and NANOG Bill Norton. Syntropy is an Oracle and Microsoft partner, and transforming into a foundation and DAO to govern the protocol work. Decentralised autonomous routing protocol (or DARP) has just been opened for community testing, and the system is live on https://darp.syntropystack.com/. ' -- source: https://tech.slashdot.org/story/21/03/14/1910257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Three Flaws in the Linux Kernel Since 2006 Could Grant Root Privileges
by Peter Reutemann 14 Mar '21

14 Mar '21

'"Three recently unearthed vulnerabilities in the Linux kernel, located in the iSCSI module used for accessing shared data storage facilities, could allow root privileges to anyone with a user account," reports SC Media: "If you already had execution on a box, either because you have a user account on the machine, or you've compromised some service that doesn't have repaired permissions, you can do whatever you want basically," said Adam Nichols, principal of the Software Security practice at GRIMM. While the vulnerabilities "are in code that is not remotely accessible, so this isn't like a remote exploit," said Nichols, they are still troublesome. They take "any existing threat that might be there. It just makes it that much worse," he explained. "And if you have users on the system that you don't really trust with root access it, it breaks them as well." Referring to the theory that 'many eyes make all bugs shallow,' Linux code "is not getting many eyes or the eyes are looking at it and saying that seems fine," said Nichols. "But, [the bugs] have been in there since the code was first written, and they haven't really changed over the last 15 years...." That the flaws slipped detection for so long has a lot to do with the sprawl of the the Linux kernel. It "has gotten so big" and "there's so much code there," said Nichols. "The real strategy is make sure you're loading as little code as possible." The bugs are in all Linux distributions, Nichols said, although the kernel driver is not loaded by default. Whether a normal user can load the vulnerable kernel module varies. They can, for instance, on all Red Hat based distros that GRIMM tested, he said. "Even though it's not loaded by default, you can get it loaded and then of course you can exploit it without any trouble...." The bugs have been patched in the following kernel releases: 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260, and 4.4.260. All older kernels are end-of- life and will not receive patches. ' -- source: https://linux.slashdot.org/story/21/03/13/0118217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Launches $4 Microcontroller With Custom Chip
by Peter Reutemann 14 Mar '21

14 Mar '21

'Meet the Raspberry Pi Pico, a tiny little microcontroller that lets you build hardware projects with some code running on the microcontroller. Even more interesting, the Raspberry Pi Foundation is using its own RP2040 chip, which means that the foundation is now making its own silicon. From a report: If you're not familiar with microcontrollers, those devices let you control other parts or other devices. You might think that you can already do this kind of stuff with a regular Raspberry Pi. But microcontrollers are specifically designed to interact with other things. They're cheap, they're small and they draw very little power. You can start developing your project with a breadboard to avoid soldering. You can pair it with a small battery and it can run for weeks or even months. Unlike computers, microcontrollers don't run traditional operating systems. Your code runs directly on the chip. Like other microcontrollers, the Raspberry Pi Pico has dozens of input and output pins on the sides of the device. Those pins are important as they act as the interface with other components. For instance, you can make your microcontroller interact with an LED light, get data from various sensors, show some information on a display, etc. The Raspberry Pi Pico uses the RP2040 chip. It has a dual-core Arm processor (running at 133MHz), 264KB of RAM, 26 GPIO pins including 3 analog inputs, a micro-USB port and a temperature sensor. It doesn't come with Wi-Fi or Bluetooth. And it costs $4.' -- source: https://hardware.slashdot.org/story/21/01/21/1258214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Critics fume after Github removes exploit code for Exchange vulnerabilities
by Peter Reutemann 13 Mar '21

13 Mar '21

'Github has ignited a firestorm after the Microsoft-owned code-sharing repository removed a proof-of-concept exploit for critical vulnerabilities in Microsoft Exchange that have led to as many as 100,000 server infections in recent weeks. ProxyLogon is the name that researchers have given both to the four Exchange vulnerabilities under attack in the wild and the code that exploits them. Researchers say that Hafnium, a state-sponsored hacking group based in China, started exploiting ProxyLogon in January, and within a few weeks, five other APTs—short for advanced persistent threat groups—followed suit. To date, no fewer than 10 APTs have used ProxyLogon to target servers around the Microsoft issued emergency patches last week, but as of Tuesday, an estimated 125,000 Exchange servers had yet to install it, security firm Palo Alto Networks said. The FBI and the Cybersecurity and Infrastructure Security Agency have warned that ProxyLogon poses a serious threat to businesses, nonprofits, and government agencies that remain vulnerable. On Wednesday, a researcher published what’s believed to be the first largely working proof-of-concept (PoC) exploit for the vulnerabilities. Based in Vietnam, the researcher also published a post on Medium describing how the exploit works. With a few tweaks, hackers would have most of what they needed to launch their own in-the-wild RCEs, security speak for remote code execution exploits. Publishing PoC exploits for patched vulnerabilities is a standard practice among security researchers. It helps them understand how the attacks work so that they can build better defenses. The open source Metasploit hacking framework provides all the tools needed to exploit tens of thousands of patched exploits and is used by black hats and white hats alike. Within hours of the PoC going live, however, Github removed it. By Thursday, some researchers were fuming about the takedown. Critics accused Microsoft of censoring content of vital interest to the security community because it harmed Microsoft interests. Some critics pledged to remove large bodies of their work on Github in response.' -- source: https://arstechnica.com/gadgets/2021/03/critics-fume-after-github-removes-e… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

7-Zip Developer Releases the First Official Linux Version
by Peter Reutemann 13 Mar '21

13 Mar '21

'An official version of the popular 7-zip archiving program has been released for Linux for the first time. Bleeping Computer reports: Linux already had support for the 7-zip archive file format through a POSIX port called p7zip but it was maintained by a different developer. As the p7zip developer has not maintained their project for 4-5 years, 7-Zip developer Igor Pavlov decided to create a new official Linux version based on the latest 7-Zip source code. Pavlov has released 7-Zip for Linux in AMD64, ARM64, x86, and armhf versions, which users can download [via their respective links]. "These new 7-Zip binaries for Linux were linked (compiled) by GCC without -static switch. And compiled 32-bit executables (x86 and armhf) didn't work on some arm64 and amd64 systems, probably because of missing of some required .so files." "Please write here, if you have some advices how to compile and link binaries that will work in most Linux systems," Pavlov stated on his release page. ' -- source: https://hardware.slashdot.org/story/21/03/12/2144238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

emergency mode
by thomas 11 Mar '21

11 Mar '21

Hello everybody hope all are well... but not me. This mail is from an old lappi with 12.04. because my current lap 18.04. is in emergency mode and I tried all advice from google and ubuntu to no success. Luckily I found you and hope you can help. I am not an IT expert just a normal user but this is business related and quite urgent. I am in Raglan and wheelchair bound but able to come to Hamilton any time and will pay any cost incurred. Thank you very much for your response Kind Regards Thomas Koppen

1 0

Up To 60,000 Computer Systems Exposed In Germany To Microsoft Flaw
by Peter Reutemann 11 Mar '21

11 Mar '21

'As many as 60,000 computer systems in Germany were exposed to a flaw that allows unauthorized users to access systems in Microsoft's email software, the head of its cybersecurity watchdog said on Wednesday. Reuters reports: More than half of the vulnerabilities were addressed following a warning last weekend by the Federal Office for Information Security (BSI), but around 25,000 systems still need to be fixed, BSI chief Arne Schoenbohm said. "The warning has worked. In Germany, many Exchange servers have been secured by downloading patches," Schoenbohm said in written comments to Reuters. "Every vulnerable system is one too many and can lead to harm." In a 14-page report on the Microsoft vulnerability, the BSI said the behavior of hackers exploiting it had changed sharply since it was publicly revealed. Initially, most targets had been think tanks, universities, non-governmental organizations, law firms and defense companies - mostly in the United States. "Now, these exploits are being deployed at mass scale against thousands of targets - apparently worldwide," the report said. At least 10 different hacking groups were using the latest flaw in Microsoft's mail server software to break into targets around the world, according to researchers at cybersecurity company ESET. In Germany, two federal authorities have been affected by the hack, the BSI said, declining to say which. ' -- source: https://it.slashdot.org/story/21/03/10/2230234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers access security cameras inside Cloudflare, jails, and hospitals
by Peter Reutemann 11 Mar '21

11 Mar '21

'Hackers say they broke into the network of Silicon Valley startup Verkada and gained access to live video feeds from more than 150,000 surveillance cameras the company manages for Cloudflare, Tesla, and a host of other organizations. The group published videos and images they said were taken from offices, warehouses, and factories of those companies as well as from jail cells, psychiatric wards, banks, and schools. Bloomberg News, which first reported the breach, said footage viewed by a reporter showed staffers at Florida hospital Halifax Health tackling a man and pinning him to a bed. Another video showed a handcuffed man in a police station in Stoughton, Massachusetts, being questioned by officers. “I don’t think the claim ‘we hacked the internet’ has ever been as accurate as now,” Tillie Kottmann, a member of a hacker collective calling itself APT 69420 Arson Cats, wrote on Twitter.' -- source: https://arstechnica.com/information-technology/2021/03/hackers-access-secur… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Debuts Sigstore Project for Software Signing
by Peter Reutemann 11 Mar '21

11 Mar '21

'The Linux Foundation has announced the launch of Sigstore, a new nonprofit initiative that aims to improve open source software supply chain security by making it easier for developers to adopt cryptographic signing for different components of the software development process. From a report: Sigstore will be free for software providers and developers, who can use it to securely sign software artifacts such as release files, container images, binaries, and bill-of-material manifests. Signing materials are then stored in a tamper-proof public log. The service's code and operation tooling will be fully open source and maintained and developed by the Sigstore community. Founding members include Red Hat, Google, and Purdue University. The idea for the service came from Luke Hinds, security engineering lead in Red Hat's Office of the CTO. He pitched the concept to Google software engineer Dan Lorenc, and the two began to work on it. Now the Sigstore project has a "small but agile community" working on its development, Lorenc says.' -- source: https://linux.slashdot.org/story/21/03/10/1446201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome OS Did Lots of Growing Up in Its First Decade -- and There's More To Come
by Peter Reutemann 10 Mar '21

10 Mar '21

'FastCompany has a feature story on Chrome OS, which has turned 10. The story talks about a new feature of Chrome OS: A new version of Chrome OS rolling out starting today will introduce a long-under-development Phone Hub feature that'll let you see and interact with notifications from your Android phone on your Chromebook, without any complex configuration or clunky software required. You'll also be able to silence your phone, adjust some of its settings, and see and access recent Chrome browser tabs you had open on the device right from your Chrome OS desktop. Carefully examined clues in Google's open-source Chromium code suggest the system could eventually do even more -- with some indications that full-fledged phone-mirroring that would let you get access to all the apps and files on your phone from your Chromebook could be in the cards. I asked John Solomon's (VP and GM of Chrome OS at Google) colleague, Chrome OS Product Manager, Engineering, and UX Lead John Maletis, if and when such a capability might come online, and while he wouldn't outright confirm any future plans, he did allow that what we're seeing now is only scratching the surface. "You're just seeing the beginning," he says. "That little tiny Phone Hub real estate -- I would put a big 'Watch This Space' on it, because there's a lot of stuff we can and will do there." The publication also touched on Fuchsia, a new operating system that Google has been working on for several years: My final pressing question about the future of Chrome OS is simply how much of it there will be. In a familiar twist, the Android- and Chrome-OS-watching communities are once again filled with speculation that Google could be working to bring the two platforms together -- this time by way of a mysterious underdeveloped Google operating system known as Fuchsia. Officially, Google says only that Fuchsia is an "open-source effort to create a production-grade operating system that prioritizes security, updatability, and performance" across a "broad range of devices." But the vague nature of its ultimate purpose along with some eyebrow-raising bits of progress in its development -- such as the recent move to allow the operating system to support both Android and Linux apps as native programs -- raise some interesting questions about what, exactly, Google is actually up to with the effort. Solomon declined to answer directly about if or how Fuchsia might one day replace or otherwise relate to Chrome OS (and there are certainly more nuanced, less black-and-white possibilities to consider), but he did offer up some broad thoughts on what Google hopes to accomplish as time wears on.' -- source: https://tech.slashdot.org/story/21/03/09/2014247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MIPS Technologies Joins RISC-V, Moves To Open-Source ISA Standard
by Peter Reutemann 09 Mar '21

09 Mar '21

'MIPS Technologies, the company that had been synonymous with the MIPS processor architecture, will now be developing processors based on RISC-V architecture. TuxPhones reports: The MIPS silicon manufacturer is one of the oldest RISC chip manufacturers, used in several systems since the late 80s. Characterized by clean and efficient designs, allowing adaption in varied applications, this company has been considered one of the most innovative in the market during its golden age - to the point that the Windows OS had a MIPS port in the early 90s. However, the company has been struggling with an increasingly lower market share and risked bankruptcy in recent years, ultimately leading to acquisition by start-up Wave Computing, which faced bankruptcy last year. How this company was reborn just weeks ago, exiting the state of bankruptcy, is surprising, but not at all irrational: in its official statement, (the new) MIPS has become a member of RISC-V International, the non-profit organization managing the fully open-hardware ISA, substantially replacing their current architecture with the de facto open chip standard in its entirety. Licensing of the original MIPS architecture to third parties will probably be managed as before, so that the "old" architecture will remain available upon need. This is officially known as the "8th generation" of MIPS chips, indicating a total architectural gap from the previous seven iterations, essentially leaving the old architecture and fully embracing the new one. The Electronic Engineering Journal says it's likely that the new MIPS will continue to honor pre-existing licensing agreements, but it's unclear what level of support the company will offer for older MIPS-based chip designs.' -- source: https://hardware.slashdot.org/story/21/03/08/2117238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0