May 2021 - wlug - list.wlug.org.nz

4 vulnerabilities under attack give hackers full control of Android devices
by Peter Reutemann 20 May '21

20 May '21

'Unknown hackers have been exploiting four Android vulnerabilities that allow the execution of malicious code that can take complete control of devices, Google warned on Wednesday. All four of the vulnerabilities were disclosed two weeks ago in Google’s Android Security Bulletin for May. Google has released security updates to device manufacturers, who are then responsible for distributing the patches to users. Google’s May 3 bulletin initially didn’t report that any of the roughly 50 vulnerabilities it covered were under active exploitation. On Wednesday, Google updated the advisory to say that there are “indications” that four of the vulnerabilities “may be under limited, targeted exploitation.” Maddie Stone, a member of Google’s Project Zero exploit research group, removed the ambiguity. She declared on Twitter that the “4 vulns were exploited in-the-wild” as zero-days.' -- source: https://arstechnica.com/gadgets/2021/05/hackers-have-been-exploiting-4-crit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

72 Hours From Patch To Exploit
by Lawrence D'Oliveiro 20 May '21

20 May '21

This report <https://www.theregister.com/2021/04/06/sap_patch_attacks/> from software company SAP and security company Onapsis says that, from the moment SAP releases a security patch for its products, it only takes about 72 hours until bad hats have reverse-engineered the patch, figured out the security vulnerability it is meant to fix, and started releasing an exploit to take advantage of that vulnerability. Actually, proof-of-concept code can appear quicker than that. Which leaves customers in a dilemma: continue running patches through their regular QA procedures before deployment, widening the window for exploits to get in, or forego those QA procedures and deploy patches quickly to plug holes while risking breaking production systems? And of course this wouldn’t be unique to SAP ...

1 1

Google Shows Off Android 12's Huge UI Overhaul
by Peter Reutemann 19 May '21

19 May '21

'At Google I/O 2021 today, Google confirmed that Android 12 is getting a huge new design. Ars Technica reports: Google calls the new design "Material You," and just like in the leaks, it's a UI that changes colors like a chameleon. For now, this design will only show up in Google Pixels, but Google says it will roll out across the ecosystem to the web, Chrome OS, smart displays, cars, watches, tablets, and every other Google form factor. The new interface is powered by a "color extraction" API that can pull the colors out of your wallpaper and apply them to the UI. This sounds exactly like the Palette API that was introduced in Android 5.0 (along with the original introduction of Material Design), but it's apparently a second swing at the color extraction idea, and Google is heavily using it in the UI now. The demo interfaces featured customized highlight colors, clock faces, widget backgrounds, and more, all matching the color of your wallpaper. Besides new colors, there are also tons of layout changes to the quick settings and notification panel. The first public beta of Android is now available. Google Pixel smartphones as far back as the Pixel 3 are eligible, as well as several devices from device-maker partners, including ASUS and OnePlus.' -- source: https://tech.slashdot.org/story/21/05/18/2134250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google and Samsung Are Merging Wear OS and Tizen
by Peter Reutemann 19 May '21

19 May '21

'Today, Google and Samsung announced that they are merging Wear OS and Tizen in an effort to better compete against Apple's watchOS. "The resulting platform is currently being referred to simply as 'Wear,' though that might not be the final name," notes The Verge. From the report: Benefits of the joint effort include significant improvements to battery life, 30 percent faster loading times for apps, and smoother animations. It also simplifies life for developers and will create one central smartwatch OS for the Android platform. Google is also promising a greater selection of apps and watch faces than ever before. "All device makers will be able to add a customized user experience on top of the platform, and developers will be able to use the Android tools they already know and love to build for one platform and ecosystem," Google's Bjorn Kilburn wrote in a blog post. Wired has more details on what's to come, including the tidbit that Samsung will stick with its popular rotating bezel on future devices -- but it's finished making Tizen-only smartwatches. There will also be a version of Google Maps that works standalone (meaning without your phone nearby) and a YouTube Music app that supports offline downloads. Oh, and Spotify will support offline downloads on Wear smartwatches, as well. Samsung confirmed that its next Galaxy Watch will run on this unified platform. And future "premium" Fitbit devices will also run the software.' -- source: https://tech.slashdot.org/story/21/05/18/2228252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Unveils Open Source 'Launch Configurable Keyboard' for Linux, Windows, and macOS
by Peter Reutemann 19 May '21

19 May '21

'System76 today unveiled its newest product -- the "Launch Configurable Keyboard." It is a mechanical keyboard made in the USA with a focus on open source. The Launch has both open source firmware and hardware. Even the configuration software -- which runs on Linux, Windows, and macOS -- is open source. From a report: "With a wide swath of customization options, the Launch is flexible to a variety of needs and use cases. The keyboard's thoughtful design keeps everything within reach, vastly reducing awkward hand contortions. Launch comes with additional keycaps and a convenient keycap puller, meaning one can swap keys based on personal workflow preferences to maximize efficiency. Launch also features a novel split Space Bar, which allows the user to swap out one Space Bar keycap for Shift, Backspace, or Function to reduce hand fatigue while typing. Launch uses only three keycap sizes to vastly expand configuration options," says System76. The keyboard, which has a removable USB-C cable for connectivity, is priced at $285.' -- source: https://news.slashdot.org/story/21/05/13/1727242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Now Uses Duplex To Fix Your Stolen Passwords
by Peter Reutemann 19 May '21

19 May '21

'Google announced a new feature for its Chrome browser today that alerts you when one of your passwords has been compromised and then helps you automatically change your password with the help of... wait for it ... Google's Duplex technology. From a report: This new feature will start to roll out slowly to Chrome users on Android in the U.S. soon (with other countries following later), assuming they use Chrome's password-syncing feature. It's worth noting that this won't work for every site just yet. As a Google spokesperson told us, "the feature will initially work on a small number of apps and websites, including Twitter, but will expand to additional sites in the future." Now you may remember Duplex as the somewhat controversial service that can call businesses for you to make hairdresser appointments or check opening times. Google introduced Duplex at its 2018 I/O developer conference and launched it to a wider audience in 2019. Since then, the team has chipped away at bringing Duplex to more tasks and brought it the web, too. Now it's coming to Chrome to change your compromised passwords for you.' -- source: https://tech.slashdot.org/story/21/05/18/182218 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Outlook Problem Was Microsoft Word’s Fault
by Lawrence D'Oliveiro 18 May '21

18 May '21

The recent problem Outlook users were having with e-mails turning up blank was due to an interaction with Word <https://www.theregister.com/2021/05/17/outlook_incident_report/>. Why Word? Because management of HTML-format mails in Outlook used to be the responsibility of (an embedded instance of) Internet Explorer, until that was abandoned because of all the security holes. So now Word handles that feature: For those who wonder why Outlook makes it so hard to format emails sensibly when doing things like quoting parts of an email received in the reply and typing in-line comments, or putting the background of the incoming email behind the reply: it is the interaction with Word that is to blame. Fair warning: ... today's Windows and Office 365 users are one bad update away from hours of lost productivity.

1 0

Amid Public Pressure Audacity Says It Will Not Collect Telemetry Data From Users
by Peter Reutemann 18 May '21

18 May '21

'After its recent announcement about plans to add telemetry collection prompted backlash, popular audio editor Audacity has announced it won't go ahead with the plan to collect its users' data. BetaNews reports: Audacity's new owner, Muse Group, has bowed to pressure from users and privacy advocates, announcing that the planned telemetry collection will no longer be going ahead. The company is blaming "communication mistakes" and public "misunderstanding" for the negative response to its previous data collection announcement.' -- source: https://yro.slashdot.org/story/21/05/17/191201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AT&T To Spin Off WarnerMedia
by Lawrence D'Oliveiro 18 May '21

18 May '21

Another questionable mega-acquisition bites the dust <https://arstechnica.com/tech-policy/2021/05/att-to-spin-off-warnermedia-wil…>, with AT&T admitting it made a mistake by trying to become a media conglomerate. There is a local element to this story. The company called Discovery, that is planning to buy these assets, also owns Three (aka TV3, aka NewsHub). So there will inevitably be some impact in our own little neck of the woods, though whether that will be for better or worse is the question <https://www.nzherald.co.nz/business/the-spinoff-a-blockbuster-media-deal-co…>.

1 0

Apple’s M1: Throughput Versus Latency
by Lawrence D'Oliveiro 18 May '21

18 May '21

An old lesson gets learned yet again <https://arstechnica.com/gadgets/2021/05/apples-m1-is-a-fast-cpu-but-m1-macs…>: efficiency and responsiveness in a computer system are often at odds, and improving one can hurt the other. We can also see a negative example—one in which the fastest throughput corresponded to distinctly unhappy users—with the circa-2006 introduction of the Completely Fair Queue (cfq) I/O scheduler in the Linux kernel. ... Unfortunately, while cfq did in fact measurably improve maximum throughput, it did so at the increase of task latency—which meant that a moderately loaded system felt sluggish and unresponsive to its users, leading to a large groundswell of complaints.

1 0