June 2021 - wlug - list.wlug.org.nz

NFC Flaws Let Researchers Hack an ATM By Waving a Phone
by Peter Reutemann 27 Jun '21

27 Jun '21

'Ars Technica reports: For years, security researchers and cybercriminals have hacked ATMs by using all possible avenues to their innards, from opening a front panel and sticking a thumb drive into a USB port to drilling a hole that exposes internal wiring. Now, one researcher has found a collection of bugs that allow him to hack ATMs -- along with a wide variety of point-of-sale terminals -- in a new way: with a wave of his phone over a contactless credit card reader. Josep Rodriguez, a researcher and consultant at security firm IOActive, has spent the last year digging up and reporting vulnerabilities in the so-called near-field communications reader chips used in millions of ATMs and point-of-sale systems worldwide. NFC systems are what let you wave a credit card over a reader -- rather than swipe or insert it -- to make a payment or extract money from a cash machine. You can find them on countless retail store and restaurant counters, vending machines, taxis, and parking meters around the globe. Now Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems' firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message. Rodriguez says he can even force at least one brand of ATMs to dispense cash -- though that "jackpotting" hack only works in combination with additional bugs he says he has found in the ATMs' software. He declined to specify or disclose those flaws publicly due to nondisclosure agreements with the ATM vendors. "You can modify the firmware and change the price to one dollar, for instance, even when the screen shows that you're paying 50 dollars. You can make the device useless, or install a kind of ransomware. There are a lot of possibilities here," says Rodriguez of the point-of-sale attacks he discovered. "If you chain the attack and also send a special payload to an ATM's computer, you can jackpot the ATM -- like cash out, just by tapping your phone." Rodriguez says he alerted the affected vendors -- which include ID Tech, Ingenico, Verifone, Crane Payment Innovations, BBPOS, Nexgo, and the unnamed ATM vendor -- to his findings between seven months and a year ago. Even so, he warns that the sheer number of affected systems and the fact that many point-of-sale terminals and ATMs don't regularly receive software updates -- and in many cases require physical access to update -- mean that many of those devices likely remain vulnerable. "Patching so many hundreds of thousands of ATMs physically, it's something that would require a lot of time," Rodriguez says.' -- source: https://it.slashdot.org/story/21/06/25/2049217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Admits to Mistakenly Signing a Malicious Malware Rootkit
by Peter Reutemann 27 Jun '21

27 Jun '21

'Bleeping Computer reports: Microsoft has now confirmed signing a malicious driver being distributed within gaming environments. This driver, called "Netfilter," is in fact a rootkit that was observed communicating with Chinese command-and-control IPs. G Data malware analyst Karsten Hahn first took notice of this event last week and was joined by the wider infosec community in tracing and analyzing the malicious drivers bearing the seal of Microsoft... This incident has once again exposed threats to software supply-chain security, except this time it stemmed from a weakness in Microsoft's code-signing process. G Data writes: We forwarded our findings to Microsoft who promptly added malware signatures to Windows Defender and are now conducting an internal investigation. At the time of writing it is still unknown how the driver could pass the signing process. In a Friday blog post, Microsoft said it was contacting other antivirus software vendors "so they can proactively deploy detections," but also emphasized the attack's limited scope: The actor's activity is limited to the gaming sector specifically in China and does not appear to target enterprise environments. We are not attributing this to a nation-state actor at this time. The actor's goal is to use the driver to spoof their geo-location to cheat the system and play from anywhere. The malware enables them to gain an advantage in games and possibly exploit other players by compromising their accounts through common tools like keyloggers. It's important to understand that the techniques used in this attack occur post exploitation, meaning an attacker must either have already gained administrative privileges in order to be able to run the installer to update the registry and install the malicious driver the next time the system boots or convince the user to do it on their behalf. We will be sharing an update on how we are refining our partner access policies, validation and the signing process to further enhance our protections. There are no actions customers should take other than follow security best practices and deploy Antivirus software such as Windows Defender for Endpoint.' -- source: https://it.slashdot.org/story/21/06/26/1918225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Photos is so 2020—welcome to the world of self-hosted photo management
by Peter Reutemann 26 Jun '21

26 Jun '21

'We take more photos now than ever before. Growth in this segment is explosive, with over 1.4 trillion photos taken last year, according to InfoTrends. That's up from 1 trillion in 2017. Video is much the same, with YouTube saying in recent years that about 500 hours of video are uploaded to the platform every minute. Finding a solution to organizing and safely storing these precious memories is more important than ever, and it's becoming an increasingly large problem to solve. Photos depict a special moment in time, a memory or event that can't be recreated. They are irreplaceable and largely only exist digitally. Because of this, there are few categories of data that suit a free and open self-hosted solution better.' -- source: https://arstechnica.com/gadgets/2021/06/the-big-alternatives-to-google-phot… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A quick-start guide to OpenZFS native encryption
by Peter Reutemann 25 Jun '21

25 Jun '21

'One of the many features OpenZFS brings to the table is ZFS native encryption. First introduced in OpenZFS 0.8, native encryption allows a system administrator to transparently encrypt data at rest within ZFS itself. This obviates the need for separate tools like LUKS, VeraCrypt, or BitLocker.' -- source: https://arstechnica.com/gadgets/2021/06/a-quick-start-guide-to-openzfs-nati… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using unknown user accounts to target Zyxel firewalls and VPNs
by Peter Reutemann 25 Jun '21

25 Jun '21

'Network device maker Zyxel is warning customers of active and ongoing attacks that are targeting a range of the company’s firewalls and other types of security appliances. In an email, the company said that targeted devices included security appliances that have remote management or SSL VPN enabled, namely in the USG/ZyWALL, USG FLEX, ATP, and VPN series running on-premise ZLD firmware. The language in the email is terse, but it appears to say that the attacks target devices that are exposed to the Internet. When the attackers succeed in accessing the device, the email further appears to say, they are then able to connect to previously unknown accounts hardwired into the devices.' -- source: https://arstechnica.com/gadgets/2021/06/zyxel-scrambles-to-thwart-active-ha… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“I’m totally screwed.” WD My Book Live users wake up to find their data deleted
by Peter Reutemann 25 Jun '21

25 Jun '21

'Western Digital, maker of the popular My Disk external hard drives, is recommending customers unplug My Disk Live storage devices from the Internet until further notice while company engineers investigate unexplained compromises that have completely wiped data from devices around the world. The mass incidents of disk wiping came to light in this thread on Western Digital’s support forum. So far, there are no reports of deleted data later being restored.' -- source: https://arstechnica.com/gadgets/2021/06/mass-data-wipe-in-my-book-devices-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu-maker Canonical Will Support Open Source Blender on Windows, Mac, and Linux
by Peter Reutemann 24 Jun '21

24 Jun '21

'Blender is one of the most important open source projects, as the 3D graphics application suite is used by countless people at home, for business, and in education. The software can be used on many platforms, such as Windows, Mac, and of course, Linux. Today, Ubuntu-maker Canonical announces it will offer paid enterprise support for Blender LTS. Surprisingly, this support will not only be for Ubuntu users. Heck, it isn't even limited to Linux installations. Actually, Canonical will offer this support to Blender LTS users on Windows, Mac, and Linux.' -- source: https://news.slashdot.org/story/21/06/23/1950222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Open Source AMD FidelityFX Super Resolution Impresses In PC Game Tests
by Peter Reutemann 24 Jun '21

24 Jun '21

'AMD's FidelityFX Super Resolution (FSR) PC graphics up-scaling technology is ready for prime-time and the company has allowed members of the press to showcase performance and visuals of the tech in action with a number of game engines. AMD FidelityFX Super Resolution is vendor-agnostic and doesn't require specialized hardware to function like NVIDIA DLSS, which relies on Tensor cores on-board NVIDIA Turing or Ampere GPUs to accelerate neural network models that have been specifically trained on game engines. In contrast, AMD FSR utilizes more traditional spatial upscaling to create a super resolution image from a single input frame, not multiple frames. AMD FSR then employs a library of open-source algorithms that work on sharpening both image edge and texture detail. In game testing at HotHardware, frame rates can jump dramatically with little to no perceptible reduction in image quality, and the technology even works on many NVIDIA GPUs as well. There are currently 19 titles that are available or planned with support for AMD FSR, but with the open nature of the technology and cross-GPU compatibility, game developers theoretically should have significant incentive for adoption to breath new performance into their game titles.' -- source: https://tech.slashdot.org/story/21/06/22/217251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS replacement distro Rocky Linux’s first general release is out
by Peter Reutemann 22 Jun '21

22 Jun '21

'Rocky Linux—one of at least two new distributions created to fill the void left when CentOS Linux was discontinued by parent corporation Red Hat—announced general availability of Rocky Linux 8.4 today. Rocky Linux 8.4 is binary-compatible with Red Hat Enterprise Linux 8.4, making it possible to run apps designed and tested only for RHEL without RHEL itself.' -- source: https://arstechnica.com/gadgets/2021/06/centos-replacement-distro-rocky-lin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Begins Testing Sponsors on Some Users' Default Home Page/New Tab Pages
by Peter Reutemann 21 Jun '21

21 Jun '21

'Earlier this year a new support page appeared at support.Mozilla.org describing sponsored shortcuts (or sponsored tiles), "an experimental feature currently being tested by a small percentage of Firefox users in a limited number of markets." Mozilla works with advertising partners to place sponsored tiles on the Firefox default home page (or New Tab page) that would be useful to Firefox users. Mozilla is paid when users click on sponsored tiles.... [W]e only work with advertising partners that meet our privacy standards for Firefox. When you click on a sponsored tile, Firefox sends anonymized technical data to our partner through a Mozilla-owned proxy service. The code for this proxy service is available on GitHub for interested technical audiences. This data does not include any personally identifying information and is only shared when you click on a Sponsored shortcut.... You can disable a specific Sponsored tile... You can also disable Sponsored shortcuts altogether. Describing the as-yet-experimental feature, Engadget wrote a story headlined "Don't freak out: Firefox is testing advertisements in new tabs." These are just the tests, still mainly aimed at fresh installs of the Firefox web browser and always to beta users, before the rollout of sponsored tiles. It does sound like adverts are in the pipe, but it depends on the reaction to Mozilla's initial tests. Mozilla's Jonathan Nightingale says that, last time around, the reaction wasn't as positive as his company hoped. "It didn't go over well," he states. Further, he insists that Firefox won't become "a mess of logos sold to the highest bidder; without user control, without user benefit." Long-time Slashdot reader angryargus says they spotted the feature when they noticed an Ebay advertisement, but appreciated the ability to opt out, and suggested the feature is "an annoying tradeoff off using a browser that's not as directly funded by a search engine."' -- source: https://news.slashdot.org/story/21/06/20/0153218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0