July 2021 - wlug - list.wlug.org.nz

1.4 Million Cubans Bypass Censorship Using US Government-Funded Software Psiphon
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Cuban officials rallied tens of thousands of supporters in the streets on Saturday — nearly a week after they were stunned by the most widespread protests in decades," the Associated Press reports. President Miguel Díaz-Canel — accompanied by 90-year-old former President Raul Castro — "made an impassioned speech blaming unrest on the U.S. and its economic embargo, 'the blockade, aggression and terror... The enemy has returned to throw all it has at destroying the sacred unity and tranquility of the citizens.'" "I think the government is just trying to signal to people that it understands their desperation and that it's going to try to alleviate some of the misery that they're experiencing. The problem is that the government just doesn't have much in the way of resources that it can devote to doing that," said William LeoGrande, an expert on Cuba at the American University in the United States. Meanwhile, Reuters reports: Psiphon Inc's freely available internet censorship circumvention tool has helped nearly 1.4 million Cubans this week gain access to websites, the company said on Friday, after Cuba's government curbed access to popular social media and messaging platforms... Thousands of Cubans joined nationwide protests over shortages of basic goods, limits on civil liberties and the government's handling of a surge in COVID-19 infections on Sunday, the most significant unrest in decades in the communist-run country. Psiphon said 1.389 million users accessed the open web from Cuba through its network on Thursday, as well as 1.238 million as noon EDT (1600 GMT) on Friday. "Internet is ON; circumvention tools ARE working," Psiphon said in a statement. Psiphon said the roughly 1.4 million represents about 20% of Cuban internet users. Its open source circumvention tool can be downloaded from app stores like Google Play or Apple to "maximize your chances of bypassing censorship," according to the company. Canadian university researchers developed the software in 2007 to let users evade governmental internet firewalls. The censorship-circumvention tool — which combines VPN, SSH, and HTTP Proxy tools — has also been used in Iran, China, Belarus, Myanmar, according to recent news reports. Bloomberg notes that the Toronto-based nonprofit Psiphon "has received funding from the Open Technology Fund, a U.S. government nonprofit that aims to support global internet freedom technologies... "On Thursday, President Biden said the U.S. is examining whether it's able to restore internet access shut down by the Cuban government."' -- source: https://yro.slashdot.org/story/21/07/18/009221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon's Elasticsearch Fork 'OpenSearch' Reaches General Availability 1.0 Milestone
by Peter Reutemann 19 Jul '21

19 Jul '21

'Mike Melanson's "This Week in Programming" column shares an update on Amazon's ongoing battle with scalable data search solution ElasticSearch: Earlier this year, AWS completed its fork of ElasticSearch with the first release of OpenSearch. If you haven't followed along, the whole affair was a bit of a tug of war between AWS and Elastic, with AWS eventually coming out seemingly on top. After Elastic changed the licensing on ElasticSearch in an attempt to prevent AWS from selling a service based on the then-open-source project, AWS forked the project to release OpenSearch under Apache 2.0, effectively preserving its open source status. Now, OpenSearch has reached 1.0, which AWS says not only "marks the first production-ready version of OpenSearch," but also introduces "multiple new enhancements," such as data streams, trace analytics span filtering, report scheduling and more. The 1.0 release also involved quite a bit of code cleanup, removing proprietary code and marks, and adds the ability to upgrade from ElasticSearch to OpenSearch as if you were performing a normal upgrade of ElasticSearch. If you're interested in learning where the project is going, head on over to the public roadmap to learn more. ' -- source: https://news.slashdot.org/story/21/07/18/1656208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will a New Law Help the Chinese Government Stockpile Zero-Days?
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Starting September 1, 2021, the Chinese government will require that any Chinese citizen who finds a zero-day vulnerability must pass the details to the Chinese government," reports SecurityWeek, "and must not sell or give the knowledge to any third-party outside of China (apart from the vulnerable product's manufacturer)." Brief details are provided in a report by the Associated Press (AP) published Tuesday, July 13, 2021. No source is provided beyond the statement, "No one may 'collect, sell or publish information on network product security vulnerabilities,' say the rules issued by the Cyberspace Administration of China and the police and industry ministries...." AP describes this action as "further tightening the Communist Party's control over information". This is unlikely to be the primary motivation for the new rule since the government already has a vice-like grip on data. Companies may not store data on Chinese customers outside of China. Foreign companies selling routers and some other network devices in China must disclose to regulators how any encryption features work. "I would expect the Chinese Government to weaponize any discovered security vulnerabilities to enhance China's cybersecurity capabilities," Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, tells SecurityWeek. And Jake Williams, co-founder and CTO at BreachQuest adds that "the defensive advantages of Chinese government organizations being able to mitigate vulnerabilities discovered may well outweigh any offensive gains...." But he also believes this could rebound against China. "One of the biggest likely issues is brain drain. If Chinese researchers can profit handsomely from their work anywhere else, but can't do so in China, why would they stay? This probably helps China in the short term but harms them in the long term." The new law does encourage network operators and product vendors to set up a reward mechanism for reported vulnerabilities, according to the Record. But Katie Moussouris, founder and CEO of Luta Security, also raises the issue of western-based bug bounty platforms that have been working with Chinese security researchers for the past years. "If Western-based bug bounty platforms comply with this requirement in order to continue to legally receive bug reports from Chinese researchers, we must assume they will be required to hand over vulnerability data to the Ministry within two days of receiving the reports," Moussouris said. "That requirement will effectively introduce a backdoor straight to the Chinese government in any VDP [vulnerability disclosure program] or bug bounty program where Chinese researchers submit bugs via platforms, even to non-Chinese companies."' -- source: https://it.slashdot.org/story/21/07/18/2143207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hey Google: It’s Not (Just) A Joke
by Lawrence D'Oliveiro 14 Jul '21

14 Jul '21

Looking at this list <https://www.nzherald.co.nz/entertainment/the-best-inappropriate-and-annoyin…> of complaints about ads that didn’t get far with the Advertising Standards Authority, one stood out for me: The complaint: One avid Google Assistant user was very riled by this ad, explaining that when the shop assistant asks "Hey Google", it ended up triggering every Google smart device in his home. "I have 10 such devices in the house which includes smart speakers, smart displays and Chromecast which all respond to the advert," they write. "This is not only highly annoying, but also a deliberate attempt to trigger these devices." Yes, it seems it really does happen ... (Though I think the award for most nitpicking has to go to the “Clair de Lune” one.)

1 0

Speed Up Microsoft Teams By Bypassing Antivirus Checks
by Lawrence D'Oliveiro 13 Jul '21

13 Jul '21

Microsoft’s official recommendation <https://github.com/MicrosoftDocs/OfficeDocs-SkypeForBusiness/blob/9df8f4069…> for improving the performance of Teams on Windows is to exclude it from antivirus checks: Add the following Teams programs to your antivirus safe list. %localappdata%\Microsoft\Teams\current\Teams.exe %localappdata%\Microsoft\Teams\Update.exe Add the following Teams folders to your antivirus safe list. %localappdata%\Microsoft\Teams %appdata%\Microsoft\Teams| Because antivirus software only exists to slow your system down, right? (Found from this <https://forums.theregister.com/forum/all/2021/07/12/windows_11_still_doesnt…> reader comment.)

2 1

Libre-SOC's Open Hardware 180nm ASIC Submitted To IMEC for Fabrication
by Peter Reutemann 11 Jul '21

11 Jul '21

'"We're building a chip. A fast chip. A safe chip. A trusted chip," explains the web page at Libre-SOC.org. "A chip with lots of peripherals. And it's VPU. And it's a 3D GPU... Oh and here, have the source code." And now there's big news, reports long-time Slashdot reader lkcl: Libre-SOC's entirely Libre 180nm ASIC, which can be replicated down to symbolic level GDS-II with no NDAs of any kind, has been submitted to IMEC for fabrication. It is the first wholly-independent Power ISA ASIC outside of IBM to go Silicon in 12 years. Microwatt went to Skywater 130nm in March; however, it is also developed by IBM, as an exceptionally well-made Reference Design, which Libre-SOC used for verification. Whilst it would seem that Libre-SOC is jumping on the chip-shortage era's innovation bandwagon, Libre-SOC has actually been in development for over three and a half years so far. It even pre-dates the OpenLane initiative, and has the same objectives: fully automated HDL to GDS-II, full transparency and auditability with Libre VLSI tools Coriolis2 and Libre Cell Libraries from Chips4Makers. With €400,000 in funding from the NLNet Foundation [a long-standing non-profit supporting privacy, security, and the "open internet"], plus an application to NGI Pointer under consideration, the next steps are to continue development of Draft Cray-style Vectors (SVP64) to the already supercomputer-level Power ISA, under the watchful eye of the upcoming OpenPOWER ISA Workgroup.' -- source: https://hardware.slashdot.org/story/21/07/10/0154220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Edge Beats Firefox To Become the Third-Most Popular Browser
by Peter Reutemann 11 Jul '21

11 Jul '21

'"New data from Statcounter shows that Edge has now overtaken established rival Firefox in the rankings," reports TechRadar: In recent months, the pair have been neck-and-neck, but Microsoft's browser has now put daylight between itself and Firefox. Figures for June suggest Microsoft Edge now holds 3.4% of the browser market, while Firefox has slipped to 3.29%, continuing a downward trajectory that has seen the browser either lose or maintain market share in ten of the last twelve months. The change pushes Edge into third position in the browser rankings, behind only Chrome (65.27%) and Safari (18.34%). Launched in January 2020, the new Chromium-based Edge got off to a slow start, but began to gather momentum as the year progressed. Since last summer, the browser's market share has more than tripled. The increase in adoption can be attributed in part to renewed marketing efforts, but also to improvements that brought the experience in line with other modern web browsers. That may be true, but the article also acknowledges that it was just last month that Microsoft began rolling out Edge to all Windows PCs (via Windows 10 updates), "expanding the install base by millions almost overnight. "Now, Microsoft is doing everything in its power to encourage users to abandon Internet Explorer in favor of Edge, such as removing support for Microsoft 365 web apps and automatically launching certain web pages in the new browser."' -- source: https://news.slashdot.org/story/21/07/10/0353201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Unfair Performance Advantage in Chrome
by Peter Reutemann 10 Jul '21

10 Jul '21

'Google Chrome for Android has a feature that gives Google Search an unfair advantage over its competition. Sure, it's the default search engine and that's a huge hurdle to overcome for any competitor. However, Chrome also reserves a performance-boosting feature for Google Search exclusively. I recently poked around in the Chromium project source code; the open-source foundation for Google's Chrome web browser. The Chromium project is co-developed by Google, and other corporate and individual contributors. The project is managed and controlled by Google, however. I was looking for something else when I stumbled upon a feature called PreconnectToSearch. When enabled, the feature preemptively opens and maintains a connection to the default search engine. The preconnection feature resolves the domain name, and negotiates and sets up a secure connection to the server. All these things take time and they must happen before the search engine can receive the users' search queries. Preempting these steps can save a dozen seconds on a slow network connection or half a second on a fast connection. This optimization can yield a nice performance boost for Google's customers. Assuming the connection only requires a trivial amount of processing power and network bandwidth, of course. Setting up the connection early can be wasteful or slow down the loading of other pages if the user isn't going to search the web. There's just one small catch: Chromium checks the default search engine setting, and only enables the feature when it's set to Google Search. This preferential treatment means no other search engine can compete with Google Search on the time it takes to load search results. Every competitor must wait until the user has started to type a search query before Chrome will establish a connection.' -- source: https://tech.slashdot.org/story/21/07/09/2056209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Extends Privacy and Security of Canadian Internet Users With By-default DNS-over-HTTPS Rollout in Canada
by Peter Reutemann 09 Jul '21

09 Jul '21

'In a few weeks, Firefox will start the by-default rollout of DNS over HTTPS (or DoH for short) to its Canadian users in partnership with local DoH provider CIRA, the Canadian Internet Registration Authority. >From a report: DoH will first become a default for 1% of Canadian Firefox users on July 20 and will gradually reach 100% of Canadian Firefox users in late September 2021 -- thereby further increasing their security and privacy online. This follows the by-default rollout of DoH to US users in February 2020. As part of the rollout, CIRA joins Mozilla's Trusted Recursive Resolver (TRR) Program and becomes the first internet registration authority and the first Canadian organization to provide Canadian Firefox users with private and secure encrypted Domain Name System (DNS) services.' -- source: https://news.slashdot.org/story/21/07/08/1732203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kaspersky Password Manager Fixes Flaw That Generated Easily Bruteforced Passwords
by Peter Reutemann 09 Jul '21

09 Jul '21

'ZDNet reports: Suppose you are in the business of generating passwords, it would probably be a good idea to use an additional source of entropy other than the current time, but for a long time, that's all Kaspersky Password Manager (KPM) used. In a blog post to cap off an almost two year saga, Ledger Donjon head of security research Jean-Baptiste Bedrune showed KPM was doing just that. "Kaspersky Password Manager used a complex method to generate its passwords. This method aimed to create passwords hard to break for standard password crackers. However, such method lowers the strength of the generated passwords against dedicated tools," Bedrune wrote. One of the techniques used by KPM was to make letters that are not often used appear more frequently, which Bedrune said was probably an attempt to trick password cracking tools. "Their password cracking method relies on the fact that there are probably 'e' and 'a' in a password created by a human than 'x' or 'j', or that the bigrams 'th' and 'he' will appear much more often than 'qx' or 'zr'," he said. "Passwords generated by KPM will be, on average, far in the list of candidate passwords tested by these tools. If an attacker tries to crack a list of passwords generated by KPM, he will probably wait quite a long time until the first one is found. This is quite clever." The flip side was that if an attacker could deduce that KPM was used, then the bias in the password generator started to work against it. "If an attacker knows a person uses KPM, he will be able to break his password much more easily than a fully random password. Our recommendation is, however, to generate random passwords long enough to be too strong to be broken by a tool." The big mistake made by KPM though was using the current system time in seconds as the seed into a Mersenne Twister pseudorandom number generator. "It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second," Bedrune said. Because the program has an animation that takes longer than a second when a password is created, Bedrune said it could be why this issue was not discovered. "The consequences are obviously bad: every password could be bruteforced," he said. Bedrune added due to sites often showing account creation time, that would leave KPM users vulnerable to a bruteforce attack of around 100 possible passwords. "Kaspersky was informed of the vulnerability in June 2019, and released the fix version in October that same year," adds ZDNet. "In October 2020, users were notified that some passwords would need to be generated, with Kaspersky publishing its security advisory on 27 April 2021." "All public versions of Kaspersky Password Manager liable to this issue now have a new logic of password generation and a passwords update alert for cases when a generated password is probably not strong enough," the security company said.' -- source: https://it.slashdot.org/story/21/07/08/2116252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0