March 2022 - wlug - list.wlug.org.nz

Linux Has Been Bitten By Its Most High-Severity Vulnerability in Years
by Peter Reutemann 09 Mar '22

09 Mar '22

'Ars Technica is reporting a major new vulnerability in Linux. Named "Dirty Pipeline" it involves abuse of 'pipes' at the shell level as you might guess. The name Dirty Pipe is meant to both signal similarities to Dirty Cow and provide clues about the new vulnerability's origins. "Pipe" refers to a pipeline, a Linux mechanism for one OS process to send data to another process. In essence, a pipeline is two or more processes that are chained together so that the output text of one process (stdout) is passed directly as input (stdin) to the next one. Tracked as CVE-2022-0847, the vulnerability came to light when a researcher for website builder CM4all was troubleshooting a series of corrupted files that kept appearing on a customer's Linux machine. After months of analysis, the researcher finally found that the customer's corrupted files were the result of a bug in the Linux kernel. ' -- source: https://it.slashdot.org/story/22/03/08/1524203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Free Software Foundation Appoints a New Executive Director
by Peter Reutemann 06 Mar '22

06 Mar '22

'The Free Software Foundation announced its new executive director this week. Back in 2010 John Sullivan had become the Free Software Foundation's previous executive director, but last year after more than 11 years he'd decided to resign. Taking his place will be the FSF's program manager for the last three years, who writes in a new blog post: The past three years working at the FSF as program manager have been educational and motivational. They have reinforced my belief that what we do is important, and that our goal to give the four freedoms to all computer users continues to be crucial. The work we do reminds people to recognize the power they have to demand change. This change will help free their own digital lives, and their loved ones'. I am grateful to John Sullivan for his leadership and support. His legacy of nineteen years will be hard to live up to, and I look forward to working with him, the FSF board, and the staff on this transition.... We will continue our unwavering focus on our mission, especially working to increase understanding and adoption of copyleft, and bringing new people into the movement by communicating the necessity of the four freedoms. In the short term, we're focused on making the upcoming LibrePlanet conference [March 19-20] the best online edition yet for you. After that, I plan to reach out and ask for your thoughts and ideas on what else the FSF can do this year and beyond to advance the cause of user freedom. As a free software activist, like many of you, each day, I am presented with almost innumerable choices between freedom and convenience, and each day I choose freedom wherever I can. I have learned to do this by questioning my tools, by joining this community, and by learning more and more about the ways that I can stand up for myself. If I can do that, I firmly believe we can reach anyone. I hope that you'll join me in rejecting the ways that Big Tech tries to deprive us of our freedoms, and to help set a positive example for computer users around the globe. In freedom, Zoë Kooyman Executive Director >From the FSF's announcement: Kooyman assumes the executive director role following a series of recent steps taken to make the non-profit's governance and board recruitment practices more transparent and participatory, including a new community engagement process that empowers associate members of the FSF to nominate and evaluate candidates for the board of directors for the first time in the organization's 37-year history. "I want to learn from the community, and will focus on relationship building, and on strengthening the free software movement together," Kooyman said. "Our immediate priority is to convene another successful LibrePlanet conference on March 19 and 20, bringing community activists, domain experts, and other users together to discuss current issues in technology and ethics. With the current and future threats users face, it's critical that we spread the free software message wider than ever before and that we help people understand the steps they can take to defend our user rights and freedom."' -- source: https://news.slashdot.org/story/22/03/05/0550228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Raspberry Pi's 10th Anniversary, Eben Upton Ponders the Prospects for a RISC-V Pi
by Peter Reutemann 06 Mar '22

06 Mar '22

'On the 10th anniversary of the Raspberry Pi, the Register takes a look backwards — and forwards — in a new interview Eben Upton: As for the future, a Raspberry Pi 5 is inevitable but, in a blow to those hoping for something even more exotic than the usual Broadcom Arm SoC, RISC-V isn't on the cards, certainly not in the timeframe for the next generation of Pi. "I can't go out today and license a RISC-V core," says Upton, citing the current state of the ecosystem, "which is even as good as the core of the Raspberry Pi 4." "Hopefully I will in the future," he adds. The implosion of the Nvidia/Arm deal has also reduced the chances of a RISC-V Pi (in the 2030 timeframe), down from 20 per cent to 10 per cent, according to Upton. "The ownership of the core of the de-facto standard low-power architecture by an organisation that's also a player was potentially very destabilising... and it was always going to be to the benefit of the obvious alternative architecture." Upton answered questions from Slashdot's readers before the first boards were even ready in 2012. But he already knew that the device would be wildly popular. Upton tells the Register that months before, its Debian-based operating system got 50,000 downloads, "And all you could do was run it in QEMU (there was a QEMU config you could build that was similar enough to a Raspberry Pi). "50,000 people downloaded this really primitive operating system for a machine that you couldn't buy!"' -- source: https://news.slashdot.org/story/22/03/05/0151232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation's 'Census II' of Open Source Libraries Urges Support, Security, and Standardization
by Peter Reutemann 06 Mar '22

06 Mar '22

'"Much of the most widely used free and open source software is developed by only a handful of contributors," warns the Linux Foundation, in the executive summary for its massive new census of free and open source software application libraries. It was prepared in conjunction with Harvard's Laboratory for Innovation Science — and that's just one of its five high-level findings. The census also notes "the increasing importance of individual developer account security," but also the persistence of legacy software, the need for a standardized naming schema for software components, and "complexities" around package versions. But there's also just a lot of data about package popularity, writes SD Times: The report, Census II, is a follow-up to Census I, which was conducted in 2015 to identify the packages in Debian Linux that were most critical to the operation and security of the kernel. According to the Linux Foundation, Census II allows for a more "complete picture of free and open source (FOSS) adoption." "Understanding what FOSS packages are the most critical to society allows us to proactively support projects that warrant operations and security support," said Brian Behlendorf, executive director at Linux Foundation's Open Source Security Foundation (OpenSSF). The census "aggregates data from over half a million observations of FOSS libraries used in production applications at thousands of companies," according to its executive summary. It argues that preserving FOSS will require this kind of data-sharing (about where and how FOSS packages are being used ) as well as coordination — including standardizing terminology — and of course, investment. "The motivation behind publishing these findings is to not only inform, but also to inspire action by developers to improve their security practices and by end users to support the FOSS ecosystem and developers who need assistance." (It suggests companies companies could provide not just financial support but also the technical talent and their time.) The results take the form of eight Top 500 lists — four that include version numbers in the analysis and four that are version agnostic. Further, as mentioned above, we present npm and non-npm packages in separate lists... Although these lists provide valuable, important insights into the most widely used FOSS projects, it is important to also consider the level of security related to these projects. Therefore, in each list, we also include the "Tiered %" measure from the OpenSSF Best Practices Badging Program....' -- source: https://news.slashdot.org/story/22/03/05/0521219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bungie Rejects Steam Deck's Linux, Threatens To Ban Destiny 2 Players There
by Peter Reutemann 04 Mar '22

04 Mar '22

'The Verge: When will Bungie let Destiny 2 come to Valve's Steam Deck handheld gaming PC? It's looking like the answer is never -- because the soon-to-be Sony subsidiary has published a help page that not only says the game's unsupported, but outright threatens to ban prospective Steam Deck players (via Wario64). The help page has a new section titled "Steam Deck and Destiny 2," which reads: "Destiny 2 is not supported for play on the Steam Deck or on any system utilizing Steam Play's Proton unless Windows is installed and running. Players who attempt to launch Destiny 2 on the Steam Deck through SteamOS or Proton will be unable to enter the game and will be returned to their game library after a short time. Players who attempt to bypass Destiny 2 incompatibility will be met with a game ban." To be fair, Bungie isn't the only one to reject the Steam Deck without necessarily providing a satisfying explanation -- Epic Games CEO Tim Sweeney explained to me why Fortnite won't get updated for the Steam Deck last month, even though Epic's own Easy Anti-Cheat (EAC) claims game developers can enable it with "just a few clicks." And while both Apex Legends and Elden Ring now fully work on Deck despite using anti-cheat, it's also true that many other top multiplayer games have yet to fully arrive.' -- source: https://linux.slashdot.org/story/22/03/02/2153252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Play app downloaded more than 10,000 times contained data-stealing RAT
by Peter Reutemann 03 Mar '22

03 Mar '22

'A malicious app downloaded from Google Play more than 10,000 times surreptitiously installed a remote access trojan that stole users’ passwords, text messages, and other confidential data, a security firm reported. The trojan, which goes under the names TeaBot and Anatsa, came to light last May. It used streaming software and abused Android’s accessibility services in a way that allowed the malware creators to remotely view the screens of infected devices and interact with the operations the devices carried out. At the time, TeaBot was programmed to steal data from a predefined list of apps from about 60 banks around the world. On Tuesday, security firm Cleafy reported that TeaBot was back. This time, the trojan spread through a malicious app called QR Code & Barcode Scanner, which as the name suggested, allowed users to interact with QR codes and barcodes. The app had more than 10,000 installations before Cleafy researchers notified Google of the fraudulent activity and Google removed it.' -- source: https://arstechnica.com/information-technology/2022/03/google-play-app-drop… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Demand NVIDIA Open Source Their Drivers Or They Leak More Data
by Peter Reutemann 03 Mar '22

03 Mar '22

'VideoCardz: Hackers that infiltrated NVIDIA systems are now threatening to release more confidential information unless the company commits to open sourcing their drivers. It is unclear what the stolen data contains, but the group confirmed that there are 250GB of hardware related data in their possession. Furthermore, the group confirmed they have evaluated NVIDIA position, which means that NVIDIA is might trying to communicate with the group to prevent future leaks. The group has already published information on NVIDIA DLSS technology and upcoming architectures. Yesterday, Nvidia reportedly retaliated against the hacker group known as "Lapsus$" by sneaking back into the hacker's system and encrypting the stolen data. The group claimed that it had a backup of the data, though.' -- source: https://news.slashdot.org/story/22/03/02/2228207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fixing The Fiji-Tonga Cable
by Lawrence D'Oliveiro 02 Mar '22

02 Mar '22

Reconnecting Tonga’s sole Internet cable link (to Fiji) turned out to be a tricky job <https://www.theregister.com/2022/03/02/tonga_submarine_cable_reconnection_r…>. The cable was ripped in six different places, and a quarter-million-dollar repeater unit went missing altogether. 40km of existing cable was able to be recovered and reused, but another 50km of new cable was needed to complete the repair. Parts of the cable actually moved 5km closer to the volcano, courtesy of an earthquake and associated turbidity currents. Next step: fixing the connections between Tonga’s islands.

1 0

DDoSers are using a potent new method to deliver attacks of unthinkable size
by Peter Reutemann 02 Mar '22

02 Mar '22

'Last August, academic researchers discovered a potent new method for knocking sites offline: a fleet of misconfigured servers more than 100,000 strong that can amplify floods of junk data to once-unthinkable sizes. These attacks, in many cases, could result in an infinite routing loop that causes a self-perpetuating flood of traffic. Now, content-delivery network Akamai says attackers are exploiting the servers to target sites in the banking, travel, gaming, media, and web-hosting industries. These servers—known as middleboxes—are deployed by nation-states such as China to censor restricted content and by large organizations to block sites pushing porn, gambling, and pirated downloads. The servers fail to follow transmission control protocol specifications that require a three-way handshake—comprising an SYN packet sent by the client, a SYN+ACK response from the server, followed by a confirmation ACK packet from the client—before a connection is established. This handshake limits the TCP-based app from being abused as amplifiers because the ACK confirmation must come from the gaming company or other target rather than an attacker spoofing the target’s IP address. But given the need to handle asymmetric routing, in which the middlebox can monitor packets delivered from the client but not the final destination that’s being censored or blocked, many such servers drop the requirement by design.' -- source: https://arstechnica.com/information-technology/2022/03/unending-data-floods… Considering that we suffered a widespread internet outage earlier today (and my internet is still flaky or slow), seems rather relevant: https://www.newshub.co.nz/home/technology/2021/09/internet-down-for-many-ar… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0