May 2022 - wlug - list.wlug.org.nz

Software Freedom Conservancy Wins Big Step Forward For Open-Source Rights
by Peter Reutemann 18 May '22

18 May '22

'ZDNet: The Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), recently sued major TV vendor Vizio for abusing the GPL with its Linux-based SmartCast OS. Vizio replied that the SFC had no right to ask for the source code. On May 13, however, the SFC succeeded in federal court with its motion to have its lawsuit against Vizio remanded back to Superior Court in Orange County, CA. Doesn't sound like that big a deal? Think again. The important part of the decision by U.S. District Court Judge Josephine L. Staton stated that SFC's claim "that the [GPLv2] enforcement of 'an additional contractual promise separate and distinct from any rights provided by the copyright laws' amounts to an 'extra element,' and therefore, SFC's claims are not preempted." Karen M. Sandler, SFC's executive director, explained, "The ruling is a watershed moment in the history of copyleft licensing. This ruling shows that the GPL agreements function both as copyright licenses and as a contractual agreement." Sandler added that even in the Free and Open Source Software (FOSS) legal community people argue incorrectly that the GPL and other copyleft licenses only function as copyright licenses. This decision clearly states that the GPL also acts as a contract. Further, this decision makes it the first case to show individual consumers have rights to the source code as third-party beneficiaries of the GPL.' -- source: https://news.slashdot.org/story/22/05/17/2039236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Parliament Protest Supercharged NZ's Misinfodemic
by Lawrence D'Oliveiro 18 May '22

18 May '22

A report <https://www.nzherald.co.nz/nz/tectonic-shift-how-parliament-protest-superch…> on how online misinformation--and deliberate disinformation--has been spreading in NZ. A flood of recent Covid-19-related activity has exposed thousands more Kiwis to what the report's authors called "splintered realities", while also helping push people toward racist and violent ideologies. ... The websites they focused on ranged from mainstream platforms like Facebook, Twitter, Instagram and YouTube, to channels linked to the far-right, such as Telegram, Rumble, Odysee, Gab and Gettr. Each shift in New Zealand's Covid-19 response caused ripples across these sites. As our pediatric vaccine roll-out kicked off, for instance, one post bogusly claiming five children had collapsed at a vaccination centre swiftly went viral. In other words, a dramatic-sounding report, even though it was wrong, can spread faster than any attempts to correct it, simply because the correction seems much less interesting in comparison. You don’t have to assume that the ones spreading these reports are deliberately lying in order to create this effect: Hanlon’s Razor says “Never attribute to malice that which can be adequately explained by stupidity”. But the unprecedented surge in online traffic they observed around February's anti-mandate convoy to Wellington, and the 24-day occupation that followed, surprised even them. ... Posts on a single Facebook page, run by a known "misinformation super-spreader" they didn't name, drew some of the highest engagement of all public pages in the country over that period. The amount of traffic on Facebook misinformation pages even eclipsed that of pages operated by New Zealand mainstream media outlets combined – receiving 357,089 and 247,620 interactions respectively on March 2. There’s more in the news article, and also on the website of the Disinformation Project group which did the research <https://thedisinfoproject.org/>. I thought one of the names of the researchers was familiar: Dr Sanjana Hattotuwa. I’ve seen him on TV news a couple of times talking about this very thing.

1 0

meeting next Monday
by Peter Reutemann 16 May '22

16 May '22

Hi everyone We have another hybrid (virtual + in-person) meeting next Monday: Since we ran out of time at our last meeting, we are continuing our theme on cyber security with more show and tells: A far simpler firewall than pfSense, ufw (uncomplicated firewall), will be introduced by Peter (command-line and GUI). He will also briefly talk about tools like ClamAV (anti-virus), nmap (port scanner) and rkhunter (root kit detection). Angus will demo Wireguard, the VPN solution that made it into the Linux kernel (starting with 5.6). Details (and virtual meeting link): https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776643/ If you'd like to demo a tool as well, then please let me know. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Surprise: Microsoft Has a Second Internal-Use-Only Linux Distro
by Peter Reutemann 16 May '22

16 May '22

'ZDNet reports there's more than just the one Microsoft-created Linux distribution for internal use only called CBL (Common Base Linux) Mariner. "It turns out there's another Microsoft-developed Linux distribution that's also for internal use that's known as CBL-Delridge or CBL-D." I discovered the existence of CBL-D for the first time this week in a rather round-about way. I stumbled onto a February 2 blog post from Hayden Barnes. a Senior Engineering Manager at SuSE who led the Windows on Rancher engineering team, which traced his steps in discovering and building his own image of CBL-D. Barnes noted that Microsoft published CBL-Delridge in 2020, the same year that it also published CBL-Mariner. The main difference between the two: Delridge is a custom Debian derivative, while Mariner is a custom Linux From Scratch-style distribution. CBL-D powers Azure's Cloud Shell. The Azure Cloud Shell provides a set of cloud-management tools packaged in a container. In a note on the GitHub repo for the Cloud Shell, officials noted that "the primary difference between Debian and CBL-D is that Microsoft compiles all the packages included in the CBL-D repository internally. This helps guard against supply chain attacks...." CBL-Mariner and CBL-Delridge are just two of the Microsoft-developed Linux-related deliverables from the Linux Systems Group. Others include the Windows Subsystem for Linux version 2 (WSL2), which is part of Windows 10; an Azure-tuned Linux kernel which is designed for optimal performance as Hyper-V guests; and Integrity Policy Enforcement (IPE), a proposed Linux Security Module (LSM) from the Enterprise and Security team.' -- source: https://linux.slashdot.org/story/22/05/14/1934226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Using SEO To Rank Malicious PDFs On Search Engines, Research Finds
by Peter Reutemann 15 May '22

15 May '22

'VentureBeat: Today, researchers at security service edge provider, Netskope, published the Netskope Cloud and Threat Report: Global Cloud and Malware Trends, which found that phishing downloads rose 450% over the past 12 months, and highlighted that attackers are using search engine optimization (SEO) to rank malicious PDF files on search engines. The report's findings show that phishing attempts are constantly evolving, and attackers aren't just targeting employees through their email inboxes; they're also using popular search engines like Google and Bing. The increase in phishing attacks and the growing popularity of SEO techniques among cybercriminals highlights the need for enterprises to provide their employees with security awareness training so they're prepared to spot threats and not at risk of handing over sensitive information. When it comes to defending against these SEO-driven attacks, [Ray Canzanese, director of Netskope's Threat Labs] highlights several methods that security teams can use to protect employees. One of the most effective is to use a solution that can decrypt and scan web traffic for malicious content. At the same time, security teams should encourage users to inspect all links they click on, and to exercise caution if the link takes them to an unfamiliar website. In the event an employee does click on a malicious PDF, they can expect to see a fake captcha at the top of the first page, followed by text on other pages. In these scenarios, users should close the file, delete it from the device and report it to the security team ASAP. Canzanese also notes that it's important for users to report malicious URLs that feature on popular search engines to help the provider unlist them from the site and prevent other users from falling victim to a scam.' -- source: https://it.slashdot.org/story/22/05/13/2155201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Some top 100,000 websites collect everything you type—before you hit submit
by Peter Reutemann 15 May '22

15 May '22

'When you sign up for a newsletter, make a hotel reservation, or check out online, you probably take for granted that if you mistype your email address three times or change your mind and X out of the page, it doesn't matter. Nothing actually happens until you hit the Submit button, right? Well, maybe not. As with so many assumptions about the web, this isn't always the case, according to new research: A surprising number of websites are collecting some or all of your data as you type it into a digital form. Researchers from KU Leuven, Radboud University, and University of Lausanne crawled and analyzed the top 100,000 websites, looking at scenarios in which a user is visiting a site while in the European Union and visiting a site from the United States. They found that 1,844 websites gathered an EU user's email address without their consent, and a staggering 2,950 logged a US user's email in some form. Many of the sites seemingly do not intend to conduct the data-logging but incorporate third-party marketing and analytics services that cause the behavior. After specifically crawling sites for password leaks in May 2021, the researchers also found 52 websites in which third parties, including the Russian tech giant Yandex, were incidentally collecting password data before submission. The group disclosed their findings to these sites, and all 52 instances have since been resolved.' -- source: https://arstechnica.com/information-technology/2022/05/some-top-100000-webs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

White House Joins OpenSSF, Linux Foundation In Securing Open-Source Software
by Peter Reutemann 15 May '22

15 May '22

'ZDNet: Securing the open-source software supply chain is a huge deal. Last year, the Biden administration issued an executive order to improve software supply chain security. This came after the Colonial Pipeline ransomware attack shut down gas and oil deliveries throughout the southeast and the SolarWinds software supply chain attack. Securing software became a top priority. In response, The Open Source Security Foundation (OpenSSF) and Linux Foundation rose to this security challenge. Now, they're calling for $150 million in funding over two years to fix ten major open-source security problems. The government will not be paying the freight for these changes. $30 million has already been pledged by Amazon, Ericsson, Google, Intel, Microsoft, and VMWare. More is already on the way. Amazon Web Services (AWS) has already pledged an additional $10 million. At the White House press conference, OpenSSF general manager Brian Behlendorf said, "I want to be clear: We're not here to fundraise from the government. We did not anticipate needing to go directly to the government to get funding for anyone to be successful." Here are the ten goals the open-source industry is committed to meeting: 1. Security Education: Deliver baseline secure software development education and certification to all. 2. Risk Assessment: Establish a public, vendor-neutral, objective-metrics-based risk assessment dashboard for the top 10,000 (or more) OSS components. 3. Digital Signatures: Accelerate the adoption of digital signatures on software releases. 4. Memory Safety: Eliminate root causes of many vulnerabilities through the replacement of non-memory-safe languages. 5. Incident Response: Establish the OpenSSF Open Source Security Incident Response Team, security experts who can step in to assist open source projects during critical times when responding to a vulnerability. 6. Better Scanning: Accelerate the discovery of new vulnerabilities by maintainers and experts through advanced security tools and expert guidance. 7. Code Audits: Conduct third-party code reviews (and any necessary remediation work) of up to 200 of the most-critical OSS components once per year. 8. Data Sharing: Coordinate industry-wide data sharing to improve the research that helps determine the most critical OSS components. 9. Software Bill of Materials (SBOMs): Everywhere Improve SBOM tooling and training to drive adoption. 10. Improved Supply Chains: Enhance the 10 most critical open-source software build systems, package managers, and distribution systems with better supply chain security tools and best practices.' -- source: https://it.slashdot.org/story/22/05/14/0336214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Exploiting WordPress Tools to Hawk Scams
by Peter Reutemann 15 May '22

15 May '22

'"If you've visited a website in recent days and been randomly redirected to the same pages with sketchy "resources" or unwanted ads, it's likely the site in question was 1) built with WordPress tools and 2) hacked," reports Gizmodo. Details come from this blog post by researchers at Sucuri (a security provider owned by GoDaddy): As outlined in our latest hacked website report, we've been tracking a long-lasting campaign responsible for injecting malicious scripts into compromised WordPress websites. This campaign leverages known vulnerabilities in WordPress themes and plugins and has impacted an enormous number of websites over the year — for example, according to PublicWWW, the April wave for this campaign was responsible for nearly 6,000 infected websites alone. Since these PublicWWW results only show detections for simple script injections, we can assume that the scope is significantly larger. We recently investigated a number of WordPress websites complaining about unwanted redirects. Interestingly enough, they were found to be related to a new wave of this massive campaign and were sending website visitors through a series of website redirects to serve them unwanted ads. The websites all shared a common issue — malicious JavaScript had been injected within their website's files and the database, including legitimate core WordPress files... This JavaScript was appended under the current script or under the head of the page where it was fired on every page load, redirecting site visitors to the attacker's destination.... Domains at the end of the redirect chain may be used to load advertisements, phishing pages, malware, or even more redirects.... At the time of writing, PublicWWW has reported 322 websites impacted by this new wave... Considering that this count doesn't include obfuscated malware or sites that have not yet been scanned by PublicWWW, the actual number of impacted websites is likely much higher. Our team has seen an influx in complaints for this specific wave of the massive campaign targeting WordPress sites beginning May 9th, 2022, which has impacted hundreds of websites already at the time of writing.... We expect the hackers will continue registering new domains for this ongoing campaign as soon as existing ones become blacklisted. "It's important to note that these hacks are related to themes and plugins built by thousands of third-party developers using the open source WordPress software, not WordPress.com, which offers hosting and tools to build websites," Gizmodo points out. But this also cite this warning from Sucuri malware analyst Krasimir Konov: "This page tricks unsuspecting users into subscribing to push notifications from the malicious site. If they click on the fake CAPTCHA, they'll be opted in to receive unwanted ads even when the site isn't open — and ads will look like they come from the operating system, not from a browser," Konov wrote.' -- source: https://it.slashdot.org/story/22/05/14/1838213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS Successor Rocky Linux Gets $26M to Fund Push Into Enterprise Space
by Peter Reutemann 15 May '22

15 May '22

'"CIQ has landed $26 million in funding to support its plans to expand the use of Rocky Linux in the enterprise space," reports ZDNet. Last year, Red Hat decided to stop supporting CentOS 8 and shifted focus to CentOS Stream. CentOS had some huge enterprise users, among them Disney, GoDaddy, RackSpace, Toyota, and Verizon. In response, Greg Kurtzer, one of CentOS's founders, kicked off Rocky Linux in December 2020.... Kurtzer says Rocky Linux adoption has been "massive", with monthly downloads of OS images typically 250,000, reaching 750,000 in a bumper month. "Within two months we had 10,000 developer and contributors trying to be part of this project...." The project has gained the support of Greg Kroah-Hartman, the maintainer of the main-line stable Linux kernel, to meet community demands for Rocky Linux to run on a more modern, optimized kernel, Kurtzer said. Kroah-Hartman is leading Rocky Linux special interest group (SIG) for the kernel to create an optional enhanced kernel for Rocky Linux. "He's working closely with us to make sure the kernel we use is blessed by him. He's in the loop as bugs come up and help us manage that kernel in Rocky Linux," says Kurtzer. "Moreover, today's news follows shortly after CIQ inked a major deal with Google to help support companies looking to deploy Rocky Linux on Google's cloud infrastructure," reports VentureBeat. Kurtzer tells the site that Rocky Linux "has been a rocket ship in terms of uptake across the enterprise and cloud."' -- source: https://linux.slashdot.org/story/22/05/14/1913237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zyxel silently patches command injection vulnerability with 9.8 severity rating
by Peter Reutemann 13 May '22

13 May '22

'Hardware manufacturer Zyxel quietly released an update fixing a critical vulnerability that gives hackers the ability to control tens of thousands of firewall devices remotely. The vulnerability, which allows remote command injection with no authentication required, carries a severity rating of 9.8 out of a possible 10. It’s easy to exploit by sending simple HTTP or HTTPS requests to affected devices. The requests allow hackers to send commands or open a web shell interface that enables hackers to maintain privileged access over time. The vulnerability affects a line of firewalls that offer a feature known as zero-touch provisioning. Zyxel markets the devices for use in small branch and corporate headquarter deployments. The devices perform VPN connectivity, SSL inspection, web filtering, intrusion protection, and email security and provide up to 5Gbps throughput through the firewall. The Shodan device search service shows more than 16,000 affected devices are exposed to the Internet.' -- source: https://arstechnica.com/information-technology/2022/05/zyxel-silently-patch… Should have used pfSense... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0