June 2022 - wlug - list.wlug.org.nz

Credentials for thousands of open source projects free for the taking—again!
by Peter Reutemann 14 Jun '22

14 Jun '22

'A service that helps open source developers write and test software is leaking thousands of authentication tokens and other security-sensitive secrets. Many of these leaks allow hackers to access the private accounts of developers on Github, Docker, AWS, and other code repositories, security experts said in a new report. The availability of the third-party developer credentials from Travis CI has been an ongoing problem since at least 2015. At that time, security vulnerability service HackerOne reported that a Github account it used had been compromised when the service exposed an access token for one of the HackerOne developers. A similar leak presented itself again in 2019 and again last year. The tokens give anyone with access to them the ability to read or modify the code stored in repositories that distribute an untold number of ongoing software applications and code libraries. The ability to gain unauthorized access to such projects opens the possibility of supply chain attacks, in which threat actors tamper with malware before it's distributed to users. The attackers can leverage their ability to tamper with the app to target huge numbers of projects that rely on the app in production servers. Despite this being a known security concern, the leaks have continued, researchers in the Nautilus team at the Aqua Security firm are reporting. A series of two batches of data the researchers accessed using the Travis CI programming interface yielded 4.28 million and 770 million logs from 2013 through May 2022. After sampling a small percentage of the data, the researchers found what they believe are 73,000 tokens, secrets, and various credentials.' -- source: https://arstechnica.com/information-technology/2022/06/credentials-for-thou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email client K-9 Mail will become Thunderbird for Android
by Peter Reutemann 14 Jun '22

14 Jun '22

'The open source Thunderbird email client has a long and storied history, but until now, that history has been limited to the desktop. That's about to change, according to a post on the Thunderbird blog. Thunderbird will be coming to Android through the popular open source mobile email client K-9 Mail. According to Thunderbird's Jason Evangelho, the Thunderbird team has acquired the source code and naming rights to K-9 Mail. K-9 Mail project maintainer Christian Ketterer (who goes by "cketti" in the OSS community) will join the Thunderbird team, and over time, K-9 Mail will become Thunderbird for Android.' -- source: https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Working To Provide Good Support For The VisionFive Low-Cost RISC-V Board
by Peter Reutemann 13 Jun '22

13 Jun '22

'"Ubuntu developers have been working on bringing up and improving support for the Starfive VisionFive," writes Phoronix, calling the $179 device "one of the most promising 'low-cost' RISC-V single board computers to date... intended to run full-blown RISC-V Linux distributions." The board comes in two varieties with 4GB or 8GB of system memory, powered by a dual-core SiFive U74 RV64 SoC @ 1.0GHz, an NVDLA deep learning accelerator engine, a Tensilica-VP6 Vision DSP, and a neural network engine.... Considering the performance of the much more capable HiFive Unmatched development board (that is also multiple times more expensive) and even that sometimes being outpaced by the Raspberry Pi, don't get too excited for the dual-core 1.0GHz RISC-V 64-bit SoC for general purpose workloads. But this VisionFive board may be interesting for some machine learning and other use-cases thanks to its additional accelerators. It's also one of the few RISC-V boards capable of running a full Linux distribution in the sub-$200 space. Since the upstream Linux 5.17 kernel there has been mainline support for the VisionFive v1 board. Ubuntu developers are working on enabling the StarFive VisionFive board for their RISC-V kernel build. ' -- source: https://linux.slashdot.org/story/22/06/12/1524230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox and Chrome are squaring off over ad-blocker extensions
by Peter Reutemann 12 Jun '22

12 Jun '22

'There’s a growing split over how much room browsers should leave for ad blocking — and Chrome and Firefox have ended up on opposite sides of the fight. The rupture centers on a feature called Web Request, commonly used in ad blockers and crucial for any system that looks to block off a domain wholesale. Google has long had security concerns about Web Request and has worked to cut it out of the most recent extension standard, called Manifest V3, or MV3 for short. But, in a recent blog post, Mozilla made clear that Firefox will maintain support for Web Request, keeping the door open for the most sophisticated forms of ad blocking. Google’s strategy has been roundly criticized by privacy advocates — the Electronic Frontier Foundation has been a vocal opponent — but the search company hasn’t been swayed. Though Firefox has a far smaller share of the desktop marketplace than Chrome, it could be a chance for Mozilla’s product to really define itself. For Google though, sticking with MV3 will have a huge impact on the overall role of ad blocking on the modern web. ' -- source: https://www.theverge.com/2022/6/10/23131029/mozilla-ad-blocking-firefox-goo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MIT Researchers Uncover 'Unpatchable' Flaw in Apple M1 Chips
by Peter Reutemann 12 Jun '22

12 Jun '22

'Apple's M1 chips have an "unpatchable" hardware vulnerability that could allow attackers to break through its last line of security defenses, MIT researchers have discovered. TechCrunch reports: The vulnerability lies in a hardware-level security mechanism utilized in Apple M1 chips called pointer authentication codes, or PAC. This feature makes it much harder for an attacker to inject malicious code into a device's memory and provides a level of defense against buffer overflow exploits, a type of attack that forces memory to spill out to other locations on the chip. Researchers from MIT's Computer Science and Artificial Intelligence Laboratory, however, have created a novel hardware attack, which combines memory corruption and speculative execution attacks to sidestep the security feature. The attack shows that pointer authentication can be defeated without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it. The attack, appropriately called "Pacman," works by "guessing" a pointer authentication code (PAC), a cryptographic signature that confirms that an app hasn't been maliciously altered. This is done using speculative execution -- a technique used by modern computer processors to speed up performance by speculatively guessing various lines of computation -- to leak PAC verification results, while a hardware side-channel reveals whether or not the guess was correct. What's more, since there are only so many possible values for the PAC, the researchers found that it's possible to try them all to find the right one.' -- source: https://apple.slashdot.org/story/22/06/11/0250238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HP releases its $1,099 Linux laptop for developers
by Peter Reutemann 11 Jun '22

11 Jun '22

'HP released its Dev One Linux laptop today. Aimed at coders, the 14-inch clamshell comes at a lower price than previous Ubuntu-based HP clamshells. Starting at $1,099, the Dev One begins to keep costs low by opting for an AMD, rather than Intel, CPU and skipping the discrete graphics card. HP's last Linux laptops, part of its ZBook workstation lineup, went well over $2,000 and offered up to Intel Xeon processors and Nvidia RTX GPUs.' -- source: https://arstechnica.com/gadgets/2022/06/hps-linux-based-amd-laptop-releases… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
by Peter Reutemann 10 Jun '22

10 Jun '22

'Researchers have unearthed a discovery that doesn’t occur all that often in the realm of malware: a mature, never-before-seen Linux backdoor that uses novel evasion techniques to conceal its presence on infected servers, in some cases even with a forensic investigation. On Thursday, researchers from Intezer and The BlackBerry Threat Research & Intelligence Team said that the previously undetected backdoor combines high levels of access with the ability to scrub any sign of infection from the file system, system processes, and network traffic. Dubbed Symbiote, it targets financial institutions in Brazil and was first detected in November.' -- source: https://arstechnica.com/information-technology/2022/06/novel-techniques-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Who Needs Modern Emacs?
by Peter Reutemann 08 Jun '22

08 Jun '22

'Every now and again I come across some discussion on making Emacs "modern". The argument always go more or less like this - Emacs doesn't look and behave like and the world will end if we don't copy something "crucial" from it. [...] If you ask me -- there's pretty much nothing we can do that would suddenly make Emacs as popular as VS Code. But you know what -- that's perfectly fine. After all there are plenty of "modern" editors that are even less popular than Emacs, so clearly being "modern" doesn't make you popular. And there's also our "arch-nemesis" vim, that's supposedly as "dated" as Emacs, but is extremely popular.' -- source: https://it.slashdot.org/story/22/06/07/1942258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple Will Allow Linux VMs To Run Intel Apps With Rosetta In macOS Ventura
by Peter Reutemann 08 Jun '22

08 Jun '22

'Ars Technica: One of the few things that Intel Macs can do that Apple Silicon Macs can't is run operating systems written for Intel or AMD processors inside of virtual machines. Most notably, this has meant that there is currently no legal way to run Windows on an Apple Silicon Mac. Apple Silicon Macs can, however, run operating systems written for Arm processors inside of virtual machines, including other versions of macOS and Arm-compatible versions of Linux. And those Linux VMs are getting a new feature in macOS Ventura: the ability to run apps written for x86 processors using Rosetta, the same binary translation technology that allows Apple Silicon Macs to run apps written for Intel Macs. Apple's documentation will walk you through the requirements for using Rosetta within a Linux guest operating system -- it requires creating a shared directory that both macOS and Linux can access and running some terminal commands in Linux to get it set up. But once you do those steps, you'll be able to enjoy the wider app compatibility that comes with being able to run x86 code as well as Arm code. Some developers, including Hector Martin of the Asahi Linux project and Twitter user @never_released, have already found that these steps can also enable Rosetta on non-Apple ARM CPUs as long as they're modern enough to support at least version 8.2 of the Arm instruction set. As Martin points out, this isn't strictly legal because of macOS's licensing restrictions, and there are some relatively minor Apple-specific hardware features needed to unlock Rosetta's full capabilities.' -- source: https://apple.slashdot.org/story/22/06/07/208222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HTTP/3 Is Officially An IETF Spec
by Lawrence D'Oliveiro 07 Jun '22

07 Jun '22

QUIC is now officially HTTP/3, as described in RFC 9114 <https://www.theregister.com/2022/06/07/http3_rfc_9114_published/>. Not everybody is keen on it: there still seem to be some concerns over privacy, as well as over the claimed performance boost. Actually, a previous spec (RFC9000) had “Proposed Standard” status over a year ago, but it wasn’t (officially) being referred to as “HTTP/3” back then.

1 0