January 2023 - wlug - list.wlug.org.nz

Linux Preparing To Disable Drivers For Microsoft's RNDIS Protocol
by Peter Reutemann 16 Jan '23

16 Jan '23

'Phoronix reports: With the next Linux kernel cycle we could see upstream disable their driver support for Microsoft's Remote Network Driver Interface Specification (RNDIS) protocol due to security concerns. RNDIS is the proprietary protocol used atop USB for virtual Ethernet functionality. The support for RNDIS outside of Microsoft Windows has been mixed. RNDIS isn't widely used today in cross-platform environments and due to security concerns the upstream Linux kernel is looking to move the RNDIS kernel drivers behind the "BROKEN" Kconfig option so they effectively become disabled in future kernel builds. Ultimately once marked as "BROKEN" for a while, the drivers will likely be eventually removed from the upstream source tree. Greg Kroah-Hartman wrote in a commit: "The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on any system that uses it with untrusted hosts or devices. Because the protocol is impossible to make secure, just disable all rndis drivers to prevent anyone from using them again."' -- source: https://linux.slashdot.org/story/23/01/15/0220203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint "Uma and Vera"idle problem..
by John 15 Jan '23

15 Jan '23

Hi Folks, My installation of Linux mint Vera 21.1 has a very annoying habit of going into "idle" mode after 10 minutes. Makes watching a movie or listening to music a less than enjoyable task. I have on past installations of Mint sought answers, including running a couple of lengthy bash scripts I found in the forums to no avail. AFAIK my screensaver and power management setting are OK. the problem seems widespread through all the applications I have tried so far Rythmbox Celluloid VLC and Netflix Any help will be appreciated.. Cheers John..

2 10

Native Americans Ask Apache Foundation To Change Name
by Peter Reutemann 12 Jan '23

12 Jan '23

'Natives in Tech, a US-based non-profit organization, has called upon the Apache Software Foundation (ASF) to change its name, out of respect for indigenous American peoples and to live up to its own code of conduct. The Register reports: In a blog post, Natives in Tech members Adam Recvlohe, Holly Grimm, and Desiree Kane have accused the ASF of appropriating Indigenous culture for branding purposes. Citing ASF founding member Brian Behlendorf's description in the documentary "Trillions and Trillions Served" of how he wanted something more romantic than a tech term like "spider" and came up with "Apache" after seeing a documentary about Geronimo, the group said: "This frankly outdated spaghetti-Western 'romantic' presentation of a living and vibrant community as dead and gone in order to build a technology company 'for the greater good' is as ignorant as it is offensive." And the aggrieved trio challenged the ASF to make good on its code of conduct commitment to "be careful in the words that [they] choose" by choosing a new name. The group took issue with what they said was the suggestion that the Apache tribe exists only in a past historical context, citing eight federally recognized Native American tribes that bear the name. In a statement emailed to The Register, an ASF spokesperson said, "We hear the concerns from the Native American people and are listening. As a non-profit run by volunteers, changes will need time to be carefully weighed with members, the board, and our legal team. Our members are exploring alternative ways to address it, but we don't have anything to share at this time."' -- source: https://apache.slashdot.org/story/23/01/11/2159256 Changing all the URLs, library names etc (and how that affects everyone downstream) sounds like a massive undertaking... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers discover that vulnerabilities are rife in the auto industry
by Peter Reutemann 12 Jan '23

12 Jan '23

'If you purchased a new car in the past few years, chances are good that it contains at least one embedded modem, which it uses to offer some connected services. The benefits, we've been told, are numerous and include convenience features like interior preheating on a cold morning, diagnostics that warn of failures before they happen, and safety features like teen driver monitoring. In some regions, connected cars are even mandatory, as in the European Union's eCall system. But if these systems sound like a potential security nightmare, that's because they often are. Ars has been covering car hacks for more than a decade now, but the problem really cemented itself in the public consciousness in 2015 with the infamous Jeep hacking incident, when a pair of researchers proved they could remotely disable a Jeep Cherokee while it was being driven, via an exploit in the SUV's infotainment system. Since then, security flaws have been found in some cars' Wi-Fi networks, NFC keys and Bluetooth, and in third-party telematics systems. Toward the end of 2022, a researcher named Sam Curry tested the security of various automakers and telematics systems and discovered security holes and vulnerabilities seemingly wherever he looked. Curry decided to explore the potential holes in the auto industry's digital infrastructure when he was visiting the University of Maryland last fall after playing around with an electric scooter's app and discovering that he could turn on the horns and headlights across the entire fleet. After reporting the vulnerability to the scooter company, Curry and his colleagues turned their attention to larger vehicles. [...] The researchers found extensive problems with 16 OEMs, telematics services like LoJack, new digital license plates, and even Sirius XM radio.' -- source: https://arstechnica.com/cars/2023/01/hackers-discover-that-vulnerabilities-… -- blog: https://samcurry.net/web-hackers-vs-the-auto-industry/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Messenger billed as better than Signal is riddled with vulnerabilities
by Peter Reutemann 11 Jan '23

11 Jan '23

'Academic researchers have discovered serious vulnerabilities in the core of Threema, an instant messenger that its Switzerland-based developer says provides a level of security and privacy “no other chat service” can offer. Despite the unusually strong claims and two independent security audits Threema has received, the researchers said the flaws completely undermine assurances of confidentiality and authentication that are the cornerstone of any program sold as providing end-to-end encryption, typically abbreviated as E2EE. Threema has more than 10 million users, which include the Swiss government, the Swiss army, German Chancellor Olaf Scholz, and other politicians in that country. Threema developers advertise it as a more secure alternative to Meta’s WhatsApp messenger. It’s among the top Android apps for a fee-based category in Switzerland, Germany, Austria, Canada, and Australia. The app uses a custom-designed encryption protocol in contravention of established cryptographic norms. Researchers from the Zurich-based ETH research university reported on Monday that they found seven vulnerabilities in Threema that seriously call into question the true level of security the app has offered over the years. Two of the vulnerabilities require no special access to a Threema server or app to cryptographically impersonate a user. Three vulnerabilities require an attacker to gain access to a Threema server. The remaining two can be exploited when an attacker gains access to an unlocked phone, such as at a border crossing.' -- source: https://arstechnica.com/information-technology/2023/01/messenger-billed-as-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fairphone 2 Will Hit End-of-Life After 7 Years of Updates
by Peter Reutemann 11 Jan '23

11 Jan '23

'Ars Technica: It can be done. Android manufacturers can actually support a phone for a sizable amount of time. Fairphone has announced the end of life for the Fairphone 2, which will be March 2023. That phone was released in October 2015, so that's almost seven-and-a-half years of updates. Fairphone is a very small Dutch company with nowhere near as many resources as Google, Samsung, BBK, and the other Big-Tech juggernauts, yet it managed to outlast them with its support program. The whole goal of the company is sustainability, with easily repairable phones, available spare parts, and long update promises. The Fairphone 4 has a five-year hardware warranty and six years of updates, and the company's reputation says it can provide that. Sadly, the phones only ship in the UK and Europe. The Fairphone 2 only promised "three to five years" of updates, and it blew that out of the water. The Fairphone 2 features the Qualcomm Snapdragon 801 SoC, a chip that Qualcomm ended support for with Android 6.0. In what is probably an Android ecosystem first, that lack of chipset support didn't stop Fairphone, which teamed up with LineageOS and today ships Android 10 on the 7-year-old device. That's not the newest OS in the world, but it passes all of Google's Android compatibility tests. I'm sure there are newer amateur releases in the Android ROM community, but Fairphone's Android 10 build is up to the standard of an official release, as opposed to the "tell me what doesn't work" standard of many amateur ROM releases. Fairphone doesn't say why support is ending in March, but if it's staying on Android 10, it was going to have to kill support sometime this year. Google only supports security patches for the last four versions of Android, so even Google will be shutting down Android 10 support soon.' -- source: https://mobile.slashdot.org/story/23/01/10/2148222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ChatGPT is enabling script kiddies to write functional malware
by Peter Reutemann 10 Jan '23

10 Jan '23

'Since its beta launch in November, AI chatbot ChatGPT has been used for a wide range of tasks, including writing poetry, technical papers, novels, and essays and planning parties and learning about new topics. Now we can add malware development and the pursuit of other types of cybercrime to the list. Researchers at security firm Check Point Research reported Friday that within a few weeks of ChatGPT going live, participants in cybercrime forums—some with little or no coding experience—were using it to write software and emails that could be used for espionage, ransomware, malicious spam, and other malicious tasks. “It’s still too early to decide whether or not ChatGPT capabilities will become the new favorite tool for participants in the Dark Web,” company researchers wrote. “However, the cybercriminal community has already shown significant interest and are jumping into this latest trend to generate malicious code.” Last month, one forum participant posted what they claimed was the first script they had written and credited the AI chatbot with providing a “nice [helping] hand to finish the script with a nice scope.” The Python code combined various cryptographic functions, including code signing, encryption, and decryption. One part of the script generated a key using elliptic curve cryptography and the curve ed25519 for signing files. Another part used a hard-coded password to encrypt system files using the Blowfish and Twofish algorithms. A third used RSA keys and digital signatures, message signing, and the blake2 hash function to compare various files. The result was a script that could be used to (1) decrypt a single file and append a message authentication code (MAC) to the end of the file and (2) encrypt a hardcoded path and decrypt a list of files that it receives as an argument. Not bad for someone with limited technical skill.' -- source: https://arstechnica.com/information-technology/2023/01/chatgpt-is-enabling-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

New Linux Malware Downloader for Compromised Servers Spotted in the Wild
by Peter Reutemann 10 Jan '23

10 Jan '23

'"A new Linux malware downloader created using SHC (Shell Script Compiler) has been spotted in the wild," reports the site Bleeping Computer, "infecting systems with Monero cryptocurrency miners and DDoS IRC bots... "The analysts say the attacks likely rely on brute-forcing weak administrator account credentials over SSH on Linux servers.... " According to ASEC researchers, who discovered the attack, the SHC loader was uploaded to VirusTotal by Korean users, with attacks generally focused on Linux systems in the same country.... When the SHC malware downloader is executed, it will fetch multiple other malware payloads and install them on the device. One of the payloads is an XMRig miner that is downloaded as a TAR archive from a remote URL and extracted to "/usr/local/games/" and executed.... The second payload retrieved, dropped, and loaded by the SHC malware downloader is a Perl-based DDoS IRC bot. The malware connects to the designated IRC server using configuration data and goes through a username-based verification process. If successful, the malware awaits commands from the IRC server, including DDoS-related actions such as TCP Flood, UDP Flood, and HTTP Flood, port scanning, Nmap scanning, sendmail commands, process killing, log cleaning, and more. ASEC warns that attacks like these are typically caused by using weak passwords on exposed Linux servers. ' -- source: https://linux.slashdot.org/story/23/01/07/0427247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Launches Higher Resolution Camera Module, Now With Autofocus
by Peter Reutemann 10 Jan '23

10 Jan '23

'Raspberry Pi is launching a new camera module for use with its diminutive DIY computers -- the Camera Module 3. Its upgraded Sony IMX708 sensor is higher resolution, but perhaps more important is that the new module supports high dynamic range photography and autofocus. Alongside it, Raspberry Pi is also releasing a new camera board for use with M12-mount lenses. From a report: Combined, the new features mean the Camera Module 3 should be able to take more detailed photographs (especially in low light), and can focus on objects as little as 5cm away. The autofocus uses a Phase Detection Autofocus (PDAF) system, with Contrast Detection Autofocus used as a backup. In contrast, previous versions of the camera module had fixed-focus lenses, which Raspberry Pi CEO Eben Upton writes were "optimized to focus at infinity" and could only take a "reasonably sharp image" of objects around a meter away. The new module's sensor has a resolution of 11.9 megapixels (compared to 8.1 megapixels for the last version), and has a higher horizontal resolution that should allow it to film HD video. HDR support means the Camera Module 3 can take several exposures of the same scene, and combine them so that both darker and lighter parts of an image are properly exposed (at the expense of some resolution) -- a trick commonly performed by just about every smartphone. Prices start at $25 for the Camera Module 3 with a standard field-of-view, while the ultra-wide angle version with a 102-degree field of view is $35.' -- source: https://tech.slashdot.org/story/23/01/09/1647247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google wants RISC-V to be a “tier-1” Android architecture
by Peter Reutemann 04 Jan '23

04 Jan '23

'Over the holiday break, the footage from the recent "RISC-V Summit" was posted for the world to see, and would you believe that Google showed up to profess its love for the up-and-coming CPU architecture? We've been trying to nail down how the Android team feels about RISC-V (reduced instruction set computer) for a while. We last heard a comment from the team six months ago, where our Google I/O question about RISC-V was answered only with "we're watching, but it would be a big change for us." Some external RISC-V porting projects exist, and various RISC-V commits have been landing in the Android Open Source Project (AOSP), but since anyone can submit code to AOSP, it has been hard to make any bold proclamations about RISC-V's Android status. Google's keynote at the RISC-V Summit was all about bold proclamations, though. Lars Bergstrom, Android's director of engineering, wants RISC-V to be seen as a "tier-1 platform" in Android, which would put it on par with Arm. That's a big change from just six months ago. Bergstrom says getting optimized Android builds on RISC-V will take "a lot of work" and outlined a roadmap that will take "a few years" to come to fruition, but AOSP started to land official RISC-V patches back in September. The build system is up and running, and anyone can grab the latest "riscv64" branch whenever they want—and yes, in line with its recent Arm work, Google wants RISC-V on Android to be 64-bit only. For now, the most you can get is a command line, and Bergstrom's slide promised "initial emulator support by the start of 2023, with Android RunTime (ART) support for Java workloads following during Q1."' -- source: https://arstechnica.com/gadgets/2023/01/google-announces-official-android-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0