July 2023 - wlug - list.wlug.org.nz

Firmware vulnerabilities in millions of computers could give hackers superuser status
by Peter Reutemann 21 Jul '23

21 Jul '23

'Two years ago, ransomware crooks breached hardware-maker Gigabyte and dumped more than 112 gigabytes of data that included information from some of its most important supply-chain partners, including Intel and AMD. Now researchers are warning that the leaked information revealed what could amount to critical zero-day vulnerabilities that could imperil huge swaths of the computing world. The vulnerabilities reside inside firmware that Duluth, Georgia-based AMI makes for BMCs (baseboard management controllers). These tiny computers soldered into the motherboard of servers allow cloud centers, and sometimes their customers, to streamline the remote management of vast fleets of computers. They enable administrators to remotely reinstall OSes, install and uninstall apps, and control just about every other aspect of the system—even when it's turned off. BMCs provide what’s known in the industry as “lights-out” system management. Lights-out forever Researchers from security firm Eclypsium analyzed AMI firmware leaked in the 2021 ransomware attack and identified vulnerabilities that had lurked for years. They can be exploited by any local or remote attacker with access to an industry-standard remote-management interface known as Redfish to execute malicious code that will run on every server inside a data center. Until the vulnerabilities are patched using an update AMI published on Thursday, they provide a means for malicious hackers—both financially motivated or nation-state sponsored—to gain superuser status inside some of the most sensitive cloud environments in the world. From there, the attackers could install ransomware and espionage malware that runs at some of the lowest levels inside infected machines. Successful attackers could also cause physical damage to servers or indefinite reboot loops that a victim organization can’t interrupt. Eclypsium warned such events could lead to “lights out forever” scenarios.' -- source: https://arstechnica.com/security/2023/07/millions-of-servers-inside-data-ce… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kevin Mitnick, Hacker Who Once Eluded Authorities, is Dead at 59
by Peter Reutemann 21 Jul '23

21 Jul '23

'Kevin Mitnick, once the so-called "most wanted computer criminal in US history," died on Sunday. He was 59. The New York Times adds: The cause was complications from pancreatic cancer. He had been undergoing treatment at the University of Pittsburgh Medical Center following his diagnosis more than a year ago, according to the King David Memorial Chapel & Cemetery in Las Vegas. After serving prison time for breaking into and tampering with corporate computer networks, he was released in 2000 and began a new career as a security consultant, writer and public speaker. Mr. Mitnick was best known for the crime spree during the 1990s that involved the theft of thousands of data files and credit card numbers from computers across the country. He used his skills to work his way into the nation's phone and cell networks, vandalizing government, corporate and university computer systems. Investigators at the time named him the "most wanted" computer hacker in the world. In 1995, after a more than two-year-long manhunt, Mr. Mitnick was captured by the F.B.I. and charged with the illegal use of a telephone access device and computer fraud. "He allegedly had access to corporate trade secrets worth millions of dollars. He was a very big threat," Kent Walker, a former assistant U.S. attorney in San Francisco, said at the time. In 1998, while Mr. Mitnick awaited sentencing, a group of supporters commandeered The New York Times website for several hours, forcing it to shut down. The next year, Mr. Mitnick pleaded guilty to computer and wire fraud as part of an agreement with prosecutors and was sentenced to 46 months in prison. He was also prohibited from using a computer or cellphone without the permission of his probation officer for the three years following his release. >From an obituary: Kevin was an original; much of his life reads like a fiction story. The word that most of us who knew him would use -- magnificent. He grew up brilliant and restless in the San Fernando Valley in California, an only child with a penchant for mischief, a defiant attitude toward authority, and a love for magic. Kevin's intelligence and delight in holding the rapt attention of audiences revealed themselves early in his childhood and continued throughout his life. In time, he transitioned from pranks and learning magic tricks to phone phreaking, social engineering, and computer hacking. When his desire to push boundaries led him too far astray, he landed in juvenile detention and eventually served a couple of stints in prison. His time on the FBI's Most Wanted List was well documented in his New York Times bestselling book, The Ghost in the Wires: My Adventures as the World's Most Wanted Hacker, and his other titles: The Art of Deception, The Art of Intrusion, both co-authored with William Simon, and The Art of Invisibility with Robert Vamosi. Kevin emerged from his final prison term, which he deemed a 'vacation,' in January 2000. He was a changed individual, and began constructing a new career, as a White Hat hacker and security consultant. He became a highly sought-after global public speaker, a writer, and established the successful Mitnick Security Consulting. In November 2011, he became the Chief Hacking Officer and part owner of security awareness training company KnowBe4, founded by close friend and business partner Stu Sjouwerman.' -- source: https://news.slashdot.org/story/23/07/20/031216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fear, loathing, and excitement as Threads adopts open standard used by Mastodon
by Peter Reutemann 20 Jul '23

20 Jul '23

'Days after Meta launched its new app, Threads, this month, a software engineer at the company named Ben Savage introduced himself to a developer group at the World Wide Web Consortium, a web standards body. The group, which maintains a protocol for connecting social networks called ActivityPub, had been preparing for this moment for months, ever since rumors first emerged that Meta planned to join the standard. Now, that moment had arrived. “I'm really interested to see how this interoperable future plays out!” he wrote. Warm replies to Savage’s email filtered in. And then came another response: “The company you work for does disgusting things among others. It harms relationships and isolates people. It builds walls and lures people into them. When that doesn't suffice, brutal peer pressure does … That said, welcome to the list, Ben.” Meta’s embrace of ActivityPub, used by apps including the Twitter-like Mastodon, was bound to be a little awkward. The constellation of small apps and personal servers that currently use the protocol, known as the Fediverse, is marked by an ethos of sharing and openness, not profit-seeking or user bases denominated in the billions. ActivityPub is designed to allow users of different apps to not only interact and view each others’ content, but also move their digital identity from one service to another. Mastodon, the largest app in the Fediverse, is open source and run by a nonprofit, and smaller Fediverse apps like PeerTube and Lemmy are often held up as a repudiation of the closed nature of services such as YouTube or Reddit. Corporations like Meta are typically held up as the enemy. No surprise that, despite appeals from ActivityPub leaders for civility when Meta arrived on the listserv, some couldn’t hold their tongue. Weeks-old Threads already dwarfs the Fediverse, which has been around for more than a decade and recently peaked at about 4 million active monthly users. Some Fediverse fans see that imbalance as a win: Suddenly, the network could become many times more relevant. Others consider that view naive and expect Meta’s size to push the small world of apps built on ActivityPub in undesirable directions. Some have circulated a pact to preemptively block content from Threads’ servers from appearing on their own.' -- source: https://arstechnica.com/tech-policy/2023/07/fear-loathing-and-excitement-as… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Emails meant for US Military Recipients Have Been Going To Mali
by Lawrence D'Oliveiro 18 Jul '23

18 Jul '23

Seems like, for the last decade, way too many emails meant for .mil addresses have been going to .ml instead <https://www.theregister.com/2023/07/18/us_military_mali_email_typos/>. The guy who runs the .ml DNS registry for the Mali Government has been trying to notify the offenders about their mistakes, with limited success. It seems to me an obvious solution is to stop using that top-level .mil, and change it to something like .mil.us instead.

1 0

Decentralized Operating System - GRIDNET OS
by john 18 Jul '23

18 Jul '23

This post just arrived at a forum I use, It seems a bit above my pay level. https://www.cybertechhelp.com/showthread.php?p=1312176#post1312176 Cheers John..

1 0

Is Wayland Becoming the Favored Way to Get a GUI on Linux?
by Peter Reutemann 18 Jul '23

18 Jul '23

'The Register shares its collection of "signs that Wayland is becoming the favored way to get a GUI on Linux." - The team developing Linux for Apple Silicon Macs said they didn't have the manpower to work on X.org support. - A year ago, the developers of the Gtk toolkit used by many Linux apps and desktops said that the next version may drop support for X11... - One of the developers of the Budgie desktop, Campbell Jones, recently published a blog post with a wildly controversial title that made The Reg FOSS desk smile: "Wayland is pretty good, actually." He lays out various benefits that Wayland brings to developers, and concludes: "Primarily, what I've learned is that Wayland is actually really well-designed. The writing is on the wall for X, and Wayland really is the future." Partly as a result of this, it looks likely that the next version of the Budgie desktop, Budgie 11, will only support Wayland, completely dropping support for X11. The team point out that this is not such a radical proposition: there was a proposal to make KDE 6 sessions default to Wayland as long ago as last October... - The GNOME spin of Fedora has defaulted to Wayland since version 25 in 2017, and the GNOME flavor of Ubuntu since 21.04. - [T]here's now an experimental effort to get Wayland working on OpenBSD. The effort happened at the recent OpenBSD hackathon in Tallinn, Estonia, and the developer's comments are encouraging. It's already available as part of FreeBSD.' -- source: https://linux.slashdot.org/story/23/07/17/0159246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress plugin installed on 1 million+ sites logged plaintext passwords
by Peter Reutemann 17 Jul '23

17 Jul '23

'All-In-One Security, a WordPress security plugin installed on more than 1 million websites, has issued a security update after being caught three weeks ago logging plaintext passwords and storing them in a database accessible to website admins. The passwords were logged when users of a site using the plugin, typically abbreviated as AIOS, logged in, the developer of AIOS said Thursday. The developer said the logging was the result of a bug introduced in May in version 5.1.9. Version 5.2.0 released Thursday fixes the bug and also “deletes the problematic data from the database.” The database was available to people with administrative access to the website.' -- source: https://arstechnica.com/security/2023/07/wordpress-plugin-installed-on-1-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AlmaLinux No Longer Aims For 1:1 Compatibility With RHEL
by Peter Reutemann 17 Jul '23

17 Jul '23

'Phoronix: With Red Hat now restricting access to the RHEL source repositories, AlmaLinux and other downstreams that have long provided "community" rebuilds of Red Hat Enterprise Linux with 1:1 compatibility to upstream RHEL have been left sorting out what to do. Benny Vasquez, Chair of the Board for the AlmaLinux OS Foundation, wrote in a blog post yesterday: After much discussion, the AlmaLinux OS Foundation board today has decided to drop the aim to be 1:1 with RHEL. AlmaLinux OS will instead aim to be Application Binary Interface (ABI) compatible*. We will continue to aim to produce an enterprise-grade, long-term distribution of Linux that is aligned and ABI compatible with RHEL in response to our community's needs, to the extent it is possible to do, and such that software that runs on RHEL will run the same on AlmaLinux. For a typical user, this will mean very little change in your use of AlmaLinux. Red Hat-compatible applications will still be able to run on AlmaLinux OS, and your installs of AlmaLinux will continue to receive timely security updates. The most remarkable potential impact of the change is that we will no longer be held to the line of "bug-for-bug compatibility" with Red Hat, and that means that we can now accept bug fixes outside of Red Hat's release cycle. While that means some AlmaLinux OS users may encounter bugs that are not in Red Hat, we may also accept patches for bugs that have not yet been accepted upstream, or shipped downstream." ' -- source: https://linux.slashdot.org/story/23/07/14/215209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Open Becomes Opaque: the Changing Face of Open-Source Hardware Companies
by Peter Reutemann 17 Jul '23

17 Jul '23

'A thoughtful post on the Adafruit Blog chronicles the problems facing open-source hardware companies, and how more and more companies, including Sparkfun, Arduino and Prusa, are becoming more and more proprietary. In Arduino's case, they are deliberately trying to stamp out the clones undercutting them. The new Arduino Pro is not open source in any way, and the web site has now removed references to being an open source company. As always there are subtleties and nuances. In the case of Prusa, not only are Chinese companies taking Prusa designs and source to make proprietary, closed-source products, they are also actively patenting designs and algorithms they've taken from open source. The original submission ends with a question. "With Red Hat recently taking a step towards becoming a proprietary software company (which happens to use and work on open source projects) and now these reports, what are Slashdotters' thoughts on the future? "Are truly open source companies doomed to failure, especially when overseas companies do not respect or even understand the principles of open source development?"' -- source: https://news.slashdot.org/story/23/07/15/1853247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Speed Versus Bandwidth
by Lawrence D'Oliveiro 16 Jul '23

16 Jul '23

Love the (original) opening sentence of this article <https://arstechnica.com/gadgets/2023/07/light-based-lifi-promises-amazing-w…>: Light is almost certainly the fastest thing around. So it makes sense that "light-based wireless communications," or LiFi, could blow the theoretical doors off existing radio-wave wireless standards, to the tune of a maximum 224GB per second. A correction/clarification immediately follows, but it’s clear the writer didn’t quite grasp that both visible light and radio waves are propagated by exactly the same particles--photons--travelling at exactly the same speed. What is true is that, as the frequency of the photons increases, so does their information-carrying capacity. This is why we have digital broadcasts (TV particularly), mobile phone/data services and our own wi-fi networks all moving to higher and higher frequencies. The downside is, as the frequency of a photon increases, so does its energy. And so it tends to react more and more with (i.e. be absorbed by) various bits of matter that it might encounter--such as the walls of buildings, or even the air itself. This tends to limit the useful range of these communication bands.

1 0