- wlug - list.wlug.org.nz

New OpenSSH Version On Debian Unstable
by Lawrence D'Oliveiro 24 Apr '22

24 Apr '22

Did my periodic OS upgrade today, and one change that has had an (easy to fix) impact on my backup system is that OpenSSH 9.0 is phasing out the special protocol that was used to implement the scp command, in favour of using the same one as for sftp. One difference this makes is with file specs that contain shell-special characters (e.g. spaces). Previously, when specifying such to the scp command in the shell, you had to do two levels of escaping, one to get them past the local shell, and another to work with the remote shell. But now, the second level of escaping for the remote end is no longer needed. The release notes describe this second level of quoting as “finicky and brittle”, so all in all things are simpler without it.

1 1

Major cryptography blunder in Java enables “psychic paper” forgeries
by Peter Reutemann 22 Apr '22

22 Apr '22

'Organizations using newer versions of Oracle’s Java framework woke up on Wednesday to a disquieting advisory: A critical vulnerability can make it easy for adversaries to forge TLS certificates and signatures, two-factor authentication messages, and authorization credentials generated by a range of widely used open standards. The vulnerability, which Oracle patched on Tuesday, affects the company’s implementation of the Elliptic Curve Digital Signature Algorithm in Java versions 15 and above. ECDSA is an algorithm that uses the principles of elliptic curve cryptography to authenticate messages digitally. A key advantage of ECDSA is the smaller size of the keys it generates, compared to RSA or other crypto algorithms, making it ideal for use in standards including FIDO-based 2FA, the Security Assertion Markup Language, OpenID, and JSON.' -- source: https://arstechnica.com/information-technology/2022/04/major-crypto-blunder… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical bug could have let hackers commandeer millions of Android devices
by Peter Reutemann 22 Apr '22

22 Apr '22

'Security researchers said they uncovered a vulnerability that could have allowed hackers to commandeer millions of Android devices equipped with mobile chipsets made by Qualcomm and MediaTek. The vulnerability resided in ALAC—short for Apple Lossless Audio Codec and also known as Apple Lossless—which is an audio format introduced by Apple in 2004 to deliver lossless audio over the Internet. While Apple has updated its proprietary version of the decoder to fix security vulnerabilities over the years, an open-source version used by Qualcomm and MediaTek had not been updated since 2011. Together, Qualcomm and MediaTek supply mobile chipsets for an estimated 95 percent of US Android devices.' The buggy ALAC code contained an out-of-bounds vulnerability, meaning it retrieved data from outside the limits of allocated memory. Hackers could exploit this mistake to force the decoder to execute malicious code that otherwise would be off-limits. “The ALAC issues our researchers found could be used by an attacker for remote code execution attack (RCE) on a mobile device through a malformed audio file,” security firm Check Point said on Thursday. “RCE attacks allow an attacker to remotely execute malicious code on a computer. The impact of an RCE vulnerability can range from malware execution to an attacker gaining control over a user’s multimedia data, including streaming from a compromised machine’s camera.” -- source: https://arstechnica.com/information-technology/2022/04/critical-bug-could-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Now Hopes To IPO in 2023
by Peter Reutemann 22 Apr '22

22 Apr '22

'The saga of Ubuntu-maker Canonical's IPO efforts now stretches back quite a few years. I think the first time I talked to the company's founder Mark Shuttleworth about going public was in 2018, though there had already been some chatter about it in previous years. But the timing never quite worked out for Canonical. In a press briefing ahead of today's launch of Ubuntu 22.04 LTS, Shuttleworth noted he now expects it to go public next year. "We are on track to float the business. And now I'm pretty confident that we will do that in 2023," said Shuttleworth, who was calling in from an undisclosed island off the coast of West Africa. "And so we're taking active steps at the board level and in our finance operation -- various other parts of the business -- to be prepared for that. We're now effectively on a very clear program to a flotation of the business next year." He stressed that Canonical is not in a situation where it has to raise outside money and that going public for him is not about fundraising. He noted that Canonical's revenue last year was $175 million and that the company's biggest challenge right now is that demand is bigger that the company's ability to service it, in large part because there isn't enough talent on the market for the company to hire.' -- source: https://news.slashdot.org/story/22/04/21/1333228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Volla Phone 22 Runs Ubuntu Touch Or a Privacy-Focused Android Fork Or Both
by Peter Reutemann 20 Apr '22

20 Apr '22

'The Volla Phone 22, a new smartphone available for preorder via a Kickstarter campaign, is unlike any other smartphone on the market today in that it ships with a choice of the Android-based Volla OS or the Ubuntu Touch mobile Linux distribution. "It also supports multi-boot functionality, allowing you to install more than one operating system and choose which to run at startup," writes Liliputing's Brad Linder. Some of the hardware specs include a 6.3-inch FHD+ display, a MediaTek Helio G85 processor, 4GB of RAM, 128GB storage, 3.5mm audio jack and a microSD card reader. There's also a 48-megapixel main camera sensor and replaceable 4,500mAh battery. From the report: While Volla works with the folks at UBPorts to ensure its phones are compatible with Ubuntu Touch, the company develops the Android-based Volla OS in-house. It's based on Google's Android Open Source Project code, but includes a custom launcher, user interface, and set of apps with an emphasis on privacy. The Google Play Store is not included, as this is a phone aimed at folks who want to minimize tracking from big tech companies. Other Google apps and services like the Chrome web browser, Google Maps, Google Drive, and Gmail are also omitted. The upshot is that no user data is collected or stored by Volla, Google, or other companies unless you decide to install apps that track your data. Of course, that could make using the phone a little less convenient if you've come to rely on those apps, so the Volla Phone might not be the best choice for everyone. Volla OS also has a built-in user-customizable firewall, an App Locker feature for disabling and hiding apps, and optional support for using the Hide.me VPN for anonymous internet usage. The source code for Volla OS is also available for anyone that wants to inspect the code. The operating system also has a custom user interface including a Springboard that allows you to quickly launch frequently-used apps by pressing a red dot for a list, or by starting to type in a search box for automatic suggestions such as placing a phone call, sending a text message, or opening a web page. You can also create notes or calendar events from the Springboard or send an encrypted message with Signal. The phone is expected to ship in June at an early bird price of about $408.' -- source: https://news.slashdot.org/story/22/04/19/2131242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers can infect >100 Lenovo models with unremovable malware. Are you patched?
by Peter Reutemann 20 Apr '22

20 Apr '22

'Lenovo has released security updates for more than 100 laptop models to fix critical vulnerabilities that make it possible for advanced hackers to surreptitiously install malicious firmware that can be next to impossible to remove or, in some cases, to detect. Three vulnerabilities affecting more than 1 million laptops can give hackers the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, the UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the initial link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and even harder to remove. Two of the vulnerabilities—tracked as CVE-2021-3971 and CVE-2021-3972—reside in UEFI firmware drivers intended for use only during the manufacturing process of Lenovo consumer notebooks. Lenovo engineers inadvertently included the drivers in the production BIOS images without being properly deactivated. Hackers can exploit these buggy drivers to disable protections, including UEFI secure boot, BIOS control register bits, and protected range register, which are baked into the serial peripheral interface (SPI) and designed to prevent unauthorized changes to the firmware it runs.' -- source: https://arstechnica.com/information-technology/2022/04/bugs-in-100-lenovo-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Tuesday (!)
by Peter Reutemann 20 Apr '22

20 Apr '22

Hi everyone We have a meeting next week on Tuesday, due to ANZAC day on Monday. Since we are back under Orange traffic light, we will attempt a hybrid meeting. Whilst the physical meeting will take place in MS4, everything will be transmitted via BigBlueButton. That way you won't miss out n case you can't or don't want to attend in person. Our topic: With increasing cyber security threats, it is high time that we look at how you can bolster the security of your Linux system and how you connect to the outside world. For this purpose, we will have short show and tells lined up: Roger will demo the pfSense firewall and router system based on FreeBSD, complete with a web-based user interface. A far simpler firewall, ufw (uncomplicated firewall), will be introduced by Peter (command-line and GUI). Angus will demo Wireguard, the VPN solutation that made it into the Linux kernel (starting with 5.6). Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776633/ If you want to demo something as well, then please contact me. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Details How China-Linked Crew’s Malware Hides Scheduled Windows Tasks
by Lawrence D'Oliveiro 18 Apr '22

18 Apr '22

Seems every week there is something new to learn about the (in)security of Microsoft Windows. In this description <https://www.theregister.com/2022/04/14/microsoft-tarrask-malware-in-windows/> of a malware attack, the software infection creates a scheduled task to automatically reinstall itself if it has been removed. So far, no big deal: on *nix we have cron, and systemd timers, that do much the same thing. But on Windows, these scheduled tasks have “security descriptors” -- basically, ACLs, as far as I have been able to determine, that control who can manage these tasks or even see them. So if a program creates a task and deletes all its security descriptors, the task effectively becomes invisible to the normal Windows admin tools. Except, it can still be seen and managed through its Registry entries. So, having write access to the Registry lets you bypass the entire security-descriptor mechanism, yet it still does not let you see these tasks in any other way? Like the “security” those higher-level tools think they are enforcing is a complete mirage, and end up making the system, not more, but less, secure.

1 0

Git For Windows Issues Update To Fix Running-Someone-Else's-Code Vulnerability
by Peter Reutemann 14 Apr '22

14 Apr '22

'The Git team has issued an update to fix a bug in Git for Windows that "affects multi-user hardware where untrusted parties have write access to the same hard disk," reports The Register. Specifically, the update is concerned with CVE-2022-24765. From the report: Arguably, if an "untrusted party" has write access to a hard disk, then all bets are off when it comes to the nooks and crannies of a PC anyway. In this case, the miscreants would only need to create the folder c:\.git, "which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory," according to NIST. The result is that Git would use the config in the directory. NIST went on to list potentially vulnerable products, which included Visual Studio. "Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash." The Git team was little blunter about the vulnerability, and warned that "Merely having a Git-aware prompt that runs 'git status' (or 'git diff') and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user." [...] To deal with the issue, the Git team recommends an update. Alternatively, a user could create that .git folder themselves and remove read/write access as workaround or "define or extend 'GIT_CEILING_DIRECTORIES' to cover the parent directory of the user profile," according to NIST. ' -- source: https://it.slashdot.org/story/22/04/13/2140258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tim Cook Invokes Eisenhower
by Lawrence D'Oliveiro 13 Apr '22

13 Apr '22

Apple’s CEO gave a speech at a gathering of the International Association of Privacy Professionals <https://arstechnica.com/gadgets/2022/04/tim-cook-delivers-speech-railing-ag…>, where he claimed that Apple has “a commitment to protecting people from a data industrial complex built on a foundation of surveillance”. He particularly hates regulatory proposals to force Apple and other platform owners to allow sideloading of apps, claiming That means data-hungry companies would be able to avoid our privacy rules, and once again track our users against their will. In other words, we should trust companies like his to keep their word, and not fall back on Big Bad Government Regulation. If it weren’t for Governments, the world would end up run by corporations. Which would you prefer?

1 0