- wlug - list.wlug.org.nz

Password-stealing Linux malware served for 3 years and no one noticed
by Peter Reutemann 13 Sep '23

13 Sep '23

'A download site surreptitiously served Linux users malware that stole passwords and other sensitive information for more than three years until it finally went quiet, researchers said on Tuesday. The site, freedownloadmanager[.]org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored. After accessing an IP address for the malicious domain, the backdoor launched a reverse shell that allowed the attackers to remotely control the infected device. Researchers from Kaspersky, the security firm that discovered the malware, then ran the backdoor on a lab device to observe how it behaved. “This stealer collects data such as system information, browsing history, saved passwords, cryptocurrency wallet files, as well as credentials for cloud services (AWS, Google Cloud, Oracle Cloud Infrastructure, Azure),” the researchers wrote in a report on Tuesday. “After collecting information from the infected machine, the stealer downloads an uploader binary from the C2 server, saving it to /var/tmp/atd. It then uses this binary to upload stealer execution results to the attackers’ infrastructure.”' -- source: https://arstechnica.com/security/2023/09/password-stealing-linux-malware-se… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Multi-Account Containers
by Peter Reutemann 11 Sep '23

11 Sep '23

Hi everyone Just came across this Firefox plugin: The Firefox Multi-Account Containers extension lets you carve out a separate box for each of your online lives – no more opening a different browser just to check your work email! Under the hood, it separates website storage into tab-specific Containers. Cookies downloaded by one Container are not available to other Containers. You can even integrate individual Containers with Mozilla VPN to protect your browsing and location. With the Firefox Multi-Account Containers extension, you can... - Sign in to two different accounts on the same site (for example, you could sign in to work email and home email in two different Container tabs. - Keep different kinds of browsing far away from each other (for example, you might use one Container tab for managing your Checking Account and a different Container tab for searching for new songs by your favorite band) - Avoid leaving social-network footprints all over the web (for example, you could use a Container tab for signing in to a social network, and use a different tab for visiting online news sites, keeping your social identity separate from tracking scripts on news sites) - Protect your browsing activity in individual Containers using Mozilla VPN, so you can shop while travelling abroad but check your bank account from a server in your home country. -- source: https://discuss.systems/@ricci/111024736570863186 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Connected cars are a “privacy nightmare,” Mozilla Foundation says
by Peter Reutemann 07 Sep '23

07 Sep '23

'Today, the Mozilla Foundation published its analysis of how well automakers handle the privacy of data collected by their connected cars, and the results will be unlikely to surprise any regular reader of Ars Technica. The researchers were horrified by their findings, stating that "cars are the worst product category we have ever reviewed for privacy." Mozilla looked at 25 car brands and found that all of them collected too much personal data, and from multiple sources—monitoring not just which buttons you push or what you do in any of the infotainment system's apps but also data from other sources like satellite radio or third-party maps. Or even when you connect your phone—remember that prompt asking you if you wanted to share all your contacts and notes with your car when you connected it via Bluetooth? While some gathered data seems innocuous or even helpful—feedback to improve cabin ergonomics and UIs, for example—some data is decidedly not. For example, Nissan's privacy policy says it can collect "sensitive personal information, including driver’s license number, national or state identification number, citizenship status, immigration status, race, national origin, religious or philosophical beliefs, sexual orientation, sexual activity, precise geolocation, health diagnosis data, and genetic information," although it's unlikely your car knows whether you're getting busy in the back seat. While this might be technically possible with a car fitted with a camera-based driver-monitoring system, Nissan's privacy policy notes the data source for the quoted paragraph as "direct contact with users and Nissan employees." (Although more sophisticated driver-monitoring systems that claim to detect emotional states have been demonstrated at shows like CES, we're unaware of any that are in production.) Mozilla found plenty more to worry about. Eighty-four percent of the brands they analyzed said they can share your data, and 76 percent said they can sell it. And more than half say they'll share data with the government and law enforcement by request. Users have very little control over what those brands do with their data. Only two of the 25 brands (Renault and Dacia) tell users they have the right to have their data deleted, and neither sell cars in the United States.' -- source: https://arstechnica.com/cars/2023/09/connected-cars-are-a-privacy-nightmare… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ArcaOS 5.1.0 (OEM OS/2 Warp Operating System) Now Available
by Peter Reutemann 04 Sep '23

04 Sep '23

'ArcaOS 5.1.0 is an OEM distribution of IBM's discontinued OS/2 Warp operating system. This new version of ArcaOS offers UEFI compatibility allowing it to run in modern x86 hardware and also includes the ability to install to GPT-based disk layouts. At OS2World the OS/2 community has been called upon to report supported hardware, open source any OS/2 software, make public as much OS/2 documentation as possible and post the important platform links. OS2World insists that open source has helped OS/2 in the past years and it is time to look under the hood to try to clone internal components like Control Program, Presentation Manager, SOM and Workplace Shell.' -- source: https://tech.slashdot.org/story/23/09/02/1912223 The one and only time I came across OS/2 was in the late 90s (at a bank)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ReiserFS is now “obsolete” in the Linux kernel and should be gone by 2025
by Peter Reutemann 01 Sep '23

01 Sep '23

'When Apple was about to introduce Time Machine in Mac OS X Leopard, John Siracusa wrote in the summer of 2006 about how a new file system should be coming to Macs (which it did, 11 years later). The Mac, Siracusa wrote, needed something that could efficiently handle lots of tiny files, volume management with pooled storage, checksum-based data integrity, and snapshots. It needed something like ZFS or, perhaps, ReiserFS, file systems “notable for their willingness to reconsider past assumptions about file system design.” Two months later, the name Reiser would lose most of its prestige and pick up a tragic association it would never shake. Police arrested the file system’s namesake, Hans Reiser, and charged him with murder in connection with the disappearance of his estranged wife. Reiser’s work on Linux file systems was essentially sentenced to obscurity from that point on. Now that designation has been made official, as the file system that was once the default on systems like SUSE Linux has been changed from “Supported” to “Obsolete” in the latest Linux 6.6 kernel merge process (as reported by Phoronix). While a former employee of Reiser’s company, Namesys, continues out-of-source work on later versions of ReiserFS, it is likely to disappear from the kernel entirely in a matter of years, likely 2025. It's an ignoble end for a filesystem that, at one time, could have been the next big thing for Linux file systems.' -- source: https://arstechnica.com/gadgets/2023/08/the-torrid-saga-of-reiserfs-nears-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes Fake Signal and Telegram Apps Hosted on Play
by Peter Reutemann 01 Sep '23

01 Sep '23

'Researchers say they have found fake apps in Google Play that masqueraded as legitimate ones for the Signal and Telegram messaging platforms. The malicious apps could pull messages or other sensitive information from legitimate accounts when users took certain actions. ArsTechnica: An app with the name Signal Plus Messenger was available on Play for nine months and had been downloaded from Play roughly 100 times before Google took it down last April after being tipped off by security firm ESET. It was also available in the Samsung app store and on signalplus[.]org, a dedicated website mimicking the official Signal.org. An app calling itself FlyGram, meanwhile, was created by the same threat actor and was available through the same three channels. Google removed it from Play in 2021. Both apps remain available in the Samsung store. Both apps were built on open source code available from Signal and Telegram. Interwoven into that code was an espionage tool tracked as BadBazaar. The Trojan has been linked to a China-aligned hacking group tracked as GREF. BadBazaar has been used previously to target Uyghurs and other Turkic ethnic minorities. The FlyGram malware was also shared in a Uyghur Telegram group, further aligning it to previous targeting by the BadBazaar malware family. Signal Plus could monitor sent and received messages and contacts if people connected their infected device to their legitimate Signal number, as is normal when someone first installs Signal on their device. Doing so caused the malicious app to send a host of private information to the attacker, including the device IMEI number, phone number, MAC address, operator details, location data, Wi-Fi information, emails for Google accounts, contact list, and a PIN used to transfer texts in the event one was set up by the user.' -- source: https://tech.slashdot.org/story/23/08/31/1655233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With Version 117, Firefox Finally Speaks Chrome's Translation Language
by Peter Reutemann 01 Sep '23

01 Sep '23

'The latest version of the flagship FOSS browser is out, and it's picked up one of the main features for which we keep Chrome around. >From a report: The Firefox version 117 feature list might not look all that impressive, but it does have a big-ticket feature that may tempt people back: automatic translation. The snag is it's disabled by default in the release version, and you'll have to manually enable it. Although it was enabled in the betas, Mozilla has decided to go for a staged rollout and not enable it for everyone until Firefox 118 in six weeks or so. The new feature is integrated, privacy-respecting machine translation between multiple languages. This was already possible in older versions, but it needed an extension, and that had two side effects. One is that the extension hooked deep into the core of the browser in ways that Mozilla wasn't comfortable about, and the other is that once your text had been sent out to a third-party website, it could be snooped upon -- but the victims of any snooping would blame the browser, even if it wasn't the browser's fault. To enable it, go to the configuration page (enter about:config in the address bar), and search for a setting called browser.translations.enable.' -- source: https://tech.slashdot.org/story/23/08/31/1658259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD Can Now Boot in 25 Milliseconds
by Peter Reutemann 31 Aug '23

31 Aug '23

'Replacing a sort algorithm in the FreeBSD kernel has improved its boot speed by a factor of 100 or more... and although it's aimed at a micro-VM, the gains should benefit everyone. From a report: MicroVMs are a hot area of technology R&D in the last half decade or so. The core idea is a re-invention of some of concepts and technology that IBM invented along with the hypervisor in the 1960s: designing OSes specifically to run as guests under another OS. This means building the OS specifically to run inside a VM, and to talk to resources provided by a specific hypervisor rather than to fake hardware. This means that the guest OS needs next to no support for real hardware, just VirtIO drivers which talk directly to facilities provided by the host hypervisor. In turn, the hypervisor doesn't have to provide an emulated PCI bus, emulated power management, emulated graphics card, emulated network interface cards, and so on. The result is that the hypervisor itself can be much smaller and simpler. The result of ruthlessly chopping down both the hypervisor, and the OS that runs inside it, is that both ends can be much smaller and simpler. That means that VMs can use much fewer resources, and start up much quicker.' -- source: https://tech.slashdot.org/story/23/08/30/1525238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nautilus File Manager Gets New Features in Upcoming GNOME 45
by Peter Reutemann 29 Aug '23

29 Aug '23

'The upcoming release of GNOME 45 — expected September 20th — will bring new features to the Nautilus file manager (now in public beta testing). An anonymous reader shared this report from 9to5Linux: Nautilus in GNOME 45 already received a search performance boost, support for dropping images directly from web pages, an improved Grid View that now indicates starred files too, the ability to display bytes size as a tooltip for folder properties, and a more adaptive design for the sidebar. It also got an improved file opening experience while sandboxed (think Flatpak, Snap, etc.), a more consistent date and time format, a more simplistic definition of the Keyboard Shortcuts window, the ability to refocus the search bar using the Ctrl+F keyboard shortcut, and a better archiving experience. But there's room for more new features as Nautilus now received new "Search Everywhere" buttons to expand the search scope and a modern full-height sidebar layout, along with refined sidebar sizing and folding threshold. This is what Nautilus looks like in GNOME 45. The article includes some screenshots, adding that Nautilus "also received some performance improvements to more quickly generate multiple thumbnails, provide users with flickerless transition into and from search, and avoid DBus-activating other apps when it starts."' -- source: https://linux.slashdot.org/story/23/08/27/2329227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux What's New in Linux 6.5?
by Peter Reutemann 28 Aug '23

28 Aug '23

'9to5Linux: Just a couple of days after celebrating its 32nd anniversary , Linus Torvalds announced today the final release of the Linux 6.5 kernel series as a major update that introduces several new features, updated and new drivers for better hardware support, and other changes. After seven weeks of RCs, Linux kernel 6.5 is here with new features like MIDI 2.0 support in ALSA, ACPI support for the RISC-V architecture, Landlock support for UML (User-Mode Linux), better support for AMD "Zen" systems, as well as user-space support for the ARMv8.8 memcpy/memset instructions. Also new in Linux 6.5 is Intel TPMI (Topology Aware Register and PM Capsule Interface) support for the power capping subsystem and a TPMI interface driver for Intel RAPL, and the "runnable boosting" feature in the EAS balancer to improve CPU utilization for specific workloads. This release also improves SMP scheduling's load balancer to recognize SMT cores with more than one busy sibling and allows lower-priority CPUs to pull tasks to avoid superfluous migrations, and improves EXT4 file system's journalling, block allocator subsystems, and performance for parallel DIO overwrites.' -- source: https://linux.slashdot.org/story/23/08/27/2316212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1