- wlug - list.wlug.org.nz

Thousands of Asus routers are being hit with stealthy, persistent backdoors
by Peter Reutemann 29 May '25

29 May '25

'Thousands of home and small office routers manufactured by Asus are being infected with a stealthy backdoor that can survive reboots and firmware updates in an attack by a nation-state or another well-resourced threat actor, researchers said. The unknown attackers gain access to the devices by exploiting now-patched vulnerabilities, some of which have never been tracked through the internationally recognized CVE system. After gaining unauthorized administrative control of the devices, the threat actor installs a public encryption key for access to the device through SSH. From then on, anyone with the private key can automatically log in to the device with administrative system rights.' -- source: https://arstechnica.com/security/2025/05/thousands-of-asus-routers-are-bein… Cheers, Peter

1 0

SUSE Is Giving YaST the Dodo Bird Treatment
by Peter Reutemann 26 May '25

26 May '25

'An important piece of Linux history is set to go the way of the passenger pigeon or dodo bird later this year, when SUSE and openSUSE put YaST out to pasture. Widely regarded as a package manager, it’s actually more of a Swiss Army knife configuration tool that can be used to install software, configure hardware, set up networks and servers, and more. Exactly what it can do might be determined by the year in which you’re using it, as its feature set and role within the SUSE ecosystem have changed over the years. Although not very well known outside SUSE circles these days, from its first appearance in 1995 until SUSE was purchased by Novell in 2004, YaST was one of the reasons why SUSE was considered one of the crown jewels of Linux.' -- source: https://fossforce.com/2025/05/suse-is-giving-yast-the-dodo-bird-treatment/ When I was using SuSE back in the day, YaST was really great for newbies to do admin stuff Later on, I switched to webmin (https://github.com/webmin/webmin) as it was not restricted to a particular distro. Cheers, Peter

2 1

“Microsoft has simply given us no other option,” Signal says as it blocks Windows Recall
by Peter Reutemann 22 May '25

22 May '25

'Signal Messenger is warning the users of its Windows Desktop version that the privacy of their messages is under threat by Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store almost everything a user does every three seconds. Effective immediately, Signal for Windows will by default block the ability of Windows to screenshot the app. Signal users who want to disable the block—for instance to preserve a conversation for their records or make use of accessibility features for sight-impaired users—will have to change settings inside their desktop version to enable screenshots. [...] With no API for blocking Recall in the Windows Desktop version, Signal is instead invoking an API Microsoft provides for protecting copyrighted material. App developers can turn on the DRM setting to prevent Windows from taking screenshots of copyrighted content displayed in the app. Signal is now repurposing the API to add an extra layer of privacy.' -- source: https://arstechnica.com/security/2025/05/signal-resorts-to-weird-trick-to-b… Who would have thought that DRM can be useful... :-) Cheers, Peter

1 0

Hackers Now Testing ‘ClickFix’ Attacks on Linux Systems
by Peter Reutemann 22 May '25

22 May '25

'Security researchers have recently uncovered a new type of cyberattack targeting Linux systems — a technique dubbed “ClickFix.” Originally known for its impact on Windows environments, ClickFix is now being adapted and tested by threat actors against Linux platforms, signaling an expansion in both scope and sophistication. ClickFix is a novel post-exploitation tactic that allows attackers to interact with graphical desktop environments through simulated clicks and UI manipulations. By abusing legitimate tools like xdotool, attackers can automate interactions with graphical interfaces — such as clicking confirmation dialogs, accepting permissions, or launching malicious scripts — even on hardened systems. This type of attack can bypass traditional security mechanisms by operating at the user interface level, making it especially dangerous in environments where users assume GUI-based interactions are secure.' -- source: https://cyptd.com/hackers-now-testing-clickfix-attacks-on-linux-systems/ Cheers, Peter

1 0

Mobile Browsers That Stick Their Noses Into Your Business
by Peter Reutemann 22 May '25

22 May '25

'Some figures hit my desk this morning about mobile browsers and the data they collect that I found interesting enough to want to pass on. Some of this won’t surprise anybody, such as the fact that Chrome is the most data-hungry mobile browser app. What might come as a surprise to many, is that Chrome is the only browser that collects financial information, such as payment methods, card numbers, and bank account details. It also collects contacts from a phone’s address book. The figures came from Surfshark, the cybersecurity folks with an eponymous VPN, which took a look at the 10 browsers it identified as the most popular. Topping the list was Chrome, which presents a somewhat mind-boggling list of privacy intrusions that includes everything from contacts and financial information to data on location, browsing and search history, content — such as photos, videos, audio recordings, uploaded files, and other stuff — usage data, identifiers — device ID, user ID, or IP address — as well as even more data that’s not identified by the study.' -- source: https://fossforce.com/2025/05/mobile-browsers-that-stick-their-noses-into-y… One thing that I wasn't aware of under Android, you will have a unique Ad ID: Settings > Privacy > Ads > Opt out of ad personalization Cheers, Peter

1 0

KDE Is Getting a Native Virtual Machine Manager Called 'Karton'
by Peter Reutemann 21 May '25

21 May '25

'A new virtual machine manager called Karton is being developed specifically for the KDE Plasma desktop, aiming to offer a seamless, Qt-native alternative to GNOME-centric tools like GNOME Boxes. Spearheaded by University of Waterloo student Derek Lin as part of Google Summer of Code 2025, Karton uses libvirt and Qt Quick to build a user-friendly, fully integrated VM experience, with features like a custom SPICE viewer, snapshot support, and a mobile-friendly UI expected by September 2025. Neowin reports: To feel right at home in KDE, Karton is being built with Qt Quick and Kirigami. It uses the libvirt API to handle virtual machines and could eventually work across different platforms. Right now, development is focused on getting the core parts in place. Lin is working on a new domain installer that ditches direct virt-install calls in favor of libosinfo, which helps detect OS images and generate the right libvirt XML for setting up virtual machines more precisely. He's still refining device configuration and working on broader hypervisor support. Another key part of the work is building a custom SPICE viewer using Qt Quick from scratch: If you're curious, here's the list of specific deliverables Lin included in his GSoC proposal, though he notes the proposal itself is a bit outdated [...]. For those interested in the timeline, Lin's GSoC proposal says the official GSoC coding starts June 2, 2025. The goal is to have a working app ready by the midterm evaluation around July 14, 2025, with the final submission due September 1, 2025. ' -- source: https://tech.slashdot.org/story/25/05/20/2223215 Cheers, Peter

1 0

Microsoft Open Sources Windows Subsystem for Linux
by Peter Reutemann 20 May '25

20 May '25

'Windows Subsystem for Linux (WSL) is now open source, Microsoft said Monday. The tool, which allows developers to run Linux distributions directly in Windows, is available for download, modification, and contribution. "We want Windows to be a great dev box," said Pavan Davuluri, corporate VP at Microsoft. "Having great WSL performance and capabilities" allows developers "to live in the Windows-native experience and take advantage of all they need in Linux." First launched in 2016 with an emulated Linux kernel, WSL switched to using the actual Linux kernel in 2019 with WSL 2, improving compatibility. The system has since gained support for GPUs, graphical applications, and systemd. Microsoft significantly refactored core Windows components to make WSL a standalone system before open sourcing it.' -- source: https://news.slashdot.org/story/25/05/19/1654225 Cheers, Peter

1 0

Final Bookworm-Based Raspberry Pi OS Released Ahead of Debian Trixie
by Peter Reutemann 20 May '25

20 May '25

'The Raspberry Pi Foundation has just released a new version of Raspberry Pi OS, their recommended, freely distributed operating system for all Raspberry Pi devices. Still based on Debian 12 ”Bookworm,” this build is likely the last one in this series before Debian 13 “Trixie” arrives later this summer.' -- source: https://linuxiac.com/final-bookworm-based-raspberry-pi-os-released-ahead-of… Cheers, Peter

1 0

Raspberry Pi Connect Goes Stable
by Peter Reutemann 19 May '25

19 May '25

'After just twelve months of public testing, Raspberry Pi Connect—the company’s browser-based remote-access service—officially graduated from beta with the release of version 2.5. According to Raspberry Pi engineer Chris Lowder, the platform’s install base has already topped 100,000 registered boards. Earlier iterations of the software relied on frequent polling: each Pi woke up at regular intervals to ask Raspberry Pi’s servers whether anyone wanted to connect. That design was easy on the cloud side—traffic remained predictable—but it quietly chewed through users’ data plans and power budgets. Version 2.5 replaces that pattern with a single, persistent HTTP connection. Now, when a user presses “Connect” in the web dashboard, the server broadcasts a wake-up event to the board, initiating the handshake on demand instead of on a schedule. Beyond wake-ups, every Connect client has been sending status heartbeats to keep the dashboard in sync. The new release debounces that chatter, dropping superfluous packets and compressing each remaining heartbeat by roughly 50 percent.' -- source: https://linuxiac.com/raspberry-pi-connect-goes-stable/ Anyone got any experience with this that they'd like to share? Cheers, Peter

1 0

Spies hack high-value mail servers using an exploit from yesteryear
by Peter Reutemann 16 May '25

16 May '25

'Threat actors, likely supported by the Russian government, hacked multiple high-value mail servers around the world by exploiting XSS vulnerabilities, a class of bug that was among the most commonly exploited in decades past. XSS is short for cross-site scripting. Vulnerabilities result from programming errors found in webserver software that, when exploited, allow attackers to execute malicious code in the browsers of people visiting an affected website. XSS first got attention in 2005, with the creation of the Samy Worm, which knocked MySpace out of commission when it added more than one million MySpace friends to a user named Samy. XSS exploits abounded for the next decade and have gradually fizzled more recently, although this class of attacks continues now. On Thursday, security firm ESET reported that Sednit, a Kremlin-backed hacking group also tracked as APT28, Fancy Bear, Forest Blizzard, and Sofacy—gained access to high-value email accounts by exploiting XSS vulnerabilities in mail server software from four different makers. Those packages are: Roundcube, MDaemon, Horde, and Zimbra.' -- source: https://arstechnica.com/security/2025/05/spies-hack-high-value-mail-servers… Cheers, Peter

1 0