- wlug - list.wlug.org.nz

The Debian usrmerge Package
by Lawrence D'Oliveiro 27 Jul '21

27 Jul '21

There is a package in Debian (and no doubt also in its derivatives) called “usrmerge” <https://wiki.debian.org/UsrMerge>. The mere act of installing this will perform a “usr merge” on your system, which means that the contents of /bin are merged with /usr/bin, with the former becoming just a symlink to the latter, and similarly /sbin merged into /usr/sbin, and /lib merged into /usr/lib. Back in the last century, when hard drives were smaller, it was standard practice to put only the minimum core of executables and libraries into /bin, /sbin and /lib that would allow the system to boot into a state where a sysadmin could perform some basic maintenance tasks. All the less crucial, but nice to have stuff, would be in /usr, which would be mounted as a separate disk or partition. This way, I suppose, problems with the /usr volume could be fixed without the entire system becoming unbootable. These days, such a division is considered an anachronism. Debian hasn’t supported booting without /usr available for a long while now. I think some other distros, like Fedora, made the move a long time ago. And if you have problems with your OS partition, it’s easier to boot and fix things with something like SystemRescueCD anyway. Note that the usr merge, once performed, is not (easily) reversible. Also note that new Debian installs have been creating a merged usr system since version 10.

1 0

Microsoft Warns of 'Evolving' LemonDuck Mining Malware Targeting Linux and Windows Machines
by Peter Reutemann 26 Jul '21

26 Jul '21

'The threat intelligence team for Microsoft's 365 Defender security suite recently focused on an example of "modern mining malware infrastructure," describing how "Anything that can gain access to machines — even so-called commodity malware — can bring in more dangerous threats." Specifically, it offered a case study of LemonDuck. The blog post's title? "When coin miners evolve..." Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity. LemonDuck's threat to enterprises is also in the fact that it's a cross-platform threat. It's one of a few documented bot malware families that targets Linux systems as well as Windows devices. It uses a wide range of spreading mechanisms — phishing emails, exploits, USB devices, brute force, among others — and it has shown that it can quickly take advantage of news, events, or the release of new exploits to run effective campaigns... Notably, LemonDuck removes other attackers from a compromised device by getting rid of competing malware and preventing any new infections by patching the same vulnerabilities it used to gain access... LemonDuck spreads in a variety of ways, but the two main methods are (1) compromises that are either edge-initiated or facilitated by bot implants moving laterally within an organization, or (2) bot-initiated email campaigns. LemonDuck acts as a loader for many other follow-on activities, but one if its main functions is to spread by compromising other systems. Since its first appearance, the LemonDuck operators have leveraged scans against both Windows and Linux devices for open or weakly authenticated SMB, Exchange, SQL, Hadoop, REDIS, RDP, or other edge devices that might be vulnerable to password spray or application vulnerabilities... Other common methods of infection include movement within the compromised environment, as well as through USB and connected drives. These processes are often kicked off automatically and have occurred consistently throughout the entirety of LemonDuck's operation.' -- source: https://linux.slashdot.org/story/21/07/25/2112228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Stops FTP Support in Firefox 90
by Peter Reutemann 25 Jul '21

25 Jul '21

'A post on Mozilla's security blog calls FTP "by now one of the oldest protocols still in use" — and it's suffering from "a number of serious security issues." The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user's device using the FTP protocol. Aligning with our intent to deprecate non-secure HTTP and increase the percentage of secure connections, we, as well as other major web browsers, decided to discontinue support of the FTP protocol. Removing FTP brings us closer to a fully-secure web which is on a path to becoming HTTPS only and any modern automated upgrading mechanisms such as HSTS or also Firefox's HTTPS-Only Mode, which automatically upgrade any connection to become secure and encrypted do not apply to FTP. The FTP protocol itself has been disabled by default since version 88 and now the time has come to end an era and discontinue the support for this outdated and insecure protocol — Firefox 90 will no longer support the FTP protocol.' -- source: https://news.slashdot.org/story/21/07/24/0213220 There is always FileZilla: https://filezilla-project.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Researchers Found a Malicious NPM Package Using Chrome's Password-Recovery Tools
by Peter Reutemann 25 Jul '21

25 Jul '21

'Threatpost reports on "another vast software supply-chain attack" that was "found lurking in the npm open-source code repository...a credentials-stealing code bomb" that used the password-recovery tools in Google's Chrome web browser. Researchers caught the malware filching credentials from Chrome on Windows systems. The password-stealer is multifunctional: It also listens for incoming commands from the attacker's command-and-control (C2) server and can upload files, record from a victim's screen and camera, and execute shell commands... ReversingLabs researchers, who published their findings in a Wednesday post, said that during an analysis of the code repository, they found an interesting embedded Windows executable file: a credential-stealing threat. Labeled "Win32.Infostealer.Heuristics", it showed up in two packages: nodejs_net_server and temptesttempfile. At least for now, the first, main threat is nodejs_net_server. Some details: nodejs_net_server: A package with 12 published versions and a total of more than 1,300 downloads since it was first published in February 2019...finally upgrading it last December with a script to download the password-stealer, which the developer hosts on a personal website. It was subsequently tweaked to run TeamViewer.exe instead, "probably because the author didn't want to have such an obvious connection between the malware and their website," researchers theorized... ReversingLabs contacted the npm security team on July 2 to give them a heads-up about the nodejs_net_server and tempdownloadtempfile packages and circled back once again last week, on Thursday, since the team still hadn't removed the packages from the repository. When Threatpost reached out to npm Inc., which maintains the repository, a GitHub spokesperson sent this statement: "Both packages were removed following our investigation...."' -- source: https://developers.slashdot.org/story/21/07/24/0152218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Reading about Firefox makes it seem a faster web browser than Chrome'
by Matthew Skiffington 25 Jul '21

25 Jul '21

Spotted in New Scientist, who sadly paywall everything. 'Going into the test, people overall tended to view Chrome as faster than Firefox (~39 per cent to ~31 per cent). While the researchers noted that many participants brought their own strong brand preferences, priming participants had an effect that overcame the inertia of that affinity. "When respondents read one of the priming articles, we saw a prevalence of the priming effect over brand preferences, providing support for the hypothesis that Firefox is faster after reading about Firefox improvements," the researchers said.' https://www.theregister.com/2021/03/11/mozilla_google_speed/ https://arxiv.org/abs/2103.06181 <https://www.theregister.com/2021/03/11/mozilla_google_speed/> Cognitive psychology + UX/UI, nifty. Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

'Update to Windows Defender will delete files Microsoft doesn't want to exist'
by Matthew Skiffington 23 Jul '21

23 Jul '21

Stumbled across something interesting on r/datahoarder, xpost from r/sysadmin. https://www.reddit.com/r/DataHoarder/comments/oopz4c/update_to_windows_defe… Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

Do Software Bugs Really Cost 100× More To Fix In Production Than In Testing?
by Lawrence D'Oliveiro 23 Jul '21

23 Jul '21

There is an oft-cited claim that if you let a bug get into production code, the cost of fixing it increases a hundredfold, compared to if you had flushed it out during testing. This report <https://www.theregister.com/2021/07/22/bugs_expense_bs/> looks into the basis of that claim, and it seems to originate from a book published in 1987, which gave it a reference “[IBM81]”, which was “course notes at the IBM System Sciences Institute”. Only there was no such “Institute”, it seems it was really just the name for an internal training program for IBM employees. It also seems a related claim, that “defects cost more to fix the later you fix them”, also has weak, if any, empirical support. Nowhere in there is the issue of “technical debt” addressed, though. That is real, and can be very costly, and its costs do increase over time.

1 0

Say hi to Microsoft's own Linux: CBL-Mariner
by Peter Reutemann 23 Jul '21

23 Jul '21

'Ok, so it's not named MS-Linux or Lindows, but Microsoft now has its very own, honest-to-goodness general-purpose Linux distribution: Common Base Linux, (CBL)-Mariner. And, just like any Linux distro, you can download it and run it yourself. Amazing isn't it? Why the next thing you know Microsoft will let you run Windows applications on Linux! Oh, wait it has!' -- source: https://www.zdnet.com/article/say-hi-to-microsofts-own-linux-cbl-mariner/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Pushed a One-Character Typo To Production, Bricking Chrome OS Devices
by Peter Reutemann 23 Jul '21

23 Jul '21

'Google says it has fixed a major Chrome OS bug that locked users out of their devices. Google's bulletin says that Chrome OS version 91.0.4472.165, which was briefly available this week, renders users unable to log in to their devices, essentially bricking them. From a report: Chrome OS automatically downloads updates and switches to the new version after a reboot, so users who reboot their devices are suddenly locked out them. The go-to advice while this broken update is out there is to not reboot. The bulletin says that a new build, version 91.0.4472.167, is rolling out now to fix the issue, but it could take a "few days" to hit everyone. Users affected by the bad update can either wait for the device to update again or "powerwash" their device -- meaning wipe all the local data -- to get logged in. Chrome OS is primarily cloud-based, so if you're not doing something advanced like running Linux apps, this solution presents less of an inconvenience than it would on other operating systems. Still, some users are complaining about lost data.' -- source: https://it.slashdot.org/story/21/07/22/1955245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines
by Peter Reutemann 22 Jul '21

22 Jul '21

'Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines. If exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights. The bug (CVE-2021-3438) has lurked in systems for 16 years, researchers at SentinelOne said, but was only uncovered this year. It carries an 8.8 out of 10 rating on the CVSS scale, making it high-severity. According to researchers, the vulnerability exists in a function inside the driver that accepts data sent from User Mode via Input/Output Control (IOCTL); it does so without validating the size parameter. As the name suggests, IOCTL is a system call for device-specific input/output operations. "This function copies a string from the user input using 'strncpy' with a size parameter that is controlled by the user," according to SentinelOne's analysis, released on Tuesday. "Essentially, this allows attackers to overrun the buffer used by the driver." Thus, unprivileged users can elevate themselves into a SYSTEM account, allowing them to run code in kernel mode, since the vulnerable driver is locally available to anyone, according to the firm. The printer-based attack vector is perfect for cybercriminals, according to SentinelOne, since printer drivers are essentially ubiquitous on Windows machines and are automatically loaded on every startup. "Thus, in effect, this driver gets installed and loaded without even asking or notifying the user," explained the researchers. "Whether you are configuring the printer to work wirelessly or via a USB cable, this driver gets loaded. In addition, it will be loaded by Windows on every boot. This makes the driver a perfect candidate to target since it will always be loaded on the machine even if there is no printer connected." -- source: https://hardware.slashdot.org/story/21/07/21/2235207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1