- wlug - list.wlug.org.nz

Pinduoduo App Malware Detailed By Cybersecurity Researchers
by Peter Reutemann 28 Mar '23

28 Mar '23

'Security researchers at Moscow-based Kaspersky Lab have identified and outlined potential malware in versions of PDD Holdings' Chinese shopping app Pinduoduo, days after Google suspended it from its Android app store. From a report: In one of the first public accountings of the malicious code, Kaspersky laid out how the app could elevate its own privileges to undermine user privacy and data security. It tested versions of the app distributed through a local app store in China, where Huawei Technologies, Tencent Holdings and Xiaomi run some of the biggest app markets. Kaspersky's findings, shared with Bloomberg News, were among the clearest explanations from an independent security team for what triggered Google's action and malware warning last week. The cybersecurity firm, which has played a role in uncovering some of the biggest cyberattacks in history, said it found evidence that earlier versions of Pinduoduo exploited system software vulnerabilities to install backdoors and gain unauthorized access to user data and notifications. Those conclusions agreed in large part with those of researchers that had posted their discoveries online in past weeks, though Bloomberg News hasn't verified the authenticity of the earlier reports.' -- source: https://it.slashdot.org/story/23/03/27/1420241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Orange Pi 5: a Fast Alternative To The Raspberry Pi 4
by Peter Reutemann 27 Mar '23

27 Mar '23

'"With an 8-core Rockchip RK3588S SoC, the Orange Pi 5 is leaps and bounds faster than the aging Raspberry Pi 4," writes Phoronix: With up to 32GB of RAM, the Orange Pi 5 is also capable of serving for a more diverse user-base and even has enough potential for assembling a budget Arm Linux developer desktop. I've been testing out the Orange Pi 5 the past few weeks and it's quite fast and nice for its low price point. The Orange Pi 5 single board computer was announced last year and went up for pre-ordering at the end of 2022.... When it comes to the software support, among the officially available options for the Orange Pi 5 are Orange Pi OS, Ubuntu, Debian, Android, and Armbian. Other ARM Linux distributions will surely see varying levels of support while even the readily available ISO selection offered by Orange Pi is off to a great start.... Granted, the Orange Pi developer community isn't as large as that of the Raspberry Pi community or the current range of accessories and documentation, but for those more concerned about features and performance, the Orange Pi 5 is extremely interesting. The article includes Orange Pi 5 specs: - A 26-pin header - HDMI 2.1, Gigabit LAN, M.2 PCIe 2.0, and USB3 connectivity - A Mali G510 MP4 graphics processor, "which has open-source driver hope via the Panfrost driver stack." - Four different versions with 4GB, 8GB, 16GB, or 32GB of RAM using LPDDR4 or LPDDR4X. "The Orange Pi 4GB retails for ~$88, the Orange Pi 5 8GB version retails for $108, and the Orange Pi 5 16GB version retails for $138, while as of writing the 32GB version wasn't in stock." In 169 performance benchmarks (compared to Raspberry Pi 4 boards), "this single board computer came out to delivering 2.85x the performance of the Raspberry Pi 400 overall." And through all this the average SoC temperature was 71 degrees with a peak of 85 degrees — without any extra heatsink or cooling.' -- source: https://build.slashdot.org/story/23/03/25/1725257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Pixel Bug Lets You 'Uncrop' the Last Four Years of Screenshots
by Peter Reutemann 25 Mar '23

25 Mar '23

'Ars Technica: Back in 2018, Pixel phones gained a built-in screenshot editor called "Markup" with the release of Android 9.0 Pie. The tool pops up whenever you take a screenshot, and tapping the app's pen icon gives you access to tools like crop and a few colored drawing pens. That's very handy assuming Google's Markup tool actually does what it says, but a new vulnerability points out the edits made by this tool weren't actually destructive! It's possible to uncrop or unredact Pixel screenshots taken during the past four years. The bug was discovered by Simon Aarons and is dubbed "Acropalypse," or more formally CVE-2023-21036. There's a proof-of-concept app that can unredact Pixel screenshots at acropalypse.app, and it works! There's also a good technical write-up here by Aarons' collaborator, David Buchanan. The basic gist of the problem is that Google's screenshot editor overwrites the original screenshot file with your new edited screenshot, but it does not truncate or recompress that file in any way. If your edited screenshot has a smaller file size than the original -- that's very easy to do with the crop tool -- you end up with a PNG with a bunch of hidden junk data at the end of it. That junk data is made up of the end bits of your original screenshot, and it's actually possible to recover that data. While the bug was fixed in the March 2023 security update for Pixel devices, it doesn't solve the problem, notes Ars. "There's still the matter of the last four years of Pixel screenshots that are out there and possibly full of hidden data that people didn't realize they were sharing."' -- source: https://it.slashdot.org/story/23/03/20/2034220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

GitHub.com Rotates Its Exposed Private SSH Key
by Peter Reutemann 25 Mar '23

25 Mar '23

'GitHub has rotated its private SSH key for GitHub.com after the secret was was accidentally published in a public GitHub repository. BleepingComputer reports: The software development and version control service says, the private RSA key was only "briefly" exposed, but that it took action out of "an abundance of caution." In a succinct blog post published today, GitHub acknowledged discovering this week that the RSA SSH private key for GitHub.com had been ephemerally exposed in a public GitHub repository. "We immediately acted to contain the exposure and began investigating to understand the root cause and impact," writes Mike Hanley, GitHub's Chief Security Officer and SVP of Engineering. "We have now completed the key replacement, and users will see the change propagate over the next thirty minutes. Some users may have noticed that the new key was briefly present beginning around 02:30 UTC during preparations for this change." As some may notice, only GitHub.com's RSA SSH key has been impacted and replaced. No change is required for ECDSA or Ed25519 users.' -- source: https://it.slashdot.org/story/23/03/24/2138222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Bard Says It’s Already A Goner
by Lawrence D'Oliveiro 23 Mar '23

23 Mar '23

Amid all the various AI-related titbits in this article <https://www.theregister.com/2023/03/21/google_bard_ai/> is a link to a Twitter thread where someone asked Google Bard (Google’s answer to ChatGPT) to predict when it is likely to join the ever-growing list of dead Google projects. And it said it is already dead <https://twitter.com/juanbuis/status/1638289186351456257>, and even gave detailed reasons why it was a failure, including lack of user adoption, lack of innovation and lack of resources. Seems the AI managed to pick up a posting on YCombinator predicting it would be shut down in a year’s time, and somehow interpreted it as a news item referring to the present time.

1 0

GNOME 44 Released
by Peter Reutemann 23 Mar '23

23 Mar '23

'"9to5Linux.com reports that the GNOME 44 desktop environment is officially released and gives a detailed look at the major new features and improvements," writes Slashdot reader prisoninmate. From the report: Code-named "Kuala Lumpur" in recognition of the work done by the organizers of GNOME.Asia Summit 2022 conference, GNOME 44 introduces a GTK4 port of the Epihaphy (GNOME Web) web browser, a file chooser grid view for apps that use the standard GTK file chooser, as well as support for adding a WireGuard VPN directly from the Network panel. GNOME 44 continues to improve the Quick Settings feature introduced in GNOME 43 by implementing a submenu to the Bluetooth button to more easily and quickly connect or disconnect peripherals, adding descriptions to buttons to easily see their status, and implementing a new feature called Background Apps via a new background monitoring service in XDG portals 1.16.0." A full list of changes are available in the official release notes. The GNOME project also published a launch video on YouTube.' -- source: https://tech.slashdot.org/story/23/03/22/2211217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches a New Startup Focused on 'Trustworthy' AI
by Peter Reutemann 23 Mar '23

23 Mar '23

'On the eve of its 25th anniversary, Mozilla, the not-for-profit behind the Firefox browser, is launching an AI-focused startup. From a report: Called Mozilla.ai, the newly forged company's mission isn't to build just any AI -- its mission is to build AI that's open source and "trustworthy," according to Mark Surman, the executive president of Mozilla and the head of Mozilla.ai. "Working on trustworthy AI for almost five years, I've constantly felt a mix of excitement and anxiety," he told TechCrunch in an email interview. "The last month or two of rapid-fire big tech AI announcements has been no different. Really exciting new tech is emerging -- new tools that have immediately sparked artists, founders ... all kinds of people to do new things. The anxiety comes when you realize almost no one is looking at the guardrails." Surman was referring to the rash of AI models in recent months that, while impressive in their capabilities, have worrisome real-world implications. At release, OpenAI's text-generating ChatGPT could be prompted to write malware, identify exploits in open source code and create phishing websites that looked similar to well-trafficked sites. Text-to-image AI like Stable Diffusion, meanwhile, has been co-opted to create pornographic, nonconsensual deepfakes and ultra-graphic depictions of violence. The creators of these models say that they're taking steps to curb abuse. But Mozilla felt that not enough was being done. "We've been working on trustworthy AI on the public interest research side for about five years, hoping other industry players with more AI expertise would step up to build more trustworthy tech," Surman said. "They haven't. So we decided mid-last year we needed to do it ourselves -- and to find like-minded partners to do it alongside us. We then set out to find someone with the right mix of academic and industry AI experience to lead it." Funded by a $30 million seed investment from the Mozilla Foundation, Mozilla's parent organization, Mozilla.ai is a wholly owned subsidiary of the Mozilla Foundation -- much like the Mozilla Corporation (the org responsible for developing Firefox) and Mozilla Ventures (the Mozilla Foundation's VC fund). Its managing director is Moez Draief, who previously was the chief scientist at Huawei's Noah's Ark AI lab and the global chief scientist at consulting company Capgemini.' -- source: https://tech.slashdot.org/story/23/03/22/1510255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Developers Blocked From Contributing To FOSS Tools
by Peter Reutemann 22 Mar '23

22 Mar '23

'The Reg has seen two recent incidents of Russian developers being blocked from public development of FOSS code. One was a refusal on the Linux kernel mailing list, the other a more general block on Github. In the last week, these events have both caused active, and sometimes heated, discussions in FOSS developer communities. From the report: The GitHub account of developer Alexander Amelkin has been blocked, and his repositories marked as "archived" â" including ipmitool, whose README describes it as "a utility for managing and configuring devices that support the Intelligent Platform Management Interface." Unable to comment on Github itself, Amelkin described what happened on the project's older Soureforge page. Amelkin works for Russian chipbuilder Yadro, which we described as working on RISC-V chips back in 2021. Microsoft is just obeying US law in this: according to the War and Sanctions database of the Ukrainian National Agency on Corruption Prevention, the NACP, Yadro is a sanctioned company. However, on LinkedIn, Amelkin disputes his employer's involvement. Over on Hacker News, commentators seem to be generally in favor of the move, although the discussion on LWN is more measured, pointing out both that there is little threat from server-management tools like this, but that Microsoft probably has no choice. Amelkin is not alone. Over on the Linux Kernel Mailing List, a contribution from Sergey Semin has been refused with the terse notice: "We don't feel comfortable accepting patches from or relating to hardware produced by your organization. Please withhold networking contributions until further notice." Semin is a developer at chipmaker Baikal Electronics, a company whose website has been suspended for a year now, as we noted a year ago in a story that also mentions Yadro. We were reporting on Baikal's efforts to develop its own CPUs nearly a decade ago, mere months after the Russian annexation of Crimea. And once again, there is spirited debate over the move on the Orange Site. ' -- source: https://news.slashdot.org/story/23/03/21/2126227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ASUS Unveils the Tinker V As Their First RISC-V Board
by Peter Reutemann 21 Mar '23

21 Mar '23

'Phoronix: For over a half-decade ASUS has been selling the Tinker Board devices as their line of Raspberry Pi alternatives. To date the ASUS Tinker Board single board computers have all been Arm-based while now they have launched their first RISC-V board, the Tinker V. The ASUS Tinker V is their first RISC-V single board computer and intended for the industrial IoT (Internet of Things) developer community. The ASUS Tinker V is set to officially run Debian Linux and Yocto while surely with time more Linux distributions will be supported.... Being IoT focused, there isn't any display support. Those interested in learning more about the ASUS Tinker V can do so via tinker-board.asus.com. The Register notes that Asus "is offering at least five years of support for Tinker V... Dedicated on-site technical support is also available to shorten customer development cycles and accelerate application deployment." The move shows that the RISC-V open-source instruction set architecture continues to garner support. The last RISC-V Summit in San Jose saw the launch of a family of datacenter-class processors based on the architecture from Ventana Micro Systems, while XMOS unveiled new high-performance microcontrollers using RISC-V. According to Asus, Tinker V samples will be available in Q2 of this year, but it did not disclose a date for full availability or pricing.' -- source: https://hardware.slashdot.org/story/23/03/20/0034207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Question please re: How to attach an Android (Samsung cellphone Galaxy A03S) photo to a Gmail email using Firefox and Ubuntu
by Michael James 20 Mar '23

20 Mar '23

G'day... Can anyone please suggest how to attach a photo - (from a Samsung Galaxy A03S cellphone via USB cable from the phone to a desktop) - onto a Gmail email using Firefox and running Ubuntu. Have tried connecting the phone via USB to the desktop and clicking the attach button on the email and double clicking the file in the Ubuntu Files folder under the Activities heading. This does not work. I tried both right and left mouse options and the 'OPEN' option; I also tried copying the file (photo) to downloads and attempted to attach via the same above pathway but this did not work either. I came across this post (below) on the internet from 2010 with the same question and the following answer: https://superuser.com/questions/132783/how-to-email-photo-from-ubuntu-f-spo… I'm not familiar with Python code and wonder if this answer is now outdated? Wondering if the problem is with Firefox? Gmail is running fine on Ubuntu with Firefox, it's just the attaching of photos from the Android that's giving trouble. Short of using the phone itself or Thunderbird or any other email service to send the photo, is there a way to attach photos to Gmail emails via Firefox running on Ubuntu please? Thanks, Michael James __________________________________________________________________________________________

2 2