- wlug - list.wlug.org.nz

Most Top Websites Are Not Following Best Practices In Their Password Policies
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

Report on a survey <https://freedom-to-tinker.com/2022/06/22/most-top-websites-are-not-followin…> on the sorts of password policies in force on various popular websites. Too many of them still have unnecessary restrictions like the characters you are allowed to use, or even imposing a maximum permitted length. There is a linked blog post from one of the developers at Discourse, which argues that rules of any kind should be avoided. Or nearly any kind: there is a case for a minimum-length requirement (but be careful how you count it -- are you just going by Unicode “code points”? Or worse still, are you requiring passwords to be ASCII-only?), and checks against leaked password lists, plus some kind of entropy test to rule out trivial things like “aaaaaaaaaa”. Beyond that, let the user enter what they like. Showing the user a password-strength meter next to their entry as they choose a password is considered part of best practice nowadays. But in their article, they show that Facebook’s password-strength meter, for example, seems to prefer certain weak passwords (with a wider character set) over more random, stronger ones (from a smaller character set). Maybe there are circumstances out of the hands of the sysadmins, and the blame lies elsewhere: the article closes with One idea for future research: directly engage with system administrators, in order to understand their mindset on password security. Perhaps password policy is meant to be security theater--giving users a sense of safety without actually improving security. Or maybe websites have shifted their attention to adopting other authentication technologies, like SMS-based multi-factor authentication (which also suffers from severe weaknesses, as we discovered in previous research on SIM swaps and number recycling). Perhaps websites have to deal with security audits from firms like Deloitte recommending outdated practices. Or maybe websites face other practical constraints that the information security community doesn’t know about.

1 0

Mega says it can’t decrypt your files. New POC exploit shows otherwise
by Peter Reutemann 22 Jun '22

22 Jun '22

'In the decade since larger-than-life character Kim Dotcom founded Mega, the cloud storage service has amassed 250 million registered users and stores a whopping 120 billion files that take up more than 1,000 petabytes of storage. A key selling point that has helped fuel the growth is an extraordinary promise that no top-tier Mega competitors make: Not even Mega can decrypt the data it stores. On the company's homepage, for instance, Mega displays an image that compares its offerings to Dropbox and Google Drive. In addition to noting Mega's lower prices, the comparison emphasizes that Mega offers end-to-end encryption, whereas the other two do not. Over the years, the company has repeatedly reminded the world of this supposed distinction, which is perhaps best summarized in this blog post. In it, the company claims, "As long as you ensure that your password is sufficiently strong and unique, no one will ever be able to access your data on MEGA. Even in the exceptionally improbable event MEGA's entire infrastructure is seized!" (emphasis added). Third-party reviewers have been all too happy to agree and to cite the Mega claim when recommending the service. Research published on Tuesday shows there's no truth to the claim that Mega, or an entity with control over Mega's infrastructure, is unable to access data stored on the service. The authors say that the architecture Mega uses to encrypt files is riddled with fundamental cryptography flaws that make it trivial for anyone with control of the platform to perform a full key recovery attack on users once they have logged in a sufficient number of times. With that, the malicious party can decipher stored files or even upload incriminating or otherwise malicious files to an account; these files look indistinguishable from genuinely uploaded data.' -- source: https://arstechnica.com/information-technology/2022/06/mega-says-it-cant-de… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RISC OS: 35-Year-Old Original ARM OS Is Alive and Well
by Peter Reutemann 22 Jun '22

22 Jun '22

'RISC OS, the operating system of the original Arm computer, the Acorn Archimedes, is still very much alive -- and doing relatively well for its age. The Register reports: In June 1987, Acorn launched the Archimedes A305 and A310, starting at $982 and running a new operating system called Arthur. At the time, it was a radical and very fast computer. In his review (PDF) for Personal Computer World, Dick Pountain memorably said: "It loads huge programs with a faint burping noise, in the time it takes to blink an eye." Arthur was loosely related to Acorn's earlier MOS, the BBC Micro operating system but looked very different thanks to a prototype graphical desktop, implemented in BBC BASIC, that could charitably be called "technicolor." Renamed RISC OS, version 2 followed in 1989 -- the same year that Sun started selling its new SPARCstation 1 (a snip at $9,200) and DEC launched the MIPS R2000-chipset-based DECstation 3100 (for $10,800). RISC OS has had a rather convoluted history, partly due to Acorn spinning out Arm, eventually pulling out of the computer market, rebranding as Element 14 and being acquired by Broadcom, where Arm co-designer Sophie Wilson still works today. And partly due to drama over the ownership of the OS post-Acorn at one point. One fork of RISC OS still supports Acorn-era Arm's odd 26-bit mode, meaning that today it mostly runs on the commercial Virtual Acorn emulator. The other branch, designed for the 32-bit mode of more recent Arm chips, is now owned by RISC OS Developments, which made it fully open source back in 2018. Development and maintenance is done by the team at RISC OS Open Ltd -- ROOL for short -- which offers downloads for a variety of current Arm hardware, such as the Titanium desktops. [...] RISC OS Developments are still working on new functionality for the OS. Notably, it recently released a new TCP/IP stack, derived from OpenBSD. Right now, the main benefit is IPv6 support. A feature more significant to most users is still in development: Wi-Fi support. Also still under development, but available to paid backers, is a new RISC OS web browser, Iris. RISC OS does come with a choice of browsers -- NetSurf and Otter -- but the plan is that the new Iris browser will be a native app, with the RISC OS look and feel, but using the WebKit engine for better compatibility with the modern web. The main remaining limitation is SMP. As an OS from the 1980s, long before the 21st-century technology of mainstream multicore processors, RISC OS practically only supports a single CPU core. Various experimental efforts are under way to address this. One has got NetBSD running on another core, and another has the experimental Genode OS running alongside RISC OS. Another effort is working on adding SMP support into the RISC OS kernel itself.' -- source: https://tech.slashdot.org/story/22/06/21/2036227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.25 Released
by Peter Reutemann 20 Jun '22

20 Jun '22

'Long-time Slashdot reader jrepin describes Plasma as "a popular desktop environment, which is also powering the desktop mode on the Steam Deck portable gaming console." And this week the KDE Community announced the release of KDE Plasma 5.25: This new version brings many improvements... - The accent colour can now be set based on the prominent colour from the current desktop background image (it updates if you use slide-show wallpapers) and it applies to more graphical elements. - Floating Panels add a margin all around the panel to make it float while no window is maximised. - Touch-screen mode can now be activated by detaching the screen, rotating it 360, or enabling it manually. - The Global Theme settings page lets you pick and choose which parts to apply. - The Application page for Discover has been redesigned and gives you links to the application's documentation and website, and shows what system resources it has access to. - Panels can now be navigated with the keyboard, and you can assign custom shortcuts to focus individual panels. Lilputing.com adds that "There's a new Overview effect that zooms out to display previews of all currently-running apps and virtual desktops. You can access this view with a four-finger pinch on a touchscreen or touchpad, and from this view, you can also search for apps, documents, or browser tabs or add, remove, or rename virtual desktops."' -- source: https://tech.slashdot.org/story/22/06/18/045234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WLUG meeting next Monday
by Peter Reutemann 20 Jun '22

20 Jun '22

Hi everyone We have a (hybrid) meeting next Monday with the following line up: 'Tom Butz will talk about his experience of installing Linux Mint 20 on his laptop and Ian Stewart of getting Ubuntu 22.04 dual-booting Linux/Windows on a UEFI-enabled device.' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776671/ Link for virtual meeting: https://bbb2.nzoss.nz/b/pet-pgj-enn-fbi Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Linux Botnet That Spreads Using Stolen SSH Keys
by Peter Reutemann 20 Jun '22

20 Jun '22

'ZDNet is warning that Linux users need to watch out for "a new peer-to-peer (P2P) botnet that spreads between networks using stolen SSH keys and runs its crypto-mining malware in a device's memory." The Panchan P2P botnet was discovered by researchers at Akamai in March and the company is now warning it could be taking advantage of collaboration between academic institutions to spread by causing previously stolen SSH authentication keys to be shared across networks. But rather than stealing intellectual property from these educational institutions, the Panchan botnet is using their Linux servers to mine cryptocurrency, according to Akamai... "Instead of just using brute force or dictionary attacks on randomized IP addresses like most botnets do, the malware also reads the id_rsa and known_hosts files to harvest existing credentials and use them to move laterally across the network...." Akamai found 209 peers, but only 40 of them are currently active and they were mostly located in Asia. And why is the education sector more impacted by Panchan? Akamai guesses this could be because of poor password hygiene, or that the malware moves across the network with stolen SSH keys. Akamai writes that the malware "catches Linux termination signals (specifically SIGTERM — 0xF and SIGINT — 0x2) that are sent to it, and ignores them. "This makes it harder to terminate the malware, but not impossible, since SIGKILL isn't handled (because it isn't possible, according to the POSIX standard, page 313)."' -- source: https://linux.slashdot.org/story/22/06/18/2046253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Patch Trouble
by Lawrence D'Oliveiro 17 Jun '22

17 Jun '22

This article <https://arstechnica.com/information-technology/2022/06/botched-and-silent-p…> relates Microsoft’s ongoing troubles coming up with proper patches for security-related issues in its systems. For example, there was a vulnerability in Azure that took over three months and three different patches before the problem could be considered fixed. (The article describes the time interval as “five months”, but to be fair, the final patch came out just over three months after the initial notification.) Then there is the “Follina” vulnerability, which lets an attacker execute code via Microsoft Office, even if you have macro autoexecution disabled. This was finally patched earlier this week -- over seven weeks after it had been seen being actively exploited in the wild. Microsoft’s response has a sentence beginning “We are deeply committed...”. I think this PR usage of the word “committed” should be on a bingo card for content-free buzzwords.

1 0

Ubuntu Core 22 Brings Real-Time Linux Options To IoT
by Peter Reutemann 17 Jun '22

17 Jun '22

'Embedded and internet of things (IoT) devices are a growing category of computing, and with that growth has come expanded needs for security and manageability. One way to help secure embedded and IoT deployments is with a secured operating system, such as Canonical's Ubuntu Core. The Ubuntu Core provides an optimized version of the open-source Ubuntu Linux operating system for smaller device footprints, using an approach that puts applications into containers. On June 15, Ubuntu Core 22 became generally available, providing users with new capabilities to help accelerate performance and lock down security. Ubuntu Core 22 is based on the Ubuntu 22.04 Linux operating system, which is Canonical's flagship Linux distribution that's made available for cloud, server and desktop users. Rather than being a general purpose OS, Ubuntu Core makes use of the open-source Snap container technology that was originally developed by Canonical to run applications. With Snaps, an organization can configure which applications should run in a specific IoT or embedded device and lock down the applications for security. Snaps provide a cryptographically authenticated approach for application updates.' -- source: https://news.slashdot.org/story/22/06/15/1729255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A New Vulnerability in Intel and AMD CPUs Lets Hackers Steal Encryption Keys
by Peter Reutemann 17 Jun '22

17 Jun '22

'Microprocessors from Intel, AMD, and other companies contain a newly discovered weakness that remote attackers can exploit to obtain cryptographic keys and other secret data traveling through the hardware, researchers said on Tuesday. From a report: Hardware manufacturers have long known that hackers can extract secret cryptographic data from a chip by measuring the power it consumes while processing those values. Fortunately, the means for exploiting power-analysis attacks against microprocessors is limited because the threat actor has few viable ways to remotely measure power consumption while processing the secret material. Now, a team of researchers has figured out how to turn power-analysis attacks into a different class of side-channel exploit that's considerably less demanding. The team discovered that dynamic voltage and frequency scaling (DVFS) -- a power and thermal management feature added to every modern CPU -- allows attackers to deduce the changes in power consumption by monitoring the time it takes for a server to respond to specific carefully made queries. The discovery greatly reduces what's required. With an understanding of how the DVFS feature works, power side-channel attacks become much simpler timing attacks that can be done remotely. The researchers have dubbed their attack Hertzbleed because it uses the insights into DVFS to expose -- or bleed out -- data that's expected to remain private. The vulnerability is tracked as CVE-2022-24436 for Intel chips and CVE-2022-23823 for AMD CPUs. The researchers have already shown how the exploit technique they developed can be used to extract an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel.' -- source: https://it.slashdot.org/story/22/06/15/1715226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tsunami of junk traffic that broke DDoS records delivered by tiniest of botnets
by Peter Reutemann 16 Jun '22

16 Jun '22

'A massive flood of malicious traffic that recently set a new distributed denial-of-service record came from an unlikely source. A botnet of just 5,000 devices was responsible as extortionists and vandals continue to develop ever more powerful attacks to knock sites offline, security researchers said. The DDoS delivered 26 million HTTPS requests per second, breaking the previous record of 15.3 million requests for that protocol set only seven weeks ago, Cloudflare Product Manager Omer Yoachimik reported. Unlike more common DDoS payloads such as HTTP, SYN, or SYN-ACK packets, malicious HTTPS requests require considerably more computing resources for the attacker to deliver and for the defender or victim to absorb. ' -- source: https://arstechnica.com/information-technology/2022/06/tsunami-of-junk-traf… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0