- wlug - list.wlug.org.nz

Bing Contract Prohibits DuckDuckGo From Completely Blocking Microsoft Tracking
by Peter Reutemann 25 May '22

25 May '22

'DuckDuckGo isn't as private as you thought. "Due to a confidential search agreement, the DuckDuckGo browser does not block all Microsoft trackers," reports Review Geek. "What's worse, DuckDuckGo only acknowledged this 'privacy hole' after it was discovered by a security researcher." From the report: Security researcher @thezedwards found that the mobile DuckDuckGo browser does not block Microsoft trackers on third-party websites, such as the Facebook-owned Workplace.com. Gabriel Weinberg, the CEO of DuckDuckGo, is now running damage control on Twitter. He explains that Microsoft cannot see what you search in DuckDuckGo, and the DuckDuckGo browser blocks all Microsoft cookies. But if you visit a website that contains Microsoft's trackers, then your data is exposed to services like Bing and LinkedIn. This is the result of DuckDuckGo's "search syndication agreement" with Microsoft. In order to pull search information from Bing, the privacy experts at DuckDuckGo have to poke holes in their browser's security system. While DuckDuckGo has a solid privacy policy when it comes to Microsoft's ads, it hasn't explained how Microsoft uses data from third-party trackers. And that's quite alarming. Maybe this situation is overblown, or maybe Microsoft can build targeted ad profiles based on your web activity in DuckDuckGo -- we don't know because DuckDuckGo signed a confidentiality agreement. Gabriel Weinberg says that DuckDuckGo is "working tirelessly behind the scenes" to improve its deal with Microsoft. Additionally, he expects DuckDuckGo to "include more third-party Microsoft protection" in a future update.' -- source: https://yro.slashdot.org/story/22/05/24/218210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Teaching Kiwi Kids To Refurbish Computers That They Get To Keep
by Lawrence D'Oliveiro 25 May '22

25 May '22

I saw an item about this on TVNZ news last night, but couldn’t find any mention on their website. But it turns out Newshub did a report on the project a week ago <https://www.newshub.co.nz/home/technology/2022/05/new-project-to-teach-kiwi…>. It involves primary-school-age children working with donated computers, learning how to dismantle them and fix them up. And then they have a working device that they get to take home: As part of West Tech, students as young as eight years old are taught how to diagnose issues, disassemble and then refurbish components in order to create an 'as-new' device. They are then gifted to the students, giving them refurbished tech products to help further their education. ... With just seven hours of learning time, students were able to learn to refurbish defunct devices ... I’m no hardware expert, so all I get to say is “wow”. One of the groups involved in this is youth charity Zeal <https://zeal.nz/>. They have centres in various places around the North Island (including Hamilton), though this particular project only seems to be at the West Auckland one. Looking for the tag “Zeal Digital” brings up several projects: <https://zeal.nz/tag/zeal-digital/>.

2 1

Microsoft Warns of 'Stealthy DDoS Malware' Targeting Linux Devices
by Peter Reutemann 24 May '22

24 May '22

'"In the last six months, we observed a 254% increase in activity from a Linux trojan called XorDdos," writes the Microsoft 365 Defender Research Team. It's a trojan combining denial-of-service functionality with XOR-based encryption for communication. Microsoft calls it part of "the trend of malware increasingly targeting Linux-based operating systems, which are commonly deployed on cloud infrastructures and Internet of Things devices." And ZDNet describes the trojan "one of the most active Linux-based malware families of 2021, according to Crowdstrike." XorDdos conducts automated password-guessing attacks across thousands of Linux servers to find matching admin credentials used on Secure Shell (SSH) servers... Once credentials are gained, the botnet uses root privileges to install itself on a Linux device and uses XOR-based encryption to communicate with the attacker's command and control infrastructure. While DDoS attacks are a serious threat to system availability and are growing in size each year, Microsoft is worried about other capabilities of these botnets. "We found that devices first infected with XorDdos were later infected with additional malware such as the Tsunami backdoor, which further deploys the XMRig coin miner," Microsoft notes... Microsoft didn't see XorDdos directly installing and distributing the Tsunami backdoor, but its researchers think XorDdos is used as a vector for follow-on malicious activities... XorDdoS can perform multiple DDoS attack techniques, including SYN flood attacks, DNS attacks, and ACK flood attacks. Microsoft's team warns that the trojan's evasion capabilities "include obfuscating the malware's activities, evading rule-based detection mechanisms and hash-based malicious file lookup, as well as using anti-forensic techniques to break process tree-based analysis. "We observed in recent campaigns that XorDdos hides malicious activities from analysis by overwriting sensitive files with a null byte. It also includes various persistence mechanisms to support different Linux distributions."' -- source: https://linux.slashdot.org/story/22/05/21/0445203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Rust For Linux Kernel Updated, Uutils As Rust Version Of Coreutils Updated Too
by Peter Reutemann 24 May '22

24 May '22

'This weekend, Miguel Ojeda, added support for a set of additional Rust patches in the kernel and separately a new version of Uutils which is the Rust version of GNU CoreUtils. These changes will go towards more inclusion of Rust into Linux. The v7 patches adds in abstractions used by Rust and the Uutils update contained fixes and addresses compatibility issues.' -- source: https://linux.slashdot.org/story/22/05/23/1836210 Anybody keen on demoing this Rust support or how to write a kernel module in general? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Windows Subsystem For Android Just Got a Big Update
by Peter Reutemann 24 May '22

24 May '22

'Microsoft has updated the Windows Subsystem for Android (WSA) to Android 12.1 and shipped improvements to Android integration with Windows, networking, the camera in apps, the Settings app, and more. ZDNet reports: Current limitations aside, Microsoft is continuing to invest in bringing Android to Windows 11, as seen in its update to the WSA on Windows 11 (version 2204.40000.15) to Android 12.1, which is available to Insiders on the Dev Channel, according to a Microsoft blogpost. WSA launched with Android 11. Microsoft has improved networking on the Windows Subsystem for Android, so that Android apps can connect to devices on the same network as a Windows PC. Advanced networking allows users to set up smart home devices such as speakers and security cameras with a compatible Android app. This feature is available in Windows 11 preview builds 22621 and higher, with advanced networking on by default for new x64 Windows builds. Android-Windows integration has also been improved. Windows taskbar icons now show which Android apps are currently using hardware features like the mic and location in the system tray. The taskbar now also correctly appears or disappears when apps are running or stopped. Android notifications also show as Windows notifications and the Windows title of an Android app now reflects the Android activity title. Android apps won't restart afresh after exiting connected standby mode, but instead will recommence where the app was paused. Of the "many camera updates" in this release, Microsoft highlights that camera orientation is fixed to natural orientation, and that it's fixed incorrect camera previews, letterboxing (where the app window is wider than it is high, or horizontally longer), and a "squishing of the camera feed." Mouse and keyboard inputs in Windows Subsystem for Android have been improved. Microsoft also improved scroll-wheel support, fixed the onscreen keyboard focus, and ensured the Android soft keyboard displays correctly. The updated Windows Subsystem for Android Settings app gained redesigned UX and diagnostics data viewer. As of this update, telemetry collection is off by default. However, Microsoft is encouraging users to enable the setting, so it can collect data about Android app usage. "Other important updates include reduced flicker when apps are restored from a minimized state, the addition of VP8 and VP9 video hardware decoding, and the addition of Chromium WebView 100 to the Windows Subsystem for Android," adds ZDNet.' -- source: https://tech.slashdot.org/story/22/05/23/2014243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers find backdoor lurking in WordPress plugin used by schools
by Peter Reutemann 23 May '22

23 May '22

'Researchers said on Friday that they found a malicious backdoor in a WordPress plugin that gave attackers full control of websites that used the package, which is marketed to schools. The premium version of School Management, a plugin schools use to operate and manage their websites, has contained the backdoor since at least version 8.9, researchers at website security service Jetpack said in a blog post without ruling out that it had been present in earlier versions. This page from a third-party site shows that version 8.9 was released last August.' -- source: https://arstechnica.com/information-technology/2022/05/researchers-find-bac… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Gov.UK Stopped Using jQuery
by Peter Reutemann 22 May '22

22 May '22

'The head of the UK government's digital transformation unit recently announced a change to the nation's government services site gov.uk: they've "removed jQuery as a dependency for all frontend apps, meaning 32 KB of minified and compressed JavaScript was removed" for everything from selecting elements to attaching event listeners.... Nearly 84% of mobile pages used jQuery in 2021, points out a new essay at Gov.UK — before explaining why they decided not to: jQuery was an instrumental tool in a time when we really needed a way to script interactivity in a way that smoothed over the differing implementations of stuff like event handling, selecting elements, animating elements, and so on. The web is better because of jQuery — not just because it has such incredible utility, but because its ubiquity led to making what it provided part of the web platform itself. Nowadays, we can do just about anything jQuery can do in vanilla JavaScript... It really begs the question: Do we really need jQuery today? That's a question that GOV.UK has answered with a resounding "no".... This is a big deal when it comes to the user experience, because GOV.UK provides services and information online for The United Kingdom at scale. Not everyone is tapping away on their 2022 MacBook Pro on a rip-roarin' broadband connection. GOV.UK has to be accessible to everyone, and that means keepin' it lean.... dependencies matter when it comes to performance. Don't shortchange your users if the web platform can easily do the job a framework can. This level of commitment to the user experience from a institution that works at the scale GOV.UK does is commendable. I can only hope others follow in their footsteps.' -- source: https://developers.slashdot.org/story/22/05/21/0214233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

HP Chooses Ubuntu-Based Pop!_OS Linux For Its Upcoming Dev One Laptop
by Peter Reutemann 22 May '22

22 May '22

'System76's CEO Carl Richell announced that HP has chosen the Ubuntu-based Pop!_OS operating system to run on its 14-inch developer-focused notebook called "Dev One." Brian Fagioli from BetaNews speculates that a HP acquisition of System76 "could be a possibility in the future -- if this new relationship pans out at least." He continues: HP could be testing the waters with the upcoming Dev One. Keep in mind, System76 does not even build its own laptops, so we could see the company leave the notebook business and focus on desktops only -- let HP handle the Pop!_OS laptops. "We've got you covered. Experience exceptional multi-core performance from the AMD Ryzen 7 PRO processor and multitask with ease. Compile code, run a build, and keep all your apps running with more speed from the 16GB memory. Plus, load and save files in a flash, thanks to 1TB fast PCIe NVMe M.2 storage. We've even added a Linux Super key so shortcuts are a click away. Simply put, HP Dev One is built to help you code better," explains HP. The company adds, "Pop!_OS is at your service. Create your ideal work experience with multiple tools to help you perform with peak efficiency. Use Stacking to organize and access multiple applications, browsers, and terminal windows. Move, resize, and arrange windows with ease or, let Pop!_OS keep you organized and efficient with Auto-tiling. And use Workspaces to reduce clutter by organizing windows across multiple desktops." Apparently, there will only be one configuration priced at $1,099. So far, no details about a release date have been announced other than "coming soon."' -- source: https://news.slashdot.org/story/22/05/21/0228258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Rust Supply-Chain Attack Infected Cloud CI Pipelines with Go Malware
by Peter Reutemann 22 May '22

22 May '22

'Sentinel Labs provides malware/threat intelligence analysis for the enterprise cybersecurity platform SentinelOne. Thursday they reported on "a supply-chain attack against the Rust development community that we refer to as 'CrateDepression'." On May 10th, 2022, the Rust Security Response Working Group released an advisory announcing the discovery of a malicious crate hosted on the Rust dependency community repository. The malicious dependency checks for environment variables that suggest a singular interest in GitLab Continuous Integration (CI) pipelines. Infected CI pipelines are served a second-stage payload. We have identified these payloads as Go binaries built on the red-teaming framework, Mythic. Given the nature of the victims targeted, this attack would serve as an enabler for subsequent supply-chain attacks at a larger-scale relative to the development pipelines infected. We suspect that the campaign includes the impersonation of a known Rust developer to poison the well with source code that relies on the typosquatted malicious dependency and sets off the infection chain.... In an attempt to fool rust developers, the malicious crate typosquats against the well known rust_decimal package used for fractional financial calculations.... The malicious package was initially spotted by an avid observer and reported to the legitimate rust_decimal github account.... Both [Linux and macOs] variants serve as an all-purpose backdoor, rife with functionality for an attacker to hijack an infected host, persist, log keystrokes, inject further stages, screencapture, or simply remotely administer in a variety of ways.... Software supply-chain attacks have gone from a rare occurrence to a highly desirable approach for attackers to 'fish with dynamite' in an attempt to infect entire user populations at once. In the case of CrateDepression, the targeting interest in cloud software build environments suggests that the attackers could attempt to leverage these infections for larger scale supply-chain attacks.' -- source: https://developers.slashdot.org/story/22/05/21/0520207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modular, DIY-friendly Framework Laptop gets updated with 12th-gen Intel CPUs
by Peter Reutemann 20 May '22

20 May '22

'We were fans of the Framework Laptop when we reviewed it last year. This was partly because its modular design prioritizes repairability and upgradeability when most other laptops don't. But we also liked it because you didn't need to make huge tradeoffs to get that repairability—the Framework Laptop is lightweight and has a high-quality screen, keyboard, and touchpad, helping it stay competitive with big-box thin-and-light laptops like Dell's XPS 13 and the Lenovo ThinkPad X1 Carbon. An upgradeable laptop is only worthwhile if you can actually upgrade it, though, and Framework is making that possible starting today: The company is introducing a new iteration of the Framework Laptop's motherboard that uses 12th-gen Intel CPUs. A brand-new 12th-gen Framework Laptop starts at $1,049 for a Core i5-equipped base model, or $819 for a build-it-yourself kit with no memory or storage. These products will be available for preorder starting today, and shipping will start in July. [...] While many of Framework's PCs will run Windows, the company boasts that the 12th-gen version of its laptop "continue[s] to focus on solid Linux support." Framework recommends Fedora 36 because it "works fantastically well out of the box" and fully supports the Framework Laptop's new CPUs, its Wi-Fi card, and its fingerprint reader. For now, though, you'll need to be careful about installing other Linux distributions—you need Linux kernel version 5.17.6 or newer to fully support Alder Lake's hybrid CPU architecture, and prominent, actively maintained distributions like Ubuntu 22.04 don't include that kernel version out of the box. This problem will disappear for most Linux distros within the next few months, but for now you may need to upgrade the kernel manually to get the best-possible Linux experience on the Framework Laptop. -- source: https://arstechnica.com/gadgets/2022/05/modular-diy-friendly-framework-lapt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0