- wlug - list.wlug.org.nz

Nosey Parker: Open-source tool finds sensitive information in textual data and Git history
by Peter Reutemann 16 Oct '25

16 Oct '25

This sounds like a useful tool: 'Nosey Parker is an open-source command-line tool that helps find secrets and sensitive information hidden in text files. It works like a specialized version of grep, focused on spotting things like passwords, API keys, and other confidential data. The tool was built with offensive security in mind, such as helping red teams move through systems during tests. It’s also useful for defensive teams checking their own systems. Offensive cybersecurity company Praetorian has used it in hundreds of security engagements to uncover hidden secrets. Key features: - Flexible scanning: Works on files, folders, GitHub repositories, and Git history. It also supports custom input sources. - Proven detection rules: Uses 188 tested regular expression rules, built from feedback by security engineers, to cut down on false positives. - Less noise: Groups duplicate matches of the same secret, making reviews 10 to 1,000 times faster. - High performance: Can scan gigabytes per second on multicore machines and handle datasets as large as 20TB.' -- source: https://www.helpnetsecurity.com/2025/09/24/nosey-parker-open-source-tool/ -- github: https://github.com/praetorian-inc/noseyparker Cheers, Peter

1 0

Secure Boot Bypass Risk Threatens Nearly 200,000 Linux Framework Laptops
by Peter Reutemann 16 Oct '25

16 Oct '25

'Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules. The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.' -- source: https://it.slashdot.org/story/25/10/14/2123205 Cheers, Peter

1 0

FSF Announces the LibrePhone Project
by Peter Reutemann 16 Oct '25

16 Oct '25

'The Free Software Foundation (FSF) has launched the LibrePhone Project, an initiative to create a fully free and open-source mobile operating system that eliminates proprietary firmware and binary blobs. From the FSF: "Librephone is a new initiative by the FSF with the goal of bringing full freedom to the mobile computing environment. The vast majority of software users around the world use a mobile phone as their primary computing device. After forty years of advocacy for computing freedom, the FSF will now work to bring the right to study, change, share, and modify the programs users depend on in their daily lives to mobile phones. ... Practically, Librephone aims to close the last gaps between existing distributions of the Android operating system and software freedom. The FSF has hired experienced developer Rob Savoye (DejaGNU, Gnash, OpenStreetMap, and more) to lead the technical project. He is currently investigating the state of device firmware and binary blobs in other mobile phone freedom projects, prioritizing the free software work done by the not entirely free software mobile phone operating system LineageOS." ' -- source: https://news.slashdot.org/story/25/10/15/0312206 -- project: https://librephone.fsf.org/ Cheers, Peter

1 0

Flatpak Doesn't Work in Ubuntu 25.10, But a Fix is Coming
by Peter Reutemann 14 Oct '25

14 Oct '25

'"It's not just you: Flatpak flat-out doesn't work in the new Ubuntu 25.10 release," writes the blog OMG Ubuntu: While Flatpak itself can be installed using apt, trying to install Flatpaks with Flatpak from the command-line throws a "could not unmount revokefs-fuse filesystem" error, followed by "Child process exited with code 1". For those who've installed the Ubuntu 'Questing Quokka' and wanted to kit it out with their favourite software from Flathub, it's a frustrating road bump. AppArmor, the tool that enforces Ubuntu's security policies for apps, is causing the issue. According to the bug report on Launchpad, the AppArmor profile for fusermount3 lacks the privileges it needs to work properly in Ubuntu 25.10. Fusermount3 is a tool Flatpak relies on to mount and unmount filesystems... This is a bug and it is being worked on. Although there's no timeframe for a fix, it is marked as critical, so will be prioritised. The bug was reported in early September, but not fixed in time for this week's Ubuntu 25.10 release, reports Phoronix: Only [Friday] an updated AppArmor was pushed to the "questing-proposed" archive for testing. Since then... a number of users have reported that the updated AppArmor from the proposed archive will fix the Flatpak issues being observed. From all the reports so far it looks like that proposed update is in good shape for restoring Flatpak support on Ubuntu 25.10. The Ubuntu team is considering pushing out this update sooner than the typical seven day testing period given the severity of the issue. More details from WebProNews: Industry insiders point out that AppArmor, Ubuntu's mandatory access control system, was tightened in this release to enhance security... This isn't the first time AppArmor has caused friction; similar issues plagued Telegram Flatpak apps in Ubuntu 24.04 LTS earlier this year, as noted in coverage from OMG Ubuntu.' -- source: https://news.slashdot.org/story/25/10/13/067256 Cheers, Peter

1 0

Ubuntu 25.10 'Questing Quokka' Released
by Peter Reutemann 10 Oct '25

10 Oct '25

'9to5Linux reports: Dubbed Questing Quokka, Ubuntu 25.10 is powered by the latest and greatest Linux 6.17 kernel series for top-notch hardware support and ships with the latest GNOME 49 desktop environment, defaulting to a Wayland-only session for the Ubuntu Desktop flavor, meaning there's no other session to choose from the login screen. Ubuntu Desktop also ships with two new apps, namely GNOME's Loupe instead of Eye of GNOME as the default image viewer, as well as Ptyxis instead of GNOME Terminal as the default terminal emulator. Also, there's a new update notification that will be shown with options to open Software Updater or install updates directly.' Other highlights of Ubuntu 25.10 include sudo-rs as the default implementation of sudo, Dracut as the default initramfs-tools, Chrony as the default NTP (Network Time Protocol) client, Rust Coreutils as the default implementation of GNU Core Utilities, and TPM-backed FDE (Full Disk Encryption) recovery key management. Moreover, Ubuntu 25.10 adds NVIDIA Dynamic Boost support and enables suspend-resume support in the proprietary NVIDIA graphics driver to prevent corruption and freezes when waking an NVIDIA desktop. For Intel users, Ubuntu 25.10 introduces support for new Intel integrated and discrete GPUs.' -- source: https://news.slashdot.org/story/25/10/09/2054218 Cheers, Peter

1 0

VLC’s First Update in a Year to Introduce Qt6 and Windows ARM64 Support
by Peter Reutemann 09 Oct '25

09 Oct '25

'After a year of silence, one of the most popular media players, VLC, is back with a new release candidate, version 3.0.22 RC1 (Vetinari). Although much of the attention is on version 4.0, long in development and expected to deliver major changes, this release also includes a notable update. One of the most important features is support for building VLC with Qt6, which is (as you can guess) a big win for all KDE enthusiasts. On top of that, the release candidate introduces native Windows ARM64 support, reflecting the growing interest in ARM hardware on laptops and tablets. The update also packs a wide set of fixes and adjustments. The developers disabled the older liba52, libmpeg2, and libdca libraries by default, encouraging use of libavcodec instead. On the playback side, users can expect improvements for AV1, Opus, ProRes, FLAC, and JPEG handling, plus more reliable behavior when seeking over SFTP and refinements in Matroska and DVD caption support. Regarding security, VLC 3.0.22 RC1 addresses a record number of issues, many of them caught through the oss-fuzz project and funding from the SecureTrust Fund. That makes this update one of the most important in recent years from a stability and safety standpoint. Lastly, Windows users will notice that the player now allows renaming, moving, or deleting the currently playing file, and there’s even a renewed compatibility with Windows XP SP3 (yes, there are still enthusiasts betting on it), which is still in use in some very specific setups.' -- source: https://linuxiac.com/vlcs-first-update-in-a-year-to-introduce-qt6-and-windo… Cheers, Peter

1 0

Tails 7.0 Anonymous Linux OS Officially Released, Based on Debian 13 “Trixie”
by Peter Reutemann 07 Oct '25

07 Oct '25

'Tails 7.0 is out today as a major update to this portable Linux OS based on the Debian GNU/Linux operating system that protects users against surveillance and censorship. Highlights of Tails 7.0 include a Debian 13 “Trixie” base and a kernel from the long-term supported Linux 6.12 LTS series from the upstream Debian release, the latest GNOME 48 desktop environment by default featuring GNOME Console as default terminal emulator and GNOME Loupe as default image viewer. The Tails devs note the fact that the Root Terminal was broken when replacing GNOME Terminal with GNOME Console, so they renamed Root Terminal to Root Console. They also removed the Kleopatra app from the Favorites menu, so now users will have to start Kleopatra from Apps > Accessories. Moreover, they removed the obsolete Network Connection option from the Welcome Screen, the Places menu, and some packages from the live ISO image, including unar, aircrack-ng, and sq. Tails 7.0 ships with many updated components, including Tor 0.4.8.17, Tor Browser 14.5.7, Mozilla Thunderbird 128.14 ESR, OnionShare 2.6.3, Kleopatra 24.12, KeePassXC 2.7.10, GIMP 3.0.4, Inkscape 1.4, Audacity 3.7.3, and Electrum 4.5.8. For Inkscape, Tails now skips the onboarding. This release also fixes various issues, including an issue with selecting the correct keyboard for certain languages. Check out the release notes for more details about the changes included in Tails 7.0, which is available for download right now from the official website as ISO and USB images for 64-bit systems.' -- source: https://9to5linux.com/tails-7-0-anonymous-linux-os-released-based-on-debian… Cheers, Peter

1 0

Redis Warns of Critical Flaw Impacting Thousands of Instances
by Peter Reutemann 07 Oct '25

07 Oct '25

'BleepingComputer reports: The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts. After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud services. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments," said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell. While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, "prioritizing those that are exposed to the internet." To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs).' -- source: https://it.slashdot.org/story/25/10/06/222222 Cheers, Peter

1 0

Systemd 258 Drops cgroup v1, Raises Kernel Baseline to 5.4
by Peter Reutemann 06 Oct '25

06 Oct '25

'Systemd, a widely adopted system and service manager for Linux, has released its latest iteration, v258, which introduces significant changes that administrators should be aware of. Probably the headline change is that support for cgroup v1—the so-called “legacy” and “hybrid” hierarchies—has been removed. From now on, only cgroup v2 is mounted during boot and inside systemd-nspawn containers. Another notable move is the bump in the minimum kernel requirement. The baseline is now Linux 5.4, first released back in 2019, with 5.7 listed as the recommended version. That means older distributions or kernels simply won’t be able to run systemd 258. Security changes are also in play. By default, tty/pts device nodes now get mode 0600 instead of the old 0620, which effectively means “mesg n” is the new normal. On the crypto side, OpenSSL has become the only supported backend for systemd-resolved and systemd-importd, dropping support for both GnuTLS and libgcrypt. Session handling has been reworked, too. systemd-logind now assigns system jobs like cron tasks or FTP sessions to new “light” classes by default. That way, they won’t spin up a full per-user service manager unless explicitly configured. PAM sessions tied to normal users remain unchanged. Admins maintaining old setups should also take note: support for System V–style init scripts is officially deprecated and scheduled for removal in systemd 259. The same goes for the legacy /run/lock/ directory, and for iptables support in networkd and nspawn, which will rely solely on nftables from the next release.' -- source: https://linuxiac.com/systemd-258-drops-cgroup-v1-raises-kernel-baseline-to-… Cheers, Peter

1 0

How to switch your Windows 10 PC to Linux Mint - for free
by Peter Reutemann 06 Oct '25

06 Oct '25

Maybe this article with step-by-step instructions might help some of the Windows user in your circle to switch to Linux... -- source: https://www.zdnet.com/article/how-to-switch-your-windows-10-pc-to-linux-min… Cheers, Peter

1 0