- wlug - list.wlug.org.nz

Google's Play Store Identified as Main Distribution Vector For Most Android Malware
by Peter Reutemann 12 Nov '20

12 Nov '20

'The official Google Play Store has been identified as the primary source of malware installs on Android devices in a recent academic study -- considered the largest one of its kind carried out to date. >From a report: Using telemetry data provided by NortonLifeLock (formerly Symantec), researchers analyzed the origin of app installations on more than 12 million Android devices for a four-month period between June and September 2019. In total, researchers looked at more than 34 million APK (Android application) installs for 7.9 million unique apps. [...] The results showed that around 67% of the malicious app installs researchers identified came from the Google Play Store. Google did not respond to a request for comment made by ZDNet almost three weeks ago.' -- source: https://tech.slashdot.org/story/20/11/11/198244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cricket NZ Makes Exclusive Deal With Amazon Prime For Indian Market
by Lawrence D'Oliveiro 11 Nov '20

11 Nov '20

Indian cricket fans (of which there are many) wanting to watch NZ matches will need to sign up for the Amazon Prime streaming service, according to this <https://www.theregister.com/2020/11/11/amazon_prime_new_zealand_cricket_dea…>. The deal will run for six years from late next year.

1 0

Lightweight Linux Distros for Old Laptop (2020)
by Peter Reutemann 11 Nov '20

11 Nov '20

'Do not discard that old PC or laptop yet. You can use a lightweight Linux distro to make them as good as new. Some of these Linux distros are specifically for use in older machines. You can use any of the lightweight Linux distros and bring your old machine back to life. In as much we focus on the old distros, we do have some new releases that do not require many resources that can re-invent your old computers. Are you in any or all of the situations below? - Your computer is but still feel like you can revive it - Your computer is modern but runs on low power - You need to install a modern computer to reserve resources to other demanding tasks If you find yourself in any of the above situations, then the best choice of action would be to start looking for the best lightweight Linux distros for old computers.' -- source: https://linoxide.com/distros/lightweight-linux-distros-for-old-laptop/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Scientists Achieve 'Crown Jewel' of Cryptography
by Peter Reutemann 11 Nov '20

11 Nov '20

'A cryptographic master tool called indistinguishability obfuscation has for years seemed too good to be true. Three researchers have figured out that it can work. Erica Klarreich, reporting for Quanta Magazine: In 2018, Aayush Jain, a graduate student at the University of California, Los Angeles, traveled to Japan to give a talk about a powerful cryptographic tool he and his colleagues were developing. As he detailed the team's approach to indistinguishability obfuscation (iO for short), one audience member raised his hand in bewilderment. "But I thought iO doesn't exist?" he said. At the time, such skepticism was widespread. Indistinguishability obfuscation, if it could be built, would be able to hide not just collections of data but the inner workings of a computer program itself, creating a sort of cryptographic master tool from which nearly every other cryptographic protocol could be built. It is "one cryptographic primitive to rule them all," said Boaz Barak of Harvard University. But to many computer scientists, this very power made iO seem too good to be true. Computer scientists set forth candidate versions of iO starting in 2013. But the intense excitement these constructions generated gradually fizzled out, as other researchers figured out how to break their security. As the attacks piled up, "you could see a lot of negative vibes," said Yuval Ishai of the Technion in Haifa, Israel. Researchers wondered, he said, "Who will win: the makers or the breakers?" "There were the people who were the zealots, and they believed in [iO] and kept working on it," said Shafi Goldwasser, director of the Simons Institute for the Theory of Computing at the University of California, Berkeley. But as the years went by, she said, "there was less and less of those people." Now, Jain -- together with Huijia Lin of the University of Washington and Amit Sahai, Jain's adviser at UCLA -- has planted a flag for the makers. In a paper posted online on August 18, the three researchers show for the first time how to build indistinguishability obfuscation using only "standard" security assumptions. All cryptographic protocols rest on assumptions -- some, such as the famous RSA algorithm, depend on the widely held belief that standard computers will never be able to quickly factor the product of two large prime numbers. A cryptographic protocol is only as secure as its assumptions, and previous attempts at iO were built on untested and ultimately shaky foundations. The new protocol, by contrast, depends on security assumptions that have been widely used and studied in the past. "Barring a really surprising development, these assumptions will stand," Ishai said. While the protocol is far from ready to be deployed in real-world applications, from a theoretical standpoint it provides an instant way to build an array of cryptographic tools that were previously out of reach. For instance, it enables the creation of "deniable" encryption, in which you can plausibly convince an attacker that you sent an entirely different message from the one you really sent, and "functional" encryption, in which you can give chosen users different levels of access to perform computations using your data. The new result should definitively silence the iO skeptics, Ishai said. "Now there will no longer be any doubts about the existence of indistinguishability obfuscation," he said. "It seems like a happy end."' -- source: https://science.slashdot.org/story/20/11/10/1922225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

And Now For Some Local Bork
by Lawrence D'Oliveiro 10 Nov '20

10 Nov '20

A laser projection mural in Christchurch goes slightly wrong, showing a Windows 10 message instead <https://www.theregister.com/2020/11/09/bork/>: There can be few of us who have not felt the clammy hand of a Windows update on our shoulder, but sticking it on a mural and declaring it "art"? That takes a New Zealander.

1 0

HP Replaces 'Free Ink for Life' Plan With '99 Cents a Month Or Your Printer Stops Working'
by Peter Reutemann 10 Nov '20

10 Nov '20

'In a new essay at EFF.org, Cory Doctorow re-visits HP's anti-consumer "security updates" that disabled third-party ink cartridges (while missing real vulnerabilities that could actually bypass network firewalls). Doctorow writes that it was just the beginning: HP's latest gambit challenges the basis of private property itself: a bold scheme! With the HP Instant Ink program, printer owners no longer own their ink cartridges or the ink in them. Instead, HP's customers have to pay a recurring monthly fee based on the number of pages they anticipate printing from month to month; HP mails subscribers cartridges with enough ink to cover their anticipated needs. If you exceed your estimated page-count, HP bills you for every page (if you choose not to pay, your printer refuses to print, even if there's ink in the cartridges). If you don't print all your pages, you can "roll over" a few of those pages to the next month, but you can't bank a year's worth of pages to, say, print out your novel or tax paperwork. Once you hit your maximum number of "banked" pages, HP annihilates any other pages you've paid for (but continues to bill you every month). Now, you may be thinking, "All right, but at least HP's customers know what they're getting into when they take out one of these subscriptions," but you've underestimated HP's ingenuity. HP takes the position that its offers can be retracted at any time. For example, HP's "Free Ink for Life" subscription plan offered printer owners 15 pages per month as a means of tempting users to try out its ink subscription plan and of picking up some extra revenue in those months when these customers exceeded their 15-page limit. But Free Ink for Life customers got a nasty shock at the end of last month: HP had unilaterally canceled their "free ink for life" plan and replaced it with "a $0.99/month for all eternity or your printer stops working" plan... For would-be robber-barons, "smart" gadgets are a moral hazard, an irresistible temptation to use those smarts to reconfigure the very nature of private property, such that only companies can truly own things, and the rest of us are mere licensors, whose use of the devices we purchase is bound by the ever-shifting terms and conditions set in distant boardrooms. From Apple to John Deere to GM to Tesla to Medtronic, the legal fiction that you don't own anything is used to force you to arrange your affairs to benefit corporate shareholders at your own expense. And when it comes to "razors and blades" business-model, embedded systems offer techno-dystopian possibilities that no shaving company ever dreamed of: the ability to use law and technology to prevent competitors from offering their own consumables. >From coffee pods to juice packets, from kitty litter to light-bulbs, the printer-ink cartridge business-model has inspired many imitators. HP has come a long way since the 1930s, reinventing itself several times, pioneering personal computers and servers. But the company's latest reinvention as a wallet-siphoning ink grifter is a sad turn indeed, and the only thing worse than HP's decline is the many imitators it has inspired.' -- source: https://hardware.slashdot.org/story/20/11/09/0221226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners Lee's Startup Inrupt Releases Privacy Platform for Enterprises
by Peter Reutemann 10 Nov '20

10 Nov '20

'Inrupt, the startup from World Wide Web founder Tim Berners-Lee, announced an enterprise version of the Solid privacy platform today, which allows large organizations and governments to build applications that put users in control of their data . From a report: Berners-Lee has always believed that the web should be free and open, but large organizations have grown up over the last 20 years that make their money using our data. He wanted to put people back in charge of their data, and the Solid open source project, developed at MIT, was the first step in that process. Three years ago he launched Inrupt, a startup built on top of the open source project, and hired John Bruce to run the company. The two shared the same vision of shifting data ownership without changing the way websites get developed. With Solid, developers use the same standards and methods of building sites, and these applications will work in any browser. What Solid aims to do is alter the balance of data power and redirect it to the user. "Fast forward to today, and we're releasing the first significant technology as the fruits of our labor, which is an enterprise version of Solid to be deployed at scale by large organizations," Bruce explained. The core idea behind this approach is that users control their data in online storage entities called Personal Online Data Stores or Pods for short. The enterprise version consists of Solid Server to manage the Pods, and developers can build applications using an SDK to take advantage of the Pods and access the data they need to do a particular job like pay taxes or interact with a healthcare provider. Bruce points out that the enterprise version is fully compatible with the open source Solid project specifications. The company has been working with some major organizations prior to today's release including the BBC and National Health Service in the UK and the Government of Flanders in Belgium as they have been working to bring this to market.' -- source: https://yro.slashdot.org/story/20/11/09/1453252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Compal, the Second-Largest Laptop Manufacturer in the World, Hit By Ransomware
by Peter Reutemann 10 Nov '20

10 Nov '20

'Compal, a Taiwanese electronics company that builds laptops for some of the world's largest computer brands, suffered a ransomware attack over the weekend. From a report: Responsible for the breach is believed to be the DoppelPaymer ransomware gang, according to a screenshot of the ransom note shared by Compal employees with Yahoo Taiwan reporters. According to Taiwanese media, the incident was discovered on Sunday morning and is believed to have impacted around 30% of Compal's computer fleet. Employees arriving at work were greeted by a memo from Compal's IT staff, asking workers to check the status of their workstations and back up important files on systems that were not impacted.' -- source: https://it.slashdot.org/story/20/11/09/1615207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FTC Announces a Settlement With Zoom Over Security Issues
by Peter Reutemann 10 Nov '20

10 Nov '20

'Zoom will implement new security practices as part of a proposed settlement with the Federal Trade Commission, the agency announced on Monday. From a report: "Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base, which has skyrocketed from 10 million in December 2019 to 300 million in April 2020 during the COVID-19 pandemic," the FTC said in a press release.' -- source: https://news.slashdot.org/story/20/11/09/1645233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cyberattackers Now Also Make Linux Versions of Their Ransomware
by Peter Reutemann 09 Nov '20

09 Nov '20

'"Security firm Kaspersky said Friday that it discovered a Linux version of the RansomEXX ransomware," reports ZDNet, "marking the first time a major Windows ransomware strain has been ported to Linux to aid in targeted intrusions." RansomEXX is a relatively new ransomware strain that was first spotted earlier this year in June. The ransomware has been used in attacks against the Texas Department of Transportation, Konica Minolta, U.S. government contractor Tyler Technologies, Montreal's public transportation system, and, most recently, against Brazil's court system (STJ)... The RansomEXX gang creating a Linux version of their Windows ransomware is in tune with how many companies operate today, with many firms running internal systems on Linux, and not always on Windows Server. A Linux version makes perfect sense from an attacker's perspective; always looking to expand and touch as much core infrastructure as possible in their quest to cripple companies and demand higher ransoms. What we see from RansomEXX may soon turn out to be an industry-defining trend, with other big ransomware groups rolling out their Linux versions in the future as well. And, this trend appears to have already begun. According to cyber-security firm Emsisoft, besides RansomEXX, the Mespinoza (Pysa) ransomware gang has also recently developed a Linux variant from their initial Windows version.' -- source: https://linux.slashdot.org/story/20/11/07/0541223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0