- wlug - list.wlug.org.nz

Reuters: Apple cut backup end-to-end encryption plans after FBI complained
by Peter Reutemann 22 Jan '20

22 Jan '20

'Two years ago, Apple dropped a plan that would have made it impossible for the company to decrypt iPhone and iPad backups for law enforcement, according to a Reuters report today. Reuters wrote that "six sources familiar with the matter" confirmed that Apple dropped the end-to-end encryption plan for iCloud Backup "after the FBI complained that the move would harm investigations." Apple had "told the FBI that it planned to offer users end-to-end encryption when storing their phone data on iCloud" more than two years ago, Reuters wrote. "Under that plan, primarily designed to thwart hackers, Apple would no longer have a key to unlock the encrypted data, meaning it would not be able to turn material over to authorities in a readable form even under court order," the report continued. But the FBI objected, and Apple dropped the plan, although the exact reason for doing so isn't clear. One former Apple employee told Reuters that the company "decided they weren't going to poke the bear anymore." However, another former Apple employee "said it was possible the encryption project was dropped for other reasons, such as concern that more customers would find themselves locked out of their data more often."' -- source: https://arstechnica.com/tech-policy/2020/01/apple-reportedly-nixed-plan-for… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notorious Crime Gang Targets Internet Routers Using Tomato Firmware
by Peter Reutemann 22 Jan '20

22 Jan '20

'Internet routers running the Tomato alternative firmware are under active attack by a self-propagating exploit that searches for devices using default credentials. When credentials are found, the exploit then makes the routers part of a botnet that's used in a host of online attacks, researchers said on Tuesday. The Muhstik botnet came to light about two years ago when it started unleashed a string of exploits that attacked Linux servers and Internet-of-things devices. It opportunistically exploited a host of vulnerabilities, including the so-called critical Drupalgeddon2 vulnerability disclosed in early 2018 in the Drupal content management system. Muhstik has also been caught using vulnerabilities in routers that use Gigabit Passive Optical Network (GPON) or DD-WRT software. The botnet has also exploited previously patched vulnerabilities in other server applications, including the Webdav, WebLogic, Webuzo, and WordPress. On Tuesday, researchers from Palo Alto Networks said they recently detected Muhstik targeting Internet routers running Tomato, an open-source package that serves as an alternative to firmware that ships by default with routers running Broadcom chips. The ability to work with virtual private networks and provide advanced quality of service control make Tomato popular with end users and in some cases router sellers. The exploits use already infected devices to scan the Internet for Tomato routers and, when found, to check if they use the default username and password of "admin:admin" or "root:admin" for remote administration. The exploit causes Tomato routers that haven't been locked down with a strong password to join an IRC server that's used to control the botnet. The infection also causes the routers to scan the Internet for servers or devices running WordPress, Webuzo, or WebLogic packages that are vulnerable.' -- source: https://it.slashdot.org/story/20/01/21/2039246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

14% of Android App Privacy Policies Contain Contradictions About Data Collection
by Peter Reutemann 22 Jan '20

22 Jan '20

'A large number of Android mobile apps listed on the official Google Play Store contain self-contradictory language in their privacy policies in regards to data collection practices. From a report: In an academic study published last year, researchers created a tool named PolicyLint that analyzed the language used in the privacy policies of 11,430 Play Store apps. They found that 14.2% (1,618 apps) contained a privacy policy with logical contradicting statements about data collection. Examples include privacy policies that stated in one section that they do not collect personal data, only to contradict themselves in subsequent sections, where they state they collect emails or customer names -- which are clearly personally-idenfiable information. While the research team could not determine the app maker's intent in using contradicting statements in their privacy policy, researchers feel the primary purpose was to mislead users if they ever took the time to read the policies.' -- source: https://yro.slashdot.org/story/20/01/21/188216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Official Kubuntu 'Focus' Linux Laptop Goes on Sale
by Peter Reutemann 21 Jan '20

21 Jan '20

'You can buy an official Kubuntu laptop. Called "Focus". It is an absolutely powerhouse with top specs. From a report: Here's the specs list: CPU: Core i7-9750H 6c/12t 4.5GHz Turbo GPU: 6GB GTX-2060 RAM: 32GB Dual Channel DDR4 2666 RAM Storage: 1TB Samsung 970 EVO Plus NVMe Display: 16.1" matte 1080p IPS Keyboard: LED backlit, 3-4mm travel User expandable SDD, NVMe, and RAM Superior cooling The starting price for the Kubuntu Focus Laptop is $2395. ' -- source: https://linux.slashdot.org/story/20/01/20/1856240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Why This Time The New Browser Wars Are Different
by Peter Reutemann 21 Jan '20

21 Jan '20

'The Verge argues that the browser wars "are back, but it's different this time." The mobile web is broken and unfettered tracking and data sharing have made visiting websites feel toxic, but since the ecosystem of websites and ad companies can't fix it through collective action, it falls on browser makers to use technological innovations to limit that surveillance, however each company that makes a browser is taking a different approach to creating those innovations, and everybody distrusts everybody else to act in the best interest of the web instead of the best interest of their employers' profits... I've been avoiding getting into the precise details of the proposals out there to fix the tracking problem because things are changing so quickly across so many different tracks... Until then, know that there are two important things to know. First: there are new browser technologies and limits coming that could radically change how ads work and could make it easier for you to protect your privacy no matter what browser you use. Since this is the web, it'll take time, but everybody seems committed. Second: the way many of us think about a Browser War is in terms of marketshare -- and that is the wrong metric this time. There is a browser war, but it won't be won or lost based on who can convince the most people to switch to their browser. Because most people can't or won't switch on the platform that matters: mobile. In 2020, the desktop is a minor skirmish compared to browsers on phones. On phones, many people aren't really free to choose their browser. That's literally true on the iPhone, which Apple locks down so apps can only use its web rendering technology. And it's for-intents-and-purposes true on Android, where the vast majority of browsers just use Chromium. Yes, there is an Android browser ballot happening in Europe, but it's much too early to know what its effects will be.... The new Browser Wars aren't about who makes the fastest or best browser, they're about whose services you want and whose data policies you trust. ' -- source: https://news.slashdot.org/story/20/01/20/048217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Opera Accused of Offering Predatory Loans Through Android apps
by Peter Reutemann 21 Jan '20

21 Jan '20

'"It's no secret that Opera isn't doing so well in the era of Chrome dominance," reports Android Police. "According to a report published by Hindenburg Research, the company's losses in browser revenue have apparently led it to create multiple loan apps with short payment windows and interest rates of ~365-876%, which are in violation of new Play Store rules Google enacted last year." The apps are aimed at India, Kenya and Nigeria, reports Engadget: The apps would claim to offer maximum annual percentage rate (APR) of 33 percent or less, but the actual rates were much higher, climbing to 438 percent in the case of OPesa. And while they publicly offered reasonable loan terms of 91 to 365 days, the real length was no more than 29 days (for OKash) and more often 15 days -- well under Google's 60-day minimum. The conditions only got worse for borrowers who missed their payments. Falling short by just a day could raise the APR as high as 876 percent. Also, the apps reportedly scraped phone contacts to harass family, friends and others with calls and texts in hopes this would pressure customers into paying up. These same notices often threatened legal action. Android Police points out that Opera became a public company in mid-2017, shortly after it was purchased by a China-based investor group. But since then, "Opera's market share has continued to fall, due to the increasing dominance of Chrome.' -- source: https://slashdot.org/story/20/01/20/0329242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jan '20

20 Jan '20

Hi everyone We have a meeting schedule for *next* Monday (a week earlier than usual due to Auckland Anniversary holiday): 'Is your Android phone no longer supported by your manufacturer? Then you might able to update it using a custom ROM from LineageOS (https://wiki.lineageos.org/devices/) or AospExtended ROM (https://www.aospextended.com/devices/pie) Peter Reutemann will show the process of updating the ROM on an Android phone.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791984 https://gettogether.community/events/3274/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Researchers find serious flaws in WordPress plugins used on 400k sites
by Peter Reutemann 20 Jan '20

20 Jan '20

'Serious vulnerabilities have recently come to light in three WordPress plugins that have been installed on a combined 400,000 websites, researchers said. InfiniteWP, WP Time Capsule, and WP Database Reset are all affected. The highest-impact flaw is an authentication bypass vulnerability in the InfiniteWP Client, a plugin installed on more than 300,000 websites. It allows administrators to manage multiple websites from a single server. The flaw lets anyone log in to an administrative account with no credentials at all. From there, attackers can delete contents, add new accounts, and carry out a wide range of other malicious tasks.' -- source: https://arstechnica.com/information-technology/2020/01/researchers-find-ser… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Project Goes Private: Amara Stops Being Developed As Open Source
by Peter Reutemann 20 Jan '20

20 Jan '20

'Slashdot reader northar writes: Subtitling project Amara closes its repository as focus is shifting... Amara was AGPL up until going private. While future improvements to the code base from the Participatory Culture Foundation (PCF) will not be public, a copy of the last public code base has been preserved at Gitlab, should anyone be interested in the work done up until now. Note that no support is given from PCF for this code >From Amara's official statement on the move: The Participatory Culture Foundation began as a nonprofit in 2006 with a focus on creating open source software to ensure that emerging video technologies were accessible to all.... For an organization like PCF, which relies on revenue generated from sustainability initiatives to fund social impact work, we believe the risk to these initiatives outweighs the potential or perceived public benefit from maintaining open code. Releasing software as open source unfortunately does not provide protection against well-funded technology firms that are driven by profit... Without the proper market position and resources, a smaller organization that relies on revenue from software they build can be outmaneuvered or overpowered with the very technology they created (assuming their code is open source). This is not only a threat to smaller organizations, but has also become a bigger debate that much larger companies are also hashing out. For venture-funded or publicly traded firms, the open source approach can be a calculated risk that makes business sense. But for less-capitalized organizations or nonprofits, like PCF, who lack significant market power, making software open source puts other more well-resourced players in position to leverage the technology in ways that may undermine the sustainability and/or the values of the original developer. With these shifts in the computing landscape, PCF has not seen individuals or communities as the primary beneficiary of releasing Amara code as open source. Instead, we have unfortunately had firsthand experience with a venture-funded organization deploying code we created and using it in ways that we did not think aligned well with our values.... As we undertake this shift in 2020, we are aware that the computing landscape will continue to change and thus we remain open to newer and better strategies for making source code available in the long-term. Future strategies might include data trusts and/or new licenses that better align with our sustainability initiatives and mission.' -- source: https://news.slashdot.org/story/20/01/18/1753246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Software Designers Ignoring The Needs of the Elderly?
by Peter Reutemann 20 Jan '20

20 Jan '20

'"[A]t the very time that it's become increasingly difficult for anyone to conduct their day to day lives without using the Net, some categories of people are increasingly being treated badly by many software designers," argues long-time Slashdot reader Lauren Weinstein: The victims of these attitudes include various special needs groups — visually and/or motor impaired are just two examples — but the elderly are a particular target. Working routinely with extremely elderly persons who are very active Internet users (including in their upper 90s!), I'm particularly sensitive to the difficulties that they face keeping their Net lifelines going. Often they're working on very old computers, without the resources (financial or human) to permit them to upgrade. They may still be running very old, admittedly risky OS versions and old browsers — Windows 7 is going to be used by many for years to come, despite hitting its official "end of life" for updates a few days ago. Yet these elderly users are increasingly dependent on the Net to pay bills (more and more firms are making alternatives increasingly difficult and in some cases expensive), to stay in touch with friends and loved ones, and for many of the other routine purposes for which all of us now routinely depend on these technologies.... There's an aspect of this that is even worse. It's attitudes! It's the attitudes of many software designers that suggest they apparently really don't care about this class of users much — or at all. They design interfaces that are difficult for these users to navigate. Or in extreme cases, they simply drop support for many of these users entirely, by eliminating functionality that permits their old systems and old browsers to function. He cites the example of Discourse, the open source internet forum software, which recently announced they'd stop supporting Internet Explorer. Weinstein himself hates Microsoft's browser, "Yet what of the users who don't understand how to upgrade? Who don't have anyone to help them upgrade? Are we to tell them that they matter not at all?" So he confronted Stack Exchange co-founder Jeff Atwood (who is also one of the co-founders of Discourse) on Twitter — and eventually found himself blocked. "Far more important though than this particular case is the attitude being expressed by so many in the software community, an attitude that suggests that many highly capable software engineers don't really appreciate these users and the kinds of problems that many of these users may have, that can prevent them from making even relatively simple changes or upgrades to their systems — which they need to keep using as much as anyone — in the real world."' -- source: https://developers.slashdot.org/story/20/01/19/0255220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0