- wlug - list.wlug.org.nz

Vulnerability In Fully Patched Android Phones Under Active Attack By Bank Thieves
by Peter Reutemann 03 Dec '19

03 Dec '19

'A vulnerability in millions of fully patched Android phones is being actively exploited by malware that's designed to drain the bank accounts of infected users, researchers said on Monday. The vulnerability allows malicious apps to masquerade as legitimate apps that targets have already installed and come to trust, researchers from security firm Promon reported in a post. Running under the guise of trusted apps already installed, the malicious apps can then request permissions to carry out sensitive tasks, such as recording audio or video, taking photos, reading text messages or phishing login credentials. Targets who click yes to the request are then compromised. Researchers with Lookout, a mobile security provider and a Promon partner, reported last week that they found 36 apps exploiting the spoofing vulnerability. The malicious apps included variants of the BankBot banking trojan. BankBot has been active since 2017, and apps from the malware family have been caught repeatedly infiltrating the Google Play Market. The vulnerability is most serious in versions 6 through 10, which account for about 80% of Android phones worldwide. Attacks against those versions allow malicious apps to ask for permissions while posing as legitimate apps. There's no limit to the permissions these malicious apps can seek. Access to text messages, photos, the microphone, camera, and GPS are some of the permissions that are possible. A user's only defense is to click "no" to the requests. "The vulnerability is found in a function known as TaskAffinity, a multitasking feature that allows apps to assume the identity of other apps or tasks running in the multitasking environment," reports Ars Technica. While Google has removed the [unnamed] malicious apps from its Play Store, according to Promon, the vulnerability is still unfixed in all versions of Android. "Promon is calling the vulnerability 'StrandHogg,' an old Norse term for the Viking tactic of raiding coastal areas to plunder and hold people for ransom," the report adds. "Promon researchers said they identified StrandHogg after learning from an unnamed Eastern European security company for financial institutions that several banks in the Czech Republic reported money disappearing from customer accounts."' -- source: https://it.slashdot.org/story/19/12/02/230254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Is Now Making Smartphones Without American Chips
by Peter Reutemann 03 Dec '19

03 Dec '19

'"American tech companies are getting the go-ahead to resume business with Chinese smartphone giant Huawei Technologies Co., but it may be too late," reports the Wall Street Journal. Huawei is just building its smartphones without U.S. chips. Huawei's latest phone, which it unveiled in September -- the Mate 30 with a curved display, telephone and wide-angle cameras that competes with Apple Inc.'s iPhone 11 -- contained no U.S. parts, according to an analysis by UBS and Fomalhaut Techno Solutions, a Japanese technology lab that took the device apart to inspect its insides... While Huawei hasn't stopped using American chips entirely, it has reduced its reliance on U.S. suppliers or eliminated U.S. chips in phones launched since May, including the company's Y9 Prime and Mate smartphones, according to Fomalhaut's teardown analysis. Similar inspections by iFixit and Tech Insights Inc., two other firms that take apart phones to inspect components, have come to similar conclusions.' -- source: https://mobile.slashdot.org/story/19/12/02/0146208 Looks like actual competition now... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust-Based Redox OS Is Nearly Self-Hosting After Four Years
by Peter Reutemann 02 Dec '19

02 Dec '19

'Redox OS, written in Rust and currently under development, is only "a few months of work away" from self-hosting, meaning that the Rustc compiler would run on Redox itself, according to its creator Jeremy Soller... Redox has a POSIX-compliant C library written in Rust, called relibc. It is Linux-compatible both at the syscall API level and at the syscall ABI (Application binary interface) level, subject to the same architecture. The article notes that the OS's latest release was version 0.5 last March, arguing that it's "best described as experimental..." "Still, if Rust continues to grow in popularity, its characteristics of safety and unimpeded performance seem ideal for creating a new operating system, so perhaps Redox will become more prominent."' -- source: https://linux.slashdot.org/story/19/11/30/2011231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kali Linux Adds 'Undercover' Mode to Impersonate Windows 10
by Peter Reutemann 02 Dec '19

02 Dec '19

'"Kali Linux 2019.4 was released last week and with it comes an 'Undercover' mode that can be used to quickly make the Kali desktop look like Windows 10," reports Bleeping Computer: Kali is a Linux distribution created for ethical hacking and penetration testing and is commonly used by researchers and red teamers to perform security tests against an organization. As most people are used to seeing Windows and macOS devices being used, it may look suspicious to see a user running Kali Linux with it's distinctive dragon logo and a Linux environment in an office lobby or other public setting. With this in mind, in Kali Linux 2019.4 the developers created a new 'Undercover' mode that will make the desktop look similar to Windows 10 in order to draw less suspicion. The script even hides Kali's dragon logo, explains a post on the Kali blog, so "you can work a bit more incognito. After you are done and in a more private place, run the script again and you switch back to your Kali theme. Like magic...!" "Thanks to Robert, who leads our penetration testing team, for suggesting a Kali theme that looks like Windows to the casual view..."' -- source: https://linux.slashdot.org/story/19/12/01/1825215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The File /var/lib/dbus/machine-id Matters For Your Privacy (and Devuan Fixed It)
by Peter Reutemann 01 Dec '19

01 Dec '19

'A few days ago Devuan ASCII 2.1 was announced and one update has been overlooked by most media outlets: our dbus patch to re-generate machine-id at every boot. This patch matters for everyone's privacy and I hope more distributions will follow our example, let alone Debian. We are dealing with important privacy implications: non-consensual user tracking is illegal in many countries and is not even mentioned in the machine-id documentation so far. "In theory, the machine-id should be a persistent identifier of the current host," explains the README documentation. "In practice, this causes some privacy concerns...' -- source: https://linux.slashdot.org/story/19/11/30/0538211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 19.10: It’s fast, like “make old hardware feel new” fast
by Peter Reutemann 28 Nov '19

28 Nov '19

'Leaves are turning. Temperatures have dipped. These are sure signs—if you live in the Northern Hemisphere, at least—that Canonical's Autumn release is upon us. Things are a bit different in 2019, however. Not only is Ubuntu 19.10 nicknamed Eoan Ermine (no, I don't know how you pronounce it either), but it's the best non-LTS Ubuntu release Canonical has ever put out. I should qualify that statement somewhat, because really, as the newest version, it had damn well better be the best Ubuntu ever. But there's more than recency bias behind the sentiment. I've been reviewing Ubuntu for 10 years now, and I was using and interacting with this distro in some form or another for another three or four years before that. After spending recent weeks with Ubuntu 19.10, I can say confidently it is quite simply the best Ubuntu Canonical has ever released. The first reason I like 19.10 so much is that it feels insanely fast. Everyday tasks like opening applications, dragging windows, activating the search interface, and even just moving the cursor around are all noticeably faster than in 19.04. The speed boost is immediately noticeable from the minute you pop in the live CD, and it's even faster once you have 19.10 installed. I happened to be testing a top-of-the-line MacBook around the time I first installed the 19.10 beta on my aging Lenovo x240, and it instantly made the Mac feel like a sloth. Ubuntu 19.10 ran circles around the Mac even on much, much less powerful hardware, and nothing says success during testing like software that makes old hardware feel newer. Even if that were all you got out of Ubuntu 19.10, I'd call it a win.' -- source: https://arstechnica.com/gadgets/2019/11/ubuntu-19-10-quite-simply-the-best-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

tagging arbitrary files (not just mp3s) under Linux
by Peter Reutemann 26 Nov '19

26 Nov '19

Hi everyone After last night's AGM, I had a conversation with Rod regarding any Linux applications that allow tagging of arbitrary files (not just mp3s) to improve organizing them, similar to what Gmail introduced all those years ago. In the following reddit discussion: https://www.reddit.com/r/linux/comments/3mjwn5/do_any_popular_linux_file_sy… I came across the "TagSpaces" application (open source, AGPL), which seems to fit that bill: https://www.tagspaces.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The strange tale of OneCoin
by Ian Young 26 Nov '19

26 Nov '19

Sorry if this is too wildly off topic but I was taken back by a story on the BBC from a day or two ago. https://www.bbc.com/news/stories-50435014

2 1

Passive-Cooling A Raspberry π 4
by Lawrence D'Oliveiro 26 Nov '19

26 Nov '19

Just came across this video <https://www.youtube.com/watch?v=VJC6OpGpq0Y>, latest in a series on cooling solutions for a Raspberry π 4. This instalment looks at a couple of purely passive, fanless products that use the case as a heat sink (or vice versa). But on top of that, a recent firmware update from Broadcom has made a massive difference to the running temperature in all the configurations. Summary: passive cooling worked quite well before the update, and now works even better.

1 0

The Librem 5 has been “shipping” for a month—but not to backers
by Peter Reutemann 26 Nov '19

26 Nov '19

'Purism announced that shipping of its Librem 5 open source smartphone began in late September. Two months later, nobody outside the company has a Librem 5, and people are getting restless. The Librem 5 is a crowdfunded project—and an ambitious one—so it wasn't much surprise or cause for concern when it missed its original January 2019 delivery target—or the April 2019 target set after January slipped. Both date changes were announced well ahead of time, and the company continued to post progress reports, commit code upstream, and assure backers of its commitment to transparency. (Full disclosure: I am a Librem 5 backer myself and am scheduled to receive a phone in the Evergreen batch.) The new delays are more troubling. On September 5, CEO Todd Weaver announced that the Librem 5 would ship in six iterative batches, codenamed Aspen, Birch, Chestnut, Dogwood, Evergreen, and Fir. The first three batches would effectively be usable prototypes of decreasing roughness; Evergreen would be the first entirely finished hardware production run, and Fir would be a relatively unspecified next-generation design.' -- source: https://arstechnica.com/gadgets/2019/11/the-librem-5-has-been-shipping-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0