- wlug - list.wlug.org.nz

Large 'GoldBrute' RDP Botnet Hunts For Exposed Servers With Weak Passwords
by Peter Reutemann 08 Jun '19

08 Jun '19

'The Internet Storm Center reports: RDP, the remote desktop protocol, made the news recently after Microsoft patched a critical remote code execution vulnerability (CVE-2019-0708). While the reporting around this "Bluekeep" vulnerability focused on patching vulnerable servers, exposing RDP to the Internet has never been a good idea. Botnets have been scanning for these servers and are using weak and reused passwords to gain access to them. The latest example of such a botnet is an ongoing malicious campaign we are refering to as "GoldBrute". This botnet is currently brute forcing a list of about 1.5 million RDP servers exposed to the Internet... Each bot will only try one particular username and password per target. This is possibly a strategy to fly under the radar of security tools as each authentication attempt comes from different addresses. Long-time Slashdot reader UnderAttack writes: Infected systems will retrieve target lists from the command and control server and attempt to brute force credentials against the list, while at the same time looking for more exposed servers. With all the attention spent on patching RDP servers for the recent "BlueKeep" vulnerability, users should also make sure to just not expose RDP in the first place. Even patched, it will still be susceptible to brute forcing.' -- source: https://it.slashdot.org/story/19/06/08/0322234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu MATE 19.10 Is Ditching VLC for GNOME MPV
by Peter Reutemann 07 Jun '19

07 Jun '19

'GNOME MPV (now known as Celluloid) will be the default media player in Ubuntu MATE 19.10. From a report: The app supplants the versatile VLC meda player, which the MATE desktop-toting distro has shipped with following the results of a community poll back in 2017. So why the change now? Better desktop integration. That's according to Ubuntu MATE's Martin Wimpress who revealed news of the swap in the latest Ubuntu MATE monthly update on Patreon: "We will be dropping VLC from the pre-installed applications and shipping GNOME MPV instead. GNOME MPV will soon be renamed to Celluloid. The reasons for switching to GNOME MPV are similar to swapping out Thunderbird for Evolution; better desktop integration." Size is another factor. GNOME MPV takes up a comparatively svelte 27MB on the ISO image, whereas Qt5-based VLC requires closer to 70MB.' -- source: https://news.slashdot.org/story/19/06/06/1840240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

The Ambitious Plan To Reinvent How Websites Get Their Names
by Peter Reutemann 06 Jun '19

06 Jun '19

'When you type in a URL to your browser and press "enter," your browser sends that name to a network of computers called the Domain Name System (DNS), which converts it into IP addresses. These numbers are what allow your browser to find the right server on the internet and connect to it. When you navigate to a website, you are trusting a handful of organizations that have been charged with keeping the DNS working and secure. "To people like Steven McKie, a developer for and investor in an open-source project called the Handshake Network, this centralized power over internet naming makes the internet vulnerable to both censorship and cyberattacks," reports MIT technology review. "Handshake wants to decentralize it by creating an alternative naming system that nobody controls. In doing so, it could help protect us from hackers trying to exploit the DNS's security weaknesses, and from governments hoping to use it to block free expression." From the report: The system would be based on blockchain technology, meaning it would be software that runs on a widely distributed network of computers. In theory, it would have no single point of failure and depend on no human-run organization that could be corrupted or co-opted. Handshake's software is a heavily modified version ("fork") of Bitcoin, and just as Bitcoin's network of miners protects the cryptocurrency from manipulation and makes it virtually impossible for authorities to shut down, a similar network could keep a permanent, censorship-resistant record of internet names. The Handshake team is far from the first to try to create a decentralized naming system for the web. But unlike previous efforts, Handshake isn't trying to replace DNS but work with it. Besides ICANN, there's yet another class of organization whose job Handshake aims to decentralize. See that little padlock icon in your browser bar, to the left of the domain name? That means your computer has verified that your connection to this website is encrypted and that the site is authentic, not a fake one designed by a criminal trying to steal your login credentials. It does that by checking the veracity of a string of numbers called the site's digital certificate, issued by one of a number of so-called certificate authorities. These entities, many of which are for-profit companies, are crucial to internet security. They can also get hacked. And if one gets breached, and an attacker can start issuing fake certificates, it undermines the security of the whole internet. But if website names are managed on a tamper-resistant blockchain, then you don't need certificate authorities; the naming system itself can provide the guarantee that the site you're connected to is real. That's what Handshake aims to do. ' -- source: https://yro.slashdot.org/story/19/06/06/0028220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New RCE Vulnerability Impacts Nearly Half of the Internet's Email Servers
by Peter Reutemann 06 Jun '19

06 Jun '19

'A critical remote command execution (RCE) security flaw impacts over half of the Internet's email servers, security researchers from Qualys have revealed today. The vulnerability affects Exim, a mail transfer agent (MTA), which is software that runs on email servers to relay emails from senders to recipients. According to a June 2019 survey of all mail servers visible on the Internet, 57% (507,389) of all email servers run Exim -- although different reports would put the number of Exim installations at ten times that number, at 5.4 million. In a security alert shared with ZDNet earlier today, Qualys, a cyber-security firm specialized in cloud security and compliance, said it found a very dangerous vulnerability in Exim installations running versions 4.87 to 4.91. The vulnerability is described as a remote command execution -- different, but just as dangerous as a remote code execution flaw -- that lets a local or remote attacker run commands on the Exim server as root. Qualys said the vulnerability can be exploited instantly by a local attacker that has a presence on an email server, even with a low-privileged account. lBut the real danger comes from remote hackers exploiting the vulnerability, who can scan the internet for vulnerable servers, and take over systems. The vulnerability was patched with Exim 4.92, on February 10, 2019, "but at the time the Exim team released v4.92, they didn't know they fixed a major security hole," reports ZDNet. "This was only recently discovered by the Qualys team while auditing older Exim versions. Now, Qualys researchers are warning Exim users to update to the 4.92 version to avoid having their servers taken over by attackers."' -- source: https://it.slashdot.org/story/19/06/06/0046234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany: Backdoor Found in Four Smartphone Models; 20,000 Users Infected
by Peter Reutemann 06 Jun '19

06 Jun '19

'The German Federal Office for Information Security (or the Bundesamt fur Sicherheit in der Informationstechnik -- BSI) has issued security alerts today warning about dangerous backdoor malware found embedded in the firmware of at least four smartphone models sold in the country. Impacted models include the Doogee BL7000, the M-Horse Pure 1, the Keecoo P11, and the VKworld Mix Plus (malware present in the firmware, but inactive). All four are low-end Android smartphones. The BSI said the phones' firmware contained a backdoor trojan named Andr/Xgen2-CY.' -- source: https://tech.slashdot.org/story/19/06/06/199249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Launches Android Q Beta 4 With Final APIs and Official SDK
by Peter Reutemann 05 Jun '19

05 Jun '19

'Google today launched the fourth Android Q beta with final Android Q APIs and the official SDK. If you're a developer, this is your fourth Android Q preview, and you can start testing your apps against this release by downloading it from developer.android.com/preview. The preview includes system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, Pixel 3a, Pixel 3a XL, and the official Android Emulator. If you're already enrolled in the beta program, you'll automatically get the update to Beta 4. Like Beta 3, Google is also bringing Android Q Beta 4 to third-party phones "over the coming weeks." The Beta 4 doesn't bring many new features -- it's more about finalizing what was already added, such as the additional privacy and security features, multitasking bubbles, and system-wide dark mode. Google is however "opening publishing on Google Play to apps that are compiled against, or optionally targeting, API 29," the report adds. "You can thus now push updates to users through Google Play to test your app's compatibility, including on devices running Android Q Beta' -- source: https://mobile.slashdot.org/story/19/06/05/2123245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 75 Released With Web Share API File Support, Numeric Separators and Secret Reader Mode
by Peter Reutemann 05 Jun '19

05 Jun '19

'Google this week released Chrome 75 for Windows, Mac, Linux, Android, and iOS. The release includes hint for low latency canvas contexts, files supported in the Web Share API, numeric separators, and more developer features. [...] Next, files are now supported by the Web Share API. For years, Google has been working to bring native sharing capabilities to the web. The Web Share API allows web apps to invoke the same share dialog box as a native app. The implementation brings a new method and a new shareData property. Numeric literals now allow underscores (_, U+005F) as separators to make them more readable. Underscores can only appear between digits, and consecutive underscores are not allowed. There is also a reader mode that is not enabled by default. From a report: The big feature included with Chrome 75 is the addition of a hidden Reader Mode, similar to the one included with Firefox. This new Reader Mode is not active by default and must be turned on using one of Google Chrome's experimental flags -- which until recently has only been available in the Chrome Canary distribution. To enable and test Chrome's new Reader Mode, users must visit the chrome://flags/#enable-reader-mode section, and enable the Reader Mode option, as in the screenshot below. Chrome for Android includes these two features: 1. Generate strong and unique passwords with Chrome's built-in password manager. 2. Quickly look up your passwords by tapping any password field and using the new keyboard option.' -- source: https://tech.slashdot.org/story/19/06/05/1357233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

238 Google Play apps with >440 million installs made phones nearly unusable
by Peter Reutemann 04 Jun '19

04 Jun '19

'If the prevalence of abusive Google Play apps has left you numb, this latest report is for you. Carefully concealed adware installed in Google-approved apps with more than 440 million installations was so aggressive that it rendered mobile devices nearly unusable, researchers from mobile security provider Lookout said Tuesday. BeiTaAd, as the adware is known, is a plugin that Lookout says it found hidden in emojis keyboard TouchPal and 237 other applications, all of which were published by Shanghai, China-based CooTek. Together, the 238 unique apps had a combined 440 million installs. Once installed, the apps initially behaved normally. Then, after a delay of anywhere between 24 hours and 14 days, the obfuscated BeiTaAd plugin would begin delivering what are known as out-of-app ads. These ads appeared on users' lock screens and triggered audio and video at seemingly random times or even when a phone was asleep.' -- source: https://arstechnica.com/information-technology/2019/06/238-google-play-apps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Replaces Bash With Zsh as the Default Shell in macOS Catalina
by Peter Reutemann 04 Jun '19

04 Jun '19

'Starting with macOS Catalina, Macs will now use zsh as the default login shell and interactive shell across the operating system. From a report: All newly created user accounts in macOS Catalina will use zsh by default. Bash will still be available, but Apple is signaling that developers should start moving to zsh on macOS Mojave or earlier in anticipation of bash eventually going away in macOS. Apple hasn't explained exactly why it's making this change, but bash isn't exactly a modern shell as it's implemented in macOS, and a switch to something less aging makes a lot more sense for the company. Apple is stuck using version 3.2 of bash that has been licensed under GPLv2, as newer versions are licensed under GPLv3. Apple has kept clear of using GPLv3 packages in macOS as the license is generally more restrictive to companies like Apple that sign their own code and it includes explicit patent grants, ' -- source: https://apple.slashdot.org/story/19/06/04/1645240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Starts Blocking Third-Party Cookies By Default
by Peter Reutemann 04 Jun '19

04 Jun '19

'Mozilla today announced a slew of privacy improvements. The company has turned on Enhanced Tracking Protection, which blocks cookies from third-party trackers in Firefox, by default. Mozilla has also improved its Facebook Container extension, released a Firefox desktop extension for its rebranded Lockwise password keeper, and updated Firefox Monitor with a dashboard for multiple email addresses. Mozilla added basic Tracking Protection to Firefox 42's private browsing mode in November 2015. The feature blocked website elements (ads, analytics trackers, and social share buttons) based on Disconnect's tracking protection rules. With the release of Firefox 57 in November 2017, Mozilla added an option to enable Tracking Protection outside of private browsing. (Tracking Protection was not turned on by default because it can break websites and cut off revenue streams for content creators who depend on third-party advertising.)' -- source: https://news.slashdot.org/story/19/06/04/1636241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0