- wlug - list.wlug.org.nz

The Prestigious Free Software Award Goes to Karen Sandler
by Peter Reutemann 31 Mar '18

31 Mar '18

'Each year the Free Software award goes to someone making "a great contribution to the progress and development of free software, through activities that accord with the spirit of free software." This year's winner is a former executive of the GNOME Foundation, Karen Sandler. Jeremy Allison - Sam, Slashdot reader #8,157, brought this announcement. Richard Stallman, President of the FSF, presented Sandler with the award during a ceremony. Stallman highlighted Sandler's dedication to software freedom. Stallman told the crowd that Sandler's "vivid warning about backdoored nonfree software in implanted medical devices has brought the issue home to people who never wrote a line of code. Her efforts, usually not in the public eye, to provide pro bono legal advice to free software organizations and [with Software Freedom Conservancy] to organize infrastructure for free software projects and copyleft defense, have been equally helpful." In her acceptance speech, Sandler spoke about her dedication to free software as a patient, advocate and professional. "Coming to terms with a dangerous heart condition should never have cost me fundamental control over the technology that my life relies on", said Sandler... "This issue is personal not just for me but for anyone who relies on software, and today that means every single person." ' -- source: https://news.slashdot.org/story/18/03/31/0322217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Experts See Chromebooks as a Closed Ecosystem That Improves Security
by Peter Reutemann 31 Mar '18

31 Mar '18

'The founder of Rendition Security believes his daughter "is more safe on a Chromebook than a Windows laptop," and he's not the only one. CNET's staff reporter argues that Google's push for simplicity, speed, and security "ended up playing off each other." mspohr shared this article: Heading to my first security conference last year, I expected to see a tricked-out laptop running on a virtual machine with a private network and security USB keys sticking out -- perhaps something out of a scene from "Mr. Robot." That's not what I got. Everywhere I went I'd see small groups of people carrying Chromebooks, and they'd tell me that when heading into unknown territory it was their travel device... "If you want prehardened security, then Chromebooks are it," said Kenneth White, director of the Open Crypto Audit Project. "Not because they're Google, but because Chrome OS was developed for years and it explicitly had web security as a core design principle...." Drewry and Liu focused on four key features for the Chromebook that have been available ever since the first iteration in 2010: sandboxing, verified boots, power washing and quick updates. These provided security features that made it much harder for malware to pass through, while providing a quick fix-it button if it ever did. That's not to say Chrome OS is impervious to malware. Cybercriminals have figured out loopholes through Chrome's extensions, like when 37,000 devices were hit by the fake version of AdBlock Plus. Malicious Android apps have also been able to sneak through the Play Store. But Chrome OS users mostly avoided massive cyberattack campaigns like getting locked up with ransomware or hijacked to become part of a botnet. Major security flaws for Chrome OS, like ones that would give an attacker complete control, are so rare that Google offers rewards up to $200,000 to anyone who can hack the system. The article argues that "Fewer software choices mean limited options for hackers. Those are some of the benefits that have led security researchers to warm up to the laptops... "Chrome OS takes an approach to security that's similar to the one Apple takes with iOS and its closed ecosystem."' -- source: https://tech.slashdot.org/story/18/03/31/0443257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source RISC V Processor Gets Support From Google, Samsung, Qualcomm, and Tesla
by Peter Reutemann 31 Mar '18

31 Mar '18

'Google, Qualcomm, and Samsung "are among 80 tech companies joining forces to develop a new open-source chip design for new technologies like self-driving vehicles," writes Seeking Alpha, citing a (pay-walled) report on The Information. "Western Digital and Nvidia also plan to use the new chip design for some of their products," while Tesla "has joined the RISC-V Foundation and is considering using the tech in its new chip efforts." MIT Technology Review adds that while Arm had hoped to bring their low-power/high performance processors to AI and self-driving cars, "The company that masterminded the processor inside your smartphone may find that a set of free-to-use alternative designs erode some of its future success."' -- source: https://news.slashdot.org/story/18/03/31/0622248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure
by Peter Reutemann 30 Mar '18

30 Mar '18

'Microsoft's January and February security fixes for Intel's Meltdown processor vulnerability opened up an even worse security hole on Windows 7 PCs and Server 2008 R2 boxes. From a report: This is according to researcher Ulf Frisk, who previously found glaring shortcomings in Apple's FileVault disk encryption system. We're told Redmond's early Meltdown fixes for 64-bit Windows 7 and Server 2008 R2 left a crucial kernel memory table readable and writable for normal user processes. This, in turn, means any malware on those vulnerable machines, or any logged-in user, can manipulate the operating system's memory map, gain administrator-level privileges, and extract and modify any information in RAM. The Meltdown chip-level bug allows malicious software, or unscrupulous logged-in users, on a modern Intel-powered machine to read passwords, personal information, and other secrets from protected kernel memory. But the security fixes from Microsoft for the bug, on Windows 7 and Server 2008 R2, issued in January and February, ended up granting normal programs read and write access to all of physical memory' -- source: https://tech.slashdot.org/story/18/03/28/2010240 Time to move to another operating system... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Yet Another Microsoft Windows Reorg
by Lawrence D'Oliveiro 30 Mar '18

30 Mar '18

From <https://arstechnica.com/gadgets/2018/03/windows-leader-terry-myerson-out-as…>: The Windows platform has many masters. It is important for both Microsoft's client and server businesses, of course, but it's also fundamental to the Azure platform. While it has become increasingly unified, responsibility for its development (and financial reporting) has often been split between divisions. Conway’s Law says that any piece of software reflects the organizational structure that produced it. The fact that there is no single mind in charge of the overall product will inevitably manifest itself in discontinuities in the characteristics of that product. Yes, I know: scratch that future tense. It already has.

1 0

An Open Source, Royalty-Free AV1 Codec Has Been Released
by Peter Reutemann 28 Mar '18

28 Mar '18

'After three years in development the Alliance for Open Media is releasing the royalty-free AOMedia Video Codec 1.0 (AV1) specification. The AV1 codec promises an average of 30 percent greater compression over competing codecs according to independent member tests. The release of AV1 includes: * Bitstream specification to enable the next-generation of silicon * Unoptimized, experimental software decoder and encoder to create and consume the bitstream * Reference streams for product validation * Binding specifications to allow content creation and streaming tools for user-generated and commercial vid' -- source: https://news.slashdot.org/story/18/03/28/1610215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Many VPN Providers Leak Customer's IP Address via WebRTC Bug
by Peter Reutemann 28 Mar '18

28 Mar '18

'Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015, and which apparently some VPN providers have never heard of. The discovery belongs to Paolo Stagno, a security researcher who goes by the pseudonym of VoidSec, and who recently audited 83 VPN apps on this old WebRTC IP leak. Stagno says he found that 17 VPN clients were leaking the user's IP address while surfing the web via a browser. The researcher published his results in a Google Docs spreadsheet. The audit list is incomplete because Stagno didn't have the financial resources to test all commercial VPN clients.' -- source: https://yro.slashdot.org/story/18/03/28/1813213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002]
by Peter Reutemann 28 Mar '18

28 Mar '18

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Mark Foster <...> Date: Thu, Mar 29, 2018 at 9:20 AM Subject: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002] To: nzlug(a)lists.nzoss.org.nz I know there's plenty of Drupal out there, and I don't usually forward these around, but in case you havn't heard... The Drupal team took the unusual step of warning that this was coming several days ago, that helps set the tone for the severity of this. I've taken the unusual step of disabling my own Drupal based website until I can attend to its update. Mark. ---------------------------- Original Message ---------------------------- Subject: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 From: security-news(a)drupal.org Date: Thu, March 29, 2018 8:21 am To: security-news(a)drupal.org -------------------------------------------------------------------------- View online: https://www.drupal.org/sa-core-2018-002 Project:Â Drupal core [1] Date:Â 2018-March-28 Security risk:Â *Highly critical* 21âˆ•25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability:Â Remote Code Execution Description:Â CVE: CVE-2018-7600 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ [3] about this issue. Solution:Â Upgrade to the most recent version of Drupal 7 or 8 core. * *If you are running 7.x, upgrade to Drupal 7.58 [4].* (If you are unable to update immediately, you can attempt to apply this patch [5] to fix the vulnerability until such time as you are able to completely update.) * *If you are running 8.5.x, upgrade to Drupal 8.5.1 [6].* (If you are unable to update immediately, you can attempt to apply this patch [7] to fix the vulnerability until such time as you are able to completely update.) Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [8]. However, given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x. Please take the time to update to a supported version after installing this security update. * If you are running 8.3.x, upgrade to Drupal 8.3.9 [9] or apply this patch [10]. * If you are running 8.4.x, upgrade to Drupal 8.4.6 [11] or apply this patch [12]. This issue also affects Drupal 8.2.x and earlier, which are no longer supported. If you are running any of these versions of Drupal 8, update to a more recent release and then follow the instructions above. This issue also affects Drupal 6. Drupal 6 is End of Life. For more information on Drupal 6 support please contact a D6LTS vendor [13]. Reported By:Â * Jasper Mattsson [14] Fixed By:Â * Jasper Mattsson [15] * Samuel Mortenson [16] Provisional Drupal Security Team member * David Rothstein [17] of the Drupal Security Team * Jess (xjm) [18] of the Drupal Security Team * Michael Hess [19] of the Drupal Security Team * Lee Rowlands [20] of the Drupal Security Team * Peter Wolanin [21] of the Drupal Security Team * Alex Pott [22] of the Drupal Security Team * David Snopek [23] of the Drupal Security Team * Pere Orga [24] of the Drupal Security Team * Neil Drumm [25] of the Drupal Security Team * Cash Williams [26] of the Drupal Security Team * Daniel Wehner [27] * Tim Plunkett [28] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached by email at security at drupal.org or via the contact form. Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://groups.drupal.org/security/faq-2018-002 [4] https://www.drupal.org/project/drupal/releases/7.58 [5] https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a83db50e2f97682d… [6] https://www.drupal.org/project/drupal/releases/8.5.1 [7] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [8] https://www.drupal.org/core/release-cycle-overview [9] https://www.drupal.org/project/drupal/releases/8.3.9 [10] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [11] https://www.drupal.org/project/drupal/releases/8.4.6 [12] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [13] https://www.drupal.org/project/d6lts [14] https://www.drupal.org/u/Jasu_M [15] https://www.drupal.org/u/Jasu_M [16] https://www.drupal.org/user/2582268 [17] https://www.drupal.org/user/124982 [18] https://www.drupal.org/user/65776 [19] https://www.drupal.org/user/102818 [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/user/49851 [22] https://www.drupal.org/u/alexpott [23] https://www.drupal.org/u/dsnopek [24] https://www.drupal.org/u/pere-orga [25] https://www.drupal.org/u/drumm [26] https://www.drupal.org/u/cashwilliams [27] https://www.drupal.org/u/dawehner [28] https://www.drupal.org/u/tim.plunkett _______________________________________________ Security-news mailing list Security-news(a)drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromebooks In Schools?
by Lawrence D'Oliveiro 28 Mar '18

28 Mar '18

In among this article about Apple’s new push to get IPads used in schools <https://arstechnica.com/gadgets/2018/03/analysis-new-ipads-will-help-apple-…> is the interesting information that Google Chromebooks are heavily used throughout the US school system: Google offers G Suite for Education for free, sans some features. Adding the full suite of enterprise features costs only $4 per user per month, compared to $25 per user per month for other kinds of organizations. Papers are typed in Google Docs. Presentations are done using Google Presentations. Each student has a Google email account assigned through the district. Homework is handed out and done entirely on Chromebooks in many classes. In so many words, Google has spread its tentacles throughout the entire school district at every level ... Are Chromebooks used in schools here? I noticed a couple of units on sale in OfficeMax when I dropped in there a few weeks ago. I don’t recall seeing them anywhere else in town.

1 0

Bring your own Linux to Windows with new open source tool
by Peter Reutemann 27 Mar '18

27 Mar '18

'After starting with Ubuntu, Microsoft has added a number of Linux distributions to its Windows Subsystem for Linux (WSL) Linux runtime environment. A Windows machine can simultaneously offer an Ubuntu, SUSE, Debian, and Kali "personality," providing users with a choice of the different distributions' preferences and package management. But if your distribution isn't yet available or if you want a Linux installation that's customized just the way you like it, there's now an answer: Microsoft has an open source tool for building your own Linux package. The tool is aimed at two groups: distribution owners (so they can produce a bundle to ship through the Microsoft Store) and developers (so they can create custom distributions and sideload them onto their development systems). Microsoft's tool provides the basic glue between Windows and the Linux distribution. It handles telling the system about the distribution and performing initial setup such as user creation, and it can be customized to—for example—print a message of the day when the distribution is started.' -- source: https://arstechnica.com/gadgets/2018/03/microsofts-new-open-source-tool-let… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0