- wlug - list.wlug.org.nz

As predicted, more speculative execution processor attacks are discovered
by Peter Reutemann 26 Mar '18

26 Mar '18

'Researchers from the College of William and Mary, Carnegie Mellon, the University of California Riverside, and Binghamton University have described a security attack that uses the speculative execution features of modern processors to leak sensitive information and undermine the security boundaries that operating systems and software erect to protect important data. That probably sounds familiar. The Spectre attacks, published earlier this year, take advantage of the speculative execution features of modern processors to leak sensitive information. The new attack, named BranchScope by the researchers, shares some similarity with variant 2 of the Spectre attack, as both BranchScope and Spectre 2 take advantage of the behavior of the processor's branch predictor.' -- source: https://arstechnica.com/gadgets/2018/03/its-not-just-spectre-researchers-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google starts blocking “uncertified” Android devices from logging in
by Peter Reutemann 26 Mar '18

26 Mar '18

'Google is apparently stepping up its efforts to crack down on illicit distribution of Google's Android apps. According to XDA Developers, Google logins on unlicensed devices will now fail at setup, and a warning message will pop up stating "Device is not certified by Google." This warning screen has appeared on and off in the past during a test phase, but XDA (and user reports) indicate it is now headed for a wider rollout.' -- source: https://arstechnica.com/gadgets/2018/03/google-starts-blocking-uncertified-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kritia 4.0 Released, Conversation With The Team
by Lawrence D'Oliveiro 26 Mar '18

26 Mar '18

Another high-quality article from Alexandre Prokoudine <http://libregraphicsworld.org/blog/entry/krita-4-0-interview> about the just-released major revamp of Krita. It now straddles both “paint” and “draw” worlds, with Inkscape-styled SVG-based vector functionality added to the older paint functions. Oh, and it does animations as well. The item links to the “official” release video, but another informative one worth checking out is this <https://www.youtube.com/watch?v=OXvHHJUyBDg>.

2 3

Shodan Search Exposes Thousands of Servers Hosting Passwords and Keys
by Peter Reutemann 25 Mar '18

25 Mar '18

'Thousands of etcd servers "are spitting sensitive passwords and encrypted keys," reports Fossbytes: Security researcher Giovanni Collazo was able to harvest 8781 passwords, 650 AWS access keys, 23 secret keys, and 8 private keys. First, he ran a query on the hacker search engine Shodan that returned around 2300 servers running etcd database. Then, he ran a simple script that gave him the login credentials stored on these servers which can be used to gain access to CMSs, MySQL, and PostgreSQL databases, etc. etcd is a database used by computing clusters to store and exchange passwords and configuration settings between servers and applications over the network. With the default settings, its programming interface can return administrative login credentials without any authentication upfront... All of the data he harvested from around 1500 servers is around 750MB in size... Collazo advises that anyone maintaining etcd servers should enable authentication, set up a firewall, and take other security measures. Another security research independently verified the results, and reported that one MySQL database had the root password "1234".' -- source: https://developers.slashdot.org/story/18/03/24/1943239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Scraped Call, Text Message Data For Years From Android Phones
by Peter Reutemann 25 Mar '18

25 Mar '18

'This past week, a New Zealand man was looking through the data Facebook had collected from him in an archive he had pulled down from the social networking site. While scanning the information Facebook had stored about his contacts, Dylan McKay discovered something distressing: Facebook also had about two years worth of phone call metadata from his Android phone, including names, phone numbers, and the length of each call made or received. This experience has been shared by a number of other Facebook users who spoke with Ars, as well as independently by us -- my own Facebook data archive, I found, contained call-log data for a certain Android device I used in 2015 and 2016, along with SMS and MMS message metadata. In response to an email inquiry about this data gathering by Ars, a Facebook spokesperson replied, "The most important part of apps and services that help you make connections is to make it easy to find the people you want to connect with. So, the first time you sign in on your phone to a messaging or social app, it's a widely used practice to begin by uploading your phone contacts." The spokesperson pointed out that contact uploading is optional and installation of the application explicitly requests permission to access contacts. And users can delete contact data from their profiles using a tool accessible via Web browser. If you granted permission to read contacts during Facebook's installation on Android a few versions ago -- specifically before Android 4.1 (Jelly Bean) -- that permission also granted Facebook access to call and message logs by default. The permission structure was changed in the Android API in version 16. But Android applications could bypass this change if they were written to earlier versions of the API, so Facebook API could continue to gain access to call and SMS data by specifying an earlier Android SDK version. Google deprecated version 4.0 of the Android API in October 2017 -- the point at which the latest call metadata in Facebook user's data was found. Apple iOS has never allowed silent access to call data. You are able to have Facebook delete the data it collects from you, "but it's not clear if this deletes just contacts or if it also purges call and SMS metadata," reports Ars. Generally speaking, if you're concerned about privacy, you shouldn't share your contacts and call-log data with any mobile application.' -- source: https://yro.slashdot.org/story/18/03/25/056246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 3 Model B+ Benchmarks Show Significantly Improved Performance
by Peter Reutemann 25 Mar '18

25 Mar '18

'Pi Day was marked this year by the launch of the Raspberry Pi 3 Model B+ as the next evolution to this $35 ARM single-board computer. Phoronix has now put out Raspberry Pi 3 B+ benchmarks showing that the Ethernet performance is indeed much faster now but still doesn't stack up to other high performance boards, the SoC temperature is noticeably lower than the very warm Raspberry Pi 3, and the overall performance is a nice upgrade while retaining the same price point as its predecessors. Follow up tests looking at the Wi-Fi performance also show the new 802.11ac dual-band wireless to be much faster as well.' -- source: https://hardware.slashdot.org/story/18/03/25/0556258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hate-Speech Laws In Europe
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

<https://www.techdirt.com/articles/20180321/17581339475/spanish-hate-anti-te…>: People are being arrested and charged with speech having nothing to with promoting hate or terrorism. ... It's gotten so bad Amnesty International -- an entity that usually spends its time decrying the acts of dictators and brutal authoritarians -- has felt compelled to speak up about Spain's terrible speech laws. ... The report also notes several other European countries are also beginning to curtail the rights of their citizens in their quest to target hate speech and international terrorism. Germany's hate speech law roll out has been an unmitigated disaster and other countries like France and Italy seem all too willing to join Spain and Germany in killing satire, parody, and content they just don't agree with. All of this is being done under the heading of "public safety," but in reality, the public is no safer and will develop an unhealthy fear of their own governments.

1 0

TLS 1.3 Has Been Approved
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

The latest version of TLS (the official name for what used to be called “SSL”, i.e. the protocol that your browser uses for URLs beginning “https://”) is now an official IETF standard <http://www.theregister.co.uk/2018/03/23/tls_1_3_approved_ietf/>. This should not only make the setup of secure connections quicker, but also harder to crack. ... banks and businesses complained that, thanks to the way the new protocol does security, they will be cut off from being able to inspect and analyze TLS 1.3 encrypted traffic flowing through their networks, and so potentially be at greater risk from attack. Unfortunately, that self-same ability to decrypt secure traffic on your own network can also be potentially used by third parties to grab and decrypt communications. An effort to effectively insert a backdoor into the protocol was met with disdain and some anger by internet engineers, many of whom pointed out that it will still be possible to introduce middleware to monitor and analyze internal network traffic. Note the key phrase “forward secrecy”. This means that, even if your private key should become compromised down the track, this will still not help attackers decrypt any records they may have kept of your secure communications prior to that. And yes, you can expect the usual suspects to be unhappy about the introduction of such a feature.

1 0

Firefox In 2018: We'll Tackle Bad Ads, Breach Alerts, Autoplay Video, Says Mozilla
by Peter Reutemann 24 Mar '18

24 Mar '18

'Firefox maker Mozilla has outlined its 2018 roadmap to make the web less intrusive and safer for users. First up, Mozilla says it will proceed and implement last year's experiment with a breach alerts service, which will warn users when their credentials have been leaked or stolen in a data breach. Mozilla aims to roll out the service around October. Breach Alerts is based on security consultant Troy Hunt's data breach site Have I Been Pwned. Firefox will also implement a similar block on autoplay video to the one Chrome 66 will introduce next month, and that Safari already has. However, Dotzler says Firefox's implementation will "provide users with a way to block video auto-play that doesn't break websites". This feature is set to arrive in Firefox 62, which is scheduled for release in May. After Firefox 62 the browser will gain an optional Chrome-like ad filter and several privacy-enhancing features similar to those that Apple's WebKit developers have been working on for Safari's Intelligent Tracking Prevention. By the third quarter of 2018, Firefox should also be blocking ad-retargeting through cross-domain tracking. It's also going to move all key privacy controls into a single location in the browser, and offer more "fine-grained" tracking protection. Dotzler says Mozilla is in the "early stages" of determining what types of ads Firefox should block by default. Also on the roadmap is a feature that arrived in Firefox 59, released earlier this month. A new Global Permissions feature will help users avoid having to deny every site that requests permission for location, camera, microphone and notifications. Beyond security and privacy, Mozilla plans to build on speed-focused Quantum improvements that came in Firefox 57 with smoother page rendering.' -- source: https://news.slashdot.org/story/18/03/23/2110244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Server 2019 Will Feature Linux and Kubernetes Support
by Peter Reutemann 22 Mar '18

22 Mar '18

'Microsoft announced this week that it will launch the next major release of Windows Server later this year with better support for hybrid workloads, Linux workloads, and hyper-converged infrastructure. >From a report: This release will succeed Windows Server 2016, which was made generally available in October 2016. While Microsoft moved to twice-yearly updates for Windows Server starting last year, the company bundles those changes into a long-term servicing channel once every two or three years for administrators who prefer less frequent releases. Those companies that haven't moved over to the semi-annual channel will get their first taste of Windows Server's Linux and Kubernetes support, which are currently in beta.' -- source: https://tech.slashdot.org/story/18/03/22/1647243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0