- wlug - list.wlug.org.nz

New attack on Tor can deanonymize hidden services with surprising accuracy
by Peter Reutemann 03 Aug '15

03 Aug '15

"Computer scientists have devised an attack on the Tor privacy network that in certain cases allows them to deanonymize hidden service websites with 88 percent accuracy. Such hidden services allow people to host websites without end users or anyone else knowing the true IP address of the service. The deanonymization requires the adversary to control the Tor entry point for the computer hosting the hidden service. It also requires the attacker to have previously collected unique network characteristics that can serve as a fingerprint for that particular service. Tor officials say the requirements reduce the effectiveness of the attack. Still, the new research underscores the limits to anonymity on Tor, which journalists, activists, and criminals alike rely on to evade online surveillance and monitoring." -- source: http://arstechnica.com/security/2015/07/new-attack-on-tor-can-deanonymize-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Maybe don't smash your phone just yet
by Ian Young 30 Jul '15

30 Jul '15

Random browsing on the interwebs. Is this the year of a free cellphone OS? Alas I fear not. But we can dream. http://www.theregister.co.uk/2015/07/27/android_phone_text_flaw/ https://dot.kde.org/2015/07/25/plasma-mobile-free-mobile-platform Mentioned on the blog of Barry Kauler of Puppy Linux. Currently latest entry. http://bkhome.org/news/ Maybe you want an Android PC? http://www.slashgear.com/jide-tries-again-remix-mini-does-android-pc-153931… http://www.androidpolice.com/2015/07/17/jide-tech-is-back-on-kickstarter-wi…

2 2

How To Test LaTeXila 3.17.0 on Ubuntu Linux
by Peter Reutemann 30 Jul '15

30 Jul '15

"LaTeXila is an editor for GNOME desktop environment, it is an open source application and lets you compile, convert and view documents on GNOME desktop. It can work with LaTeX commands and provides easier navigation through the document. It can also be installed on other desktop environments like Unity, KDE etc. Over the passage of time, it has become an important part of GNOME desktop environment. As you might already aware that GNOME dev team is working actively to announce the upcoming release 3.17.4, so in this process, GNOME development team has announced the availability of LaTeXila 3.17 now." -- source: http://www.linuxtoday.com/developer/how-to-test-latexila-3.17.0-on-ubuntu-l… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

950 million Android phones can be hijacked by malicious text messages
by Peter Reutemann 27 Jul '15

27 Jul '15

'Almost all Android mobile devices available today are susceptible to hacks that can execute malicious code when they are sent a malformed text message or the user is lured to a malicious website, a security researcher reported Monday. The vulnerability affects about 950 million Android phones and tablets, according to Joshua Drake, vice president of platform research and exploitation at security firm Zimperium. It resides in "Stagefright," an Android code library that processes several widely used media formats. The most serious exploit scenario is the use of a specially modified text message using the multimedia message (MMS) format. All an attacker needs is the phone number of the vulnerable Android phone. From there, the malicious message will surreptitiously execute malicious code on the vulnerable device with no action required by the end user and no indication that anything is amiss.' -- source: http://arstechnica.com/security/2015/07/950-million-android-phones-can-be-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WLUG meeting tomorrow
by Peter Reutemann 27 Jul '15

27 Jul '15

Hi everyone We have a WLUG meeting tomorrow: "Ian Stewart will talk about the Linux Terminal Server Project (LTSP) and how to connect to it using thin clients and Raspberry Pi. Peter Reutemann will give the new Linux Mint release a quick spin." Details can be found here: http://www.meetup.com/WaikatoLinuxUsersGroup/events/223850397 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

SSH -> getting the originating IP of a client using RDP
by Eric Light 24 Jul '15

24 Jul '15

Hey all This is a total edge case, but I thought it may be interesting to some. We have thin clients, which RDP to a Windows Terminal Server, through which users SSH (using PuTTY) into our Linux server. This isn't flexible (for good reasons which I won't go into here). However, to talk properly to our new EFTPOS units, we need to know the IP of the thin client. Of course, through SSH you only get the IP of the client, which is the Terminal Server. Here's how I fixed it: 1) Add the following line to /etc/ssh/sshd_config, and restarted ssh: * AcceptEnv CLIENTNAME* 2) Added the following to the Windows login script: * REG ADD HKCU\Software\SimonTatham\PuTTY\Sessions\DG\ /v Environment /d "CLIENTNAME="%CLIENTNAME% /f* 3) Result: * ~ $ env | grep CLIENTNAME CLIENTNAME=eric-lmde* >From there, we can do what we needed with the EFTPOS! Eric -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

2 1

Troubleshooting Over The Phone
by Lawrence D'Oliveiro 23 Jul '15

23 Jul '15

I just helped someone unbork their Ubuntu system over the phone. It was reporting “disk full”, without being more specific than that. I got him to open up a terminal window, and use the “df” and “du” commands to narrow down the directory that was filling up the disk. Sometimes /tmp gets filled up with stuff, but in this case it was /var/lib/apt/lists/partial/. I have had an instance of high disk usage on that directory myself, a while back. I think it’s where apt keeps partially-downloaded repo index files, though I’m not sure why—is it to retry downloading the rest? But when the problem hits, it just seems to fill up with failed downloads. So I carefully led him up to executing the command “sudo rm /var/lib/apt/lists/partial/*”, and that cleared the problem. The main thing I was careful with was spelling out the commands phonetically, and getting him to read them back to me. But imagine having to do this with a GUI, over the phone. I don’t think I would even try...

3 4

Why Debian Returned To FFmpeg
by Lawrence D'Oliveiro 23 Jul '15

23 Jul '15

<http://lwn.net/Articles/650816/> What impresses me about this is, even though the Debian package maintainer is also a libav developer, he “...in the end, could not bring himself to say that he was sure libav was the better choice.” With regard to the commit statistics, it seems like much of the activity in FFmpeg commits is wholesale copying of code from libav. But so what? If sticking with FFmpeg gives you the best of both worlds, why bother separately including packages for libav at all?

1 0

meeting next Monday
by Peter Reutemann 22 Jul '15

22 Jul '15

Hi everyone We have a WLUG meeting coming up next Monday: "Ian Stewart will talk about the Linux Terminal Server Project (LTSP) and how to connect to it using thin clients and Raspberry Pi. Peter Reutemann will give the new Linux Mint release a quick spin." Details can be found here: http://www.meetup.com/WaikatoLinuxUsersGroup/events/223850397 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

On Being Pro-GPL
by Peter Reutemann 22 Jul '15

22 Jul '15

'Christopher Allan Webber, recently returned from OSCON, shares his thoughts on the GPL and why he dislikes people pitting one type of software license against another. He says, "I am not only pro-copyleft, I am also pro-permissive licensing. The difference between these is tactics: the first tactic is towards guaranteeing user freedom, the second tactic is toward pushing adoption. I am generally pro-freedom, but sometimes pushing adoption is important, especially if you're pushing standards and the like. But let's step back for a moment. One thing that's true is that over the last many years we've seen an explosion of free and open source software... at the same time that computers have become more locked down than ever before! How can this be? And notice... the rise of the arguments for permissive/lax licensing have grown simultaneously with this trend. ...The fastest way to develop software which locks down users for maximum monetary extraction is to use free software as a base. And this is where the anti-copyleft argument comes in, because copyleft may effectively force an entity to give back at this stage... and they might not want to. ... Copyleft's strings say, 'you can use my stuff, as long as you give back what you make from it.' But the proprietary differentiation strategy's strings say, 'I will use your stuff, and then add terms which forbid you to ever share or modify the things I build on top of it.' Don't be fooled: both attach strings. But which strings are worse?"' -- source: http://news.slashdot.org/story/15/07/21/2256243 Personally, I'm a pro-GPL person. Simply because I don't like software getting locked down and nothing flowing back to the community. Especially, when open source is so community centred. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1