- wlug - list.wlug.org.nz

Android Leaks Some Traffic Even When 'Always-On VPN' Is Enabled
by Peter Reutemann 13 Oct '22

13 Oct '22

'Mullvad VPN has discovered that Android leaks traffic every time the device connects to a WiFi network, even if the "Block connections without VPN," or "Always-on VPN," features is enabled. BleepingComputer reports: The data being leaked outside VPN tunnels includes source IP addresses, DNS lookups, HTTPS traffic, and likely also NTP traffic. This behavior is built into the Android operating system and is a design choice. However, Android users likely didn't know this until now due to the inaccurate description of the "VPN Lockdown" features in Android's documentation. Mullvad discovered the issue during a security audit that hasn't been published yet, issuing a warning yesterday to raise awareness on the matter and apply additional pressure on Google. Android offers a setting under "Network & Internet" to block network connections unless you're using a VPN. This feature is designed to prevent accidental leaks of the user's actual IP address if the VPN connection is interrupted or drops suddenly. Unfortunately, this feature is undercut by the need to accommodate special cases like identifying captive portals (like hotel WiFi) that must be checked before the user can log in or when using split-tunnel features. This is why Android is configured to leak some data upon connecting to a new WiFi network, regardless of whether you enabled the "Block connections without VPN" setting. Mullvad reported the issue to Google, requesting the addition of an option to disable connectivity checks. "This is a feature request for adding the option to disable connectivity checks while "Block connections without VPN" (from now on lockdown) is enabled for a VPN app," explains Mullvad in a feature request on Google's Issue Tracker. "This option should be added as the current VPN lockdown behavior is to leaks connectivity check traffic (see this issue for incorrect documentation) which is not expected and might impact user privacy." In response to Mullvad's request, a Google engineer said this is the intended functionality and that it would not be fixed for the following reasons: - Many VPNs actually rely on the results of these connectivity checks to function, - The checks are neither the only nor the riskiest exemptions from VPN connections, - The privacy impact is minimal, if not insignificant, because the leaked information is already available from the L2 connection. Mullvad countered these points and the case remains open.' -- source: https://tech.slashdot.org/story/22/10/12/2057246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Wi-Fi Spy Drones Snooped On Financial Services Firm
by Lawrence D'Oliveiro 13 Oct '22

13 Oct '22

Some security experts predicted this possibility years ago, and now we are seeing it for real <https://www.theregister.com/2022/10/12/drone-roof-attack/>: drones being used to attack network security. The company’s security team twigged to something odd going on when a user (or at least a device answering to their MAC address) seemed to be in two places at once: at home some distance away, and yet also at the premises, on a wi-fi network. Using a Fluke wi-fi meter, they traced the signal and found, not one, but two drones parked on the roof of the building. One had a “Wi-Fi Pineapple” penetration-testing device (which you can buy for USD120), while the other was carrying a range of kit, including a Raspberry Pi and a mini laptop. Seemed the attackers took advantage of a temporary lapse in security, due to some facilities reorganizations at the company, to trick a user into entering their credentials on a fake login page.

1 0

VirtualBox 7.0 adds first ARM Mac client, full encryption, Windows 11 TPM
by Peter Reutemann 12 Oct '22

12 Oct '22

'Nearly four years after its last major release, VirtualBox 7.0 arrives with a… host of new features. Chief among them are Windows 11 support via TPM, EFI Secure Boot support, full encryption for virtual machines, and a few Linux niceties. [...] Linux hosts receive "reworked" screen resizing, along with "initial support" for automatic updating of the Guest Additions inside Linux guests. Perhaps most interesting for Linux hosts is support for DXVK, the Vulkan-based implementation of DirectX layers that allows for running 3D Windows applications in Wine. This provides some parity with Windows hosts, which receive standard DirectX 11 support in this 7.0 release.' -- source: https://arstechnica.com/gadgets/2022/10/virtualbox-7-0-adds-first-arm-mac-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Confirms Alder Lake BIOS Source Code Leaked
by Peter Reutemann 10 Oct '22

10 Oct '22

'Tom's Hardware reports: We recently broke the news that Intel's Alder Lake BIOS source code had been leaked to 4chan and Github, with the 6GB file containing tools and code for building and optimizing BIOS/UEFI images. We reported the leak within hours of the initial occurrence, so we didn't yet have confirmation from Intel that the leak was genuine. Intel has now issued a statement to Tom's Hardware confirming the incident: "Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program...." The BIOS/UEFI of a computer initializes the hardware before the operating system has loaded, so among its many responsibilities, is establishing connections to certain security mechanisms, like the TPM (Trusted Platform Module). Now that the BIOS/UEFI code is in the wild and Intel has confirmed it as legitimate, both nefarious actors and security researchers alike will undoubtedly probe it to search for potential backdoors and security vulnerabilities.... Intel hasn't confirmed who leaked the code or where and how it was exfiltrated. However, we do know that the GitHub repository, now taken down but already replicated widely, was created by an apparent LC Future Center employee, a China-based ODM that manufactures laptops for several OEMs, including Lenovo. ' -- source: https://hardware.slashdot.org/story/22/10/09/2330258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Launches New Free Tier for Its Security-Focused 'Ubuntu Pro'
by Peter Reutemann 10 Oct '22

10 Oct '22

'"Starting with the Ubuntu 16.04 edition and including the later LTS versions, Canonical will offer expanded security coverage for critical, high, and medium Common Vulnerabilities and Exposures (CVEs) to all of Ubuntu's open-source applications and toolchains for ten years," reports ZDNet. "Yes, you read that right, you get security patches not just for the operating system, but for all of Ubuntu's open-source applications for a decade." Most of these are server programs, such as Ansible, Apache Tomcat, Drupal, Nagios, Redis, and WordPress. But, it also includes such developer essentials as Docker, Node.js, phpMyAdmin, Python 2, and Rust. Altogether, Canonical is supporting more than 23,000 packages. Indeed, it's now offering security for, as Mark Shuttleworth, Canonical's CEO, said, "Security coverage to every single package in the Ubuntu distribution." Canonical isn't doing this on its own. It's offering free, improved security in partnership with the security management company Tenable. Robert Huber, Tenable's Chief Security Officer, said, "Ubuntu Pro offers security patch assurance for a broad spectrum of open-source software. Together, we give customers a foundation for trustworthy open source." Beyond ordinary security, Canonical is backporting security fixes from newer application versions. This enables Ubuntu Pro users to use the Ubuntu release of their choice for long-term security without forced upgrades. Happy to keep using Ubuntu 20.04? No problem. You can run it until April 2030. Knock yourself out.... Users can obtain a free personal Ubuntu Pro subscription at ubuntu.com/pro for up to five machines. This free tier is for personal and small-scale commercial use. Mark Shuttleworth, CEO of Ubuntu's parent company company Canonical, explains in a new video that Ubuntu "is now the world's most widely used Linux..." "What makes most proud, though, is that we have found a way to make this available free of charge to anybody for their personal and for small-scale commercial use.... full commercial use for you, and any business you own, on up to five machines."' -- source: https://linux.slashdot.org/story/22/10/09/007217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Court Won’t Order Bad Tenants Facebook Group To Release Information
by Lawrence D'Oliveiro 10 Oct '22

10 Oct '22

A bunch of landlords in NZ were running a Facebook group called “Bad Tenants”, where they were sharing personal details about tenants <https://www.nzherald.co.nz/nz/court-wont-force-bad-tenants-facebook-group-t…>: ... it provides a space for landlords to share personal information about their tenants as a warning to other property owners, essentially blacklisting them. The Privacy Commission and Renters United have stated explicitly that this sharing of private information is against the law. So a tenant named Adam Sheehan took a complaint to the Privacy Commissioner last year, who directed that the group hand over any information they had about him. But they did not comply, and deleted the group. So then he went to court. But the court decided that there was no way they could enforce any decision made against the group. Under the Privacy Act 2020, any individual can request information that any organisation holds about them - whether it's the police, the Ministry of Health or an insurance broker - and they have to supply it. However, because a Facebook group isn't an organisation or an incorporated body, just a group of individuals, there was no one specifically for the tribunal to order to release Sheehan's information. I wonder, when groups or accounts or pages are deleted, does Facebook guarantee that that information really and permanently disappears?

2 1

Matter Smart Home Standard Officially Launches
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Connectivity Standards Alliance and its members that include Apple, Google, Amazon, Samsung, and other smart home manufacturers, today announced the official launch of the Matter 1.0 smart home accessory standard. MacRumors reports: Companies that have agreed to support Matter now have all of the resources that they need to begin implementing Matter into their platforms, so we could see Apple integrating Matter into HomeKit very soon. In fact, iOS 16.1 is already laying the groundwork for Matter, so Matter could be announced with the launch of the update. With the Matter 1.0 launch, authorized test labs are now available for product certification, tools are available, and the open-source reference design SDK is complete. Alliance members with devices that have already been deployed and with plans to update their products with Matter support can do so as soon as their products are certified. The Connectivity Standards Alliance says that the first release of Matter will support a variety of smart home products such as lighting, HVAC controls, window coverings, safety and security sensors, door locks, media devices, controllers, and bridges. "What started as a mission to unravel the complexities of connectivity has resulted in Matter, a single, global IP-based protocol that will fundamentally change the IoT," said Tobin Richardson, President and CEO of the Connectivity Standards Alliance. "This release is the first step on a journey our community and the industry are taking to make the IoT more simple, secure, and valuable no matter who you are or where you live. With global support from companies large and small, today's Matter 1.0 release is more than a milestone for our organization and our members; it is a celebration of what is possible." ' -- source: https://mobile.slashdot.org/story/22/10/04/2145233 Home assistant has support for it: https://www.home-assistant.io/blog/2022/05/29/matter-in-home-assistant-work… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Adafruit’s Cheekmate gets to the bottom (ahem) of chess cheating controversy
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Internet has been abuzz for weeks about a particularly juicy chess cheating controversy that erupted last month. The reigning chess world champion, Magnus Carlsen, lost in the third round to a 19-year-old upstart, Hans Niemann, in what was widely considered to be a shocking upset. Carlsen withdrew from the tournament the next day, and his cryptic comments on Twitter fueled rampant speculation that Niemann had cheated. The fact that Niemann admitted to cheating in online chess matches didn't help his case, but he steadfastly insisted he never cheated in over-the-board games. The fierce debate eventually produced a bizarre viral conspiracy theory that Niemann had used anal beads to receive coded messages during the match. But would that even be possible? The folks at Adafruit Industries were sufficiently intrigued to put the theory to the test—you know, just to get to the bottom of the matter. The result is a prototype device called Cheekmate—because the Adafruit team rightfully loves their punny innuendoes—complete with a step-by-step guide for those who might want to build their own prototype. This device, Adafruit insists, is not for actual cheating: "That would be asinine… in brief, a stain on the sport, but to record for posterior whether this sort of backdoor intrusion is even plausible or just an Internet myth." Lacking any willing human volunteers to test the prototype, they ended up embedding Cheekmate in a big, juicy slab of pork butt.' -- source: https://arstechnica.com/gaming/2022/10/adafruits-cheekmate-gets-to-the-bott… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IceWM Reaches Version 3 After a Mere 25 Years
by Peter Reutemann 06 Oct '22

06 Oct '22

'A new version of a quarter-century-old window manager shows that there's still room for improvement and innovation, even in established, mature tools. The Register reports: IceWM is [...] a traditional stacking window manager allowing you to open, move, and resize windows. It's relatively simple, easy, and quick to learn. By default, it also provides an app launcher and an app switcher, using the familiar Windows 95 model: a hierarchical start menu and a taskbar. If you do a minimal install of openSUSE, you get IceWM. It's also one of the defaults in the lightweight antiX and Absolute Linux distros. With such a relatively simple remit, it's good to see that development is still going on. Version 2.0 appeared late in 2020, removing a legacy protocol and adding a new image rendering engine. Now version 3.0 is out with a whole new feature: tabbed windows. Reminiscent of one of The Reg FOSS desk's favorite OSes, the late and great Be OS, tabbed windows turn the title bar into a tab that is less than the full width of the window. In IceWM 3, this allows you to attach windows together to form one entity that can be moved and sized in a single operation â" but the contents of the different windows can be accessed individually using each one's tab. In other words, it works like browser tabs, but the different windows don't need to be from the same parent application. "IceWM's new tabbed windows are the sort of relatively simple improvement to the very well-established metaphor of window management that this vulture really likes to see: small, elegant, and yet helpful," adds The Register's Liam Proven. "We feel that there's plenty more room for improvement within this space. For instance, very few window managers offer the choice of where the title bar (or tab) is located; on a widescreen, placing them on the side, as wm2 and wmx do, would save valuable vertical pixels."' -- source: https://tech.slashdot.org/story/22/10/05/214241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Filling A USB Stick
by Lawrence D'Oliveiro 06 Oct '22

06 Oct '22

Does anybody else fill USB sticks full of data? I have a backup regime currently based on 32GiB sticks, and I find it can take up to around 8 hours to fill one with files. (USB 3 sticks might have been a bit quicker, maybe half that time). So I tried an alternative approach: use dd to copy the stick to an image file, do a loopback mount of that image file, do the backup copy to the mounted image, dismount it, then use dd to copy it back to the actual stick. Time taken: typically less than 10 minutes to copy the stick to an image file, and up to an hour to copy the image file back to a USB 3 stick, or around 3 and a half hours for a USB 2 stick. The backup to the image file itself took an hour at most. Overall, still a substantial saving in time using the image-file approach. Doing a restore from the sticks is fast enough that I do this directly from them, without bothering with intermediate image files. Also I notice quite a variation in the actual capacities of the sticks. They are all nominally 32GiB = 2 ** 35 bytes, but the sizes of the usable partitions range from 89.5% of this to 91.4% -- well short of what it says on the tin. Even if you say it’s supposed to be 32GB = 32 * 10 ** 9 bytes, capacities range from 96.1% to 98.1% of the nominal value.

1 0