- wlug - list.wlug.org.nz

60% of MD5 Password Hashes Are Crackable In Under an Hour
by Peter Reutemann 08 May '26

08 May '26

'In honor of World Password Day, Kaspersky researchers revisited their study on the crackability of real-world passwords and found that 60% of MD5-hashed passwords could be cracked in under an hour with a single Nvidia RTX 5090, and 48% could be cracked in under a minute. "The bottom line is that passwords protected only by fast hashing algorithms such as MD5 are no longer safe if attackers obtain them in a data breach," reports The Register. From the report: Much of the reason password hashes have become so easy to crack is password predictability. Per Kaspersky, its analysis of more than 200 million exposed passwords revealed common patterns that attackers can use to optimize cracking algorithms, significantly reducing the time needed to guess the character combinations that grant access to target accounts. In case you're wondering whether there's a trend to compare this to, Kaspersky ran a prior iteration of this study in 2024, and bad news: Passwords are actually a bit easier to crack in 2026 than they were a couple of years ago. Not by much, mind you -- only a few percent -- but it's still a move in the wrong direction. "Attackers owe this boost in speed to graphics processors, which grow more powerful every year," Kaspersky explained. "Unfortunately, passwords remain as weak as ever." "This World Password Day, the main message ought not to be to the users, who often have no choice but to use passwords anyway, but to the sites and providers that are requiring them to do so," said senior IEEE member and University of Nottingham cybersecurity professor Steven Furnell. His advice is that providers need to modernize their login systems and enforce stronger protections, because users are often stuck with whatever security options they're given.' -- source: https://yro.slashdot.org/story/26/05/07/1952206 Cheers, Peter

1 0

DAEMON Tools vs daemontools
by Lawrence D'Oliveiro 06 May '26

06 May '26

“Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack” <https://arstechnica.com/security/2026/05/widely-used-daemon-tools-disk-app-…>: Kaspersky, the security firm reporting the supply-chain attack, said it began on April 8 and remained active as of the time its post went live. Installers that are signed by the developer’s official digital certificate and downloaded from its website infect Daemon Tools executables, causing the malware to run at boot time. Kaspersky didn’t explicitly say so, but based on technical details, the infected versions appear to be only those that run on Windows. Versions 12.5.0.2421 through 12.5.0.2434 are affected. Neither Kaspersky nor developer AVB could be contacted immediately for additional details. Checking my Debian repo, I find a set of related packages named “daemontools”. But it seems clear to me this “daemontools” has nothing to do with the “DAEMON Tools” product that is the subject of this security alert. To start with, the version numbers are quite different. Also, the latter is Windows-only <https://www.daemon-tools.cc/support/faq#system_requirements>, while the former makes it quite clear <https://cr.yp.to/daemontools.html> that it is “for managing UNIX services”.

1 0

Fixing A Service Dependency
by Lawrence D'Oliveiro 02 May '26

02 May '26

I don’t often have to restart my public-facing virtual server, but when I do, I have had trouble with one or two services not starting properly. The server picks up my mail via Postfix. From my office, I then run a periodic task which connects via POP to Dovecot on the server, and transfers the mail to my main office machine. This happens over an encrypted OpenVPN connection, so Dovecot itself doesn’t need to implement any encrypted transport, or accept connections on any publicly-accessible ports. One problem was, there was by default no coordination between the startup of the VPN connection and the startup of the Dovecot process. If the latter got going first, then it would fail to open a listening socket on the LAN-internal interface, because the VPN connection had not created that interface yet. Today I finally sat down and worked out a fix. This requires adding a dependency between the two services, via their systemd service configuration files. systemd offers a convenient method for allowing you to customize service configurations without having to completely replace their .service files. Instead, you create “drop-in” files, which amend the configuration in the desired ways. In this case, the original Dovecot service config file is /lib/systemd/system/dovecot.service, which I didn’t need to touch. Instead, I created the directory /etc/systemd/system/dovecot.service.d, to contain my amendments to the service definition. In here, I put a file which I decided to call geek-central.conf, which only needed to contain [Unit] Requires=openvpn-server(a)geek-central.service After=openvpn-server(a)geek-central.service (Note that the OpenVPN service definitions are “template” files, which means you can start multiple service instances from a common template, with a unique name after the “@” character. It’s up to the software implementing the service to use this instance name as a hint as to which configuration to choose for the service instance -- in this case, it looks for the VPN setup details in /etc/openvpn/server/geek-central.conf.) First I did a “systemctl daemon-reload”, followed by “systemctl show dovecot.service”, just to confirm it was picking up the configuration changes correctly -- namely, that the “Requires=” and “After=” entries showed the combination of the default settings and my amendments. Then, of course, to do a proper test, I had to reboot the server. Which worked. I also did a similar thing to fix a race condition between the startup of the SQLGrey mail greylisting service and the database server it is using. The former requires the latter, but the default service configuration doesn’t specify this, again leading to startup failures -- I would class this as a configuration bug. A fix for this was similarly easy.

1 0

New Linux 'Copy Fail' Vulnerability Enables Root Access On Major Distros
by Peter Reutemann 02 May '26

02 May '26

'A newly disclosed Linux kernel flaw dubbed "Copy Fail" can let a local, unprivileged attacker gain root access on major Linux distributions, with researchers claiming the bug affects kernels shipped since 2017. "The POC exploit works out of the box today, but a future version that can escape from containers like Docker is promised soon," writes Slashdot reader tylerni7. "Technical details are available here." Slashdot reader BrianFagioli shares a report from NERDS.xyz: A newly disclosed Linux kernel vulnerability called Copy Fail (CVE-2026-31431) allows an unprivileged user to gain root access using a tiny 732-byte script, and it works with unsettling consistency across major distributions. Unlike older exploits that relied on race conditions or fragile timing, this one is a straight-line logic flaw in the kernel's crypto subsystem. It abuses AF_ALG sockets and splice to overwrite a few bytes in the page cache of a target file, such as /usr/bin/su. Because the kernel executes from the page cache, not directly from disk, the attacker can inject code into a setuid binary in memory and immediately escalate privileges. What makes this especially concerning is how quiet it is. The file on disk remains unchanged, so standard integrity checks see nothing wrong, while the in-memory version has already been tampered with. The same primitive can also cross container boundaries since the page cache is shared, raising the stakes for multi-tenant environments and Kubernetes nodes. The underlying issue traces back to an in-place optimization added years ago, now being rolled back as part of the fix. Until patched kernels are widely deployed, this is one of those bugs that feels less like a theoretical risk and more like a practical, reliable path to full system compromise. ' -- source: https://it.slashdot.org/story/26/04/30/207231 Cheers, Peter

1 0

Hackers Are Actively Exploiting a Bug In cPanel, Used By Millions of Websites
by Peter Reutemann 02 May '26

02 May '26

'Hackers are actively exploiting a critical cPanel and WHM vulnerability, tracked as CVE-2026-41940, that allows remote attackers to bypass the login screen and gain full administrative access to affected web servers. Major hosts including Namecheap, HostGator, and KnownHost have taken mitigation steps or patched systems, but cPanel is urging all customers and web hosts to update immediately because the software is widely used across millions of websites. TechCrunch reports: cPanel and WHM are two software suites used for managing web servers that host websites, manage emails, and handle important configurations and databases needed to maintain an internet domain. The two suites have deep-access to the servers that they manage, allowing a malicious hacker potentially unrestricted access to data managed by the affected software. Given the ubiquity of the cPanel and WHM software across the web hosting industry, hackers could compromise potentially large numbers of websites that haven't patched the bug. Canada's national cybersecurity agency said in an advisory that the bug could be exploited to compromise websites on shared hosting servers, such as large web hosting companies. The agency said that "exploitation is highly probable" and that immediate action from cPanel customers, or their web hosts, is necessary to prevent malicious access. [...] One web hosting company says it found evidence that hackers have been abusing the vulnerability for months before the attempts were discovered.' -- source: https://it.slashdot.org/story/26/05/01/0631257 Cheers, Peter

1 0

Framework CEO Reviews Framework Laptop 12 versus Apple MacBook Neo
by Lawrence D'Oliveiro 29 Apr '26

29 Apr '26

Quite a lot of hardware detail in this half-hour video <https://www.youtube.com/watch?v=uvYt1GgcsUI>, in which Framework CEO Nirav Patel, assisted by Izzy, his hardware product manager, do side-by-side teardowns of their company’s Laptop 12 model and Apple’s new MacBook Neo. He does try not to let his bias show *too* much, by being complimentary to the Neo’s better screen, and also by being reasonably even-handed in his discussion of respective design tradeoffs (just compare the size of the two different mainboards, for -- to me at least -- the most dramatic example of this). Both target the sub-US$1000 market, but of course they do it in very different ways: the whole philosophy of Framework is to keep things modular for easy repair and upgradeability, while Apple has traditionally taken a “keep out” attitude to would-be do-it-yourself hardware tinkerers. It appears, though that the Neo represents a shift in this attitude somewhat -- not that Apple has much choice, with new EU rules on minimizing e-waste coming into effect. Plus of course the political pressure from consumer-driven right-to-repair movements on both sides of the Atlantic. He talks at the end about an emphasis on the education market -- a market which Apple dominated back in the last century, but gave up somewhat in the last couple of decades. Seems like the Neo might represent an attempt by Apple to reestablish a presence here, while Patel says he is already getting lots of queries from schools looking to save costs by buying more easily repairable products.

1 0

Phrase Of The Week: “Distillation Attack”
by Lawrence D'Oliveiro 28 Apr '26

28 Apr '26

It’s not enough that the creators of the AI models have scraped information from millions of websites to build their systems, now they have to worry about competitors short-circuiting the process by extracting information wholesale from their models, by making hundreds or thousands of requests and combining the results. This is called a “distillation attack”. Some AI service providers try to say this is against their terms and conditions, but how do you define what is and isn’t allowed, exactly? <https://arstechnica.com/ai/2026/02/attackers-prompted-gemini-over-100000-ti…>: In March 2023, shortly after Meta’s LLaMA model weights leaked online, Stanford University researchers built a model called Alpaca by fine-tuning LLaMA on 52,000 outputs generated by OpenAI’s GPT-3.5. The total cost was about $600. The result behaved so much like ChatGPT that it raised immediate questions about whether any AI model’s capabilities could be protected once it was accessible through an API. A big worry in the US now is that China is doing this to train its AI models <https://arstechnica.com/tech-policy/2026/04/us-accuses-china-of-industrial-…>. And of course, as soon as it is seen as a “national security” issue, they start to lobby the politicians to pass laws against it. Imagine that: making too much use of the service, or prompting it according to certain forbidden patterns, could now become criminal violations of laws such as the Economic Espionage Act and the Computer Fraud and Abuse Act. Another quote from the February article: As long as an LLM is accessible to the public, no foolproof technical barrier prevents a determined actor from doing the same thing to someone else’s model over time (though rate-limiting helps), which is exactly what Google says happened to Gemini

1 0

Framework’s CEO on the RAM crisis and creating a “MacBook Pro for Linux users”
by Lawrence D'Oliveiro 23 Apr '26

23 Apr '26

Interview with Framework CEO Nirav Patel <https://arstechnica.com/gadgets/2026/04/frameworks-ceo-on-the-ram-crisis-an…>. Framework, the maker of configurable laptops, is naturally a Linux-heavy, but not a Linux-exclusive, company: “... on Framework Laptop 13, we actually have slightly more Linux users than Windows users. It’s something like 55/45 [Linux versus Windows] on the 13. It varies on our different products. The [Framework Laptop] 16 is a bit more Windows heavy.” Also: The company is also trying to capture Mac users, which was one reason Framework shifted from a trackpad with a physical clicking mechanism to a haptic trackpad like the ones Apple has used in most MacBooks over the past decade. Yes, there are actually enough Mac users that want to switch to Framework machines, for this to matter. And the headline quote: “Increasingly over the last five years, especially software developers come in because they want Linux and they want it on hardware that supports it as a first-class experience,” Patel told Ars. “And so really a lot of the philosophy behind the [Framework Laptop 13] Pro was ‘let’s build essentially the MacBook Pro for Linux users. Let’s take the software that they want, the distro that they prefer, and then make sure that the hardware experience lives up to what they would expect coming from a MacBook Pro.’”

1 1

IPv6 Marches On
by Lawrence D'Oliveiro 17 Apr '26

17 Apr '26

Some interesting stats from <https://www.tomshardware.com/networking/ipv6-usage-reaches-historic-50-perc…>: • 50% of users of Google’s services connect over IPv6 • 43% of the world uses IPv6, with some parts approaching 50% • Cloudflare reports 40% of its traffic is done via IPv6 Choice quote: Some people still think that the additional 20 bytes or so of an IPv6 packet header translates to significant bandwidth losses, higher CPU usage, and hair loss. The reality is that even 11 years ago, Facebook's tests saw that IPv6 connectivity was around 10-15% faster overall, while networking giant Akamai noticed a 5% speedup in mobile page loading. The speedups are almost assuredly due to the fact that with IPv6, there's very little need to do math with NAT, proxies, and other shenanigans, as in most instances, everything can directly connect to everything else.

1 0

Linux 7.0 Released
by Peter Reutemann 14 Apr '26

14 Apr '26

'"The new Linux kernel was released and it's kind of a big deal," writes longtime Slashdot reader rexx mainframe. "Here is what you can expect." Linuxiac reports: A key update in Linux 7.0 is the removal of the experimental label from Rust support. That (of course) does not make Rust a dominant language in kernel development, but it is still an important step in its gradual integration into the project. Another notable security-related change is the addition of ML-DSA post-quantum signatures for kernel module authentication, while support for SHA-1-based module-signing schemes has been removed. The kernel now includes BPF-based filtering for io_uring operations, providing administrators with improved control in restricted environments. Additionally, BTF type lookups are now faster due to binary search. At the same time, this release continues ongoing cleanup in the kernel's lower layers. The removal of linuxrc initrd code advances the transition to initramfs as the sole early-userspace boot mechanism. Linux 7.0 also introduces NULLFS, an immutable and empty root filesystem designed for systems that mount the real root later. Plus, preemption handling is now simpler on most architectures, with further improvements to restartable sequences, workqueues, RCU internals, slab allocation, and type-based hardening. Filesystems and storage receive several updates as well. Non-blocking timestamp updates now function correctly, and filesystems must explicitly opt in to leases rather than receiving them by default. Phoronix has compiled a list of the many exciting changes. Linus Torvalds himself announced the release, which can be downloaded directly from his git tree or from the kernel.org website. Linux 7.0 has a major new version number but it's "largely a numbering reset [...], not a sign of some unusually disruptive release," notes Linuxiac.' -- source: https://linux.slashdot.org/story/26/04/13/1857240/linux-70-released Cheers, Peter

1 0