- wlug - list.wlug.org.nz

Windows.com Bitsquatting Hack Can Wreak 'Unknown Havoc' On PCs
by Peter Reutemann 05 Mar '21

05 Mar '21

'Ars Technica: Bitflips are events that cause individual bits stored in an electronic device to flip, turning a 0 to a 1 or vice versa. Cosmic radiation and fluctuations in power or temperature are the most common naturally occurring causes. Research from 2010 estimated that a computer with 4GB of commodity RAM has a 96 percent chance of experiencing a bitflip within three days. An independent researcher recently demonstrated how bitflips can come back to bite Windows users when their PCs reach out to Microsoft's windows.com domain. Windows devices do this regularly to perform actions like making sure the time shown in the computer clock is accurate, connecting to Microsoft's cloud-based services, and recovering from crashes. Remy, as the researcher asked to be referred to, mapped the 32 valid domain names that were one bitflip away from windows.com. Of the 32 bit-flipped values that were valid domain names, Remy found that 14 of them were still available for purchase. This was surprising because Microsoft and other companies normally buy these types of one-off domains to protect customers against phishing attacks. He bought them for $126 and set out to see what would happen. Over the course of two weeks, Remy's server received 199,180 connections from 626 unique IP addresses that were trying to contact ntp.windows.com. By default, Windows machines will connect to this domain once per week to check that the time shown on the device clock is correct. What the researcher found next was even more surprising. "The NTP client for windows OS has no inherent verification of authenticity, so there is nothing stopping a malicious person from telling all these computers that it's after 03:14:07 on Tuesday, 19 January 2038 and wreaking unknown havoc as the memory storing the signed 32-bit integer for time overflows," he wrote in a post summarizing his findings. "As it turns out though, for ~30% of these computers doing that would make little to no difference at all to those users because their clock is already broken."' -- source: https://tech.slashdot.org/story/21/03/04/2152239 I wonder whether anyone has tested apt-get in regards to this... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Issues Warning After Microsoft Says China Hacked Its Mail Server Program
by Peter Reutemann 05 Mar '21

05 Mar '21

'NBC News: The U.S. has issued an emergency warning after Microsoft said it caught China hacking into its mail and calendar server program, called Exchange. The perpetrator, Microsoft said in a blog post, is a hacker group that the company has "high confidence" is working for the Chinese government and primarily spies on American targets. The latest software update for Exchange blocks the hackers, prompting the U.S. Cybersecurity and Infrastructure Security Agency to issue a rare emergency directive that requires all government networks do so. CISA, the U.S.'s primary defensive cybersecurity agency, rarely exercises its authority to demand the entire U.S. government take protective steps to protect its cybersecurity. The move was necessary, the agency announced, because the Exchange hackers are able "to gain persistent system access." All government agencies have until noon Friday to download the latest software update. In a separate blog post, Microsoft Vice President Tom Burt wrote that the hackers have recently spied on a wide range of American targets, including disease researchers, law firms and defense contractors. There was no immediate indication that the hack led to significant exploitation of U.S. government computer networks. But the announcement marks the second instance in recent months that the U.S. scrambled to address a widespread hacking campaign believed be the work of foreign government spies.' -- source: https://it.slashdot.org/story/21/03/04/022226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Switches Its Release Cycle for First Time in a Decade
by Peter Reutemann 05 Mar '21

05 Mar '21

'Google Chrome releases will soon arrive more frequently than ever. >From a report: In an announcement today, Google said it is updating the Chrome release schedule for the first time in over a decade. For a cool 10+ years now, Chrome stable releases have shipped every 6 weeks with new features, security fixes, etc. With improvements to testing and release processes, Google has realized that it can shorten the release cycle and will do so in Q3 of this year. Starting with Chrome 94, Google will move to a 4-week milestone release cycle. Freaked out at the possibility that Google might break features, remove things you like, or cause other issues with so many releases? Don't worry, Google is also introducing an Extended Stable release that will see milestone updates every 8 weeks. Now, it will still get updates every 2 weeks to address "important issues," but none of the new features or all security fixes that the 4-week milestones see will be included.' -- source: https://tech.slashdot.org/story/21/03/04/1924223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-first Browser Brave Now Has Its Own Google Search Rival
by Peter Reutemann 04 Mar '21

04 Mar '21

'Two years after publicly launching a privacy-focussed browser, Brave, founded by former Mozilla executive Brendan Eich, is taking on Google's search business, too. From a report: The announcement of Brave Search puts the upstart in the rare position of taking on both Google's browser and search dominance. Eich says that Brave Search, which has opened a waitlist and will launch in the first half of this year, won't track or profile people who use it. "Brave already has a default anonymous user model with no data collection at all," he says adding this will continue in its search engine. No IP addresses will be collected and the company is exploring how it can create both a paid, ad-free search engine and one that comes with ads. But building a search engine isn't straightforward. [...] Eich says Brave isn't starting its search engine or index from scratch and won't be using indexes from Bing or other tech firms. Instead Brave has purchased Tailcat, an offshoot of German search engine Cliqz, which was owned by Hubert Burda Media and closed down last year. The purchase includes an index of the web that's been created by Tailcat and the technology that powers it. Eich says that some users will be given the ability to opt-in to anonymous data collection to help fine-tune search results. "What Tailcat does is it looks at a query log and a click log anonymously," Eich says. "These allow it to build an index, which Tailcat has done and already did at Cliqz, and it's getting bigger." He admits that the index will not be anywhere near as deep as Google's but that the top results it surfaces are largely the same.' -- source: https://search.slashdot.org/story/21/03/03/1643231 Interesting that they didn't simply use DuckDuckGo... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Launches Power Fx, a New Open Source Low-Code Language
by Peter Reutemann 03 Mar '21

03 Mar '21

'Microsoft today announced Power Fx, a new low-code language that "will become the standard for writing logic customization across Microsoft's own low-code Power Platform," reports TechCrunch. "[S]ince the company is open-sourcing the language, Microsoft also hopes others will implement it as well and that it will become the de facto standard for these kinds of use cases." From the report: Microsoft says the language was developed by a team led by Vijay Mital, Robin Abraham, Shon Katzenberger and Darryl Rubin. Beyond Excel, the team also took inspiration from tools and languages like Pascal, Mathematica and Miranda, a functional programming language developed in the 1980s. Microsoft plans to bring Power Fx to all of its low-code platforms, but given the focus on community, it'll start making appearances in Power Automate, Power Virtual Agents and elsewhere soon. But the team clearly hopes that others will adopt it as well. Low-code developers will see it pop up in the formula bars of products like Power Apps Studio, but more sophisticated users will also be able to use it to go to Visual Studio Code and build more complex applications with it. As the team noted, it focused on not just making the language Excel-like but also having it behave like Excel -- or like a REPL, for you high-code programmers out there. That means formulas are declarative and instantly recalculate as developers update their code. ' -- source: https://news.slashdot.org/story/21/03/02/2126228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux On Mars
by Lawrence D'Oliveiro 03 Mar '21

03 Mar '21

One of many accounts of the NASA “Perseverance” rover landing on Mars is this one <https://www.youtube.com/watch?v=mfgzTfw_J6o> by ever-dependable space nerd Scott Manley. He mentions that the umbilical carrying those camera images from the skycrane back to the lander is Ethernet, and that camera connections are done via USB 3. And yes, apparently there is Linux running on there somewhere as well.

1 1

Google-free /e/ OS is now selling preloaded phones in the US, starting at $380
by Peter Reutemann 03 Mar '21

03 Mar '21

'/e/ OS, the "open-source, pro-privacy, and fully degoogled" fork of Android, is coming to Canada and the USA. Of course, you've always been able to download the software in any region, but now (as first spotted by It's Foss News) the e Foundation will start selling preloaded phones in North America. Previously, /e/ only did business in Europe. Like normal, the e Foundation's smartphone strategy is to sell refurbished Samsung devices with /e/ preloaded. In the US, there are only two phones right now: the Galaxy S9 for $379.99 or a Galaxy S9+ for $429.99. North Americans still have reason to be jealous of Europe, where you can get /e/ preloaded on a Fairphone, which is also Europe-exclusive. These Samsung phones are used devices, but the site says the devices have "been checked and reconditioned to be fully working at our partner's facilities." The phones have a one-year warranty and are described as "Good-as-New" with "no surprises." An /e/ device means you'll be getting a fork of Android 10, and for ongoing support, the e Foundation says, "We aim to support with at least 3 years of software updates and security patches."' -- source: https://arstechnica.com/gadgets/2021/03/google-free-e-os-is-now-selling-pre… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Went Six Days Without Electricity, Swears Smaller 5.12 Kernel Is Co-Incidental
by Peter Reutemann 03 Mar '21

03 Mar '21

'Linux overlord Linus Torvalds has revealed that inclement weather in the USA meant he recently endured six electricity-free days in his Portland, Oregon, home during which he was unable to tend to the kernel. As a result he therefore pondered adding an extra week to the merge window for version 5.12 of the Linux kernel. The Register reports: "As you can tell, I didn't do that," he said in his State of The Kernel update that announced release candidate one of the new kernel cut. "To a large part because people were actually very good about sending in their pull requests, so by the time I finally got power back, everything was nicely lined up and I got things merged up ok." It wasn't just penguinistas behaving well that helped. Torvalds said this version of the kernel has received around 10,000 commits. That's rather fewer than the 12,000 or 13,000 he usually sees. In case anyone was inconvenienced by blackout-induced inability to merge, Torvalds said he's open to help any kernel devs for whom his unavailability caused problems but is not open to all late pulls. Torvalds rated the new release as offering "a fair amount of historical cleanup" on account of "removing the legacy OPROFILE support (the user tools have been using the "perf" interface for years), and removing several legacy SoC platforms and various drivers that no longer make any sense." Among the big inclusions in 5.12 are Clang Link-Time Optimizations, which make for better compiler performance, and support for Intel's eASIC NX5 silicon that aims to offer an alternative to FPGAs in edge and cloud applications. Qualcomm's Snapdragon 888 5G SoC also gains support. ' -- source: https://linux.slashdot.org/story/21/03/01/2237246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Go Malware is Now Common, Having Been Adopted by Both APTs and E-crime Groups
by Peter Reutemann 02 Mar '21

02 Mar '21

'The number of malware strains coded in the Go programming language has seen a sharp increase of around 2,000% over the last few years, since 2017, cybersecurity firm Intezer said in a report published recently. From a report: The company's findings highlight and confirm a general trend in the malware ecosystem, where malware authors have slowly moved away from C and C++ to Go, a programming language developed and launched by Google in 2007. While the first Go-based malware was detected in 2012, it took, however, a few years for Golang to catch on with the malware scene. "Before 2019, spotting malware written in Go was more a rare occurrence and during 2019 it became a daily occurrence," Intezer said in its report. But in the new report, Golang (as it's often also referred to instead of Go) has broken through and has been widely adopted. It is used by nation-state hacking groups (also known as APTs), cybercrime operators, and even security teams alike, who often used it to create penetration-testing toolkits.' -- source: https://it.slashdot.org/story/21/03/01/1545257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First Fully Weaponized Spectre Exploit Discovered Online
by Peter Reutemann 02 Mar '21

02 Mar '21

'Catalin Cimpanu, reporting for The Record: A fully weaponized exploit for the Spectre CPU vulnerability was uploaded on the malware-scanning website VirusTotal last month, marking the first time a working exploit capable of doing actual damage has entered the public domain. The exploit was discovered by French security researcher Julien Voisin. It targets Spectre, a major vulnerability that was disclosed in January 2018. [...] The vulnerability, which won a Pwnie Award in 2018 for one of the best security bug discoveries of the year, was considered a milestone moment in the evolution and history of the modern CPU. Its discovery, along with the Meltdown bug, effectively forced CPU vendors to rethink their approach to designing processors, making it clear that they cannot focus on performance alone, to the detriment of data security. Software patches were released at the time, but the Meltdown and Spectre disclosures forced Intel to rethink its entire approach to CPU designs going forward. At the time, the teams behind the Meltdown and Spectre bugs published their work in the form of research papers and some trivial proof-of-concept code to prove their attacks. Shortly after the Meltdown and Spectre publications, experts at AV-TEST, Fortinet, and Minerva Labs spotted a spike in VirusTotal uploads for both CPU bugs. While initially there was a fear that malware authors might be experimenting with the two bugs as a way to steal data from targeted systems, the exploits were classified as harmless variations of the public PoC code published by the Meltdown and Spectre researchers and no evidence was found of in-the-wild attacks. But today, Voisin said he discovered new Spectre exploits -- one for Windows and one for Linux -- different from the ones before. In particular, Voisin said he found a Linux Spectre exploit capable of dumping the contents of /etc/shadow, a Linux file that stores details on OS user accounts.' -- source: https://it.slashdot.org/story/21/03/01/1851240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0