- wlug - list.wlug.org.nz

New Android malware with full range of spying capabilities has been found
by Peter Reutemann 29 Mar '21

29 Mar '21

'Researchers have discovered a new advanced piece of Android malware that finds sensitive information stored on infected devices and sends it to attacker-controlled servers. The app disguises itself as a system update that must be downloaded from a third-party store, researchers from security firm Zimperium said on Friday. In fact, it’s a remote-access trojan that receives and executes commands from a command-and-control server. It provides a full-featured spying platform that performs a wide range of malicious activities. Zimperium listed the following capabilities: - Stealing instant messenger messages - Stealing instant messenger database files (if root is available) - Inspecting the default browser’s bookmarks and searches - Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser - Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx) - Inspecting the clipboard data - Inspecting the content of the notifications - Recording audio - Recording phone calls - Periodically take pictures (either through the front or back cameras) - Listing of the installed applications - Stealing images and videos - Monitoring the GPS location - Stealing SMS messages - Stealing phone contacts - Stealing call logs - Exfiltrating device information (e.g., installed applications, device name, storage stats) - Concealing its presence by hiding the icon from the device’s drawer/menu' -- source: https://arstechnica.com/gadgets/2021/03/new-android-malware-with-full-range… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cURL's 20th Anniversary Celebrated With 3D-Printed 'GitHub Steel' Contribution Graph
by Peter Reutemann 29 Mar '21

29 Mar '21

'This week Swedish developer Daniel Stenberg posted a remarkable reflection on the 20th anniversary of his command-line data tool, cURL: curl was adopted in Red Hat Linux in late 1998, became a Debian package in May 1999, shipped in Mac OS X 10.1 in August 2001. Today, it is also shipped by default in Windows 10 and in iOS and Android devices. Not to mention the game consoles, Nintendo Switch, Xbox and Sony PS5. Amusingly, libcurl is used by the two major mobile OSes but not provided as an API by them, so lots of apps, including many extremely large volume apps bundle their own libcurl build: YouTube, Skype, Instagram, Spotify, Google Photos, Netflix etc. Meaning that most smartphone users today have many separate curl installations in their phones. Further, libcurl is used by some of the most played computer games of all times: GTA V, Fortnite, PUBG mobile, Red Dead Redemption 2 etc. libcurl powers media players and set-top boxes such as Roku, Apple TV by maybe half a billion TVs. curl and libcurl ships in virtually every Internet server and is the default transfer engine in PHP, which is found in almost 80% of the world's almost two billion websites. Cars are Internet-connected now. libcurl is used in virtually every modern car these days to transfer data to and from the vehicles. Then add media players, kitchen and medical devices, printers, smart watches and lots of "smart"; IoT things. Practically speaking, just about every Internet-connected device in existence runs curl. I'm convinced I'm not exaggerating when I claim that curl exists in over ten billion installations world-wide... Those 300 lines of code in late 1996 have grown to 172,000 lines in March 2021. Stenberg attributes cURL's success to persistence. "We hold out. We endure and keep polishing. We're here for the long run. It took me two years (counting from the precursors) to reach 300 downloads. It took another ten or so until it was really widely available and used." But he adds that 22 different CPU architectures and 86 different operating systems are now known to have run curl. In a later blog post titled "GitHub Steel," Stenberg also reveals that GitHub gave him a 3D-printed steel version of his 2020 GitHub contribution matrix — accompanied by a friendly note. "Please accept this small gift as a token of appreciation on behalf of all of us here at GitHub, and everyone who benefits from your work."' -- source: https://tech.slashdot.org/story/21/03/28/0143206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Attackers Breach 21,000 Microsoft Exchange Servers, Install Malware Implicating Brian Krebs
by Peter Reutemann 29 Mar '21

29 Mar '21

'Security researcher Brian Krebs wants you to know... "New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name. Let's just get this out of the way right now: It wasn't me." The Shadowserver Foundation, a nonprofit that helps network owners identify and fix security threats, says it has found 21,248 different Exchange servers which appear to be compromised by a backdoor and communicating with [a domain that begins with brian . krebsonsecurity... Not a safe domain.] Shadowserver has been tracking wave after wave of attacks targeting flaws in Exchange that Microsoft addressed earlier this month in an emergency patch release. The group looks for attacks on Exchange systems using a combination of active Internet scans and "honeypots" — systems left vulnerable to attack so that defenders can study what attackers are doing to the devices and how. David Watson, a longtime member and director of the Shadowserver Foundation Europe, says his group has been keeping a close eye on hundreds of unique variants of backdoors (a.k.a. "web shells") that various cybercrime groups worldwide have been using to commandeer any unpatched Exchange servers. These backdoors give an attacker complete, remote control over the Exchange server (including any of the server's emails)... Shadowserver's honeypots saw multiple hosts with the Babydraco backdoor doing the same thing: Running a Microsoft Powershell script that fetches the file "krebsonsecurity.exe"... Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. The Krebsonsecurity file also installs a root certificate, modifies the system registry, and tells Windows Defender not to scan the file. Watson said the Krebsonsecurity file will attempt to open up an encrypted connection between the Exchange server and the above-mentioned IP address, and send a small amount of traffic to it each minute. Shadowserver found more than 21,000 Exchange Server systems that had the Babydraco backdoor installed. But Watson said they don't know how many of those systems also ran the secondary download from the rogue Krebsonsecurity domain. "Despite the abuse, this is potentially a good opportunity to highlight how vulnerable/compromised MS Exchange servers are being exploited in the wild right now, and hopefully help get the message out to victims that they need to sign up our free daily network reports," Watson said.' -- source: https://it.slashdot.org/story/21/03/28/1924206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Open Source Initiative' Stops Collaboration With FSF Over Richard Stallman's Return
by Peter Reutemann 28 Mar '21

28 Mar '21

'The Open Source Initiative's board of directors recently issued the following statement: Richard M. Stallman recently announced that he will be returning to the board of directors of the Free Software Foundation (FSF), a statement that the FSF has not denied. We believe it is inappropriate for Stallman to hold any leadership position in the free and open source software community. If we do not speak out against this, our silence may be misinterpreted as support. The Open Source Initiative calls upon the Free Software Foundation to hold Stallman responsible for past behavior, remove him from the organization's leadership and work to address the harm he caused to all those he has excluded: those he considers less worthy, and those he has hurt with his words and actions. We will not participate in any events that include Richard M. Stallman and we cannot collaborate with the Free Software Foundation until Stallman is removed from the organization's leadership. Free and open source software will not be accessible to all until it is safe for everyone to participate, and we therefore call upon our peers in the broader software community to join us in making these commitments. Another perspective turns up in the "This Week in Programming" column: YouTuber Brodie Roberston offers his take on the return of RMS, saying "Like it or not, Richard Stallman is the face of free software. When you think about the free software movement, he is the one person that comes to mind." He then goes on to argue that the FSF is essentially the "ideological arm" of Stallman himself and that he is essentially irreplaceable not only because of his thoughts around free software but his passion for it, before going on to list the things that are "part of his charm."' -- source: https://news.slashdot.org/story/21/03/27/0347246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Open Collective Launches Funds that Financially Support Open-Source Communities
by Peter Reutemann 28 Mar '21

28 Mar '21

'"Introducing Funds for Open Source!" reads a blog post on the site for Open Collective. Back in 2018 TechCrunch called them "a non-profit platform that provides tools to 'collectives' to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way." But while they're currently serving 2500+ projects, now SD Times reports that Open Collective "is trying to make working full-time for an open-source project an alternative to a career developing for a for-profit company." It believes the steps to achieve this goal include eliminating friction between projects, the communities that support them, and the corporations that depend on them. It is introducing Funds to its open funding management platform to make it easier for companies to invest in open-source projects by making a one-time payment to a Fund, which then redistributes the money to different projects and contributors, rather than paying those projects individually... According to Open Collective, more and more companies are now becoming aware of the need to compensate developers for their work on open-source projects and are willing to fund them. There are a few reasons for this, such as developers taking pride in working at a company that supports open source, access to creators, building a positive reputation within the community, ensuring their own open-source dependencies are being properly maintained, and ensuring open-source projects can scale with their needs.' -- source: https://news.slashdot.org/story/21/03/27/2136248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Re: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here
by Eric Light 27 Mar '21

27 Mar '21

Further to the list conversations about Wireguard and FreeBSD, it looks like things have become much, much worse. Conversation between Jason Donenfeld (Wireguard) and Scott Long (Netgate) below - ew. As LDO mentioned, Netgate don't seem to be particularly friendly members of the open source community :-/ E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es ----- Original message ----- From: "Jason A. Donenfeld" <Jason(a)zx2c4.com> To: wireguard(a)lists.zx2c4.com, Scott Long <scottl(a)netgate.com> Cc: secteam(a)FreeBSD.org, cperciva(a)FreeBSD.org Subject: Re: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here Date: Tuesday, 16 March 2021 14:18 Hi Scott, It's certainly disappointing to receive your email like that. I see that you're really upset, and I think we have a shared interest in deescalating this. You've mentioned the desire to talk about this in public, so I'm responding in the announcement thread to you, as this seems like the appropriate venue for discussion. I've also CC'd the FreeBSD Security Officer. I've responded to your email and its threats in line mailing-list style below: On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > What you and Kyle did was tell the world that there are a number of > zero-day exploits in the code. You gave us no details until after the > fact, gave us no time to mitigate, correct, and publish before your > announcement and Kyle's code drop, and used the opportunity to > bash the code, and by extension us, for your own self-gain. I have no idea how you possibly have arrived at this here. FreeBSD 13 is currently at RC2 or RC3, if I recall correctly. Our whole motivation for working on this so tirelessly and with so much energy and devotion over the week was to get things fixed up before 13 was actually released. I dropped everything else I was working on to focus on this. I'm actually with my folks in Colorado and should be spending more time with them but the idea of FreeBSD 13 shipping with all those bugs seemed like a really important thing to address. Here's what we did, step by step: 1. We made a clone of the freebsd git repo where we could all push changes to master, to git.zx2c4.com like everything else. 2. We took turns taking big passes at the codebase, reading it, auditing it, fixing things. We did a lot of syncing and comparison with the OpenBSD code base. For example, in one step, we reordered the functions to match the flow of OpenBSD so we could see it more easily side by side. 3. We kept pushing commits like this in that manner. 4. We didn't know where we'd end up, but after a few days of this, the number of changes we had accumulated and fishy business we had observed was massive. 5. When we thought we reached a good resting point -- and when it became clear that our rapid fire changes were becoming too numerous -- we squashed that down to a summary commit, and Kyle committed it. 6. Seeing that the crypto needed to be re-accelerated, I published a call for help here -- https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057076.html 7. I published wireguard-tools with the improved wg(8) command here -- https://lists.zx2c4.com/pipermail/wireguard/2021-March/006493.html 8. I sent a summary of everything to the mailing list here -- https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html I also made sure to email a FreeBSD Security Officer, Colin, to keep him posted about the state of this, so he was kept apprised. Again, the whole idea was: two weeks until release! If I suggest the code is just disabled, people will be really upset, so instead we'll try to fix as much as fast as possible before the release. And actually, really focused sprints like that are fun and stimulating. We were all really enjoying writing code until the torrents of anger started coming from you about our efforts. (And I also learned that this isn't the first time you guys tried to intimidate an open source project -- see this summary of the opnSense defamatory website Netgate created -- https://opnsense.org/opnsense-com/ .) And in the process, too, I've tried to be in contact with you and Jim and let you know what our intentions are and to diffuse tensions. I spent time on a video call trying to describe to you some of the security things we found, in case it wasn't possible for you to use the new code right away. I've also made it abundantly clear to you how much I want to work WITH Netgate. When that Reddit thread cropped up, I offered to you multiple times to send a message to it telling people that we've spoken and it looks like you have a good plan and every things going to be okay, but you didn't respond to my offer. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > None > of these actions reflect good-faith collaboration, and your statements > that you think that our work is "really cool" ring hollow. Maybe you > and Kyle are really naive and thought that this was how people > normally collaborate in the security and business worlds, and that > everyone would rush to praise you and shower you with contracts > and funding. And hey, maybe that’ll happen, you certainly have > made a splash. That of course, comes at our expense, and it’s > likely to be a pretty damaging one. Now with the Ars article, I’m > starting to wonder if this was a coordinated smear campaign. > Normally we don’t get this kind of attention. It’s going to be painful > to navigate our way out. I'm not sure how to address these types of... theories. I certainly AM acting in good faith. I can't possibly see how it benefits anybody to have WireGuard and Netgate at odds with one another. You guys make a neat product based on open source software, and I think it's great you're planning to add WireGuard to it. My interest is in making sure the underlying operating system -- FreeBSD 13 -- does that well. (Or, I think you mentioned to me this morning that you're actually planning to base it on FreeBSD 12 for some time, but same idea for the backport you're working on, I guess.) And there's no "smear campaign" -- that's outrageous. I have no idea how that would help anybody at all. I should point out, again to you, how grateful I am that Netgate got the initial work on this started. Had you guys not gotten if_wg rolling, it's not clear to me that it'd exist in the first place. >From your end, it's very disappointing that you're (below) planning to attack security researchers and kernel programmers who took the time to rewrite code to make it better, hustling to get it in before FreeBSD 13 is released. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > I’ll be writing an article tonight outlining the mistakes that we made > and what we will be doing to correct it. I’ll also be highlighting that > this incident has been a textbook example of the wrong way for > people to collaborate in the security community, and that extreme > caution should be taken in any future dealings with you. Your > actions are self serving and in bad faith, and your words are > hollow and untrustworthy. I don’t care if you disagree or don’t see > it this way, this is the effect that you’ve had. It makes sense to communicate with your customers about things with your upcoming products if you feel it's necessary. But threatening that you're going to highlight "that extreme caution should be taken in any future dealings with you" sounds to me like a threat of some intense slander. And again, attacking security researchers and kernel programmers who took time to rewrite code to make it better before a release deadline... That's ...wow. I wish you would not go on the attack like that. Instead, it seems like we can both be glad that we're on the path to having better code! And that there's a team of people volunteering to do this and enjoying writing that code. We're all working together to make things better. We worked really super hard on fixing up this code base. It was a LOT of work. And I would like to keep working on it and feeling good about it. So I'm just disappointed that somehow this has devolved for you into making threats like that. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > I’ve also spoken with the FreeBSD Security Officer, and we’ve > agreed that wireguard will be removed from all branches of FreeBSD > until further notice. I’ve also informed Kyle of this. I do not support > its reintroduction into FreeBSD, whether in the src tree or in the > ports tree, at this time. As for pfSense, we are conducting an > audit and will decide on the best course of action for our customers > and our company. I actually think that's a great idea. I was under the impression initially that removing it would be a total non-starter and would just make people upset, hence this hurried mad dash to turn things around. But having an opportunity to take it out of tree and develop it slowly and carefully, like we did for Linux and OpenBSD, sounds a lot better. This also meshes well with what we had planned to do, which I mentioned in the announcement email this morning -- have this available as an out of tree module that people can try out. Then, after we've got it really solid, reintroduce it in the normal FreeBSD ways of doing that. (I'm not so familiar with that latter process, but I trust that Kyle & folks know that part well.) On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > > Scott So, that's where we are. You're upset and making threats to slander security researchers and kernel programmers. That's really disappointing. All I can do is ask you: please don't? We have much more to gain by supporting each other than being in conflict. I just want to make sure FreeBSD 13 (or 14) gets a great WireGuard implementation. And you want to make sure your customers get great products. I see no reason why these are conflicting goals. I hope this can deescalate, and we can work together on this. I'm confident that our goals are ultimately aligned very well. Regards, Jason

2 2

WSL start up script
by Matthew Skiffington 26 Mar '21

26 Mar '21

For heathens like me that use the windows linux subsystem (wsl): https://askubuntu.com/questions/978977/windows-subsystem-for-linux-display-… Cheers, Matthew

2 1

Alan Turing On UK £50 Note
by Lawrence D'Oliveiro 26 Mar '21

26 Mar '21

The Bank Of England has shown off the upcoming £50 note featuring computing pioneer Alan Turing <https://www.theregister.com/2021/03/25/turing_50_quid/>. The rhyming slang for this denomination is apparently “bullseyes”, but the linked page gives no explanation of the derivation ...

2 1

OpenSSL fixes high-severity flaw that allows hackers to crash servers
by Peter Reutemann 26 Mar '21

26 Mar '21

'On Thursday, OpenSSL maintainers disclosed and patched a vulnerability that causes servers to crash when they receive a maliciously crafted request from an unauthenticated end user. CVE-2021-3449, as the denial-of-server vulnerability is tracked, is the result of a null pointer dereference bug. Cryptographic engineer Filippo Valsorda, said on Twitter that the flaw could probably have been discovered earlier than now. “Anyway, sounds like you can crash most OpenSSL servers on the Internet today,” he added.' -- source: https://arstechnica.com/gadgets/2021/03/openssl-fixes-high-severity-flaw-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Where Rust Will Fit Into Linux
by Peter Reutemann 25 Mar '21

25 Mar '21

'ZDNet article, written by Steven J. Vaughan-Nichols: Linux is the poster-child for the C language. But times change. The Rust language has been slowly gathering support for use as a system language in Linux. For example, at the 2020 Linux Plumbers Conference, developers gave serious thought to using the Rust language for new Linux inline code. So, where is it today? I asked Linux's creator, Linus Torvalds, and the Linux stable kernel maintainer Greg Kroah-Hartman for their thoughts. [...] What does Torvalds make of all this? He's in "the 'wait and see' camp -- I'm interested in the project, but I think it's driven by people who are very excited about Rust, and I want to see how it actually then ends up working in practice." "Personally," Torvalds is "in no way "pushing" for Rust, [but] I'm open to it considering the promised advantages and avoiding some safety pitfalls, but I also know that sometimes promises don't pan out." Torvalds thinks "Rust's primary first target seems to be drivers, simply because that's where you find just a lot of different possible targets, and you have these individual parts of the kernel that are fairly small and independent. That may not be a very interesting target to some people, but it's the obvious one." Another point is taking on drivers first for "any initial trials to drivers is simply the architecture side," said Torvalds. "Lots of drivers are only relevant on a couple of target architectures, so the whole issue with Rust code not being supported on some architectures is less of an issue." Kroah-Hartman agrees that "drivers are probably the first place for an attempt like this as they are the 'end leafs' of the tree of dependencies in the kernel source. They depend on core kernel functionality, but nothing depends on them." Torvalds knows some people don't like the idea of Rust in userspace at all. "People complain[ing] about "Rustification" in userspace isn't a great sign for any future kernel use, but hey, we'll see. The kernel is different from userspace projects -- more difficult in some respects (we use a lot of very odd header files that pushes the boundary of what can be called "C"), but easier in many other respects (mainly in the sense that the kernel is fairly self-contained, and then doesn't rely on other projects for the final binary)." From where Kroah-Hartman sits, "it will all come down to how well the interaction between the kernel core structures and lifetime rules that are written in C can be mapped into Rust structures and lifetime rules for drivers in Rust to be able to use them properly. That's going to take a lot of careful work by the developers wanting to hook this all up and I wish them the best of luck."' -- source: https://linux.slashdot.org/story/21/03/24/2115238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0