- wlug - list.wlug.org.nz

Xiaomi Found Recording 'Private' Web and Phone Use, Researchers Claim
by Peter Reutemann 01 May '20

01 May '20

'According to an exclusive report from Forbes, cybersecurity researcher Gabi Cirlig discovered that his Xiaomi Redmi Note 8 smartphone was watching much of what he was doing and sending that data to remote servers hosted by Chinese tech giant Alibaba, which were ostensibly rented by Xiaomi. From the report: The seasoned cybersecurity researcher found a worrying amount of his behavior was being tracked, whilst various kinds of device data were also being harvested, leaving Cirlig spooked that his identity and his private life was being exposed to the Chinese company. When he looked around the Web on the device's default Xiaomi browser, it recorded all the websites he visited, including search engine queries whether with Google or the privacy-focused DuckDuckGo, and every item viewed on a news feed feature of the Xiaomi software. That tracking appeared to be happening even if he used the supposedly private "incognito" mode. The device was also recording what folders he opened and to which screens he swiped, including the status bar and the settings page. All of the data was being packaged up and sent to remote servers in Singapore and Russia, though the Web domains they hosted were registered in Beijing. Meanwhile, at Forbes' request, cybersecurity researcher Andrew Tierney investigated further. He also found browsers shipped by Xiaomi on Google Play -- Mi Browser Pro and the Mint Browser -- were collecting the same data. Together, they have more than 15 million downloads, according to Google Play statistics. Cirlig thinks that the problems affect many more models than the one he tested. In response to the findings, Xiaomi said, "The research claims are untrue," and "Privacy and security is of top concern," adding that it "strictly follows and is fully compliant with local laws and regulations on user data privacy matters." A spokesperson did however confirm it was collecting browsing data, claiming the info was anonymized and users had consented to it. Cirlig and Tierney pointed out that Xiaomi "was also collecting data about the phone, including unique numbers for identifying the specific device and Android version," reports Forbes. "Cirlig said such 'metadata' could 'easily be correlated with an actual human behind the screen.'" The researchers also say they found their Xiaomi apps to be sending data to domains that appeared to reference Sensor Analytics, which Xiaomi says "provides a data analysis solution for Xiaomi," adding that that the collected anonymous data "are stored on Xiaomi's own servers and will not be shared with Sensor Analytics, or any other third-party companies."' -- source: https://yro.slashdot.org/story/20/04/30/237249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Virtualization on the Linux desktop—Gnome Boxes vs virt-manager
by Peter Reutemann 01 May '20

01 May '20

'In the comments of our recent GhostBSD review, reader Enduzzer casually mentioned trying out the distribution in a Gnome Boxes VM. Linux's Kernel Virtual Machine has been a mainstay of my own system administration for more than a decade—but I use virt-manager, an excellent and deeply sysadmin-ish graphical management interface. I generally describe virt-manager as "simple"—and in many ways it's much simpler than Boxes is—but there are different ways to interpret simplicity.' -- source: https://arstechnica.com/gadgets/2020/04/virtualization-on-the-linux-desktop… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Distro Showdown May
by tom butz 01 May '20

01 May '20

I have just checked microphone/camera on my Toshiba laptop running Mint 19.3: they're both ok for a remote meeting. What I could do is talk about the various Linuxes I have used, starting witn Tiny Linux, then Arch-Linux, then OpenBSD, then FreeBSD and finally Mint as well as Ubuntu14 as well as Sparky Linux. Maybe also a bit about my trials with GhostBSD. Why am I using more than 1? Mint 19.3 is the workhorse, Sparky does movies using conventional openshot as well as avidemux and Ubuntu 14 supports USB-tethering out of the box. USB-tethering is way faster than the alternatives and also very secure (as long as no-one nicks your phone). Tom Butz.

2 1

Google Play has been spreading advanced Android malware for years
by Peter Reutemann 01 May '20

01 May '20

'Hackers have been using Google Play for years to distribute an unusually advanced backdoor capable of stealing a wide range of sensitive data, researchers said on Tuesday. Researchers from security firm Kaspersky Lab have recovered at least eight Google Play apps that date back to 2018, a Kaspersky Lab representative said, but based on archive searches and other methods, the researchers believe malicious apps from the same advanced group seeded Google’s official market since at least 2016. Google removed recent versions of the malware shortly after the researchers from Kaspersky, and earlier fellow security firm Dr. Web, reported them. Apps from earlier were already removed, and it’s not clear what prompted the move. Third-party markets have also hosted the backdoored apps, and many of them remain available. Command-and-control domains were registered as early as 2015, raising the possibility the operation goes back earlier than 2016. Code in the malware and command servers it connects to contain several overlaps with a known hacking group dubbed OceanLotus (aka APT32, APT-C-00, and SeaLotus), leading researchers to believe the apps are the work of that advanced group.' -- source: https://arstechnica.com/information-technology/2020/04/sophisticated-androi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fairphone 3 Now Available With 'de-Googled' Android /e/OS
by Peter Reutemann 01 May '20

01 May '20

'Fairphone, the European manufacturer of mobile phones with a reduced environmental impact, has announced a partnership to offer /e/OS, the most "de-Googled" and pro-privacy Android OS, on their latest model Fairphone 3. An interesting move that reminds me of the recent introduction of the Google-free Huawei Mate 30. A pithy explainer of its "privacy by design ecosystem" -- and the point of "Android without Google" -- further notes: "We have removed many pieces of code that send your personal data to remote servers without your consent. We don't scan your data in your phone or in your cloud space, and we don't track your location a hundred times a day or collect what you're doing with your apps." According to TechCrunch, the e/OS variant of the Firephone 3 ships from May 6, priced at just under 480 euros -- "a 30 euro premium on the Googley flavor of Android you get on the standard Fairphone 3." The report adds that existing owners of the Fairphone 3 can manually install /e/OS gratis via an installer on its website.' -- source: https://mobile.slashdot.org/story/20/04/29/2131230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Gains a New 12.3-Megapixel Camera and Interchangeable Lenses
by Peter Reutemann 01 May '20

01 May '20

'The Raspberry Pi can be used for all sorts of maker projects, and the foundation has offered camera modules for it since 2013, adding vision-related functionality. The first module was a modest 5-megapixel affair that was eventually replaced by an 8-megapixel Sony sensor four years ago. Today, sees the arrival of a new much higher 12.3 megapixel quality camera, and a range of interchangeable lenses. >From a report: The new camera is compatible with all Raspberry Pi models -- from Pi 1 Model B onwards -- with the exception of early Pi Zero boards. The camera is available to buy from today for $50.' -- source: https://tech.slashdot.org/story/20/04/30/1554232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Predictive Text Patent Troll Tries To Shake Down Wikipedia
by Peter Reutemann 30 Apr '20

30 Apr '20

'WordLogic (patent troll) claims it has the rights of the concept of predictive text writing and went after the Wikimedia foundation. WordLogic offered a "discounted, lump sum fee of $30,000 in exchange for a paid-up one-time license," an easy win they thought, but Wikimedia fought back. "Wikimedia notes that (1) WordLogic's patents are invalid due to prior art, (2) that they are invalid for not covering patentable subject matter, and (3) that anyway, it doesn't even infringe on the patents if they were valid," reports Techdirt. Now we are waiting to see what will happen. Will the patent troll desist, or will it push forward?' -- source: https://news.slashdot.org/story/20/04/29/216210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Data Hoarders
by Lawrence D'Oliveiro 30 Apr '20

30 Apr '20

Turns out there’s a whole Reddit subforum devoted to the subject of digital data hoarding. And of course the activity has a long history, from well before the era of digital electronic computers <https://arstechnica.com/gaming/2020/04/digital-hoarders-our-terabytes-are-p…>.

1 4

A bit of light relief!!
by john 30 Apr '20

30 Apr '20

A plain computer illiterate guy rings tech support to report that his computer is faulty. Tech: What’s the problem? User: There is smoke coming out of the power supply. Tech: (keep quite) Tech: You’ll need a new power supply. User: No, I don’t! I just need to change the startup files. Tech: Sir, the power supply is faulty. You’ll need to replace it. User: No way! Someone told me that I just needed to change the startup and it will fix the problem! All I need is for you to tell me the command. Tech support:: 10 minutes later, the User is still adamant that he is right. The tech is frustrated and fed up. Tech support:: (hush hush) Tech: Sorry, Sir. We don’t normally tell our customers this, but there is an undocumented DOS command that will fix the problem. User: I knew it! Tech : Just add the line LOAD NOSMOKE.COM at the end of the CONFIG.SYS. Let me know how it goes. 10 minutes later. User : It didn’t work. The power supply is still smoking. Tech : Well, what version of DOS are you using? User : MS-DOS 6.22 . Tech : That’s your problem there. That version of DOS didn’t come with NOSMOKE. Contact Microsoft and ask them for a patch that will give you the file. Let me know how it goes. 1 hour later. User : I need a new power supply. Tech support : How did you come to that conclusion? Tech support : (hush hush) User : Well, I rang Microsoft and told him about what you said, and he started asking questions about the make of power supply. Tech: Then what did he say? User: He told me that my power supply isn’t compatible with NOSMOKE. Cheers John..

1 0

OS Vulnerabilities
by Lawrence D'Oliveiro 29 Apr '20

29 Apr '20

While fixes for security bugs on the Linux platform usually come out quickly, there do seem to be a lot of laggards in deploying them <https://www.theregister.co.uk/2020/04/28/vulnerabilities_report_9_million/>. Why is this? The researchers speculate that "Windows admins are more accustomed to regular reboots after decades of conditioning," while "tooling for managing Linux fleets at scale generally lags behind that of Windows." Also perhaps the Linux installations include a lot of embedded/IoT devices that never get manufacturer updates.

1 0