- wlug - list.wlug.org.nz

MITRE’s Latest Common Weakness Enumeration List
by Lawrence D'Oliveiro 18 Sep '19

18 Sep '19

The CWE is not a list of security vulnerabilities as such, but of factors which commonly lead to security vulnerabilities <https://www.theregister.co.uk/2019/09/18/the_25_most_dangerous_software_wea…>. The methodology of the list has changed from the previous one (from back in 2011), so it’s hard to say that the changes are down to different (improved?) coding practices. Still, two thirds of the entries are the same in both lists.

1 0

Researchers Uncover 125 Vulnerabilities Across 13 Routers and NAS Devices
by Peter Reutemann 18 Sep '19

18 Sep '19

'Independent Security Evaluators (ISE) discovered a total of 125 different security vulnerabilities across 13 IoT devices, likely affecting millions of consumers. Help Net Security reports: In nearly all the devices (12 of the 13), ISE achieved its goal of obtaining remote root-level access. The table below shows the types of vulnerabilities that ISE identified in the targets. All 13 of the devices evaluated by ISE had at least one web application vulnerability such as cross-site scripting (XSS), operating system command injection (OS CMDi), or SQL injection (SQLi) that could be leveraged by an attacker to get remote access to the device's shell or gain access to the device's administrative panel. ISE obtained root shells on 12 of the devices, allowing complete control over the device. Six of them can be remotely exploited without authentication: the Asustor AS-602T, Buffalo TeraStation TS5600D1206, TerraMaster F2-420, Drobo 5N2, Netgear Nighthawk R9000, and TOTOLINK A3002RU. "We found that many of these issues were trivial to exploit and should have been discovered even in a rudimentary vulnerability assessment," says ISE founder Stephen Bono. "This indicates that these manufacturers likely undergo no such assessment whatsoever, that the bug bounty programs they employ are ineffective, that vulnerability disclosures sent to them are not addressed, or more likely, all of the above."' -- source: https://it.slashdot.org/story/19/09/17/2053202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HP Printers Try To Send Data Back To HP About Your Devices and What You Print
by Peter Reutemann 17 Sep '19

17 Sep '19

'Robert Heaton: Last week my in-laws politely but firmly asked me to set up their new HP printer. I protested that I'm completely clueless about that sort of thing, despite my tax-return-job-title of "software engineer." Still remonstrating, I was gently bundled into their study with an instruction pamphlet, a cup of tea, a promise to unlock the door once I'd printed everyone's passport forms, and a warning not to try the window because the roof tiles are very loose. At first the setup process was so simple that even a computer programmer could do it. But then, after I had finished removing pieces of cardboard and blue tape from the various drawers of the machine, I noticed that the final step required the downloading of an app of some sort onto a phone or computer. This set off my crapware detector. [...] It was a way to try and get people to sign up for expensive ink subscriptions and/or hand over their email addresses, plus something even more nefarious that we'll talk about shortly (there were also some instructions for how to download a printer driver tacked onto the end). This was a shame, but not unexpected. I'm sure that the HP ink department is saddled with aggressive sales quotas, and no doubt the only way to hit them is to ruthlessly exploit people who don't know that third-party cartridges are just as good as HP's and are much cheaper. Fortunately, the careful user can still emerge unscathed from this phase of the setup process by gingerly navigating the UI patterns that presumably do fool some people who aren't paying attention.' -- source: https://hardware.slashdot.org/story/19/09/17/1454203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Moving To a Faster 4-Week Release Cycle
by Peter Reutemann 17 Sep '19

17 Sep '19

'Mozilla announces in a blog post: We typically ship a major Firefox browser (Desktop and Android) release every 6 to 8 weeks. Building and releasing a browser is complicated and involves many players. To optimize the process, and make it more reliable for all users, over the years we've developed a phased release strategy that includes 'pre-release' channels: Firefox Nightly, Beta, and Developer Edition. With this approach, we can test and stabilize new features before delivering them to the majority of Firefox users via general release. And today we're excited to announce that we're moving to a four-week release cycle! We're adjusting our cadence to increase our agility, and bring you new features more quickly. In recent quarters, we've had many requests to take features to market sooner. Feature teams are increasingly working in sprints that align better with shorter release cycles. Considering these factors, it is time we changed our release cadence. Starting Q1 2020, we plan to ship a major Firefox release every 4 weeks. Firefox ESR release cadence (Extended Support Release for the enterprise) will remain the same. In the years to come, we anticipate a major ESR release every 12 months with 3 months support overlap between new ESR and end-of-life of previous ESR. The next two major ESR releases will be ~June 2020 and ~June 2021.' -- source: https://news.slashdot.org/story/19/09/17/1750247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Linux 31 Beta is Here
by Peter Reutemann 17 Sep '19

17 Sep '19

'Fedora 31 is due later this year, but first, there needs to be some beta testing. And so, today, Fedora 31 Beta is made available for download. Unfortunately, details surrounding version 31 are a bit sparse. With that said, one big change involves Fedora users with ARM 64-based single board computers, such as a Raspberry Pi. Those folks will get access to an additional desktop spin -- the lightweight Xfce. Workstation users will be treated to GNOME 3.34, but not the final version that was released recently. Don't worry -- when Fedora leaves beta status, and is officially released, you can be sure the stable GNOME 3.34 will be included. Remember, Fedora is one of the best ways to experience a vanilla GNOME desktop environment.' -- source: https://linux.slashdot.org/story/19/09/17/1836214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman’s Last Interview As FSF President
by Lawrence D'Oliveiro 17 Sep '19

17 Sep '19

Seems the great prophet has bumbled into matters where perhaps he should have kept his mouth shut, and is now stepping down from the FSF. But leaving that aside, this interview <https://www.theregister.co.uk/2019/09/17/richard_stallman_interview/> has the usual choice nuggets on subjects he does know something about: One thing that has changed is that nowadays, a non-free program is typically malware as well. That was not the case in 1983. In 1983, when a proprietary software product was discovered to be malware, it was scandalous. It was shocking. It made the news, sort of at least in the tech press, because this wasn't the usual case. It there was a certain level of scruples, even among proprietary software developers. But over the years, those scruples have evaporated, as companies raced each other to the bottom in terms of mistreating their own users. And now, almost any non free program you run is mistreating you somehow.

1 0

Password-exposing bug purged from LastPass extensions
by Peter Reutemann 16 Sep '19

16 Sep '19

'Developers of the LastPass password manager have patched a vulnerability that made it possible for websites to steal credentials for the last account the user logged into using the Chrome or Opera extension. The vulnerability was discovered late last month by Google Project Zero researcher Tavis Ormandy, who privately reported it to LastPass. In a write-up that became public on Sunday, Ormandy said the flaw stemmed from the way the extension generated popup windows. In certain situations, websites could produce a popup by creating an HTML iframe that linked to the Lastpass popupfilltab.html window rather than through the expected procedure of calling a function called do_popupregister(). In some cases, this unexpected method caused the popups to open with a password of the most recently visited site.' -- source: https://arstechnica.com/information-technology/2019/09/lastpass-fixes-bug-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Say hello to 802.11ax: Wi-Fi 6 device certification begins today
by Peter Reutemann 16 Sep '19

16 Sep '19

'Today, the Wi-Fi Alliance launched its Wi-Fi Certified 6 program, which means that the standard has been completely finalized, and device manufacturers and OEMs can begin the process of having the organization certify their products to carry the Wi-Fi 6 branding. If you need a bit of a catch-up, Wi-Fi 6—aka 802.11ax—is the next generation of Wi-Fi. 802.11ax will, at least in theory, allow many more nearby devices to use the same Wi-Fi channels and frequencies without causing as much congestion and lag as Wi-Fi 5 (better known as 802.11ac) and Wi-Fi 4 (802.11n) do. That's the good news. The bad news is that very few of these benefits can be seen just from buying a Wi-Fi 6 router—you need most, if not all, of the devices in range (both yours and, ideally, any neighbors') to also support Wi-Fi 6 before you see the improvements. 802.11ax also mandates support for the WPA3 encryption and authentication protocol. WPA3 provides considerably better security for your Wi-Fi network than WPA2 did, and due to its adoption of Simultaneous Authentication of Equals (SAE), it will hopefully prove more robust toward future attacks as well.' -- source: https://arstechnica.com/gadgets/2019/09/say-hello-to-802-11ax-wi-fi-6-devic… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64 Confirms $25 'PineTime' Smartwatch for Linux Smartphones
by Peter Reutemann 16 Sep '19

16 Sep '19

'Besides their Linux laptops, single-board computers, and tablets, Pine64 is now also working on "PineTime," a new $25 smartwatch for Linux smartphones running open source software (and based on either ARM Mbed or FreeRTOS), reports Liliputing.com: The company describes the PineTime watch as a companion for Linux smartphones... you know, like the company's upcoming $150 PinePhone. For either or both of those reasons, it could appeal to folks who may not have wanted in on the smartphone space until now... The PineTime uses an existing watch body that's used by other device makers, but Pine64 is choosing custom internal hardware. The PineTime will support Bluetooth 5.0, a heart rate monitor, and multi-day battery life and the watch features a zinc alloy & plastic case and comes with a charging dock... At this point the PineTime is described as a side project, which means it's not a top priority for Pine64. While the company says the picture above is an actual photo of a prototype, Pine64 is still seeking software developers interested in contributing to the project, and the company's primary focus at this point will still be other upcoming devices like the PineBook Pro laptop and PinePhone smartphone.' -- source: https://news.slashdot.org/story/19/09/15/2345229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.3 Released
by Peter Reutemann 16 Sep '19

16 Sep '19

'This release includes support for AMD Navi GPUs; support for the umwait x86 instructions that let processes wait for short amounts of time without spinning loops; a 'utilization clamping' mechanism that is used to boost interactivity on power-asymmetric CPUs used in phones; a new pidfd_open(2) system call that completes the work done to let users deal with the PID reuse problem; 16 millions of new IPv4 addresses in the 0.0.0.0/8 range are made available; support for Zhaoxin x86 CPUs; support Intel Speed Select for easier power selection in Xeon servers; and support for the lightweight hypervisor ACRN, built for embedded IoT devices. As always, many other new drivers and improvements can be found in the changelog.' -- source: https://linux.slashdot.org/story/19/09/15/2319220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2