- wlug - list.wlug.org.nz

Bing Contract Prohibits DuckDuckGo From Completely Blocking Microsoft Tracking
by Peter Reutemann 25 May '22

25 May '22

'DuckDuckGo isn't as private as you thought. "Due to a confidential search agreement, the DuckDuckGo browser does not block all Microsoft trackers," reports Review Geek. "What's worse, DuckDuckGo only acknowledged this 'privacy hole' after it was discovered by a security researcher." From the report: Security researcher @thezedwards found that the mobile DuckDuckGo browser does not block Microsoft trackers on third-party websites, such as the Facebook-owned Workplace.com. Gabriel Weinberg, the CEO of DuckDuckGo, is now running damage control on Twitter. He explains that Microsoft cannot see what you search in DuckDuckGo, and the DuckDuckGo browser blocks all Microsoft cookies. But if you visit a website that contains Microsoft's trackers, then your data is exposed to services like Bing and LinkedIn. This is the result of DuckDuckGo's "search syndication agreement" with Microsoft. In order to pull search information from Bing, the privacy experts at DuckDuckGo have to poke holes in their browser's security system. While DuckDuckGo has a solid privacy policy when it comes to Microsoft's ads, it hasn't explained how Microsoft uses data from third-party trackers. And that's quite alarming. Maybe this situation is overblown, or maybe Microsoft can build targeted ad profiles based on your web activity in DuckDuckGo -- we don't know because DuckDuckGo signed a confidentiality agreement. Gabriel Weinberg says that DuckDuckGo is "working tirelessly behind the scenes" to improve its deal with Microsoft. Additionally, he expects DuckDuckGo to "include more third-party Microsoft protection" in a future update.' -- source: https://yro.slashdot.org/story/22/05/24/218210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Teaching Kiwi Kids To Refurbish Computers That They Get To Keep
by Lawrence D'Oliveiro 25 May '22

25 May '22

I saw an item about this on TVNZ news last night, but couldn’t find any mention on their website. But it turns out Newshub did a report on the project a week ago <https://www.newshub.co.nz/home/technology/2022/05/new-project-to-teach-kiwi…>. It involves primary-school-age children working with donated computers, learning how to dismantle them and fix them up. And then they have a working device that they get to take home: As part of West Tech, students as young as eight years old are taught how to diagnose issues, disassemble and then refurbish components in order to create an 'as-new' device. They are then gifted to the students, giving them refurbished tech products to help further their education. ... With just seven hours of learning time, students were able to learn to refurbish defunct devices ... I’m no hardware expert, so all I get to say is “wow”. One of the groups involved in this is youth charity Zeal <https://zeal.nz/>. They have centres in various places around the North Island (including Hamilton), though this particular project only seems to be at the West Auckland one. Looking for the tag “Zeal Digital” brings up several projects: <https://zeal.nz/tag/zeal-digital/>.

2 1

Microsoft Warns of 'Stealthy DDoS Malware' Targeting Linux Devices
by Peter Reutemann 24 May '22

24 May '22

'"In the last six months, we observed a 254% increase in activity from a Linux trojan called XorDdos," writes the Microsoft 365 Defender Research Team. It's a trojan combining denial-of-service functionality with XOR-based encryption for communication. Microsoft calls it part of "the trend of malware increasingly targeting Linux-based operating systems, which are commonly deployed on cloud infrastructures and Internet of Things devices." And ZDNet describes the trojan "one of the most active Linux-based malware families of 2021, according to Crowdstrike." XorDdos conducts automated password-guessing attacks across thousands of Linux servers to find matching admin credentials used on Secure Shell (SSH) servers... Once credentials are gained, the botnet uses root privileges to install itself on a Linux device and uses XOR-based encryption to communicate with the attacker's command and control infrastructure. While DDoS attacks are a serious threat to system availability and are growing in size each year, Microsoft is worried about other capabilities of these botnets. "We found that devices first infected with XorDdos were later infected with additional malware such as the Tsunami backdoor, which further deploys the XMRig coin miner," Microsoft notes... Microsoft didn't see XorDdos directly installing and distributing the Tsunami backdoor, but its researchers think XorDdos is used as a vector for follow-on malicious activities... XorDdoS can perform multiple DDoS attack techniques, including SYN flood attacks, DNS attacks, and ACK flood attacks. Microsoft's team warns that the trojan's evasion capabilities "include obfuscating the malware's activities, evading rule-based detection mechanisms and hash-based malicious file lookup, as well as using anti-forensic techniques to break process tree-based analysis. "We observed in recent campaigns that XorDdos hides malicious activities from analysis by overwriting sensitive files with a null byte. It also includes various persistence mechanisms to support different Linux distributions."' -- source: https://linux.slashdot.org/story/22/05/21/0445203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Rust For Linux Kernel Updated, Uutils As Rust Version Of Coreutils Updated Too
by Peter Reutemann 24 May '22

24 May '22

'This weekend, Miguel Ojeda, added support for a set of additional Rust patches in the kernel and separately a new version of Uutils which is the Rust version of GNU CoreUtils. These changes will go towards more inclusion of Rust into Linux. The v7 patches adds in abstractions used by Rust and the Uutils update contained fixes and addresses compatibility issues.' -- source: https://linux.slashdot.org/story/22/05/23/1836210 Anybody keen on demoing this Rust support or how to write a kernel module in general? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Windows Subsystem For Android Just Got a Big Update
by Peter Reutemann 24 May '22

24 May '22

'Microsoft has updated the Windows Subsystem for Android (WSA) to Android 12.1 and shipped improvements to Android integration with Windows, networking, the camera in apps, the Settings app, and more. ZDNet reports: Current limitations aside, Microsoft is continuing to invest in bringing Android to Windows 11, as seen in its update to the WSA on Windows 11 (version 2204.40000.15) to Android 12.1, which is available to Insiders on the Dev Channel, according to a Microsoft blogpost. WSA launched with Android 11. Microsoft has improved networking on the Windows Subsystem for Android, so that Android apps can connect to devices on the same network as a Windows PC. Advanced networking allows users to set up smart home devices such as speakers and security cameras with a compatible Android app. This feature is available in Windows 11 preview builds 22621 and higher, with advanced networking on by default for new x64 Windows builds. Android-Windows integration has also been improved. Windows taskbar icons now show which Android apps are currently using hardware features like the mic and location in the system tray. The taskbar now also correctly appears or disappears when apps are running or stopped. Android notifications also show as Windows notifications and the Windows title of an Android app now reflects the Android activity title. Android apps won't restart afresh after exiting connected standby mode, but instead will recommence where the app was paused. Of the "many camera updates" in this release, Microsoft highlights that camera orientation is fixed to natural orientation, and that it's fixed incorrect camera previews, letterboxing (where the app window is wider than it is high, or horizontally longer), and a "squishing of the camera feed." Mouse and keyboard inputs in Windows Subsystem for Android have been improved. Microsoft also improved scroll-wheel support, fixed the onscreen keyboard focus, and ensured the Android soft keyboard displays correctly. The updated Windows Subsystem for Android Settings app gained redesigned UX and diagnostics data viewer. As of this update, telemetry collection is off by default. However, Microsoft is encouraging users to enable the setting, so it can collect data about Android app usage. "Other important updates include reduced flicker when apps are restored from a minimized state, the addition of VP8 and VP9 video hardware decoding, and the addition of Chromium WebView 100 to the Windows Subsystem for Android," adds ZDNet.' -- source: https://tech.slashdot.org/story/22/05/23/2014243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers find backdoor lurking in WordPress plugin used by schools
by Peter Reutemann 23 May '22

23 May '22

'Researchers said on Friday that they found a malicious backdoor in a WordPress plugin that gave attackers full control of websites that used the package, which is marketed to schools. The premium version of School Management, a plugin schools use to operate and manage their websites, has contained the backdoor since at least version 8.9, researchers at website security service Jetpack said in a blog post without ruling out that it had been present in earlier versions. This page from a third-party site shows that version 8.9 was released last August.' -- source: https://arstechnica.com/information-technology/2022/05/researchers-find-bac… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Gov.UK Stopped Using jQuery
by Peter Reutemann 22 May '22

22 May '22

'The head of the UK government's digital transformation unit recently announced a change to the nation's government services site gov.uk: they've "removed jQuery as a dependency for all frontend apps, meaning 32 KB of minified and compressed JavaScript was removed" for everything from selecting elements to attaching event listeners.... Nearly 84% of mobile pages used jQuery in 2021, points out a new essay at Gov.UK — before explaining why they decided not to: jQuery was an instrumental tool in a time when we really needed a way to script interactivity in a way that smoothed over the differing implementations of stuff like event handling, selecting elements, animating elements, and so on. The web is better because of jQuery — not just because it has such incredible utility, but because its ubiquity led to making what it provided part of the web platform itself. Nowadays, we can do just about anything jQuery can do in vanilla JavaScript... It really begs the question: Do we really need jQuery today? That's a question that GOV.UK has answered with a resounding "no".... This is a big deal when it comes to the user experience, because GOV.UK provides services and information online for The United Kingdom at scale. Not everyone is tapping away on their 2022 MacBook Pro on a rip-roarin' broadband connection. GOV.UK has to be accessible to everyone, and that means keepin' it lean.... dependencies matter when it comes to performance. Don't shortchange your users if the web platform can easily do the job a framework can. This level of commitment to the user experience from a institution that works at the scale GOV.UK does is commendable. I can only hope others follow in their footsteps.' -- source: https://developers.slashdot.org/story/22/05/21/0214233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

HP Chooses Ubuntu-Based Pop!_OS Linux For Its Upcoming Dev One Laptop
by Peter Reutemann 22 May '22

22 May '22

'System76's CEO Carl Richell announced that HP has chosen the Ubuntu-based Pop!_OS operating system to run on its 14-inch developer-focused notebook called "Dev One." Brian Fagioli from BetaNews speculates that a HP acquisition of System76 "could be a possibility in the future -- if this new relationship pans out at least." He continues: HP could be testing the waters with the upcoming Dev One. Keep in mind, System76 does not even build its own laptops, so we could see the company leave the notebook business and focus on desktops only -- let HP handle the Pop!_OS laptops. "We've got you covered. Experience exceptional multi-core performance from the AMD Ryzen 7 PRO processor and multitask with ease. Compile code, run a build, and keep all your apps running with more speed from the 16GB memory. Plus, load and save files in a flash, thanks to 1TB fast PCIe NVMe M.2 storage. We've even added a Linux Super key so shortcuts are a click away. Simply put, HP Dev One is built to help you code better," explains HP. The company adds, "Pop!_OS is at your service. Create your ideal work experience with multiple tools to help you perform with peak efficiency. Use Stacking to organize and access multiple applications, browsers, and terminal windows. Move, resize, and arrange windows with ease or, let Pop!_OS keep you organized and efficient with Auto-tiling. And use Workspaces to reduce clutter by organizing windows across multiple desktops." Apparently, there will only be one configuration priced at $1,099. So far, no details about a release date have been announced other than "coming soon."' -- source: https://news.slashdot.org/story/22/05/21/0228258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Rust Supply-Chain Attack Infected Cloud CI Pipelines with Go Malware
by Peter Reutemann 22 May '22

22 May '22

'Sentinel Labs provides malware/threat intelligence analysis for the enterprise cybersecurity platform SentinelOne. Thursday they reported on "a supply-chain attack against the Rust development community that we refer to as 'CrateDepression'." On May 10th, 2022, the Rust Security Response Working Group released an advisory announcing the discovery of a malicious crate hosted on the Rust dependency community repository. The malicious dependency checks for environment variables that suggest a singular interest in GitLab Continuous Integration (CI) pipelines. Infected CI pipelines are served a second-stage payload. We have identified these payloads as Go binaries built on the red-teaming framework, Mythic. Given the nature of the victims targeted, this attack would serve as an enabler for subsequent supply-chain attacks at a larger-scale relative to the development pipelines infected. We suspect that the campaign includes the impersonation of a known Rust developer to poison the well with source code that relies on the typosquatted malicious dependency and sets off the infection chain.... In an attempt to fool rust developers, the malicious crate typosquats against the well known rust_decimal package used for fractional financial calculations.... The malicious package was initially spotted by an avid observer and reported to the legitimate rust_decimal github account.... Both [Linux and macOs] variants serve as an all-purpose backdoor, rife with functionality for an attacker to hijack an infected host, persist, log keystrokes, inject further stages, screencapture, or simply remotely administer in a variety of ways.... Software supply-chain attacks have gone from a rare occurrence to a highly desirable approach for attackers to 'fish with dynamite' in an attempt to infect entire user populations at once. In the case of CrateDepression, the targeting interest in cloud software build environments suggests that the attackers could attempt to leverage these infections for larger scale supply-chain attacks.' -- source: https://developers.slashdot.org/story/22/05/21/0520207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modular, DIY-friendly Framework Laptop gets updated with 12th-gen Intel CPUs
by Peter Reutemann 20 May '22

20 May '22

'We were fans of the Framework Laptop when we reviewed it last year. This was partly because its modular design prioritizes repairability and upgradeability when most other laptops don't. But we also liked it because you didn't need to make huge tradeoffs to get that repairability—the Framework Laptop is lightweight and has a high-quality screen, keyboard, and touchpad, helping it stay competitive with big-box thin-and-light laptops like Dell's XPS 13 and the Lenovo ThinkPad X1 Carbon. An upgradeable laptop is only worthwhile if you can actually upgrade it, though, and Framework is making that possible starting today: The company is introducing a new iteration of the Framework Laptop's motherboard that uses 12th-gen Intel CPUs. A brand-new 12th-gen Framework Laptop starts at $1,049 for a Core i5-equipped base model, or $819 for a build-it-yourself kit with no memory or storage. These products will be available for preorder starting today, and shipping will start in July. [...] While many of Framework's PCs will run Windows, the company boasts that the 12th-gen version of its laptop "continue[s] to focus on solid Linux support." Framework recommends Fedora 36 because it "works fantastically well out of the box" and fully supports the Framework Laptop's new CPUs, its Wi-Fi card, and its fingerprint reader. For now, though, you'll need to be careful about installing other Linux distributions—you need Linux kernel version 5.17.6 or newer to fully support Alder Lake's hybrid CPU architecture, and prominent, actively maintained distributions like Ubuntu 22.04 don't include that kernel version out of the box. This problem will disappear for most Linux distros within the next few months, but for now you may need to upgrade the kernel manually to get the best-possible Linux experience on the Framework Laptop. -- source: https://arstechnica.com/gadgets/2022/05/modular-diy-friendly-framework-lapt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Bluetooth hack can unlock your Tesla—and all kinds of other devices
by Peter Reutemann 19 May '22

19 May '22

'When you use your phone to unlock a Tesla, the device and the car use Bluetooth signals to measure their proximity to each other. Move close to the car with the phone in hand, and the door automatically unlocks. Move away, and it locks. This proximity authentication works on the assumption that the key stored on the phone can only be transmitted when the locked device is within Bluetooth range. Now, a researcher has devised a hack that allows him to unlock millions of Teslas—and countless other devices—even when the authenticating phone or key fob is hundreds of yards or miles away. The hack, which exploits weaknesses in the Bluetooth Low Energy standard adhered to by thousands of device makers, can be used to unlock doors, open and operate vehicles, and gain unauthorized access to a host of laptops and other security-sensitive devices.' -- source: https://arstechnica.com/information-technology/2022/05/new-bluetooth-hack-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Blocks File Manager Total Commander From Allowing Users To Sideload Apps
by Peter Reutemann 19 May '22

19 May '22

'Total Commander has been around since the 90s, eventually expanding into Android after the platform launched over a decade ago. The app has more than 10 million downloads on the Play Store, still supporting OS versions as far back as Android 2.2. With a new update, developer Christian Ghisler has removed the ability to install APK files on Android, blaming Google Play policies in the patch notes for the app. It's a shocking twist for the service and, seemingly, a bad omen of things to come for other mobile file managers. A forum post from Ghisler sheds some more light on what's going on here, as Google sent him a notice warning of his app's removal from the Play Store within a week if the app went unmodified. The company's automated response pointed the developer to the "Device and Network Abuse" policy.' -- source: https://tech.slashdot.org/story/22/05/18/1843221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Start Distributing a Security-Vetted Collection of Open-Source Software Libraries
by Peter Reutemann 18 May '22

18 May '22

'Google announced a new initiative Tuesday aimed at securing the open-source software supply chain by curating and distributing a security-vetted collection of open-source packages to Google Cloud customers. From a report: The new service, branded Assured Open Source Software, was introduced in a blog post from the company. In the post, Andy Chang, group product manager for security and privacy at Google Cloud, pointed to some of the challenges of securing open-source software and stressed Google's commitment to open source. "There has been an increasing awareness in the developer community, enterprises, and governments of software supply chain risks," Chang wrote, citing last year's major log4j vulnerability as an example. "Google continues to be one of the largest maintainers, contributors, and users of open source and is deeply involved in helping make the open source software ecosystem more secure." Per Google's announcement, the Assured Open Source Software service will extend the benefits of Google's own extensive software auditing experience to Cloud customers. All open-source packages made available through the service are also used internally by Google, the company said, and are regularly scanned and analyzed for vulnerabilities.' -- source: https://tech.slashdot.org/story/22/05/17/1726201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Wins Big Step Forward For Open-Source Rights
by Peter Reutemann 18 May '22

18 May '22

'ZDNet: The Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), recently sued major TV vendor Vizio for abusing the GPL with its Linux-based SmartCast OS. Vizio replied that the SFC had no right to ask for the source code. On May 13, however, the SFC succeeded in federal court with its motion to have its lawsuit against Vizio remanded back to Superior Court in Orange County, CA. Doesn't sound like that big a deal? Think again. The important part of the decision by U.S. District Court Judge Josephine L. Staton stated that SFC's claim "that the [GPLv2] enforcement of 'an additional contractual promise separate and distinct from any rights provided by the copyright laws' amounts to an 'extra element,' and therefore, SFC's claims are not preempted." Karen M. Sandler, SFC's executive director, explained, "The ruling is a watershed moment in the history of copyleft licensing. This ruling shows that the GPL agreements function both as copyright licenses and as a contractual agreement." Sandler added that even in the Free and Open Source Software (FOSS) legal community people argue incorrectly that the GPL and other copyleft licenses only function as copyright licenses. This decision clearly states that the GPL also acts as a contract. Further, this decision makes it the first case to show individual consumers have rights to the source code as third-party beneficiaries of the GPL.' -- source: https://news.slashdot.org/story/22/05/17/2039236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Parliament Protest Supercharged NZ's Misinfodemic
by Lawrence D'Oliveiro 18 May '22

18 May '22

A report <https://www.nzherald.co.nz/nz/tectonic-shift-how-parliament-protest-superch…> on how online misinformation--and deliberate disinformation--has been spreading in NZ. A flood of recent Covid-19-related activity has exposed thousands more Kiwis to what the report's authors called "splintered realities", while also helping push people toward racist and violent ideologies. ... The websites they focused on ranged from mainstream platforms like Facebook, Twitter, Instagram and YouTube, to channels linked to the far-right, such as Telegram, Rumble, Odysee, Gab and Gettr. Each shift in New Zealand's Covid-19 response caused ripples across these sites. As our pediatric vaccine roll-out kicked off, for instance, one post bogusly claiming five children had collapsed at a vaccination centre swiftly went viral. In other words, a dramatic-sounding report, even though it was wrong, can spread faster than any attempts to correct it, simply because the correction seems much less interesting in comparison. You don’t have to assume that the ones spreading these reports are deliberately lying in order to create this effect: Hanlon’s Razor says “Never attribute to malice that which can be adequately explained by stupidity”. But the unprecedented surge in online traffic they observed around February's anti-mandate convoy to Wellington, and the 24-day occupation that followed, surprised even them. ... Posts on a single Facebook page, run by a known "misinformation super-spreader" they didn't name, drew some of the highest engagement of all public pages in the country over that period. The amount of traffic on Facebook misinformation pages even eclipsed that of pages operated by New Zealand mainstream media outlets combined – receiving 357,089 and 247,620 interactions respectively on March 2. There’s more in the news article, and also on the website of the Disinformation Project group which did the research <https://thedisinfoproject.org/>. I thought one of the names of the researchers was familiar: Dr Sanjana Hattotuwa. I’ve seen him on TV news a couple of times talking about this very thing.

1 0

meeting next Monday
by Peter Reutemann 16 May '22

16 May '22

Hi everyone We have another hybrid (virtual + in-person) meeting next Monday: Since we ran out of time at our last meeting, we are continuing our theme on cyber security with more show and tells: A far simpler firewall than pfSense, ufw (uncomplicated firewall), will be introduced by Peter (command-line and GUI). He will also briefly talk about tools like ClamAV (anti-virus), nmap (port scanner) and rkhunter (root kit detection). Angus will demo Wireguard, the VPN solution that made it into the Linux kernel (starting with 5.6). Details (and virtual meeting link): https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776643/ If you'd like to demo a tool as well, then please let me know. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Surprise: Microsoft Has a Second Internal-Use-Only Linux Distro
by Peter Reutemann 16 May '22

16 May '22

'ZDNet reports there's more than just the one Microsoft-created Linux distribution for internal use only called CBL (Common Base Linux) Mariner. "It turns out there's another Microsoft-developed Linux distribution that's also for internal use that's known as CBL-Delridge or CBL-D." I discovered the existence of CBL-D for the first time this week in a rather round-about way. I stumbled onto a February 2 blog post from Hayden Barnes. a Senior Engineering Manager at SuSE who led the Windows on Rancher engineering team, which traced his steps in discovering and building his own image of CBL-D. Barnes noted that Microsoft published CBL-Delridge in 2020, the same year that it also published CBL-Mariner. The main difference between the two: Delridge is a custom Debian derivative, while Mariner is a custom Linux From Scratch-style distribution. CBL-D powers Azure's Cloud Shell. The Azure Cloud Shell provides a set of cloud-management tools packaged in a container. In a note on the GitHub repo for the Cloud Shell, officials noted that "the primary difference between Debian and CBL-D is that Microsoft compiles all the packages included in the CBL-D repository internally. This helps guard against supply chain attacks...." CBL-Mariner and CBL-Delridge are just two of the Microsoft-developed Linux-related deliverables from the Linux Systems Group. Others include the Windows Subsystem for Linux version 2 (WSL2), which is part of Windows 10; an Azure-tuned Linux kernel which is designed for optimal performance as Hyper-V guests; and Integrity Policy Enforcement (IPE), a proposed Linux Security Module (LSM) from the Enterprise and Security team.' -- source: https://linux.slashdot.org/story/22/05/14/1934226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Using SEO To Rank Malicious PDFs On Search Engines, Research Finds
by Peter Reutemann 15 May '22

15 May '22

'VentureBeat: Today, researchers at security service edge provider, Netskope, published the Netskope Cloud and Threat Report: Global Cloud and Malware Trends, which found that phishing downloads rose 450% over the past 12 months, and highlighted that attackers are using search engine optimization (SEO) to rank malicious PDF files on search engines. The report's findings show that phishing attempts are constantly evolving, and attackers aren't just targeting employees through their email inboxes; they're also using popular search engines like Google and Bing. The increase in phishing attacks and the growing popularity of SEO techniques among cybercriminals highlights the need for enterprises to provide their employees with security awareness training so they're prepared to spot threats and not at risk of handing over sensitive information. When it comes to defending against these SEO-driven attacks, [Ray Canzanese, director of Netskope's Threat Labs] highlights several methods that security teams can use to protect employees. One of the most effective is to use a solution that can decrypt and scan web traffic for malicious content. At the same time, security teams should encourage users to inspect all links they click on, and to exercise caution if the link takes them to an unfamiliar website. In the event an employee does click on a malicious PDF, they can expect to see a fake captcha at the top of the first page, followed by text on other pages. In these scenarios, users should close the file, delete it from the device and report it to the security team ASAP. Canzanese also notes that it's important for users to report malicious URLs that feature on popular search engines to help the provider unlist them from the site and prevent other users from falling victim to a scam.' -- source: https://it.slashdot.org/story/22/05/13/2155201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Some top 100,000 websites collect everything you type—before you hit submit
by Peter Reutemann 15 May '22

15 May '22

'When you sign up for a newsletter, make a hotel reservation, or check out online, you probably take for granted that if you mistype your email address three times or change your mind and X out of the page, it doesn't matter. Nothing actually happens until you hit the Submit button, right? Well, maybe not. As with so many assumptions about the web, this isn't always the case, according to new research: A surprising number of websites are collecting some or all of your data as you type it into a digital form. Researchers from KU Leuven, Radboud University, and University of Lausanne crawled and analyzed the top 100,000 websites, looking at scenarios in which a user is visiting a site while in the European Union and visiting a site from the United States. They found that 1,844 websites gathered an EU user's email address without their consent, and a staggering 2,950 logged a US user's email in some form. Many of the sites seemingly do not intend to conduct the data-logging but incorporate third-party marketing and analytics services that cause the behavior. After specifically crawling sites for password leaks in May 2021, the researchers also found 52 websites in which third parties, including the Russian tech giant Yandex, were incidentally collecting password data before submission. The group disclosed their findings to these sites, and all 52 instances have since been resolved.' -- source: https://arstechnica.com/information-technology/2022/05/some-top-100000-webs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

White House Joins OpenSSF, Linux Foundation In Securing Open-Source Software
by Peter Reutemann 15 May '22

15 May '22

'ZDNet: Securing the open-source software supply chain is a huge deal. Last year, the Biden administration issued an executive order to improve software supply chain security. This came after the Colonial Pipeline ransomware attack shut down gas and oil deliveries throughout the southeast and the SolarWinds software supply chain attack. Securing software became a top priority. In response, The Open Source Security Foundation (OpenSSF) and Linux Foundation rose to this security challenge. Now, they're calling for $150 million in funding over two years to fix ten major open-source security problems. The government will not be paying the freight for these changes. $30 million has already been pledged by Amazon, Ericsson, Google, Intel, Microsoft, and VMWare. More is already on the way. Amazon Web Services (AWS) has already pledged an additional $10 million. At the White House press conference, OpenSSF general manager Brian Behlendorf said, "I want to be clear: We're not here to fundraise from the government. We did not anticipate needing to go directly to the government to get funding for anyone to be successful." Here are the ten goals the open-source industry is committed to meeting: 1. Security Education: Deliver baseline secure software development education and certification to all. 2. Risk Assessment: Establish a public, vendor-neutral, objective-metrics-based risk assessment dashboard for the top 10,000 (or more) OSS components. 3. Digital Signatures: Accelerate the adoption of digital signatures on software releases. 4. Memory Safety: Eliminate root causes of many vulnerabilities through the replacement of non-memory-safe languages. 5. Incident Response: Establish the OpenSSF Open Source Security Incident Response Team, security experts who can step in to assist open source projects during critical times when responding to a vulnerability. 6. Better Scanning: Accelerate the discovery of new vulnerabilities by maintainers and experts through advanced security tools and expert guidance. 7. Code Audits: Conduct third-party code reviews (and any necessary remediation work) of up to 200 of the most-critical OSS components once per year. 8. Data Sharing: Coordinate industry-wide data sharing to improve the research that helps determine the most critical OSS components. 9. Software Bill of Materials (SBOMs): Everywhere Improve SBOM tooling and training to drive adoption. 10. Improved Supply Chains: Enhance the 10 most critical open-source software build systems, package managers, and distribution systems with better supply chain security tools and best practices.' -- source: https://it.slashdot.org/story/22/05/14/0336214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Exploiting WordPress Tools to Hawk Scams
by Peter Reutemann 15 May '22

15 May '22

'"If you've visited a website in recent days and been randomly redirected to the same pages with sketchy "resources" or unwanted ads, it's likely the site in question was 1) built with WordPress tools and 2) hacked," reports Gizmodo. Details come from this blog post by researchers at Sucuri (a security provider owned by GoDaddy): As outlined in our latest hacked website report, we've been tracking a long-lasting campaign responsible for injecting malicious scripts into compromised WordPress websites. This campaign leverages known vulnerabilities in WordPress themes and plugins and has impacted an enormous number of websites over the year — for example, according to PublicWWW, the April wave for this campaign was responsible for nearly 6,000 infected websites alone. Since these PublicWWW results only show detections for simple script injections, we can assume that the scope is significantly larger. We recently investigated a number of WordPress websites complaining about unwanted redirects. Interestingly enough, they were found to be related to a new wave of this massive campaign and were sending website visitors through a series of website redirects to serve them unwanted ads. The websites all shared a common issue — malicious JavaScript had been injected within their website's files and the database, including legitimate core WordPress files... This JavaScript was appended under the current script or under the head of the page where it was fired on every page load, redirecting site visitors to the attacker's destination.... Domains at the end of the redirect chain may be used to load advertisements, phishing pages, malware, or even more redirects.... At the time of writing, PublicWWW has reported 322 websites impacted by this new wave... Considering that this count doesn't include obfuscated malware or sites that have not yet been scanned by PublicWWW, the actual number of impacted websites is likely much higher. Our team has seen an influx in complaints for this specific wave of the massive campaign targeting WordPress sites beginning May 9th, 2022, which has impacted hundreds of websites already at the time of writing.... We expect the hackers will continue registering new domains for this ongoing campaign as soon as existing ones become blacklisted. "It's important to note that these hacks are related to themes and plugins built by thousands of third-party developers using the open source WordPress software, not WordPress.com, which offers hosting and tools to build websites," Gizmodo points out. But this also cite this warning from Sucuri malware analyst Krasimir Konov: "This page tricks unsuspecting users into subscribing to push notifications from the malicious site. If they click on the fake CAPTCHA, they'll be opted in to receive unwanted ads even when the site isn't open — and ads will look like they come from the operating system, not from a browser," Konov wrote.' -- source: https://it.slashdot.org/story/22/05/14/1838213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS Successor Rocky Linux Gets $26M to Fund Push Into Enterprise Space
by Peter Reutemann 15 May '22

15 May '22

'"CIQ has landed $26 million in funding to support its plans to expand the use of Rocky Linux in the enterprise space," reports ZDNet. Last year, Red Hat decided to stop supporting CentOS 8 and shifted focus to CentOS Stream. CentOS had some huge enterprise users, among them Disney, GoDaddy, RackSpace, Toyota, and Verizon. In response, Greg Kurtzer, one of CentOS's founders, kicked off Rocky Linux in December 2020.... Kurtzer says Rocky Linux adoption has been "massive", with monthly downloads of OS images typically 250,000, reaching 750,000 in a bumper month. "Within two months we had 10,000 developer and contributors trying to be part of this project...." The project has gained the support of Greg Kroah-Hartman, the maintainer of the main-line stable Linux kernel, to meet community demands for Rocky Linux to run on a more modern, optimized kernel, Kurtzer said. Kroah-Hartman is leading Rocky Linux special interest group (SIG) for the kernel to create an optional enhanced kernel for Rocky Linux. "He's working closely with us to make sure the kernel we use is blessed by him. He's in the loop as bugs come up and help us manage that kernel in Rocky Linux," says Kurtzer. "Moreover, today's news follows shortly after CIQ inked a major deal with Google to help support companies looking to deploy Rocky Linux on Google's cloud infrastructure," reports VentureBeat. Kurtzer tells the site that Rocky Linux "has been a rocket ship in terms of uptake across the enterprise and cloud."' -- source: https://linux.slashdot.org/story/22/05/14/1913237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zyxel silently patches command injection vulnerability with 9.8 severity rating
by Peter Reutemann 13 May '22

13 May '22

'Hardware manufacturer Zyxel quietly released an update fixing a critical vulnerability that gives hackers the ability to control tens of thousands of firewall devices remotely. The vulnerability, which allows remote command injection with no authentication required, carries a severity rating of 9.8 out of a possible 10. It’s easy to exploit by sending simple HTTP or HTTPS requests to affected devices. The requests allow hackers to send commands or open a web shell interface that enables hackers to maintain privileged access over time. The vulnerability affects a line of firewalls that offer a feature known as zero-touch provisioning. Zyxel markets the devices for use in small branch and corporate headquarter deployments. The devices perform VPN connectivity, SSL inspection, web filtering, intrusion protection, and email security and provide up to 5Gbps throughput through the firewall. The Shodan device search service shows more than 16,000 affected devices are exposed to the Internet.' -- source: https://arstechnica.com/information-technology/2022/05/zyxel-silently-patch… Should have used pfSense... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Cloud Launches AlloyDB, a New Fully-Managed PostgreSQL Database Service
by Peter Reutemann 13 May '22

13 May '22

'TechCrunch: Google today announced the launch of AlloyDB, a new fully-managed PostgreSQL-compatible database service that the company claims to be twice as fast for transactional workloads as AWS's comparable Aurora PostgreSQL (and four times faster than standard PostgreSQL for the same workloads and up to 100 times faster for analytical queries). [...] AlloyDB is the standard PostgreSQL database at its core, though the team did modify the kernel to allow it to use Google's infrastructure to its fullest, all while allowing the team to stay up to date with new versions as they launch. Andi Gutmans, who joined Google as its GM and VP of Engineering for its database products in 2020 after a long stint at AWS, told me that one of the reasons the company is launching this new product is that while Google has done well in helping enterprise customers move their MySQL and PostgreSQL servers to the cloud with the help of services like CloudSQL, the company didn't necessarily have the right offerings for those customers who wanted to move their legacy databases (Gutmans didn't explicitly say so, but I think you can safely insert 'Oracle' here) to an open-source service. "There are different reasons for that," he told me. "First, they are actually using more than one cloud provider, so they want to have the flexibility to run everywhere. There are a lot of unfriendly licensing gimmicks, traditionally. Customers really, really hate that and, I would say, whereas probably two to three years ago, customers were just complaining about it, what I notice now is customers are really willing to invest resources to just get off these legacy databases. They are sick of being strapped and locked in." Add to that Postgres' rise to becoming somewhat of a de facto standard for relational open-source databases (and MySQL's decline) and it becomes clear why Google decided that it wanted to be able to offer a dedicated high-performance PostgreSQL service. The report also says Google spent a lot of effort on making Postgres perform better for customers that want to use their relational database for analytics use cases. "The changes the team made to the Postgres kernel, for example, now allow it to scale the system linearly to over 64 virtual cores while on the analytical side, the team built a custom machine learning-based caching service to learn a customer's access patterns and then convert Postgres' row format into an in-memory columnar format that can be analyzed significantly faster."' -- source: https://developers.slashdot.org/story/22/05/12/0117241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia Transitioning To Official, Open-Source Linux GPU Kernel Driver
by Peter Reutemann 12 May '22

12 May '22

'Nvidia is publishing their Linux GPU kernel modules as open-source and will be maintaining it moving forward. Phoronix's Michael Larabel reports: To much excitement and a sign of the times, the embargo has just expired on this super-exciting milestone that many of us have been hoping to see for many years. Over the past two decades NVIDIA has offered great Linux driver support with their proprietary driver stack, but with the success of AMD's open-source driver effort going on for more than a decade, many have been calling for NVIDIA to open up their drivers. Their user-space software is remaining closed-source but as of today they have formally opened up their Linux GPU kernel modules and will be maintaining it moving forward. [...] This isn't limited to just Tegra or so but spans not only their desktop graphics but is already production-ready for data center GPU usage. ' -- source: https://linux.slashdot.org/story/22/05/11/2051237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux On Mars: NASA’s Ingenuity Helicopter Flies
by Lawrence D'Oliveiro 10 May '22

10 May '22

The first powered aircraft on Mars <https://www.theregister.com/2021/04/19/perseverance_computing_feature/> has proved its concept, taken flight for a few seconds, and made a controlled landing again. The control system is running Linux on a Qualcomm Snapdragon 801 chip, not because NASA considered it the best tool for the job, but because it was the easiest solution available. The hardware “is tuned for use on Earth, not Mars”, so it is only planned to make brief flights of no more than 90 seconds at a time, always landing back at the same spot, and it is not expected to endure beyond the initial 30 days of the Perseverance mission.

1 3

Hackers Are Now Hiding Malware In Windows Event Logs
by Peter Reutemann 10 May '22

10 May '22

'Security researchers have noticed a malicious campaign that used Windows event logs to store malware, a technique that has not been previously documented publicly for attacks in the wild. BleepingComputer reports: The method enabled the threat actor behind the attack to plant fileless malware in the file system in an attack filled with techniques and modules designed to keep the activity as stealthy as possible. [...] The dropper copies the legitimate OS error handling file [...] and then drops an encrypted binary resource to the 'wer.dll' (Windows Error Reporting) in the same location, for DLL search order hijacking to load malicious code. DLL hijacking is a hacking technique that exploits legitimate programs with insufficient checks to load into memory a malicious Dynamic Link Library (DLL) from an arbitrary path. [Denis Legezo, lead security researcher at Kaspersky] says that the dropper's purpose is to loader on the disk for the side-loading process and to look for particular records in the event logs (category 0x4142 - 'AB' in ASCII. If no such record is found, it writes 8KB chunks of encrypted shellcode, which are later combined to form the code for the next stager. "The dropped wer.dll is a loader and wouldn't do any harm without the shellcode hidden in Windows event logs," says Legezo. The new technique analyzed by Kaspersky is likely on its way to becoming more popular as Soumyadeep Basu, currently an intern for Mandiant's red team, has created and published on GitHub source code for injecting payloads into Windows event logs. ' -- source: https://tech.slashdot.org/story/22/05/09/2155240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are actively exploiting BIG-IP vulnerability with a 9.8 severity rating
by Peter Reutemann 10 May '22

10 May '22

'Researchers are marveling at the scope and magnitude of a vulnerability that hackers are actively exploiting to take full control of network devices that run on some of the world's biggest and most sensitive networks. The vulnerability, which carries a 9.8 severity rating out of a possible 10, affects F5’s BIG-IP, a line of appliances that organizations use as load balancers, firewalls, and for inspection and encryption of data passing into and out of networks. There are more than 16,000 instances of the gear discoverable online, and F5 says it’s used by 48 of the Fortune 50. Given BIG-IP's proximity to network edges and their functions as devices that manage traffic for web servers, they often are in a position to see decrypted contents of HTTPS-protected traffic. Last week, F5 disclosed and patched a BIG-IP vulnerability that hackers can exploit to execute commands that run with root system privileges. The threat stems from a faulty authentication implementation of the iControl REST, a set of web-based programming interfaces for configuring and managing BIG-IP devices. “This issue allows attackers with access to the management interface to basically pretend to be an administrator due to a flaw in how the authentication is implemented,” Aaron Portnoy, the director of research and development at security firm Randori, said in a direct message. “Once you are an admin, you can interact with all the endpoints the application provides, including execute code.”' -- source: https://arstechnica.com/information-technology/2022/05/hackers-are-actively… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME Patent Troll Gets Stripped of Patent Rights
by Peter Reutemann 09 May '22

09 May '22

'An anonymous Slashdot reader writes: Remember that patent lawsuit filed against GNOME's Shotwell in 2019? An enterprising open source lawyer has challenged it within the patent office and gotten the whole thing canceled! OpenSource.org argues that decision by the U.S. patent office "may well give patent trolls cause to steer clear of open source projects — even more than the fierce resistance the community impressively funded and mounted in the GNOME case." Of the many methods developed over the past 20 years to eliminate patent threats against FOSS, none is as powerful as challenging the nefarious patents directly. That's what McCoy Smith, founder of OSI sponsor LexPan Law, did.... Smith pointed out in a re-examination request to the U.S. Patent & Trademark Office that the patent was not for any new invention. They agreed. As a result, all of these "claims" in the Rothschild '086 Patent — the part of a patent describing what the patent rights cover — have consequently been canceled. The Rothschild '086 patent can no longer be used against any victim, including open source projects. Of course, that's little comfort to the 20+ victims attacked after GNOME with the now-proven-worthless Rothschild '086 patent, or the 50+ companies targeted with related patents that haven't yet been re-examined.... Still, it's good to know there are open source champions of all sizes defending the development of open software.' -- source: https://yro.slashdot.org/story/22/05/08/0052226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

(Mostly) Open Source SteamOS Forked into Homegrown ISO For Other Machines
by Peter Reutemann 09 May '22

09 May '22

'"While Valve has yet to actually release a proper ISO for SteamOS 3 used on the Steam Deck, others have been taking it into their own hands to provide," reports GamingOnLinux, "like with the new HoloISO. "This is possible, since 99% of what SteamOS uses is open source (not the Steam client though)..." So people can easily hack away at it to do whatever they want. [HoloISO] is not exactly the same as SteamOS 3 but it's probably the closest I've seen yet, with the main packages coming direct from Valve with "zero possible edits" the developer says. It's described as a "first beta release." Neowin supplies some context: Back in early March, Valve released the Steam Deck recovery image for Deck users who need to get back to a factory state. When it was released, many of us over at the Steam OS subreddit did the first thing any reasonable enthusiast would do and tried installing it on a standard PC. The results of this approach were mixed, and only partial successes were achieved. Then HoloISO happened.... The first release, called 'Ground Zero', was released today and allows users to install Steam OS on any machine. But there are some things you need to know before installing this for yourself.... There's a bunch of caveats, but the article still concludes that "If you're team red and you want to give this a shot, head over to the project's Github page to read more and download."' -- source: https://games.slashdot.org/story/22/05/08/0844220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Silicon Exclusively Hit With World-First 'Augury' DMP Vulnerability
by Peter Reutemann 07 May '22

07 May '22

'Tom's Hardware: A team of researchers with the University of Illinois Urbana-Champaign, Tel Aviv University, and the University of Washington have demonstrated a world-first Data Memory-Dependent Prefetcher (DMP) vulnerability, dubbed "Augury," that's exclusive to Apple Silicon. If exploited, the vulnerability could allow attackers to siphon off "at rest" data, meaning the data doesn't even need to be accessed by the processing cores to be exposed. Augury takes advantage of Apple Silicon's DMP feature. This prefetcher aims to improve system performance by being aware of the entire memory content, which allows it to improve system performance by pre-fetching data before it's needed. Usually, memory access is limited and compartmentalized in order to increase system security, but Apple's DMP prefetch can overshoot the set of memory pointers, allowing it to access and attempt a prefetch of unrelated memory addresses up to its prefetch depth. If you feel your mind grasping at a certain familiarity with this, it's likely because the infamous Spectre/Meltdown vulnerabilities also try and speculate what data will be required by the system before it's even requested (hence the term speculative execution). But while side-channel vulnerabilities such as Spectre and Meltdown are only capable of leaking in-use data, Apple's DMP can potentially leak the entire memory content even if it's not being actively accessed. The nature of Apple's DMP also renders void some of the already-engineered fixes for speculative execution vulnerabilities -- those that rely on controlling what is visible to the processing cores. The researchers said that Apple is fully aware of their discoveries, but there are no plans for whether or not the company will deploy mitigations.' -- source: https://apple.slashdot.org/story/22/05/06/2226251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Celebrates the Release of Firefox 100
by Peter Reutemann 05 May '22

05 May '22

'vm shares the blogpost of Mozilla releasing Firefox 100, and outlines some of thoughts: Out of the ashes of Netscape/AOL, Firebird rose as a promising new browser. A significant name change and a hundred releases later, Firefox 100 is still the underdog that keeps on fighting. With my mounting annoyance at all the Google services underpinning Chrome, I've since discovered and used Ungoogled Chromium, Waterfox, LibreWolf, and a handful of other lesser known spins on Chrome or Firefox. On mobile, Brave really does the best job at ad blocking whether you're on iOS or Android but the Mozilla Foundations is probably still the largest dev group fighting the good fight when it comes to both privacy and security enhancements.That's not to say that the Chromium team isn't security savvy -- I only wish they were just a little less Google. Anyhow, tell us about your favorite browser in the comments and have a look at Mozilla's latest release while you're at it.' -- source: https://news.slashdot.org/story/22/05/03/1720240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome's Latest Update: 30 Security Fixes and Bug Details Kept 'Restricted'
by Peter Reutemann 02 May '22

02 May '22

'Hot Hardware warns that on Tuesday, the Stable Channel for Chrome's desktop edition "had an update on April 26, 2022. That update includes 30 security fixes, some of them so bad that Google is urging all users to update immediately." The release notes for Google's Chrome v101.0.4951.41 for Windows, Mac, and Linux has a long list of bug fixes; you can view it here. However, there's also a key statement in that page. "Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed...." Effectively the the non-developer translation of the quote above is that something so significant was found, the details are being kept hidden.' -- source: https://it.slashdot.org/story/22/05/02/0034206 That sounds pretty bad... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora's Lead Speaks on the Popularity of Linux and the Importance of Open Source
by Peter Reutemann 02 May '22

02 May '22

'Fedora project leader Matthew Miller spoke to TechRepublic's Jack Wallen this week, sharing some thoughts on the future of Linux — and on open source in general: Matthew Miller: I think it's a lost cause to try to "sell" our quirky technology interest to people who don't see it already. We need to take a different approach.... I think our message, at its root, has to be around open source.... [W]ith Linux, when you install an open-source distro, you're not just part of a fan community. You're part of a colossal, global effort that makes software more available to everyone, makes that software better and better, and makes the whole world better through sharing... Just by using it you're sharing in this amazing undertaking, part of a move away from scarcity to an economy based on abundance.... Jack Wallen: What's the biggest difference in Linux today vs. Linux of 10 years ago? Matthew Miller: I think first we have to start with just the amazing ubiquity of it. Ten years ago, it was cute to find a TV that ran Linux. Now, not only is it definitely powering your TV, you've probably got Linux running on your lightbulbs! It's everywhere. And while Linux had pushed proprietary Unix from the server room, ten years ago Windows-based servers were pushing back. The cloud changed that — now, the cloud is Linux, almost completely. (Anything that isn't is a legacy app that it was too much trouble to port!) From tiny devices to the most powerful mainframes and supercomputers: Linux, Linux, Linux.... Jack Wallen: If Linux has an Achilles' heel, what is it? Matthew Miller: Linux and the whole free and open-source software movement grew up with the rise of the internet as an open communication platform. We absolutely need that to continue in order to realize our vision, and I don't think we can take it for granted. That's more general than an Achilles' heel, though, so right now let me highlight one thing that I think is troubling: Chrome becoming the dominant browser to the point where it's often the only way to make sites work. Chromium (the associated upstream project) is open source, but isn't really run as a community project, and, pointedly, very very few people run Chromium itself. I'd love to see that change, but I'd also like to see Firefox regain a meaningful presence. Miller also said Fedora's next release is focused on simplicity. ("When the OS gets in the way, it drops from the conversation I want to have about big ideas to ... well, the boring technical details that people never want to deal with") And he also shared his thoughts on what Linux needs most. "What I'd really like to see more of are more non-technical contributors. I mean, yes, we can always benefit from more packagers and coders and engineers, but I think what we really need desperately are writers, designers, artists, videographers, communicators, organizers and planners. I don't think big companies are likely to provide those things, at least, not for the parts of the Linux world which aren't their products." "We need people who think the whole grand project I've been talking about is important, and who have the skills and interests to help make it real."' -- source: https://linux.slashdot.org/story/22/05/01/014252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

30,000 New Users Signed Up For Mastodon After Elon Musk Bought Twitter
by Peter Reutemann 29 Apr '22

29 Apr '22

'Motherboard: Social media platform Mastodon, often seen as an alternative to Twitter, gained nearly 30,000 new users on the day that Elon Musk bought Twitter. On Tuesday a Mastodon domain became unresponsive. Eugen Rochko, Mastodon's CEO, later told Motherboard in an email that there were performance issues. "I'm sorry I couldn't have responded sooner," he wrote. "I was working all day on fixing performance issues on the Mastodon servers I operate due to the influx of new and returning users following Twitter's acquisition by Elon Musk." Rochko added that Mastodon has seen an increase of 41,287 active users, including both returning users and new users. When breaking that figure down by just new users, 28,391 new people have joined Mastodon in the past day, Rochko said. Mastodon is a piece of open-source software that people can use as a base to create their own social networks. Although its appearance is similar to Twitter, it also differs from Twitter in the sense that Twitter is a single social network people sign up for. When it comes to the social network side of things, Mastodon holds more similarities with Discord, in that users have to find specific Mastodon instances to join. Those looking to create their own Mastodon instance also have to host it themselves, a step that may alienate many non-technical users. Donald Trump's social media site, Truth Social, is based on Mastodon and was recently called out by the company for failing to provide the source code for the site built on top of it. Two weeks later, the social media site quietly acknowledged Mastodon in a dedicated section labeled "open source." In regard to the matter, Mastodon founder Eugen Rochko said: "Compliance with our AGPLv3 license is very important to me as that is the sole basis upon which I and other developers are willing to give away years of work for free." Twitter did confirm some fluctuations in follower counts after Musk's deal was made official, although they said they were organic in nature.' -- source: https://news.slashdot.org/story/22/04/27/2141231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

One of the most powerful DDoSes ever targets cryptocurrency platform
by Peter Reutemann 29 Apr '22

29 Apr '22

'A cryptocurrency platform was recently on the receiving end of one of the biggest distributed denial-of-service attacks ever after threat actors bombarded it with 15.3 million requests, content delivery network Cloudflare said. DDoS attacks can be measured in several ways, including by the volume of data, the number of packets, or the number of requests sent each second. The current records are 3.4 terabits per second for volumetric DDoSes—which attempt to consume all bandwidth available to the target—and 809 million packets per second, and 17.2 million requests per second. The latter two records measure the power of application-layer attacks, which attempt to exhaust the computing resources of a target’s infrastructure. Cloudflare's recent DDoS mitigation peaked at 15.3 million requests per second. While still smaller than the record, its power was more considerable because the attack was delivered through HTTPS requests rather than HTTP requests used in the record. Because HTTPS requests are much more compute-intensive than HTTP requests, the latest attack had the potential to put much more strain on the target.' -- source: https://arstechnica.com/information-technology/2022/04/one-of-the-most-powe… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: New Zealand Cyber Security Challenge 2022
by Peter Reutemann 29 Apr '22

29 Apr '22

Considering our cyber security theme from this week, some of you might want to participate in the (free) challenge outlined below. Cheers, Peter ---------- Forwarded message --------- From: Buddhika Subasinghe <buddhika.subasinghe(a)waikato.ac.nz> Date: Fri, Apr 29, 2022 at 10:28 AM Subject: New Zealand Cyber Security Challenge 2022 To: Computing Staff: CS & SE <computing-staff(a)waikato.ac.nz>, Mathematics Staff <maths-staff(a)waikato.ac.nz>, Design staff: NZ <design-nz(a)waikato.ac.nz > Hi all FYI Please see the message below from Harpreet re the NZ Cyber Security Challenge 2022. Please contact Vimal vimal.kumar(a)waikato.ac.nz ro Harpreet harpreet.kaur(a)waikato.ac.nz if you need any further information about this event. Many thanks! Buddhika On Fri, Apr 29, 2022 at 9:26 AM Harpreet Kaur <harpreet.kaur(a)waikato.ac.nz> wrote: > Dear Buddhika, > > This is the email we want to regulate in the cs list. Much appreciated > your help! > > > *Hi All,* > *Cyber Security Researchers of Waikato (CROW) team is organising the NZ > Cyber Security Challenge again this year. Could you please distribute this > email invitation to your students?* > > ------------------------------------------------------------------------------------------ > *New Zealand Cyber Security Challenge 2022* > > The NZ Cyber Security Challenge is back for its 9th edition. Participation > is free and as always there are a number of prizes to be won. > > We invite anyone interested in cybersecurity to join and take part in the > challenge. The challenge will start with an online CTF round (Round 0). We > will then invite the top 150 participants to the University of Waikato > campus for the main competition involving Rounds 1,2, a networking lunch, > cybersecurity talks and a side challenge. > > The schedule of the NZCSC’22 is as follows: > > - > > 04 June - 22 June: > - > > Online Round 0: open for everyone > > > - > > 15 June - 22 June: > - > > Online Waikato x Cardiff Challenge (special round for Waikato and > Cardiff University Students) > - > > 22-23 July : > - > > Round 1 - Incident Response round > - > > Round 2 - Capture the Flag > - > > Side Challenge > - > > Networking lunch and talks from the industry > > Feel free to contact me (vimal.kumar(a)waikato.ac.nz) or Harpreet Kaur ( > harpreet.kaur(a)waikato.ac.nz) if you have any questions. More information > and the Registration of Interest link can be found on the event website. > > https://cybersecuritychallenge.org.nz/ > > > We look forward to hosting you at the event! > > > > -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PFSense - additional info
by Roger Hardy 27 Apr '22

27 Apr '22

Hi all. These are the manuals for the small boards we use to run remote installs. https://pcengines.ch/pdf/apu4.pdf Better details here https://www.pcengines.ch/apu4c4.htm You can even download the schematics there. Price lists here https://www.pcengines.ch/order.htm As I said, these are cheaper than the netgate ones, that can be seen at https://www.netgate.com/appliances The "manual" for PFSense is here https://docs.netgate.com/pfsense/en/latest/ And just for giggles, I checked their (netgate) support prices. Not too bad for a business. https://www.netgate.com/support And they have a pretty interesting service called "Zero to Ping" where "they will help get your Netgate appliance connected to the Internet and one client on the same network online." Feel free to ask any questions, about either PFSense or the APU devices. Roger

1 0

Concerns Raised Over The 'New' NTFS Linux Driver That Merged Last Year
by Peter Reutemann 27 Apr '22

27 Apr '22

'In 2020, Paragon Software announced they wanted to upstream their previously proprietary NTFS driver into Linux. After a year of review, the NTFS3 driver was added to the Linux 5.15 kernel. While Paragon pledged to maintain their driver, there have been no major updates to the driver despite a growing list of patches that have submitted. Developer Kari Argillander has raised his concerns on the mailing list that the driver is orphaned, and that the Paragon maintainer has not responded to any messages about fixes. An offer to co-maintain the driver has also been met with "radio silence".' -- source: https://linux.slashdot.org/story/22/04/26/1749239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New OpenSSH Version On Debian Unstable
by Lawrence D'Oliveiro 24 Apr '22

24 Apr '22

Did my periodic OS upgrade today, and one change that has had an (easy to fix) impact on my backup system is that OpenSSH 9.0 is phasing out the special protocol that was used to implement the scp command, in favour of using the same one as for sftp. One difference this makes is with file specs that contain shell-special characters (e.g. spaces). Previously, when specifying such to the scp command in the shell, you had to do two levels of escaping, one to get them past the local shell, and another to work with the remote shell. But now, the second level of escaping for the remote end is no longer needed. The release notes describe this second level of quoting as “finicky and brittle”, so all in all things are simpler without it.

1 1

Major cryptography blunder in Java enables “psychic paper” forgeries
by Peter Reutemann 22 Apr '22

22 Apr '22

'Organizations using newer versions of Oracle’s Java framework woke up on Wednesday to a disquieting advisory: A critical vulnerability can make it easy for adversaries to forge TLS certificates and signatures, two-factor authentication messages, and authorization credentials generated by a range of widely used open standards. The vulnerability, which Oracle patched on Tuesday, affects the company’s implementation of the Elliptic Curve Digital Signature Algorithm in Java versions 15 and above. ECDSA is an algorithm that uses the principles of elliptic curve cryptography to authenticate messages digitally. A key advantage of ECDSA is the smaller size of the keys it generates, compared to RSA or other crypto algorithms, making it ideal for use in standards including FIDO-based 2FA, the Security Assertion Markup Language, OpenID, and JSON.' -- source: https://arstechnica.com/information-technology/2022/04/major-crypto-blunder… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical bug could have let hackers commandeer millions of Android devices
by Peter Reutemann 22 Apr '22

22 Apr '22

'Security researchers said they uncovered a vulnerability that could have allowed hackers to commandeer millions of Android devices equipped with mobile chipsets made by Qualcomm and MediaTek. The vulnerability resided in ALAC—short for Apple Lossless Audio Codec and also known as Apple Lossless—which is an audio format introduced by Apple in 2004 to deliver lossless audio over the Internet. While Apple has updated its proprietary version of the decoder to fix security vulnerabilities over the years, an open-source version used by Qualcomm and MediaTek had not been updated since 2011. Together, Qualcomm and MediaTek supply mobile chipsets for an estimated 95 percent of US Android devices.' The buggy ALAC code contained an out-of-bounds vulnerability, meaning it retrieved data from outside the limits of allocated memory. Hackers could exploit this mistake to force the decoder to execute malicious code that otherwise would be off-limits. “The ALAC issues our researchers found could be used by an attacker for remote code execution attack (RCE) on a mobile device through a malformed audio file,” security firm Check Point said on Thursday. “RCE attacks allow an attacker to remotely execute malicious code on a computer. The impact of an RCE vulnerability can range from malware execution to an attacker gaining control over a user’s multimedia data, including streaming from a compromised machine’s camera.” -- source: https://arstechnica.com/information-technology/2022/04/critical-bug-could-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Now Hopes To IPO in 2023
by Peter Reutemann 22 Apr '22

22 Apr '22

'The saga of Ubuntu-maker Canonical's IPO efforts now stretches back quite a few years. I think the first time I talked to the company's founder Mark Shuttleworth about going public was in 2018, though there had already been some chatter about it in previous years. But the timing never quite worked out for Canonical. In a press briefing ahead of today's launch of Ubuntu 22.04 LTS, Shuttleworth noted he now expects it to go public next year. "We are on track to float the business. And now I'm pretty confident that we will do that in 2023," said Shuttleworth, who was calling in from an undisclosed island off the coast of West Africa. "And so we're taking active steps at the board level and in our finance operation -- various other parts of the business -- to be prepared for that. We're now effectively on a very clear program to a flotation of the business next year." He stressed that Canonical is not in a situation where it has to raise outside money and that going public for him is not about fundraising. He noted that Canonical's revenue last year was $175 million and that the company's biggest challenge right now is that demand is bigger that the company's ability to service it, in large part because there isn't enough talent on the market for the company to hire.' -- source: https://news.slashdot.org/story/22/04/21/1333228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Volla Phone 22 Runs Ubuntu Touch Or a Privacy-Focused Android Fork Or Both
by Peter Reutemann 20 Apr '22

20 Apr '22

'The Volla Phone 22, a new smartphone available for preorder via a Kickstarter campaign, is unlike any other smartphone on the market today in that it ships with a choice of the Android-based Volla OS or the Ubuntu Touch mobile Linux distribution. "It also supports multi-boot functionality, allowing you to install more than one operating system and choose which to run at startup," writes Liliputing's Brad Linder. Some of the hardware specs include a 6.3-inch FHD+ display, a MediaTek Helio G85 processor, 4GB of RAM, 128GB storage, 3.5mm audio jack and a microSD card reader. There's also a 48-megapixel main camera sensor and replaceable 4,500mAh battery. From the report: While Volla works with the folks at UBPorts to ensure its phones are compatible with Ubuntu Touch, the company develops the Android-based Volla OS in-house. It's based on Google's Android Open Source Project code, but includes a custom launcher, user interface, and set of apps with an emphasis on privacy. The Google Play Store is not included, as this is a phone aimed at folks who want to minimize tracking from big tech companies. Other Google apps and services like the Chrome web browser, Google Maps, Google Drive, and Gmail are also omitted. The upshot is that no user data is collected or stored by Volla, Google, or other companies unless you decide to install apps that track your data. Of course, that could make using the phone a little less convenient if you've come to rely on those apps, so the Volla Phone might not be the best choice for everyone. Volla OS also has a built-in user-customizable firewall, an App Locker feature for disabling and hiding apps, and optional support for using the Hide.me VPN for anonymous internet usage. The source code for Volla OS is also available for anyone that wants to inspect the code. The operating system also has a custom user interface including a Springboard that allows you to quickly launch frequently-used apps by pressing a red dot for a list, or by starting to type in a search box for automatic suggestions such as placing a phone call, sending a text message, or opening a web page. You can also create notes or calendar events from the Springboard or send an encrypted message with Signal. The phone is expected to ship in June at an early bird price of about $408.' -- source: https://news.slashdot.org/story/22/04/19/2131242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers can infect >100 Lenovo models with unremovable malware. Are you patched?
by Peter Reutemann 20 Apr '22

20 Apr '22

'Lenovo has released security updates for more than 100 laptop models to fix critical vulnerabilities that make it possible for advanced hackers to surreptitiously install malicious firmware that can be next to impossible to remove or, in some cases, to detect. Three vulnerabilities affecting more than 1 million laptops can give hackers the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, the UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the initial link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and even harder to remove. Two of the vulnerabilities—tracked as CVE-2021-3971 and CVE-2021-3972—reside in UEFI firmware drivers intended for use only during the manufacturing process of Lenovo consumer notebooks. Lenovo engineers inadvertently included the drivers in the production BIOS images without being properly deactivated. Hackers can exploit these buggy drivers to disable protections, including UEFI secure boot, BIOS control register bits, and protected range register, which are baked into the serial peripheral interface (SPI) and designed to prevent unauthorized changes to the firmware it runs.' -- source: https://arstechnica.com/information-technology/2022/04/bugs-in-100-lenovo-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Tuesday (!)
by Peter Reutemann 20 Apr '22

20 Apr '22

Hi everyone We have a meeting next week on Tuesday, due to ANZAC day on Monday. Since we are back under Orange traffic light, we will attempt a hybrid meeting. Whilst the physical meeting will take place in MS4, everything will be transmitted via BigBlueButton. That way you won't miss out n case you can't or don't want to attend in person. Our topic: With increasing cyber security threats, it is high time that we look at how you can bolster the security of your Linux system and how you connect to the outside world. For this purpose, we will have short show and tells lined up: Roger will demo the pfSense firewall and router system based on FreeBSD, complete with a web-based user interface. A far simpler firewall, ufw (uncomplicated firewall), will be introduced by Peter (command-line and GUI). Angus will demo Wireguard, the VPN solutation that made it into the Linux kernel (starting with 5.6). Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776633/ If you want to demo something as well, then please contact me. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Details How China-Linked Crew’s Malware Hides Scheduled Windows Tasks
by Lawrence D'Oliveiro 18 Apr '22

18 Apr '22

Seems every week there is something new to learn about the (in)security of Microsoft Windows. In this description <https://www.theregister.com/2022/04/14/microsoft-tarrask-malware-in-windows/> of a malware attack, the software infection creates a scheduled task to automatically reinstall itself if it has been removed. So far, no big deal: on *nix we have cron, and systemd timers, that do much the same thing. But on Windows, these scheduled tasks have “security descriptors” -- basically, ACLs, as far as I have been able to determine, that control who can manage these tasks or even see them. So if a program creates a task and deletes all its security descriptors, the task effectively becomes invisible to the normal Windows admin tools. Except, it can still be seen and managed through its Registry entries. So, having write access to the Registry lets you bypass the entire security-descriptor mechanism, yet it still does not let you see these tasks in any other way? Like the “security” those higher-level tools think they are enforcing is a complete mirage, and end up making the system, not more, but less, secure.

1 0

Git For Windows Issues Update To Fix Running-Someone-Else's-Code Vulnerability
by Peter Reutemann 14 Apr '22

14 Apr '22

'The Git team has issued an update to fix a bug in Git for Windows that "affects multi-user hardware where untrusted parties have write access to the same hard disk," reports The Register. Specifically, the update is concerned with CVE-2022-24765. From the report: Arguably, if an "untrusted party" has write access to a hard disk, then all bets are off when it comes to the nooks and crannies of a PC anyway. In this case, the miscreants would only need to create the folder c:\.git, "which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory," according to NIST. The result is that Git would use the config in the directory. NIST went on to list potentially vulnerable products, which included Visual Studio. "Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash." The Git team was little blunter about the vulnerability, and warned that "Merely having a Git-aware prompt that runs 'git status' (or 'git diff') and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user." [...] To deal with the issue, the Git team recommends an update. Alternatively, a user could create that .git folder themselves and remove read/write access as workaround or "define or extend 'GIT_CEILING_DIRECTORIES' to cover the parent directory of the user profile," according to NIST. ' -- source: https://it.slashdot.org/story/22/04/13/2140258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tim Cook Invokes Eisenhower
by Lawrence D'Oliveiro 13 Apr '22

13 Apr '22

Apple’s CEO gave a speech at a gathering of the International Association of Privacy Professionals <https://arstechnica.com/gadgets/2022/04/tim-cook-delivers-speech-railing-ag…>, where he claimed that Apple has “a commitment to protecting people from a data industrial complex built on a foundation of surveillance”. He particularly hates regulatory proposals to force Apple and other platform owners to allow sideloading of apps, claiming That means data-hungry companies would be able to avoid our privacy rules, and once again track our users against their will. In other words, we should trust companies like his to keep their word, and not fall back on Big Bad Government Regulation. If it weren’t for Governments, the world would end up run by corporations. Which would you prefer?

1 0

Trend says hackers have weaponized SpringShell to install Mirai malware
by Peter Reutemann 12 Apr '22

12 Apr '22

'Researchers on Friday said that hackers are exploiting the recently discovered SpringShell vulnerability to successfully infect vulnerable Internet of Things devices with Mirai, an open source piece of malware that wrangles routers and other network-connected devices into sprawling botnets. The Internet’s biggest players are all affected by critical Log4Shell 0-day When SpringShell (also known as Spring4Shell) came to light last Sunday, some reports compared it to Log4Shell, the critical zero-day vulnerability in the popular logging utility Log4J that affected a sizable portion of apps on the Internet. That comparison proved to be exaggerated because the configurations required for SpringShell to work were by no means common. To date, there are no real-world apps known to be vulnerable. Researchers at Trend Micro now say that hackers have developed a weaponized exploit that successfully installs Mirai. A blog post they published didn’t identify the type of device or the CPU used in the infected devices. The post did, however, say a malware file server they found stored multiple variants of the malware for different CPU architectures.' -- source: https://arstechnica.com/information-technology/2022/04/trend-says-hackers-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox downloads PDF files to home directory when viewing
by Peter Reutemann 12 Apr '22

12 Apr '22

Hi everyone One annoying new feature that showed up in Firefox recently is that it downloads PDF files to my home directory rather then /tmp when I'm only viewing them. The following thread discusses this: https://support.mozilla.org/en-US/questions/1370409 All you have to do is go to the configuration ("about:config" in URL bar) and change the following option to "false: browser.download.improvements_to_download_panel Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The End Of Byte Magazine
by Lawrence D'Oliveiro 12 Apr '22

12 Apr '22

I’ve been browsing through a few more of those old issues of Byte magazine, up to its shutdown in 1998. In the final, July, issue, among the items promised as “coming up in August”, was a “software lab report” on “free Unixes”: “We test Linux and FreeBSD to see how they measure up against their commercial cousins as servers and development platforms”. Presumably as per the typical magazine publishing pipeline, that report had already been done and written up by that point; I wonder if it ever got published anywhere ... Linux had been getting a few small mentions in the prior issues, along with other free software such as Perl for website development. Though the writers kept referring to these as “freeware” ... Also in that issue was a mention of an unusual new PC design, called the “Rock City”, from a company called the Panda Project. It was the shape of a cube, balanced on one corner (where the stand was attached). Hunting around, I found a short item, with one small, intriguing-looking picture, here <https://www.fatsofa.com/rockcity.html>. The actual company website is of course long gone; I tried looking for copies at archive.org, but while the text of the website back to 1998 is there, the pictures are not.

2 1

Raspberry Pi OS Ditches Longtime User Account For Security Reasons
by Peter Reutemann 09 Apr '22

09 Apr '22

'Ars Technica: Since its launch, the Raspberry Pi OS (and most operating systems based on it) has shipped with a default "pi" user account, making it simpler to boot up a Pi and start working without needing to hook up the device to a monitor or go through a multi-step setup process. But as of today, that's changing -- new installs of the Raspberry Pi OS are shedding that default user account for both security and regulatory reasons. Raspberry Pi Foundation software engineer Simon Long explains the thinking in this blog post. "[The "pi" user account] could potentially make a brute-force attack slightly easier, and in response to this, some countries are now introducing legislation to forbid any Internet-connected device from having default login credentials," he writes. This move will improve the Pi operating system's security. Before, even if you assigned a good password to the "pi" account, attackers could still assume with a reasonable degree of certainty that most Raspberry Pi boards were using the "pi" username. Many Pi OS-based operating systems also ship with the default "pi" user account enabled and are completely passwordless, requiring extra steps to assign the account a password in the first place. The flip side is that the change could break some software and scripts, particularly those that are hard-coded to use the "pi" user account and home folder. "[T]he Raspberry Pi OS now boots into a dedicated setup mode the first time you start it up instead of running the setup wizard as an app in the normal desktop environment," adds Ars. "And that setup wizard now prompts you to create a username and password rather than simply assigning a password to the default 'pi' user account. To aid with setup, the wizard can now pair Bluetooth keyboards and mice without requiring you to plug in a USB accessory first." The new version of the Pi OS also includes experimental support for the Wayland display server protocol, but Long says most people should ignore it for now since it's explicitly labeled as "experimental."' -- source: https://hardware.slashdot.org/story/22/04/08/2032252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Plans To Drop Support For Legacy BIOS Systems
by Peter Reutemann 08 Apr '22

08 Apr '22

'The Fedora 37 development team is considering dropping support for non-UEFI BIOS. Linuxiac reports: The Unified Extensible Firmware Interface, or UEFI, is a modern method of handling the boot process. UEFI is similar to Legacy; however, the boot data is stored in a .efi file rather than the firmware. In the case of Fedora, while the change may take some time, the new Fedora x86_64 installations will no longer work on non-UEFI platforms. On x86_64 architectures, Fedora 37 will mark legacy BIOS installation as deprecated in favor of UEFI. While systems already using Legacy BIOS to boot will continue to be supported, new Legacy BIOS installations on these architectures will be impossible. ' -- source: https://linux.slashdot.org/story/22/04/07/2049257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese Hackers Abuse VLC Media Player To Launch Malware Loader
by Peter Reutemann 08 Apr '22

08 Apr '22

'Security researchers have uncovered a long-running malicious campaign from hackers associated with the Chinese government who are using VLC Media Player to launch a custom malware loader. BleepingComputer reports: The campaign appears to serve espionage purposes and has targeted various entities involved in government, legal, and religious activities, as well as non-governmental organizations (NGOs) on at least three continents. This activity has been attributed to a threat actor tracked as Cicada (a.k.a. menuPass, Stone Panda, Potassium, APT10, Red Apollo) that has been active for more than 15 years, since at least 2006. Brigid O Gorman of Symantec Threat Hunter Team told BleepingComputer that the attacker uses a clean version of VLC with a malicious DLL file in the same path as the media player's export functions. The technique is known as DLL side-loading and it is widely used by threat actors to load malware into legitimate processes to hide the malicious activity. Apart from the custom loader, which O Gorman said Symantec does not have a name but has been seen in previous attacks attributed to Cicada/APT10, the adversary also deployed a WinVNC server to gain remote control over victim systems. The attacker also executed the Sodamaster backdoor on compromised networks, a tool believed to be used exclusively by the Cicada threat group since at least 2020. Sodamaster runs in the system memory (fileless) and is equipped to evade detection by looking in the registry for clues of a sandbox environment or by delaying its execution. The malware can also collect details about the system, search for running processes, and download and execute various payloads from the command and control server. [...] The attackers' dwell time on the networks of some of the discovered victims lasted for as long as nine months, the researchers note in a report today. ' -- source: https://it.slashdot.org/story/22/04/06/2144218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

disable "Pocket" in Firefox
by Peter Reutemann 08 Apr '22

08 Apr '22

Hi everyone If you find that "Pocket" in Firefox is getting in your way or you simply don't want to use it, just do the following to disable it: - in the URL bar, type about:config (and click on "show all") - and toggle "extensions.pocket.enabled" to "false" >From here: https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zyxel patches critical vulnerability that can allow Firewall and VPN hijacks
by Peter Reutemann 05 Apr '22

05 Apr '22

'Hardware manufacturer Zyxel has issued patches for a highly critical security flaw that gives malicious hackers the ability to take control of a wide range of firewalls and VPN products the company sells to businesses. The flaw is an authentication bypass vulnerability that stems from a lack of a proper access-control mechanism in the CGI (common gateway interface) of affected devices, the company said. Access control refers to a set of policies that rely on passwords and other forms of authentication to ensure resources or data are available only to authorized people. The vulnerability is tracked as CVE-2022-0342. “The flaw could allow an attacker to bypass the authentication and obtain administrative access of the device,” Zyxel said in an advisory. The severity rating is 9.8 out of a possible 10.' -- source: https://arstechnica.com/information-technology/2022/04/zyxel-patches-critic… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Infinite Mac' Project Lets You Boot Up Mac OS In Your Browser
by Peter Reutemann 03 Apr '22

03 Apr '22

'Ars Technica: What makes the ["Infinite Mac"] project unique isn't necessarily the fact that it's browser-based; it has been possible to run old DOS, Windows, and Mac OS versions in browser windows for quite a while now. Instead, it's the creative solutions that developer Mihai Parparita has come up with to enable persistent storage, fast download speeds, reduced processor usage, and file transfers between the classic Mac and whatever host system you're running it on. Parparita details some of his work in this blog post. Beginning with a late 2017 browser-based port of the Basilisk II emulator, Parparita wanted to install old apps to more faithfully re-create the experience of using an old Mac, but he wanted to do it without requiring huge downloads or running as a separate program as the Macintosh.js project does. To solve the download problem, Parparita compressed the disk image and broke it up into 256K chunks that are downloaded on demand rather than up front. "Along with some old fashioned web optimizations, this makes the emulator show the Mac's boot screen in a second and be fully booted in 3 seconds, even with a cold HTTP cache," Parparita wrote. CPU usage was another issue. Old operating systems and processors didn't really distinguish between active and idle processor states -- your computer was either on or off. So when you emulate these old systems, they'll ramp one of your CPU cores to 100% whether you're actually using the emulator or not. Parparita used existing Basilisk II features to reduce CPU usage, only requiring full performance when "there was user input or a screen refresh was required." Infinite Mac won't run later releases of classic Mac OS (including 8.5, 8.6, and 9) because those releases ran exclusively on PowerPC Macs, dropping support for the old Motorola 68000-based processors. Emulators like QEMU are capable of emulating PowerPC Macs, but (at least as far as I am aware) there are no easy browser-based implementations that exist. Not yet, anyway.' -- source: https://apple.slashdot.org/story/22/04/01/2032251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

StarFive VisionFive RISC-V Single Board Computer
by Lawrence D'Oliveiro 29 Mar '22

29 Mar '22

A few videos have appeared on YouTube in the last few days about this VisionFive board. Instead of an ARM chip, it uses a RISC-V CPU, but of course it runs Linux. It’s quite clearly gunning for the Raspberry π market, both in its configuration and pricewise, though I don’t think it’s as powerful as a π 4. StarFive Technology have a few quite technical-looking videos on their channel, seemingly going into details like how the OS boots. I’ll see if I can find a decent hands-on review.

1 0

Mozilla To Offer MDN Premium Tier
by Lawrence D'Oliveiro 28 Mar '22

28 Mar '22

The Mozilla Developer Network <https://developer.mozilla.org/en-US/docs/Web> is a really good resource if you’re doing any kind of web development. I’ve found all kinds of well-explained technical detail there that is simply missing from other sources (*cough* w3schools *cough*). Now Mozilla is trying to get some money from it. They’re not taking anything away from existing access, they are merely offering extra personalization features on a paid basis <https://www.theregister.com/2022/03/24/mozillas_mdn_subscription/>.

1 0

'Rolling Rhino' Tool Converts Ubuntu Into a Rolling Release
by Peter Reutemann 28 Mar '22

28 Mar '22

'"Rolling Rhino is a tool long ago created by Martin Wimpress, who until recently was part of the Canonical team," one Linux blog pointed out recently. "What it does is basically change the repositories of the DailyLive developers...." Neowin sees it as a competitive advantage. After more than 17 years, there's a way to get a Ubuntu distro offering the same "rolling" release cycles that helped popularize Arch Linux: While there are many positive qualities that would draw a user into the world of Arch, its headlining feature would be the one that remains the most relevant in today's world of continuous integration and delivery and that's its rolling release strategy. While I don't think Judd Vinet could have predicted the proliferation of DevOps or the massive shift to cloud computing, it must be interesting to see that the entire industry is following the Arch strategy in all sorts of different places. One could even argue that Microsoft Windows has become a rolling release. While many of Arch's contemporaries have joined the fray, one notable open-source giant has yet to make the leap. Rolling Rhino looks to change that by converting Ubuntu into a rolling release.' -- source: https://news.slashdot.org/story/22/03/27/0035232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE's New Swipe Gesture Makes Windows 11 Look Bad
by Peter Reutemann 28 Mar '22

28 Mar '22

'"Microsoft has been struggling to reach a state of convergence between tablet and desktop ever since Windows 8 and the original Surface," argues Neowin, adding "If we're using Windows 11 as a barometer of their progress, they'll likely never get there...." But meanwhile, writes Slashdot reader segaboy81, "KDE's new swipe gesture is awesome. It's about 1000% smoother than the overview in Windows 11 and the swiping mechanism is easier, too. Is KDE getting better for tablets?" >From Neowin's report: Starting in KDE Plasma 5.25, users with touch screen devices will be able to enter their tasks and virtual desktops overview by simply swiping down from the top edge, but with a special twist. The scale of the windows directly follows the path of your finger. The result is every bit as fluid as you might imagine. While you can achieve the same result in Windows 11 with a simple three-finger swipe up, this implementation looks great and performs great too.' -- source: https://tech.slashdot.org/story/22/03/27/201245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Is Reverse-Engineering Support For Apple Silicon, Including M1 Ultra
by Peter Reutemann 27 Mar '22

27 Mar '22

'Ars Technica: For months, a small group of volunteers has worked to get this Arch Linux-based distribution up and running on Apple Silicon Macs, adapting existing drivers and (in the case of the GPU) painstakingly writing their own. And that work is paying off -- last week, the team released its first alpha installer to the general public, and as of yesterday, the software supports the new M1 Ultra in the Mac Studio. In the current alpha, an impressive list of hardware already works, including Wi-Fi, USB 2.0 over the Thunderbolt ports (USB 3.0 only works on Macs with USB-A ports, but USB 3.0 over Thunderbolt is "coming soon"), and the built-in display. But there are still big features missing, including DisplayPort and Thunderbolt, the webcam, Bluetooth, sleep mode, and GPU acceleration. That said, regarding GPU acceleration, the developers say that the M1 is fast enough that a software-rendered Linux desktop feels faster on the M1 than a GPU-accelerated desktop feels on many other ARM chips. Asahi's developers don't think the software will be "done," with all basic M1-series hardware and functionality supported and working out of the box, "for another year, maybe two." By then, Apple will probably have introduced another generation or two of M-series chips. But the developers are optimistic that much of the work they're doing now will continue to work on future generations of Apple hardware with relatively minimal effort. [...] If you want to try Asahi Linux on an M1 Mac, the current installer is run from the command line and requires "at least 53GB of free space" for an install with a KDE Plasma desktop. Asahi only needs about 15GB, but the installer requires you to leave at least 38GB of free space to the macOS install so that macOS system updates don't break. From there, dual-booting should work similarly to the process on Intel Macs, with the alternate OS visible from within Startup Disk or the boot picker you can launch when your start your Mac. Future updates should be installable from within your new Asahi Linux installation and shouldn't require you to reinstall from scratch.' -- source: https://linux.slashdot.org/story/22/03/25/2333245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ted Nelson Quote From 1995
by Lawrence D'Oliveiro 26 Mar '22

26 Mar '22

I was prompted to browse through old scanned issues of “Byte” magazine (available from vintageapple.org) after watching a YouTube video by a guy who has collected a complete set of actual paper issues <https://www.youtube.com/watch?v=0lU537upx3c>. In the November 1995 issue, there was a back-page column by Ted Nelson (originator of the terms “hypertext” and “hypermedia”) called “Things To Come”, where he casually threw out a bunch of prognostications on how he thought computing would develop. I was struck by this quote, under the title “Tomorrow’s killer applications”: My hope is that there will be no more applications, because future software will be set up to be tied together, piped together, scripted together. I would say that has partially come true. We have a lot of software components now that can be reused via scriptable APIs, or even just shell scripts. However, nobody considered that such usage is the anithesis of how GUIs work. Most of the predictions in the rest of the column were, shall we say, a bit wide of the mark. For example, the next sentence after the above was “The real killer applications will be nanotech bugs that escape”, which is perhaps best left to just lie there quietly ...

1 0

topic for next wlug meeting?
by Peter Reutemann 25 Mar '22

25 Mar '22

Hi everyone At this stage, we don't have a speaker lined up for this month's virtual meeting (we're still at the Red traffic light). With the current world situation and increasing cyber security threats, I was wondering whether we should have a meeting where we discuss together (and showcase) various tools that we can run or use to make our online life safer. A non-exhaustive list: firewalls, virus scanners, rootkit detectors, VPNs. Thoughts? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Two Years After Chrome and Edge, Firefox is Getting AV1 Hardware Acceleration
by Peter Reutemann 24 Mar '22

24 Mar '22

'Firefox is finally gaining proper AV1 support. Neowin reports: According to an update made to a post on Bugzilla, the Mozilla Foundation is finally ready to add hardware acceleration for the AV1 video format. Developers plan to implement improved AV1 support in the upcoming release of Firefox 100, scheduled to arrive on May 3, 2022. Hardware acceleration for AV1 video brings several noticeable benefits to customers. The standard developed by Alliance for Open Media and initially released in March 2018 offers better video compression than H.264 (about 50%) and VP9 (about 20%). Shifting AV1 video processing from software to hardware improves efficiency and reduces energy consumption, resulting in better battery life on tablets and laptops. Google and Microsoft announced hardware-accelerated AV1 video in Chrome and Edge in late 2020. Mozilla, on the other hand, did not rush to introduce improved AV1 support in Firefox. While it is easy to dunk on Firefox, there is a reason why developers took their time. Hardware-accelerated AV1 video is not something you can add to any computer with Windows 10, and it requires a PC with the most recent and powerful hardware.' -- source: https://news.slashdot.org/story/22/03/23/1359219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's Messages, Dialer Apps Quietly Sent Text, Call Info To Google
by Peter Reutemann 23 Mar '22

23 Mar '22

'Google's Messages and Dialer apps for Android devices have been collecting and sending data to Google without specific notice and consent, and without offering the opportunity to opt-out, potentially in violation of Europe's data protection law. From a report: According to a research paper, "What Data Do The Google Dialer and Messages Apps On Android Send to Google?" [PDF], by Trinity College Dublin computer science professor Douglas Leith, Google Messages (for text messaging) and Google Dialer (for phone calls) have been sending data about user communications to the Google Play Services Clearcut logger service and to Google's Firebase Analytics service. "The data sent by Google Messages includes a hash of the message text, allowing linking of sender and receiver in a message exchange," the paper says. "The data sent by Google Dialer includes the call time and duration, again allowing linking of the two handsets engaged in a phone call. Phone numbers are also sent to Google." The timing and duration of other user interactions with these apps has also been transmitted to Google. And Google offers no way to opt-out of this data collection. [...] Both pre-installed versions of these apps, the paper observes, lack app-specific privacy policies that explain what data gets collected -- something Google requires from third-party developers. And when a request was made through Google Takeout for the Google Account data associated with the apps used for testing, the data Google provided did not include the telemetry data observed.' -- source: https://yro.slashdot.org/story/22/03/22/2146234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Random Number Generator Sees Major Improvements
by Peter Reutemann 22 Mar '22

22 Mar '22

'An anonymous Slashdot reader summarizes some important news from the web page of Jason Donenfeld (creator of the open-source VPN protocol WireGuard): The Linux kernel's random number generator has seen its first set of major improvements in over a decade, improving everything from the cryptography to the interface used. Not only does it finally retire SHA-1 in favor of BLAKE2s [in Linux kernel 5.17], but it also at long last unites '/dev/random' and '/dev/urandom' [in the upcoming Linux kernel 5.18], finally ending years of Slashdot banter and debate: The most significant outward-facing change is that /dev/random and /dev/urandom are now exactly the same thing, with no differences between them at all, thanks to their unification in random: block in /dev/urandom. This removes a significant age-old crypto footgun, already accomplished by other operating systems eons ago. [...] The upshot is that every Internet message board disagreement on /dev/random versus /dev/urandom has now been resolved by making everybody simultaneously right! Now, for the first time, these are both the right choice to make, in addition to getrandom(0); they all return the same bytes with the same semantics. There are only right choices. Phoronix adds: One exciting change to also note is the getrandom() system call may be a hell of a lot faster with the new kernel. The getrandom() call for obtaining random bytes is yielding much faster performance with the latest code in development. Intel's kernel test robot is seeing an 8450% improvement with the stress-ng getrandom() benchmark. Yes, an 8450% improvement.' -- source: https://linux.slashdot.org/story/22/03/19/1821254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

KDE Konsole Shows Colours!
by Lawrence D'Oliveiro 22 Mar '22

22 Mar '22

I noticed this happening in my Konsole terminal windows very occasionally over the last couple of months: a little coloured square with a black border would momentarily appear, then disappear when I moved the mouse. I never quite figured out what was going on, thought it was a window manager glitch or something ... until today. It appears Konsole has this (undocumented?) feature where, if you hover over the name of a colour in a terminal session, it will helpfully pop up this square showing what the colour looks like. The colour names come from the traditional X11 set in /usr/share/X11/rgb.txt, with limits: it only looks at single-word names, and does not match names with numeric suffixes. Thus, “darkmagenta” will work (case-insensitive match against “DarkMagenta”), while “dark magenta” only matches the “magenta” part, and “magenta1” is not recognized at all. It will also recognize a sequence of 3 or 6 hex digits preceded by “#” -- “#rgb” or “#rrggbb”, as commonly used in HTML. Just tried 8 hex digits -- “#rrggbbaa” with alpha transparency -- and that works too. This feature might be new in Konsole 21.08 or something.

1 0

Browser-in-the-Browser Attack Can Trick Even Savvy Users
by Peter Reutemann 22 Mar '22

22 Mar '22

'Ars Technica: Hundreds of thousands of sites use the OAuth protocol to let visitors login using their existing accounts with companies like Google, Facebook, or Apple. Instead of having to create an account on the new site, visitors can use an account that they already have -- and the magic of OAuth does the rest. The Browser-in-the-Browser (BitB) technique capitalizes on this scheme. Instead of opening a genuine second browser window that's connected to the site facilitating the login or payment, BitB uses a series of HTML and cascading style sheets (CSS) tricks to convincingly spoof the second window. The URL that appears there can show a valid address, complete with a padlock and HTTPS prefix. The layout and behavior of the window appear identical to the real thing. While the method is convincing, it has a few weaknesses that should give savvy visitors a foolproof way to detect that something is amiss. Genuine OAuth or payment windows are in fact separate browser instances that are distinct from the primary page. That means a user can resize them and move them anywhere on the monitor, including outside the primary window. BitB windows, by contrast, aren't a separate browser instance at all. Instead, they're images rendered by custom HTML and CSS and contained in the primary window. That means the fake pages can't be resized, fully maximized or dragged outside the primary window. All users should protect their accounts with two-factor authentication. One other thing more experienced users can do is right click on the popup page and choose "inspect." If the window is a BitB spawn, its URL will be hardcoded into the HTML. ' -- source: https://it.slashdot.org/story/22/03/21/236242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A big bet to kill the password for good
by Peter Reutemann 21 Mar '22

21 Mar '22

'After years of tantalizing hints that a passwordless future is just around the corner, you're probably still not feeling any closer to that digital unshackling. Ten years into working on the issue, though, the FIDO Alliance, an industry association that specifically works on secure authentication, thinks it has finally identified the missing piece of the puzzle. On Thursday, the organization published a white paper that lays out FIDO's vision for solving the usability issues that have dogged passwordless features and, seemingly, kept them from achieving broad adoption. FIDO's members collaborated to produce the paper, and they span chipmakers like Intel and Qualcomm, prominent platform developers like Amazon and Meta, financial institutions like American Express and Bank of America, and the developers of all major operating systems—Google, Microsoft, and Apple. The paper is conceptual, not technical, but after years of investment to integrate what are known as the FIDO2 and WebAuthn passwordless standards into Windows, Android, iOS, and more, everything is now riding on the success of this next step.' -- source: https://arstechnica.com/information-technology/2022/03/a-big-bet-to-kill-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trickbot is using MikroTik routers to ply its trade. Now we know why
by Peter Reutemann 18 Mar '22

18 Mar '22

'For years, malicious hackers have been hacking large fleets of MikroTik routers and conscripting them into Trickbot, one of the Internet’s most destructive botnets. Now, Microsoft has finally figured out why and how the routers are being put to use. Trickbot came to light in 2016 as a trojan for stealing account passwords for use in bank fraud. Since then, Trickbot has mushroomed into one of the Internet's most aggressive threat platforms, thanks to its highly modular, multistage malware framework that provides a full suite of tools that are used to install ransomware and other forms of malware from other hacking groups. The malware driving Trickbot is notable for its advanced capabilities. It excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks, and performing reconnaissance that identifies infected computers belonging to high-value targets. The malware often uses readily available software like Mimikatz or exploits like EternalBlue, which was stolen from the National Security Agency.' -- source: https://arstechnica.com/information-technology/2022/03/trickbot-is-using-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher uses Dirty Pipe exploit to fully root a Pixel 6 Pro and Samsung S22
by Peter Reutemann 17 Mar '22

17 Mar '22

'A researcher has successfully used the critical Dirty Pipe vulnerability in Linux to fully root two models of Android phones—a Pixel 6 Pro and Samsung S22—in a hack that demonstrates the power of exploiting the newly discovered OS flaw. The researcher chose those two handset models for a good reason: they are two of the few—if not the only—devices known to run Android version 5.10.43, the only release of Google's mobile OS that's vulnerable to Dirty Pipe. Because the LPE, or local privilege escalation, vulnerability wasn't introduced until the recently released version 5.8 of the Linux kernel, the universe of exploitable devices—whether mobile, Internet of Things, or servers and desktops—is relatively small.' -- source: https://arstechnica.com/information-technology/2022/03/researcher-uses-dirt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nasty Linux Netfilter Firewall Security Hole Found
by Peter Reutemann 16 Mar '22

16 Mar '22

'Sophos threat researcher Nick Gregory discovered a hole in Linux's netfilter firewall program that's "exploitable to achieve kernel code execution (via ROP [return-oriented programming]), giving full local privilege escalation, container escape, whatever you want." ZDNet reports: Behind almost all Linux firewalls tools such as iptables; its newer version, nftables; firewalld; and ufw, is netfilter, which controls access to and from Linux's network stack. It's an essential Linux security program, so when a security hole is found in it, it's a big deal. [...] This problem exists because netfilter doesn't handle its hardware offload feature correctly. A local, unprivileged attacker can use this to cause a denial-of-service (DoS), execute arbitrary code, and cause general mayhem. Adding insult to injury, this works even if the hardware being attacked doesn't have offload functionality! That's because, as Gregory wrote to a security list, "Despite being in code dealing with hardware offload, this is reachable when targeting network devices that don't have offload functionality (e.g. lo) as the bug is triggered before the rule creation fails." This vulnerability is present in the Linux kernel versions 5.4 through 5.6.10. It's listed as Common Vulnerabilities and Exposures (CVE-2022-25636), and with a Common Vulnerability Scoring System (CVSS) score of 7.8), this is a real badie. How bad? In its advisory, Red Hat said, "This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a privilege escalation threat." So, yes, this is bad. Worse still, it affects recent major distribution releases such as Red Hat Enterprise Linux (RHEL) 8.x; Debian Bullseye; Ubuntu Linux, and SUSE Linux Enterprise 15.3. While the Linux kernel netfilter patch has been made, the patch isn't available yet in all distribution releases. ' -- source: https://linux.slashdot.org/story/22/03/15/221258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A brief tour of the PDP-11, the most influential minicomputer of all time
by Peter Reutemann 15 Mar '22

15 Mar '22

'The history of computing could arguably be divided into three eras: that of mainframes, minicomputers, and microcomputers. Minicomputers provided an important bridge between the first mainframes and the ubiquitous micros of today. This is the story of the PDP-11, the most influential and successful minicomputer ever. In their moment, minicomputers were used in a variety of applications. They served as communications controllers, instrument controllers, large system pre-processors, desk calculators, and real-time data acquisition handlers. But they also laid the foundation for significant hardware architecture advances and contributed greatly to modern operating systems, programming languages, and interactive computing as we know them today. In today’s world of computing, in which every computer runs some variant of Windows, Mac, or Linux, it’s hard to distinguish between the CPUs underneath the operating system. But there was a time when differences in CPU architecture were a big deal. The PDP-11 helps explain why that was the case. The PDP-11 was introduced in 1970, a time when most computing was done on expensive GE, CDC, and IBM mainframes that few people had access to. There were no laptops, desktops, or personal computers. Programming was done by only a few companies, mostly in assembly, COBOL, and FORTRAN. Input was done on punched cards, and programs ran in non-interactive batch runs.' -- source: https://arstechnica.com/gadgets/2022/03/a-brief-tour-of-the-pdp-11-the-most… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Researcher uses 379-year-old algorithm to crack crypto keys found in the wild
by Peter Reutemann 15 Mar '22

15 Mar '22

'Cryptographic keys generated with older software now owned by technology company Rambus are weak enough to be broken instantly using commodity hardware, a researcher reported on Monday. This revelation is part of an investigation that also uncovered a handful of weak keys in the wild. The software comes from a basic version of the SafeZone Crypto Libraries, which were developed by a company called Inside Secure and acquired by Rambus as part of its 2019 acquisition of Verimatrix, a Rambus representative said. That version was deprecated prior to the acquisition and is distinct from a FIPS-certified version that the company now sells under the Rambus FIPS Security Toolkit brand. Researcher Hanno Böck said that the vulnerable SafeZone library doesn't sufficiently randomize the two prime numbers it used to generate RSA keys. (These keys can be used to secure Web traffic, shells, and other online connections.) Instead, after the SafeZone tool selects one prime number, it chooses a prime in close proximity as the second one needed to form the key. "The problem is that both primes are too similar," Böck said in an interview. "So the difference between the two primes is really small." The SafeZone vulnerability is tracked as CVE-2022-26320. Cryptographers have long known that RSA keys that are generated with primes that are too close together can be trivially broken with Fermat's factorization method. French mathematician Pierre de Fermat first described this method in 1643.' -- source: https://arstechnica.com/information-technology/2022/03/researcher-uses-600-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Finds Bug In AMD's Spectre Mitigation, AMD Issues Fix
by Peter Reutemann 14 Mar '22

14 Mar '22

'"News of a fresh Spectre BHB vulnerability that only impacts Intel and Arm processors emerged this week," reports Tom's Hardware, "but Intel's research around these new attack vectors unearthed another issue. "One of the patches that AMD has used to fix the Spectre vulnerabilities has been broken since 2018." Intel's security team, STORM, found the issue with AMD's mitigation. In response, AMD has issued a security bulletin and updated its guidance to recommend using an alternative method to mitigate the Spectre vulnerabilities, thus repairing the issue anew.... Intel's research into AMD's Spectre fix begins in a roundabout way — Intel's processors were recently found to still be susceptible to Spectre v2-based attacks via a new Branch History Injection variant, this despite the company's use of the Enhanced Indirect Branch Restricted Speculation (eIBRS) and/or Retpoline mitigations that were thought to prevent further attacks. In need of a newer Spectre mitigation approach to patch the far-flung issue, Intel turned to studying alternative mitigation techniques. There are several other options, but all entail varying levels of performance tradeoffs. Intel says its ecosystem partners asked the company to consider using AMD's LFENCE/JMP technique. The "LFENCE/JMP" mitigation is a Retpoline alternative commonly referred to as "AMD's Retpoline." As a result of Intel's investigation, the company discovered that the mitigation AMD has used since 2018 to patch the Spectre vulnerabilities isn't sufficient — the chips are still vulnerable. The issue impacts nearly every modern AMD processor spanning almost the entire Ryzen family for desktop PCs and laptops (second-gen to current-gen) and the EPYC family of datacenter chips.... In response to the STORM team's discovery and paper, AMD issued a security bulletin (AMD-SB-1026) that states it isn't aware of any currently active exploits using the method described in the paper. AMD also instructs its customers to switch to using "one of the other published mitigations (V2-1 aka 'generic retpoline' or V2-4 aka 'IBRS')." The company also published updated Spectre mitigation guidance reflecting those changes [PDF].... AMD's security bulletin thanks Intel's STORM team by name and noted it engaged in the coordinated vulnerability disclosure, thus allowing AMD enough time to address the issue before making it known to the public. ' -- source: https://hardware.slashdot.org/story/22/03/13/200224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Copper Lines To Be Cut Starting September
by Lawrence D'Oliveiro 14 Mar '22

14 Mar '22

First I heard about it today, but it’s the beginning of the end for copper phone lines; Chorus is going to cut off a few installations (“fewer than 5000”) on a trial basis later this year <https://www.stuff.co.nz/business/124317060/first-copper-phone-services-to-b…>: Chorus chief executive Jean-Baptiste Rousselot said that outside of those “limited initial trial areas” no-one should feel under any pressure to move off copper. This will only happen in areas where the takeup of fibre is already high, and customers will get six months’ notice.

1 0

Arch Linux Turns 20
by Peter Reutemann 13 Mar '22

13 Mar '22

'"Arch Linux, the rolling Linux distribution that powers Valve's Steam Deck is now 20 years old," reports Neowin. Slashdot reader segaboy81 writes that "What's cool to see here is that everything changed behind the scenes, but on the surface, things are the same." From the article: Announced on March 11th, 2002, and codenamed Homer, version 0.1 was released to minor fanfare. The release notes were a far cry from today's, essentially announcing it had broken ground and the foundation was going in, as it were. Homer's release notes: I've finally got a bootable iso image on the ftp site. The bad news is that you don't get a pretty interactive installer. But if you wanted one of those, you would have gone with RedHat, right? ;) I'll try to get the docs up for ABS (Arch Build System) which, IMHO, is one of the best advantages of Arch. With ABS, you can easily create new packages, and it's trivial to rebuild existing packages with your own customizations.... It shipped with Linux kernel 2.4.18 which many of the Linux old-timers (myself included) will remember was right before we started to get nice things like auto-mounting USB drives in kernel 2.6. XFree86 4.2.0 was also in stow, which is what we now call Xorg. If you wanted to build software, you had to use an absolutely ancient gcc toolchain (2.95.3). Web browsing was covered by the ghost of Netscape Navigator, Mozilla 0.9.9. Heady days, these were!' -- source: https://linux.slashdot.org/story/22/03/12/0251257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Brave takes on the creepy websites that override your privacy settings
by Peter Reutemann 10 Mar '22

10 Mar '22

'Some websites just can't take "no" for an answer. Instead of respecting visitors' choice to block third-party cookies—the identifiers that track browsing activity as a user moves from site to site—they find sneaky ways to bypass those settings. Now, makers of the Brave browser are taking action. Earlier this week, Brave Nightly—the testing and development version of the browser—rolled out a feature that's designed to prevent what's known as bounce tracking. The new feature, known as unlinkable bouncing, will roll out for general release in Brave version 1.37 slated for March 29.' -- source: https://arstechnica.com/information-technology/2022/03/brave-has-a-plan-to-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Launch review: Linux-friendly keyboard with a USB hub
by Peter Reutemann 09 Mar '22

09 Mar '22

'The Launch is System76's first mechanical keyboard, but it could be the last keyboard you need. With hot-swappable mechanical switches, legends that won't fade, a durable build, and a pair of detachable cables, this tenkeyless board can evolve with you. It's also open source—from its chassis to its PCB and firmware—allowing for deeper tinkering. There are even some extra keycaps for when you want a new look. And in true System76 style, the board favors Linux users. At $285, though, the Launch is a big investment, and many won't like how hard it is to press the keys. The clicky mechanical switches are so tactile that they'll tire some fingers out.' -- source: https://arstechnica.com/gadgets/2022/03/system76-launch-review-linux-friend… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Zone Grinds Away At Patent Trolls
by Peter Reutemann 09 Mar '22

09 Mar '22

'For the last two years, Unified Patents, an international organization of over 200 businesses, has been winning the battle against patent trolls "to keep them from stealing from the companies and organizations that actually use patents' intellectual property (IP)," writes ZDNet's Steven Vaughan Nichols. "This is their story to date." From the report: Unified Patents brings the fight to the trolls. It deters patent trolls from attacking its members by making it too expensive for the troll to win. The group does this by examining troll patents and their activities in various technology sectors (Zones). The United Patents Open Source Software Zone (OSS Zone) is the newest of these Zones. [...] Even before OSS Zone was formally launched, Unified Patents along with the Open Invention Network (OIN), the world's largest patent non-aggression group, launched legal cases against poor quality PAE-owned (Patent Assertion Entities) patents. The Linux Foundation and Microsoft have also joined the OSS Zone to battle these bad patents. [...] Together, United Patents uses open-source software evidence as proof to establish that the trolls often don't have a case. This is done using Inter Partes Review (IPR), a 2012 legal tool for showing that a bad patent never should have been granted in the first place. [Linux Foundation Executive Director Jim Zemlin] notes, "The Patent Trial and Appeal Board (PTAB)'s discretionary rulings on IPRs have changed the landscape around NPEs. These cases take a long time to be resolved. Typically, it takes from 12 to 24 months. That also makes them expensive for both the OSS Zone and the trolls. Keith Bergelt, the OIN's CEO, said "In other technology areas when patents go through the IPR process or are reexamined, there is a settlement around 20% of the time. In the OSS Zone, there are few settlements. This makes it more costly and difficult to administer, but also is difficult on the PAEs. When the success rate against their patents is over 95%, certain PAEs that would otherwise hope to settle have essentially given up on defending their patents." Still, with such a high success rate, it's worth the expense. To date, Unified has overseen and managed 43 challenges. Of these, 12 patents were found invalid, another 23 cases have been instituted, and six are still in process. This has led to multiple settlements for Unified Patents members. These, in turn directly pass through to OIN's 3,600+ community members. For example, an Accelerated Memory Tech patent 6,513,062, was used by the troll IP Investments Group to claim that the open-source Redis, which manages cache resources on the cloud, violated the patent. Redis, not having any money, IP Investments Group instead went after Hulu, Citrix Systems, Barracuda Networks, Kemp Technologies, and F5 Networks for their use of Redis software. IP Investments Group gave up rather than fighting it out. Everyone who uses Redis wins. It's one small victory, but that's how the patent troll wars are won. And, with the United Patents' high-success rate in knocking out bad patents, slowly but surely the patent trolls are being driven back from not only open-source software but all software. ' -- source: https://yro.slashdot.org/story/22/03/07/235211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has Been Bitten By Its Most High-Severity Vulnerability in Years
by Peter Reutemann 09 Mar '22

09 Mar '22

'Ars Technica is reporting a major new vulnerability in Linux. Named "Dirty Pipeline" it involves abuse of 'pipes' at the shell level as you might guess. The name Dirty Pipe is meant to both signal similarities to Dirty Cow and provide clues about the new vulnerability's origins. "Pipe" refers to a pipeline, a Linux mechanism for one OS process to send data to another process. In essence, a pipeline is two or more processes that are chained together so that the output text of one process (stdout) is passed directly as input (stdin) to the next one. Tracked as CVE-2022-0847, the vulnerability came to light when a researcher for website builder CM4all was troubleshooting a series of corrupted files that kept appearing on a customer's Linux machine. After months of analysis, the researcher finally found that the customer's corrupted files were the result of a bug in the Linux kernel. ' -- source: https://it.slashdot.org/story/22/03/08/1524203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Free Software Foundation Appoints a New Executive Director
by Peter Reutemann 06 Mar '22

06 Mar '22

'The Free Software Foundation announced its new executive director this week. Back in 2010 John Sullivan had become the Free Software Foundation's previous executive director, but last year after more than 11 years he'd decided to resign. Taking his place will be the FSF's program manager for the last three years, who writes in a new blog post: The past three years working at the FSF as program manager have been educational and motivational. They have reinforced my belief that what we do is important, and that our goal to give the four freedoms to all computer users continues to be crucial. The work we do reminds people to recognize the power they have to demand change. This change will help free their own digital lives, and their loved ones'. I am grateful to John Sullivan for his leadership and support. His legacy of nineteen years will be hard to live up to, and I look forward to working with him, the FSF board, and the staff on this transition.... We will continue our unwavering focus on our mission, especially working to increase understanding and adoption of copyleft, and bringing new people into the movement by communicating the necessity of the four freedoms. In the short term, we're focused on making the upcoming LibrePlanet conference [March 19-20] the best online edition yet for you. After that, I plan to reach out and ask for your thoughts and ideas on what else the FSF can do this year and beyond to advance the cause of user freedom. As a free software activist, like many of you, each day, I am presented with almost innumerable choices between freedom and convenience, and each day I choose freedom wherever I can. I have learned to do this by questioning my tools, by joining this community, and by learning more and more about the ways that I can stand up for myself. If I can do that, I firmly believe we can reach anyone. I hope that you'll join me in rejecting the ways that Big Tech tries to deprive us of our freedoms, and to help set a positive example for computer users around the globe. In freedom, Zoë Kooyman Executive Director >From the FSF's announcement: Kooyman assumes the executive director role following a series of recent steps taken to make the non-profit's governance and board recruitment practices more transparent and participatory, including a new community engagement process that empowers associate members of the FSF to nominate and evaluate candidates for the board of directors for the first time in the organization's 37-year history. "I want to learn from the community, and will focus on relationship building, and on strengthening the free software movement together," Kooyman said. "Our immediate priority is to convene another successful LibrePlanet conference on March 19 and 20, bringing community activists, domain experts, and other users together to discuss current issues in technology and ethics. With the current and future threats users face, it's critical that we spread the free software message wider than ever before and that we help people understand the steps they can take to defend our user rights and freedom."' -- source: https://news.slashdot.org/story/22/03/05/0550228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Raspberry Pi's 10th Anniversary, Eben Upton Ponders the Prospects for a RISC-V Pi
by Peter Reutemann 06 Mar '22

06 Mar '22

'On the 10th anniversary of the Raspberry Pi, the Register takes a look backwards — and forwards — in a new interview Eben Upton: As for the future, a Raspberry Pi 5 is inevitable but, in a blow to those hoping for something even more exotic than the usual Broadcom Arm SoC, RISC-V isn't on the cards, certainly not in the timeframe for the next generation of Pi. "I can't go out today and license a RISC-V core," says Upton, citing the current state of the ecosystem, "which is even as good as the core of the Raspberry Pi 4." "Hopefully I will in the future," he adds. The implosion of the Nvidia/Arm deal has also reduced the chances of a RISC-V Pi (in the 2030 timeframe), down from 20 per cent to 10 per cent, according to Upton. "The ownership of the core of the de-facto standard low-power architecture by an organisation that's also a player was potentially very destabilising... and it was always going to be to the benefit of the obvious alternative architecture." Upton answered questions from Slashdot's readers before the first boards were even ready in 2012. But he already knew that the device would be wildly popular. Upton tells the Register that months before, its Debian-based operating system got 50,000 downloads, "And all you could do was run it in QEMU (there was a QEMU config you could build that was similar enough to a Raspberry Pi). "50,000 people downloaded this really primitive operating system for a machine that you couldn't buy!"' -- source: https://news.slashdot.org/story/22/03/05/0151232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation's 'Census II' of Open Source Libraries Urges Support, Security, and Standardization
by Peter Reutemann 06 Mar '22

06 Mar '22

'"Much of the most widely used free and open source software is developed by only a handful of contributors," warns the Linux Foundation, in the executive summary for its massive new census of free and open source software application libraries. It was prepared in conjunction with Harvard's Laboratory for Innovation Science — and that's just one of its five high-level findings. The census also notes "the increasing importance of individual developer account security," but also the persistence of legacy software, the need for a standardized naming schema for software components, and "complexities" around package versions. But there's also just a lot of data about package popularity, writes SD Times: The report, Census II, is a follow-up to Census I, which was conducted in 2015 to identify the packages in Debian Linux that were most critical to the operation and security of the kernel. According to the Linux Foundation, Census II allows for a more "complete picture of free and open source (FOSS) adoption." "Understanding what FOSS packages are the most critical to society allows us to proactively support projects that warrant operations and security support," said Brian Behlendorf, executive director at Linux Foundation's Open Source Security Foundation (OpenSSF). The census "aggregates data from over half a million observations of FOSS libraries used in production applications at thousands of companies," according to its executive summary. It argues that preserving FOSS will require this kind of data-sharing (about where and how FOSS packages are being used ) as well as coordination — including standardizing terminology — and of course, investment. "The motivation behind publishing these findings is to not only inform, but also to inspire action by developers to improve their security practices and by end users to support the FOSS ecosystem and developers who need assistance." (It suggests companies companies could provide not just financial support but also the technical talent and their time.) The results take the form of eight Top 500 lists — four that include version numbers in the analysis and four that are version agnostic. Further, as mentioned above, we present npm and non-npm packages in separate lists... Although these lists provide valuable, important insights into the most widely used FOSS projects, it is important to also consider the level of security related to these projects. Therefore, in each list, we also include the "Tiered %" measure from the OpenSSF Best Practices Badging Program....' -- source: https://news.slashdot.org/story/22/03/05/0521219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bungie Rejects Steam Deck's Linux, Threatens To Ban Destiny 2 Players There
by Peter Reutemann 04 Mar '22

04 Mar '22

'The Verge: When will Bungie let Destiny 2 come to Valve's Steam Deck handheld gaming PC? It's looking like the answer is never -- because the soon-to-be Sony subsidiary has published a help page that not only says the game's unsupported, but outright threatens to ban prospective Steam Deck players (via Wario64). The help page has a new section titled "Steam Deck and Destiny 2," which reads: "Destiny 2 is not supported for play on the Steam Deck or on any system utilizing Steam Play's Proton unless Windows is installed and running. Players who attempt to launch Destiny 2 on the Steam Deck through SteamOS or Proton will be unable to enter the game and will be returned to their game library after a short time. Players who attempt to bypass Destiny 2 incompatibility will be met with a game ban." To be fair, Bungie isn't the only one to reject the Steam Deck without necessarily providing a satisfying explanation -- Epic Games CEO Tim Sweeney explained to me why Fortnite won't get updated for the Steam Deck last month, even though Epic's own Easy Anti-Cheat (EAC) claims game developers can enable it with "just a few clicks." And while both Apex Legends and Elden Ring now fully work on Deck despite using anti-cheat, it's also true that many other top multiplayer games have yet to fully arrive.' -- source: https://linux.slashdot.org/story/22/03/02/2153252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Play app downloaded more than 10,000 times contained data-stealing RAT
by Peter Reutemann 03 Mar '22

03 Mar '22

'A malicious app downloaded from Google Play more than 10,000 times surreptitiously installed a remote access trojan that stole users’ passwords, text messages, and other confidential data, a security firm reported. The trojan, which goes under the names TeaBot and Anatsa, came to light last May. It used streaming software and abused Android’s accessibility services in a way that allowed the malware creators to remotely view the screens of infected devices and interact with the operations the devices carried out. At the time, TeaBot was programmed to steal data from a predefined list of apps from about 60 banks around the world. On Tuesday, security firm Cleafy reported that TeaBot was back. This time, the trojan spread through a malicious app called QR Code & Barcode Scanner, which as the name suggested, allowed users to interact with QR codes and barcodes. The app had more than 10,000 installations before Cleafy researchers notified Google of the fraudulent activity and Google removed it.' -- source: https://arstechnica.com/information-technology/2022/03/google-play-app-drop… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Demand NVIDIA Open Source Their Drivers Or They Leak More Data
by Peter Reutemann 03 Mar '22

03 Mar '22

'VideoCardz: Hackers that infiltrated NVIDIA systems are now threatening to release more confidential information unless the company commits to open sourcing their drivers. It is unclear what the stolen data contains, but the group confirmed that there are 250GB of hardware related data in their possession. Furthermore, the group confirmed they have evaluated NVIDIA position, which means that NVIDIA is might trying to communicate with the group to prevent future leaks. The group has already published information on NVIDIA DLSS technology and upcoming architectures. Yesterday, Nvidia reportedly retaliated against the hacker group known as "Lapsus$" by sneaking back into the hacker's system and encrypting the stolen data. The group claimed that it had a backup of the data, though.' -- source: https://news.slashdot.org/story/22/03/02/2228207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fixing The Fiji-Tonga Cable
by Lawrence D'Oliveiro 02 Mar '22

02 Mar '22

Reconnecting Tonga’s sole Internet cable link (to Fiji) turned out to be a tricky job <https://www.theregister.com/2022/03/02/tonga_submarine_cable_reconnection_r…>. The cable was ripped in six different places, and a quarter-million-dollar repeater unit went missing altogether. 40km of existing cable was able to be recovered and reused, but another 50km of new cable was needed to complete the repair. Parts of the cable actually moved 5km closer to the volcano, courtesy of an earthquake and associated turbidity currents. Next step: fixing the connections between Tonga’s islands.

1 0

DDoSers are using a potent new method to deliver attacks of unthinkable size
by Peter Reutemann 02 Mar '22

02 Mar '22

'Last August, academic researchers discovered a potent new method for knocking sites offline: a fleet of misconfigured servers more than 100,000 strong that can amplify floods of junk data to once-unthinkable sizes. These attacks, in many cases, could result in an infinite routing loop that causes a self-perpetuating flood of traffic. Now, content-delivery network Akamai says attackers are exploiting the servers to target sites in the banking, travel, gaming, media, and web-hosting industries. These servers—known as middleboxes—are deployed by nation-states such as China to censor restricted content and by large organizations to block sites pushing porn, gambling, and pirated downloads. The servers fail to follow transmission control protocol specifications that require a three-way handshake—comprising an SYN packet sent by the client, a SYN+ACK response from the server, followed by a confirmation ACK packet from the client—before a connection is established. This handshake limits the TCP-based app from being abused as amplifiers because the ACK confirmation must come from the gaming company or other target rather than an attacker spoofing the target’s IP address. But given the need to handle asymmetric routing, in which the middlebox can monitor packets delivered from the client but not the final destination that’s being censored or blocked, many such servers drop the requirement by design.' -- source: https://arstechnica.com/information-technology/2022/03/unending-data-floods… Considering that we suffered a widespread internet outage earlier today (and my internet is still flaky or slow), seems rather relevant: https://www.newshub.co.nz/home/technology/2021/09/internet-down-for-many-ar… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 28 Feb '22

28 Feb '22

Hi everyone We have a (virtual) meeting scheduled for next Monday: Peter Reutemann will demo openbalena (https://www.balena.io/open/) and how it can be used for managing an IoT fleet of devices. Ian Stewart will present his modem running the latest version of OpenWrt ( https://openwrt.org/ ). Using ssh into his modem and what the web-based user interface looks like, we will see some of the improvements that have gone into this latest release. Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776605/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Australia’s Standoff Against Google And Facebook Worked--Sort Of
by Lawrence D'Oliveiro 28 Feb '22

28 Feb '22

Analysis of how Australia forced Google and Facebook to negotiate with news outlets over compensation for carrying their stories <https://arstechnica.com/tech-policy/2022/02/australias-standoff-against-goo…>. Other countries (most famously Spain) had previously tried something similar, only to have it backfire spectacularly. Australia has succeeded where others failed—up to a point. Seems the two online behemoths are paying off some bigger news outlets, but rebuffing attempts from others to come to a similar deal. While the country’s news media bargaining code is now law, it has not (yet) actually needed enforcement: all the deals so far have been voluntary. So, has it been beneficial for Australian media as a whole, or only for certain favoured players? But even critics of the code suggest it could be a useful starting point. Emily Bell, director of Columbia University’s Tow Center for Digital Journalism, says she is concerned by the code’s lack of transparency, but concedes that Facebook and Google have paid more to publishers in Australia than they do under their philanthropic donations elsewhere. “What we do know is that some legislation is better than none.”

1 0

Samsung Shattered Encryption On 100 Million Phones
by Peter Reutemann 25 Feb '22

25 Feb '22

'Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year's Galaxy S21. Threatpost reports: Researchers at Tel Aviv University found what they called "severe" cryptographic design flaws that could have let attackers siphon the devices' hardware-based cryptographic keys: keys that unlock the treasure trove of security-critical data that's found in smartphones. What's more, cyber attackers could even exploit Samsung's cryptographic missteps -- since addressed in multiple CVEs -- to downgrade a device's security protocols. That would set up a phone to be vulnerable to future attacks: a practice known as IV (initialization vector) reuse attacks. IV reuse attacks screw with the encryption randomization that ensures that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts will each be distinct. The design flaws primarily affect devices that use ARM's TrustZone technology: the hardware support provided by ARM-based Android smartphones (which are the majority) for a Trusted Execution Environment (TEE) to implement security-sensitive functions. TrustZone splits a phone into two portions, known as the Normal world (for running regular tasks, such as the Android OS) and the Secure world, which handles the security subsystem and where all sensitive resources reside. The Secure world is only accessible to trusted applications used for security-sensitive functions, including encryption. Matthew Green, associate professor of computer science at the Johns Hopkins Information Security Institute, explained on Twitter that Samsung incorporated "serious flaws" in the way its phones encrypt key material in TrustZone, calling it "embarrassingly bad." "They used a single key and allowed IV re-use," Green said. "So they could have derived a different key-wrapping key for each key they protect," he continued. "But instead Samsung basically doesn't. Then they allow the app-layer code to pick encryption IVs." The design decision allows for "trivial decryption," he said. Samsung responded to the academics' disclosure by issuing a patch for affected devices that addressed CVE-2021-25444: an IV reuse vulnerability in the Keymaster Trusted Application (TA) that runs in the TrustZone. Keymaster TA carries out cryptographic operations in the Secure world via hardware, including a cryptographic engine. The Keymaster TA uses blobs, which are keys "wrapped" (encrypted) via AES-GCM. The vulnerability allowed for decryption of custom key blobs. Then, in July 2021, the researchers revealed a downgrade attack -- one that lets attacker trigger IV reuse vulnerability with privileged process. Samsung issued another patch -- to address CVE-2021-25490 -- that remoged the legacy blob implementation from devices including Samsung's Galaxy S10, S20 and S21 phones. ' -- source: https://mobile.slashdot.org/story/22/02/24/222207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeDOS Puts Out New Release
by Peter Reutemann 25 Feb '22

25 Feb '22

'FreeDOS has put out release 1.3, the latest release in 6-years. Some of the improvements since the 1.2 release, include: new FreeCOM 0.85a, new Kernel 2043 and an 8086 version with FAT32 support, floppy edition now uses compression...let's party like it's 1994.' -- source: https://tech.slashdot.org/story/22/02/24/1540240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia’s most cutthroat hackers infect network devices with new botnet malware
by Peter Reutemann 24 Feb '22

24 Feb '22

'Hackers for one of Russia’s most elite and brazen spy agencies have infected home and small-office network devices around the world with a previously unseen malware that turns them into attack platforms that can steal confidential data and target other networks. Cyclops Blink, as the advanced malware has been dubbed, has infected about 1 percent of network firewall devices made by network device manufacturer Watchguard, the company said on Wednesday. The malware is able to abuse a legitimate firmware update mechanism found in infected devices in a way that gives it persistence, meaning it survives reboots. [...] So far, the advisory stated, Sandworm has “primarily” used the malware to infect network devices from WatchGuard, but it’s likely the hackers are able to compile it to run on other platforms as well. The malware gains persistence on WatchGuard devices by abusing the legitimate process they use to receive firmware updates.' -- source: https://arstechnica.com/information-technology/2022/02/russias-most-cut-thr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ReiserFS Proposed To Be Removed From Linux In 2022
by Peter Reutemann 24 Feb '22

24 Feb '22

'Linux kernel developers have discussed on the kernel developers forum to remove ReiserFS from the kernel starting in 2022. ReiserFS was added as Linux's first journaling file system 21 years ago with SUSE using it as the default filesystem until 2006. However, since Hans Reiser was sent to jail 15 years ago for murder, there has not been much development or interest in it. Noting that there have been no user-spotted fixes since 2019, longtime kernel developer Matthew Wilcox also cited that ReiserFS was only block for some kernel changes he wished to implement. These days there are better alternatives like EXT4, Btrfs, XFS, and OpenZFS.' -- source: https://linux.slashdot.org/story/22/02/23/0537213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Fwd: [Flounder] new list and updated web site, next meeting 5th March
by Peter Reutemann 22 Feb '22

22 Feb '22

This new list FLOSS Down Under - Internet-Meeting group for Free Software people may be of interest to some of the people on this list as well. Cheers, Peter ---------- Forwarded message --------- From: Russell Coker via Flounder <flounder(a)lists.linux.org.au> Date: Tue, Feb 22, 2022 at 5:08 PM Subject: [Flounder] new list and updated web site, next meeting 5th March To: <flounder(a)lists.linux.org.au> https://flounder.linux.org.au/ Above is the new URL for the web site. It has a link for an iCal file with future meetings. I will add meetings without agenda many months ahead of time and then replace them with proper events when we have an agenda. This is the new list, I subscribed some people who are interested (hope everyone wanted that). Please forward to your friends! -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ _______________________________________________ Flounder mailing list Flounder(a)lists.linux.org.au http://lists.linux.org.au/mailman/listinfo/flounder -- My Open Source Blog - http://open.fracpete.org

1 0

Tip Of The Week: Controlling The Battery Charge Threshold
by Lawrence D'Oliveiro 21 Feb '22

21 Feb '22

Came across this rather interesting reader comment <https://forums.theregister.com/forum/all/2022/02/18/something_for_the_weeke…> about (supposedly) prolonging the life of your laptop battery by reducing the limit to which it is charged. This is configured by creating a systemd service file (called, for example, /etc/systemd/system/battery-charge-threshold.service) that automatically sets the threshold at boot time. Its contents are [Unit] Description=Set the battery charge threshold After=multi-user.target StartLimitBurst=0 [Service] Type=oneshot Restart=on-failure ExecStart=/bin/bash -c 'echo 50 > /sys/class/power_supply/BAT0/charge_control_end_threshold' [Install] WantedBy=multi-user.target You then use the usual “systemctl start” command to invoke this immediately, plus “systemctl enable” to ensure it runs at every subsequent boot. Regardless of whether it actually prolongs the life of your battery (try at your own risk!), it shows how easy it is to customize aspects of your system behaviour with systemd. As of this writing, that comment has garnered 7 upvotes and no downvotes, on a site where the readers are notorious for being a nest of systemd-haters.

2 6

Is Firefox OK?
by Peter Reutemann 21 Feb '22

21 Feb '22

'At the end of 2008, Firefox was flying high. Twenty percent of the 1.5 billion people online were using Mozilla’s browser to navigate the web. In Indonesia, Macedonia, and Slovenia, more than half of everyone going online was using Firefox. “Our market share in the regions above has been growing like crazy,” Ken Kovash, Mozilla’s president at the time, wrote in a blog post. Almost 15 years later, things aren’t so rosy. Across all devices, the browser has slid to less than 4 percent of the market—on mobile it’s a measly half a percent. “Looking back five years and looking at our market share and our own numbers that we publish, there's no denying the decline,” says Selena Deckelmann, senior vice president of Firefox. Mozilla’s own statistics show a drop of around 30 million monthly active users from the start of 2019 to the start of 2022. “In the last couple years, what we've seen is actually a pretty substantial flattening,” Deckelmann adds.' -- source: https://arstechnica.com/gadgets/2022/02/is-firefox-ok/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1