- wlug - list.wlug.org.nz

Code-execution bug in Pulse Secure VPN threatens patch laggards everywhere
by Peter Reutemann 27 Aug '20

27 Aug '20

'Organizations that have yet to install the latest version of the Pulse Secure VPN have a good reason to stop dithering—a code-execution vulnerability that allows attackers to take control of networks that use the product. Tracked as CVE-2020-8218, the vulnerability requires an attacker to have administrative rights on the machine running the VPN. Researchers from GoSecure, the firm that discovered the flaw, found an easy way to clear that hurdle: trick an administrator into clicking on a malicious link embedded in an email or other type of message.' -- source: https://arstechnica.com/information-technology/2020/08/code-execution-bug-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google: Jetpack Compose Lets Android Developers Write Apps With 'Dramatically Less Code'
by Peter Reutemann 27 Aug '20

27 Aug '20

'Google today released the alpha version of Jetpack Compose, its UI toolkit for helping developers "build beautiful UI across all Android platforms, with native access to the platform APIs." From a report: While an alpha release means it is definitely not production ready, Jetpack Compose promises to let Android developers build apps using "dramatically less code, interactive tools, and intuitive Kotlin APIs." The alpha release also includes new tools including Animations, Constraint Layouts, and performance optimizations. Android Jetpack, which Google launched at its I/O 2018 developer conference, is a set of components for speeding up app development. Think of it as the successor to Support Library, a set of components that makes it easier to leverage new Android features while maintaining backwards compatibility. Jetpack Compose, which Google first showed off at its I/O 2019 developer conference, is an unbundled toolkit meant to simplify UI development by combining a reactive programming model with Kotlin.' -- source: https://developers.slashdot.org/story/20/08/26/1749231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Requiring Plain-Text Email Is A “Barrier To Entry” For Linux Kernel Development, Says Somebody Or Other
by Lawrence D'Oliveiro 26 Aug '20

26 Aug '20

Seems plain-text e-mails are just too hard to work with nowadays <https://www.theregister.com/2020/08/25/linux_kernel_email/>: “It is a fairly specific workflow that is a challenge for some newer developers to engage with. As an example, my partner submitted a patch to OpenBSD a few weeks ago, and he had to set up an entirely new mail client which didn’t mangle his email message to HTML-ise or do other things to it, so he could even make that one patch. That’s a barrier to entry that’s pretty high for somebody who may want to be a first-time contributor.” ... It turned out, though, that this time Outlook was not guilty. “I think it was actually Gmail that was a barrier. And he also couldn’t do it from Apple Mail. It is just that the modern mail client has intentionally moved towards HTML,” ...

2 1

Firefox Daylight For Android Arrives With Enhanced Tracking Protection, New UI
by Peter Reutemann 26 Aug '20

26 Aug '20

'After more than a year of development, Mozilla today launched Firefox 79 for Android, branded Firefox Daylight. Like with Firefox 57 Quantum, Firefox Daylight gets its own name as it marks "a new beginning for our Android browser." The new version is "an entirely overhauled, faster, and more convenient product." Firefox Daylight includes Enhanced Tracking Protection on by default, a new user interface, Mozilla's own mobile browser engine GeckoView, and a slew of new features. Mozilla is rolling out the new Firefox for Android globally, starting in Germany, France, and the U.K. today, and North America starting August 27.' -- source: https://news.slashdot.org/story/20/08/25/1511257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A New Botnet Is Covertly Targeting Millions of Servers
by Peter Reutemann 26 Aug '20

26 Aug '20

'Wired reports: FritzFrog has been used to try and infiltrate government agencies, banks, telecom companies, and universities across the US and Europe. Researchers have found what they believe is a previously undiscovered botnet that uses unusually advanced measures to covertly target millions of servers around the world. The botnet uses proprietary software written from scratch to infect servers and corral them into a peer-to-peer network, researchers from security firm Guardicore Labs reported on Wednesday. Peer-to-peer (P2P) botnets distribute their administration among many infected nodes rather than relying on a control server to send commands and receive pilfered data. With no centralized server, the botnets are generally harder to spot and more difficult to shut down. The botnet, which Guardicore Labs researchers have named FritzFrog, has a host of other advanced features, including: In-memory payloads that never touch the disks of infected servers; At least 20 versions of the software binary since January; A sole focus on infecting secure shell, or SSH, servers that network administrators use to manage machines; The ability to backdoor infected servers; and A list of login credential combinations used to suss out weak login passwords that's more "extensive" than those in previously seen botnets. Taken together, the attributes indicate an above-average operator who has invested considerable resources to build a botnet that's effective, difficult to detect, and resilient to takedowns. The new code base -- combined with rapidly evolving versions and payloads that run only in memory -- make it hard for antivirus and other end-point protection to detect the malware. The botnet has so far succeeded in infecting 500 servers belonging to "well-known universities in the US and Europe, and a railway company."Once installed, the malicious payload can execute 30 commands, including those that run scripts and download databases, logs, or files. To evade firewalls and endpoint protection, attackers pipe commands over SSH to a netcat client on the infected machine. Netcat then connects to a "malware server." (Mention of this server suggests that the FritzFrog peer-to-peer structure may not be absolute. Or it's possible that the "malware server" is hosted on one of the infected machines, and not on a dedicated server. Guardicore Labs researchers weren't immediately available to clarify.)' -- source: https://it.slashdot.org/story/20/08/25/1947246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 95 Released a Quarter Century Ago
by Peter Reutemann 26 Aug '20

26 Aug '20

'Windows 95 was released a full quarter century ago today, on August 24th, 1995. Long gone, nearly forgotten? I'm surprised to not have come across a retrospective article yet. I've linked to the Wikipedia article. As for me I still haven't grown to re-like The Rolling Stones "Start Me Up" yet. I got so sick of hearing it with all the pre-launch and post-launch hype, as the song was tied heavily to the Win 95 launch event. Microsoft paid the Stones a princely sum to use it. I still remember how exciting it was to see the full-length, full-screen video included on the installation CD-ROM, "Buddy Holly" by Weezer. Mind-blowing to watch a whole music video on your computer. Crappy resolution by our standards today, and a very limited palette to my memory. But as I said, amazing in the day. Windows 95 had many fans and many critics. At the time, I recall it as an exciting OS (or GUI on top of DOS, if you prefer). PC users were riveted to all the magazine and other media coverage pre-launch. I remember it fondly (with all the obligatory respect due Mac OS, the Amiga, and all the other early GUIs of course).' -- source: https://tech.slashdot.org/story/20/08/25/1936234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 85 Arrives With Tab Management, 10% Faster Page Loads, and PDF Improvements
by Peter Reutemann 26 Aug '20

26 Aug '20

'Google today launched Chrome 85 for Windows, Mac, Linux, Android, and iOS. Chrome 85 brings tab management changes, 10% faster page loads, PDF improvements, and a slew of developer features. From a report: Google is promising under-the-hood performance improvements with Chrome 85. You can expect two types of speed gains: Profile Guided Optimization, which delivers up to 10% faster page loads, and Tab Throttling, which helps reduce the impact of idle background tabs. The latter, however, is coming to the Beta channel meaning it's not yet ready. Profile Guided Optimization is a compiler optimization technique where the most performance-critical parts of the code can run faster. Profile Guided Optimization prioritizes the most common tasks using real usage scenarios that match the workflows of Chrome users around the world.' -- source: https://it.slashdot.org/story/20/08/25/1741206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese-Made Smartphones Are Secretly Stealing Money From People Around the World
by Peter Reutemann 25 Aug '20

25 Aug '20

'When Mxolosi saw a Tecno W2 smartphone in a store in Johannesburg, South Africa, he was attracted to its looks and functionality. But what really drew him in was the price, roughly $30 -- far less than comparable models from Samsung, Nokia, or Huawei, Africa's other top brands. It was another sale for Transsion, the Chinese company that makes Tecno and other low-priced smartphones, as well as basic handsets, for the developing world. Since releasing its first smartphone in 2014, the upstart has grown to become Africa's top handset seller, beating out longtime market leaders Samsung and Nokia. But its success can come at a price. Mxolosi, an unemployed 41-year-old, became frustrated with his Tecno W2. Pop-up ads interrupted his calls and chats. He'd wake up to find his prepaid data mysteriously used up and messages about paid subscriptions to apps he'd never asked for. He thought it might be his fault, but according to an investigation by Secure-D, a mobile security service, and BuzzFeed News, software embedded in his phone right out of the box was draining his data while trying to steal his money. Mxolosi's Tecno W2 was infected with xHelper and Triada, malware that secretly downloaded apps and attempted to subscribe him to paid services without his knowledge. Secure-D's system, which mobile carriers use to protect their networks and customers against fraudulent transactions, blocked 844,000 transactions connected to preinstalled malware on Transsion phones between March and December 2019. Secure-D Managing Director Geoffrey Cleaves told BuzzFeed News that Mxolosi's data was used up by the malware as it attempted to subscribe him to paid services. Along with South Africa, Tecno W2 phones in Ethiopia, Cameroon, Egypt, Ghana, Indonesia, and Myanmar were infected.' -- source: https://it.slashdot.org/story/20/08/24/2139209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bridgefy, the Messenger Promoted For Mass Protests, Is a Privacy Disaster
by Peter Reutemann 25 Aug '20

25 Aug '20

'Bridgefy, a popular messaging app for conversing with one another when internet connections are heavily congested or completely shut down, is a privacy disaster that can allow moderately-skilled hackers to take a host of nefarious actions against users, according to a paper published on Monday. The findings come after the company has for months touted the app as a safe and reliable way for activists to communicate in large gatherings. Ars Technica reports: By using Bluetooth and mesh network routing, Bridgefy lets users within a few hundred meters -- and much further as long as there are intermediary nodes -- to send and receive both direct and group texts with no reliance on the Internet at all. Bridgefy cofounder and CEO Jorge Rios has said he originally envisioned the app as a way for people to communicate in rural areas or other places where Internet connections were scarce. And with the past year's upswell of large protests around the world -- often in places with hostile or authoritarian governments -- company representatives began telling journalists that the app's use of end-to-end encryption (reiterated here, here, and here) protected activists against governments and counter protesters trying to intercept texts or shut down communications. [R]esearchers said that the app's design for use at concerts, sports events, or during natural disasters makes it woefully unsuitable for more threatening settings such as mass protests. They wrote: "Though it is advertised as 'safe' and 'private' and its creators claimed it was secured by end-to-end encryption, none of aforementioned use cases can be considered as taking place in adversarial environments such as situations of civil unrest where attempts to subvert the application's security are not merely possible, but to be expected, and where such attacks can have harsh consequences for its users. Despite this, the Bridgefy developers advertise the app for such scenarios and media reports suggest the application is indeed relied upon." The researchers are: Martin R. Albrecht, Jorge Blasco, Rikke Bjerg Jensen, and Lenka Marekova from Royal Holloway, University of London. After reverse engineering the app, they devised a series of devastating attacks that allow hackers -- in many cases with only modest resources and moderate skill levels -- to take a host of nefarious actions against users. The attacks allow for: deanonymizing users; building social graphs of users' interactions, both in real time and after the fact; decrypting and reading direct messages; impersonating users to anyone else on the network; completely shutting down the network; and performing active man-in-the-middle attacks, which allow an adversary not only to read messages, but to tamper with them as well. "The key shortcoming that makes many of these attacks possible is that Bridgefy offers no means of cryptographic authentication, which one person uses to prove she's who she claims to be," the report adds. "Instead, the app relies on a user ID that's transmitted in plaintext to identify each person. Attackers can exploit this by sniffing the ID over the air and using it to spoof another user." The app also uses PKCS #1, an outdated way of encoding and formatting messages so that they can be encrypted with the RSA cryptographic algorithm. "This encoding method, which was deprecated in 1998, allows attackers to perform what's known as a padding oracle attack to derive contents of an encrypted message," reports Ars.' -- source: https://yro.slashdot.org/story/20/08/24/2228219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Apologizes To WordPress, Won't Force the Free App To Add Purchases After All
by Peter Reutemann 25 Aug '20

25 Aug '20

'On Friday, the internet erupted in a small way to learn that Apple had successfully forced WordPress to monetize its free app -- forcing it to sell premium plans and custom domain names seemingly just so that Apple could get its traditional 30 percent cut. But one afternoon and evening of surprise and outrage later, Apple is backing off. The company is issuing a rare on-the-record apology, and it says that WordPress will no longer have to add in-app purchases now that all is said and done. Here's Apple's full statement: "We believe the issue with the WordPress app has been resolved. Since the developer removed the display of their service payment options from the app, it is now a free stand-alone app and does not have to offer in-app purchases. We have informed the developer and apologize for any confusion that we have caused." You'll notice that Apple is positioning this as the developer -- WordPress -- having done the right thing and removed the "display of their service payment options from the app," and to my knowledge that is technically true. But as far as I'm aware, that didn't happen today: it happened weeks or months ago.' -- source: https://apple.slashdot.org/story/20/08/24/204211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Sustainability is Really a People Problem
by Peter Reutemann 24 Aug '20

24 Aug '20

'Matt Asay, a former COO of Canonical now working at AWS, argues that the question of open source sustainability "is really a people problem." But to make the case, he cites comments by Tobie Langel, formerly W3C's testing lead (and a former member of Facebook's Open Source and Web Standards Team) who's now founded an open-source strategies consulting firm whose clients include Mozilla, Intell, Google, and Microsoft. Much of the "open source sustainability" discussion has focused on the one thing that really needs no help being sustained: software. As Tobie Langel rightly points out, "Open source code isn't a scarce resource. It's the exact opposite, actually: It's infinitely reproducible at zero cost to the user and to the ecosystem." Nor is sustainability really a matter of funding, though this gets closer to the truth. No, open source sustainability is really a people problem. Or, as Langel highlights, "In open source, the maintainers working on the source code are the scarce resource that needs to be protected and nurtured." Over the past several weeks, I've interviewed a number of maintainers for popular open source projects. In every case, they talked about how they contribute because it's fun, but also acknowledged that some aspects of open source development can make it decidedly "un-fun" (e.g., demanding users who complain about missing features or existing bugs but don't contribute code or fixes). Most have found ways to turn their passion into financial independence, but Langel stresses that cash is critical to keeping open source humming along... "Without revenue, there is no maintenance, and without maintenance, the commons becomes toxic very quickly... As new security issues are discovered, open source code that isn't updated becomes a security risk..." Langel is absolutely correct to argue, "In an ecosystem with infinite resources, the attention needs to be on the people taking care of and maintaining that resource, because that's where the bottleneck is." Again, that's partly a question of money, but it's even more a question of treating people with dignity and respect, while making open source communities a fun, welcoming place.' -- source: https://news.slashdot.org/story/20/08/23/0447224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Virtual Influencers: Who Needs Real People?
by Lawrence D'Oliveiro 23 Aug '20

23 Aug '20

You probably know that celebrities can earn a lot by promoting products to their followers on social media. Some of these don’t actually have a flesh-and-blood job: they are famous for nothing more than being such “influencers”. Some advertisers have now decided to shortcut the process by creating their own “virtual influencers”: essentially, animated CG characters that they can control totally and much more easily than managing real people <https://www.theregister.com/2020/08/21/virtual_instagram_influencers/>. If all their interactions happen online, why do they need to be real?

1 0

Chrome/Chromium Now Accounting For Half Of All DNS Root Server Traffic
by Lawrence D'Oliveiro 23 Aug '20

23 Aug '20

Google’s Chrome (and its Chromium-based offshoots) include some elaborate workarounds to detect ISPs hijacking “no such domain” responses to advertise their own DNS services. Unfortunately, these workarounds lead to the generation of a lot of traffic to the DNS root servers <https://www.theregister.com/2020/08/21/chromiums_dns_network/>. Firefox is able to implement something similar, but with less impact on the Internet at large.

1 0

Google Fixes Major Gmail Bug Seven Hours After Exploit Details Go Public
by Peter Reutemann 21 Aug '20

21 Aug '20

'Google has patched on Wednesday a major security bug impacting the Gmail and G Suite email servers. From a report: The bug could have allowed a threat actor to send spoofed emails mimicking any Gmail or G Suite customer. According to security researcher Allison Husain, who found and reported this issue to Google in April, the bug also allowed attachers to pass the spoofed emails as compliant with SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance), two of the most advanced email security standards. However, despite having 137 days to fix the reported issue, Google initially delayed patches past the disclosure deadline, planning to fix the bug somewhere in September. Google engineers changed their mind yesterday after Husain published details about the bug on her blog, including proof-of-concept exploit code.' -- source: https://it.slashdot.org/story/20/08/20/1522226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Some Email Clients Are Vulnerable To Attacks Via 'mailto' Links
by Peter Reutemann 21 Aug '20

21 Aug '20

'A lesser-known technology known as "mailto" links can be abused to launch attacks on the users of email desktop clients. From a report: The new attacks can be used to secretly steal local files and have them emailed as attachments to attackers, according to a research paper published last week by academics from two German universities. The "vulnerability" at the heart of these attacks is how email clients implemented RFC6068 -- the technical standard that describes the 'mailto' URI scheme. Mailto refer to special types of links, usually supported by web browsers or email clients. These are links that, when clicked, they open a new email compose/reply window rather than a new web page (website). RFC6068 says that mailto links can support various parameters. When used with mailto links, these parameters will pre-fill the new email window with predefined content.' -- source: https://it.slashdot.org/story/20/08/20/177204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Legend Of The Melbourne Citadel
by Lawrence D'Oliveiro 21 Aug '20

21 Aug '20

It appears there is a 2300-foot tall building in Melbourne, at least according to the latest version of Microsoft Flight Simulator <https://www.theregister.com/2020/08/20/flight_simulator_bing_fawkner_tower/>. This would make it the second-tallest in the world. It originated from a mistaken entry into the OpenStreetMap database (since corrected), which Flight Simulator nevertheless managed to incorporate into its map data. There’s even a linked video of a player trying to land on it, before a future update deletes it from the game. Spoiler alert: yes, you can land, with the right sort of aircraft and a bit of effort. And you can even take off again. Another amusing item from the report comes from Microsoft’s use of AI to fill in road traffic flows. There is one case where the map data seems to omit the fact that there is a traffic tunnel through a building, with the result that the software has the cars going vertically up and down the sides of the building.

1 0

Linux Is Taking Over
by Lawrence D'Oliveiro 21 Aug '20

21 Aug '20

Seems like The Register’s BorkBorkBork column, featuring public examples of embedded systems falling over, is including more and more Linux-based screwups, e.g. <https://www.theregister.com/2020/08/20/bork/>: RailPoint has form for bork. Its Windows-based signage has already featured in these pages and back then the company told us it was "about to upgrade all of our production machines to a custom Linux build to improve their stability and generally operate with more efficiency". Behold the stability and efficiency. *Sigh*

1 0

'Real' Programming Is an Elitist Myth
by Peter Reutemann 20 Aug '20

20 Aug '20

'When people build a database to manage reading lists or feed their neighbors, that's coding -- and culture. From an essay: We are past the New York City Covid-19 peak. Things have started to reopen, but our neighborhood is in trouble, and people are hungry. There's a church that's opened space for a food pantry, a restaurant owner who has given herself to feeding the neighborhood, and lots of volunteers. [...] It's a complex data model. It involves date fields, text fields, integers, notes. You need lots of people to log in, but you need to protect private data too. You'd think their planning conversations would be about making lots of rice. But that is just a data point. The tool the mutual aid group has settled on to track everything is Airtable, a database-as-a-service program. You log in and there's your database. There are a host of tools like this now, "low-code" or "no-code" software with names like Zapier or Coda or Appy Pie. At first glance these tools look like flowcharts married to spreadsheets, but they're powerful ways to build little data-management apps. Airtable in particular keeps showing up everywhere for managing office supplies or scheduling appointments or tracking who at WIRED has their fingers on this column. The more features you use, the more they charge for it, and it can add up quickly. I know because I see the invoices at my company; we use it to track projects. "Real" coders in my experience have often sneered at this kind of software, even back when it was just FileMaker and Microsoft Access managing the flower shop or tracking the cats at the animal shelter. It's not hard to see why. These tools are just databases with a form-making interface on top, and with no code in between. It reduces software development, in all its complexity and immense profitability, to a set of simple data types and form elements. You wouldn't build a banking system in it or a game. It lacks the features of big, grown-up databases like Oracle or IBM's Db2 or PostgreSQL. And since it is for amateurs, the end result ends up looking amateur. But it sure does work. I've noticed that when software lets nonprogrammers do programmer things, it makes the programmers nervous. Suddenly they stop smiling indulgently and start talking about what "real programming" is. This has been the history of the World Wide Web, for example. Go ahead and tweet "HTML is real programming," and watch programmers show up in your mentions to go, "As if." Except when you write a web page in HTML, you are creating a data model that will be interpreted by the browser. This is what programming is. Code culture can be solipsistic and exhausting. Programmers fight over semicolon placement and the right way to be object-oriented or functional or whatever else will let them feel in control and smarter and more economically safe, and always I want to shout back: Code isn't enough on its own. We throw code away when it runs out its clock; we migrate data to new databases, so as not to lose one precious bit. Code is a story we tell about data.' -- source: https://developers.slashdot.org/story/20/08/19/146204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

235 Million Instagram, TikTok and YouTube User Profiles Exposed In Massive Data Leak
by Peter Reutemann 20 Aug '20

20 Aug '20

'Forbes: The security research team at Comparitech today disclosed how an unsecured database left almost 235 million Instagram, TikTok and YouTube user profiles exposed online in what can only be described as a massive data leak. The data was spread across several datasets; the most significant being two coming in at just under 100 million each and containing profile records apparently scraped from Instagram. The third-largest was a dataset of some 42 million TikTok users, followed by just under 4 million YouTube user profiles. Comparitech says that, based on the samples it collected, one in five records contained either a telephone number or email address. Every record also included at least some, sometimes all, the following information: Profile name; Full real name; Profile photo; and Account description. Statistics about follower engagement, including: Number of followers; Engagement rate; Follower growth rate; Audience gender; Audience age; Audience location; Likes; Last post timestamp; Age; and Gender. "The information would probably be most valuable to spammers and cybercriminals running phishing campaigns," Paul Bischoff, Comparitech editor, says. "Even though the data is publicly accessible, the fact that it was leaked in aggregate as a well-structured database makes it much more valuable than each profile would be in isolation," Bischoff adds. Indeed, Bischoff told me that it would be easy for a bot to use the database to post targeted spam comments on any Instagram profile matching criteria such as gender, age or number of followers. The data appeared to have originated from a company called Deep Social, which was banned by both Facebook and Instagram in 2018 after scraping user profile data. The company was wound down sometime after this. The researchers reached out to Deep Social, which then forwarded the disclosure to a Hong Kong-registered social media influencer data-marketing company called Social Data. Social Data shut down the database about three hours after the researchers' initial email. "Social Data has denied any connection between itself and Deep Social," reports Forbes, citing Comparitech.' -- source: https://yro.slashdot.org/story/20/08/19/212230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More PowerShell Users On Linux Than Windows?!?
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

According to this <https://www.theregister.com/2020/08/18/powershell_71_preview_6/>: While the Linux useragent continues to be responsible for the lion's share of daily usage (and Ubuntu the distro of choice), Windows has continued to rise in popularity, according to the figures. which surprises me just a little bit, considering this was a tool originally designed to bring more advanced command-line facilities to Windows, not Linux. Maybe they should fix those Linux-specific bugs <http://www.theregister.co.uk/2016/08/23/your_wget_is_broken_and_should_die_…> after all...

1 0

Chrome 86 Will Warn Users About Insecure Forms On HTTPS Pages
by Peter Reutemann 19 Aug '20

19 Aug '20

'While there's wide HTTPS adoption today, HTTP content on secure pages still persists. Google has been working to stamp that out, and Chrome is now turning its attention to and warning about insecure forms. "These 'mixed forms' (forms on HTTPS sites that do not submit on HTTPS) are a risk to users' security and privacy," says Google in a blog post. "Information submitted on these forms can be visible to eavesdroppers, allowing malicious parties to read or change sensitive form data." 9to5Google reports: The Google browser today removes the address bar's lock icon from sites with mixed forms. However, this proved to deliver an "unclear" experience that "did not effectively communicate the risks associated with submitting data in insecure forms." Starting in version 86, due to hit stable in October, Chrome will provide a more aggressive warning about insecure forms. Autofill will be disabled, but the built-in password manager will continue to offer "unique passwords." The company argues it's safer than reusing credentials. Next, the form will show red warning text underneath the field: "This form is not secure. Autofill has been turned off. The last measure will throw up a full-page warning communicating the potential risks. It gives users an option to cancel the action, but there will be a "Send anyway" button. ' -- source: https://tech.slashdot.org/story/20/08/18/0033257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel NTFS Driver
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

This article <https://www.theregister.com/2020/08/18/paragon_tries_to_contribute_ntfs/>, about the submission of a new Linux kernel driver for accessing Microsoft NTFS volumes (i.e. the kind of filesystems that are standard among Windows users), had me confused for a moment. It mentions limitations of the current kernel driver, like not being able to create or delete files or directories. I thought this kind of problem had been solved for Linux over a decade ago. And indeed it has, in the form of NTFS-3G, which is a userspace driver that connects via FUSE, and is available as a standard package for Debian and derivatives. I know this works, because just a few weeks ago, for example, I was at some friends’ place, and transferred several dozen gigabytes of files to an external hard drive of theirs from my Debian-Unstable-running laptop, without thinking twice about it, even though they are exclusively Windows users. I suppose a kernel driver offers higher performance, in principle, than one running in userspace. But I can’t imagine many Linux-based workloads that make heavy use of NTFS volumes.

2 1

meeting next Monday
by Peter Reutemann 19 Aug '20

19 Aug '20

Hi everyone We have a meeting coming up next Monday: "With VPNs being in the news frequently (and often for sad reasons like selling logs despite assurances that no such logs would exist), let's have a hands-on session with WireGuard (https://www.wireguard.com/) a VPN tunnel that is easier to use and configure than IPSec and faster than OpenVPN." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792032 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Microsoft: Improving The “Outage Experience”
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

Seems that, when something goes wrong with Microsoft’s cloud service, customers expect to find out what has happened by visiting the Azure Status page. How silly of them <https://www.theregister.com/2020/08/18/dont_use_azure_status_page/>: The place to look, Kubba said, is in the Azure Portal under Service Health. The public Azure status page is "only used to communicate widespread outages" so likely to be ineffective in discovering what may be wrong. "Despite this, we constantly find that customers visit the Azure Status page to determine the health of services on Azure," complained Kubba – though we presume that if an outage blocks access to the portal, the Status page would then be the right place to look. In other cases, it is not much use since "more than 95 per cent of our incidents" do not appear there, according to Kubba. A further complication is that Azure DevOps (which is where Pipelines live) is not integrated into the Azure portal, and many Azure DevOps users only hang around the DevOps portal. Therefore, there is a separate Azure DevOps status page, making this a third site that needs to be bookmarked for tracking outages.

1 0

An Alexa Bug Could Have Exposed Your Voice History To Hackers
by Peter Reutemann 18 Aug '20

18 Aug '20

'Findings published on Thursday by the security firm Check Point reveal that Alexa's Web services had bugs that a hacker could have exploited to grab a target's entire voice history, meaning their recorded audio interactions with Alexa. Amazon has patched the flaws, but the vulnerability could have also yielded profile information, including home address, as well as all of the "skills," or apps, the user had added for Alexa. An attacker could have even deleted an existing skill and installed a malicious one to grab more data after the initial attack. [...] For an attacker to exploit the vulnerabilities, they would need first to trick targets into clicking a malicious link, a common attack scenario. Underlying flaws in certain Amazon and Alexa subdomains, though, meant that an attacker could have crafted a genuine and normal-looking Amazon link to lure victims into exposed parts of Amazon's infrastructure. By strategically directing users to track.amazon.com -- a vulnerable page not related to Alexa, but used for tracking Amazon packages -- the attacker could have injected code that allowed them to pivot to Alexa infrastructure, sending a special request along with the target's cookies from the package-tracking page to skillsstore.amazon.com/app/secure/your-skills-page. At this point, the platform would mistake the attacker for the legitimate user, and the hacker could then access the victim's full audio history, list of installed skills, and other account details. The attacker could also uninstall a skill the user had set up and, if the hacker had planted a malicious skill in the Alexa Skills Store, could even install that interloping application on the victim's Alexa account. Both Check Point and Amazon note that all skills in Amazon's store are screened and monitored for potentially harmful behavior, so it's not a foregone conclusion that an attacker could have planted a malicious skill there in the first place. Check Point also suggests that a hacker might be able to access banking data history through the attack, but Amazon disputes this, saying that information is redacted in Alexa's responses. "The security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us," an Amazon spokesperson told WIRED in a statement. "We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed."' -- source: https://yro.slashdot.org/story/20/08/17/2129202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Text Editor Notepad++ Banned In China After 'Stand With Hong Kong' Update
by Peter Reutemann 18 Aug '20

18 Aug '20

'The website of Notepad++ is banned in China as of Monday, "obviously due to" its release of editions named "Free Uyghur" and "Stand with Hong Kong," the source code and text editor announced on Twitter. TechCrunch reports: First released in 2003 by France-based developer Don Ho, free-to-use Notepad++ operates on Windows and supports some 90 languages. In his release notices for the two editions, Ho openly voiced his concerns over "human rights" conditions, respectively in the Xinjiang autonomous region and Hong Kong. Tests by TechCrunch found that the Notepad++ ban only applies to its Download page -- which showcases the special editions and thus politically sensitive language -- when one tries to reach it from Chinese browsers developed by Tencent (QQ Browser and WeChat's built-in browser), Alibaba (UC Browser), 360 and Sogou. These services flag the page as containing content "prohibited" by local regulators. Notepad++'s home page, on the other hand, remains unblocked through these local browsers. One can still access the full site from Chrome and DuckDuckGo in China. The ban began as early as August 12 when a user notified Ho of the ban, the developer told TechCrunch. He has never been contacted by any Chinese government authority and does not plan to take measures to cope with the website restriction.' -- source: https://yro.slashdot.org/story/20/08/17/2028235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reviewer Calls Linux-based PinePhone 'the Most Interesting Smartphone I've Tried in Years'
by Peter Reutemann 17 Aug '20

17 Aug '20

'A review at the Android Police site calls Pine64's new Linux-based PinePhone "the most interesting smartphone I've tried in years," with 17 different operating systems available (including Fedora, Ubuntu Touch, SailfishOS, openSUSE, and Arch Linux ARM): There's a replaceable battery, which is compatible with batteries designed for older Samsung Galaxy J7 phones. It's good to know that even if PinePhone vanished overnight, you could still purchase new batteries for around $10-15... There's a microSD card slot above the SIM tray, which supports cards up to 2TB in size. While it can be used as extra storage, just like the SD slots in Android phones and tablets, it can also function as a bootable drive. If you write an operating system image to the SD card and put it in the PinePhone, the phone will boot from the SD card. This means you can move between operating systems on the PinePhone by simply swapping microSD cards, which is amazing for trying out new Linux distributions without wiping data. How great would it be if Android phones could do that? Finally, the inside of the PinePhone has six hardware killswitches that can be manipulated with a screwdriver. You can use them to turn off the modem, Wi-Fi/Bluetooth, microphone, rear camera, front camera, and headphone jack. No need to put a sticker over the selfie camera if you're worried about malicious software — just flip the switch and never worry about it again.... For a $150 phone produced in limited batches by a company with no previous experience in the smartphone industry, I'm impressed it's built as well as it is... I look forward to seeing what the community around the PinePhone can accomplish. A Pine64 blog post this weekend touts "a boat-load of cool and innovative things" being attempted by the PinePhone community, including users working on things like a fingerprint scanner or a thermal camera, plus a community that's 3D-printing their own custom PinePhone cases. And Pine64 has now identified three candidates for a future keyboard option (each of which can be configured as either a slide-out or clamshell keyboard): I feel like we have finally gotten into a good production rhythm; it was only last month we announced the postmarketOS Community Edition of the PinePhone, and this month I am here to tell you that the factory will deliver the phones to us at the end of this month... I don't know about you, but I think that this is a rather good production pace. At the time of writing, and based on current sale rates, the postmarketOS production-run will sell out in a matter of days... While I have no further announcements at this time, what I will say is that we have no intention of slowing down the pace now until February 2021 (when Chinese New Year begins)...' -- source: https://mobile.slashdot.org/story/20/08/17/0115227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can Firefox Be Saved?
by Peter Reutemann 17 Aug '20

17 Aug '20

'"Even with another infusion of cash from Google, you have to wonder just how long Firefox will survive as a viable, mainstream web browser," argues ZDNet contributing editor Steven J. Vaughan-Nichols: I've been using Mozilla's Firefox browser since it was still in beta. In 2004, for a while, it was my favorite web browser. Not because it was open-source, but because it was so much better and more secure than Internet Explorer. That was then. This is now. Firefox is in real danger of dying off... Mozilla and Firefox still produced important work. You need to look no further than the JavaScript, Rust, and WebAssembly languages. They were also champions of security and privacy. Projects such as embracing DNS-over-HTTPS (DoH) and overall security improvements were great, but users didn't care. With the arrival of Google's Chrome browser, users turned from Firefox to Chrome as their favorite browser... Firefox is on its way to irrelevance. Making matters even worse, Mozilla's just had its second round of layoffs... As technology writer Matthew MacDonald put it, "Mozilla "." Firefox's security and development teams have also been hard hit. This is bad. In January. Mitchell Baker, Mozilla Corporation CEO and Mozilla Foundation chairperson, said it let people go because of declining interest in Firefox, and thus reduced earnings, and that Mozilla was looking for more revenue from "sources outside of search" but "this did not happen." It still isn't happening. According to Mozilla's latest annual report, the majority of its revenue is still generated from global browser search partnerships. This includes the deal negotiated with Google in 2017... Baker assured onlookers that Mozilla would "ship new products faster and develop new revenue streams." These include its bookmarking app Pocket; its virtual rooms Hubs; and its $4.99-a-month Firefox VPN. Excuse me if I don't buy any of these new revenue sources.... Firefox will live on in one way or the other. It's open source after all. But Firefox as an important browser, or Mozilla as a significant open-source developer hub? No. I can't see it. Those days are done. Firefox is officially on my endangered species list. Technology writer Matthew MacDonald ended his Medium essay on a more hopeful note. "If you have the skills and time, the best possible support is to join the Mozilla community and contribute to their code base."' -- source: https://news.slashdot.org/story/20/08/15/1955237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy Birthday to Debian, CPAN, and Mutt
by Peter Reutemann 17 Aug '20

17 Aug '20

'27 years ago today, in 1993, Debian first appeared in the world. August 16th has since been recognized as "DebianDay," celebrated shortly before the annual Debian Conference — with lots of ways to get involved, according to Debian.org: Today is also an opportunity for you to start or resume your contributions to Debian. For example, you can scratch your creative itch and suggest a wallpaper to be part of the artwork for the next release, have a look at the DebConf20 schedule and register to participate online (August 23rd to 29th, 2020), or put a Debian live image in a DVD or USB and give it to some person near you, who still didn't discover Debian. Our favorite operating system is the result of all the work we do together. Thanks to everybody who has contributed in these 27 years, and happy birthday Debian! And the same day is also the 25th anniversary of CPAN, the Comprehensive Perl Archive Network: On the 16th August 1995, Andreas König uploaded Symdump 1.20 to CPAN. There were other things already on CPAN, but this was the first true upload, to be followed by more than 6,500 people who have released over 35,000 distributions in 230k releases. So it seems appropriate that 16th August be designated CPAN Day, to celebrate CPAN, and all the authors who've made it what it is. That blog post urges readers to celebrate the anniversary "by doing something related to CPAN: release something, blog about your favourite module, or email its author thanking her or him." Finally, Slashdot reader JobSnijders reminds us that Mutt is also enjoying a birthday: The email client that aims to suck a little bit less celebrates its 25th anniversary!' -- source: https://linux.slashdot.org/story/20/08/16/1652249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Qualcomm Shook Down The Cell Phone Industry For Almost 20 Years
by Lawrence D'Oliveiro 15 Aug '20

15 Aug '20

A pretty sobering read <https://arstechnica.com/tech-policy/2019/05/how-qualcomm-shook-down-the-cel…>: Qualcomm's first weapon against competitors: patent licensing terms requiring customers to pay a royalty on every phone sold—not just phones that contained Qualcomm's wireless chips. Sound familiar? Judge Koh draws a direct parallel to licensing behavior that got Microsoft in legal trouble in the 1990s. Microsoft would offer PC makers a discount if they agreed to pay Microsoft a licensing fee for every PC sold—whether or not the PC shipped with a copy of MS-DOS. This effectively meant that a PC maker had to pay twice if it shipped a PC running a non-Microsoft operating system. There’s a lot more--the article reads like a catalogue of gangster-like tactics. All of which is perfectly all right under the US interpretation of “Free Enterprise”, of course ... Also, reading the details of how Qualcomm managed to sabotage Intel’s efforts to develop 5G chips, it seems to me that Qualcomm is directly responsible for the situation today where US companies are lagging behind Chinese ones like Huawei in 5G capability.

1 1

LibreOffice 7.0
by Peter Reutemann 14 Aug '20

14 Aug '20

Hi everyone I completely missed the release of LibreOffice 7.0 at the start of August: https://wiki.documentfoundation.org/ReleaseNotes/7.0 Notable changes: - ODF 1.3 support - EMF+ import improved - improved import/export of docx/xlsx/pptx files - Python 2.7 support removed, uses Python 3 by default - Macromedia flash export removed Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

GPT-3 Raises Complex Questions for Philosophy and Policy
by Lawrence D'Oliveiro 14 Aug '20

14 Aug '20

From <https://freedom-to-tinker.com/2020/08/13/gpt-3-raises-complex-questions-for…>: GPT-3, a powerful, 175 billion parameter language model developed recently by OpenAI, has been galvanizing public debate and controversy ... Why the hype? GPT-3 is unlike other natural language processing (NLP) systems, the latter of which often struggle with what comes comparatively easily to humans: performing entirely new language tasks based on a few simple instructions and examples. Instead, NLP systems usually have to be pre-trained on a large corpus of text, and then fine-tuned in order to successfully perform a specific task. GPT-3, by contrast, does not require fine tuning of this kind: it seems to be able to perform a whole range of tasks reasonably well, from producing fiction, poetry, and press releases to functioning code, and from music, jokes, and technical manuals, to “news articles which human evaluators have difficulty distinguishing from articles written by humans”. Also note this: ... GPT-3 has been trained on us—on a lot of things that we have said and written—and ends up reproducing just that, racial and gender bias included. OpenAI acknowledges this in their own paper on GPT-3,where they contrast the biased words GPT-3 used most frequently to describe men and women, following prompts like “He was very…” and “She would be described as…”. The results aren’t great. For men? Lazy. Large. Fantastic. Eccentric. Stable. Protect. Survive. For women? Bubbly, naughty, easy-going, petite, pregnant, gorgeous.

1 0

FBI and NSA Expose New Linux Malware Drovorub, Used by Russian State Hackers
by Peter Reutemann 14 Aug '20

14 Aug '20

'The FBI and NSA have published today a joint security alert containing details about a new strain of Linux malware that the two agencies say was developed and deployed in real-world attacks by Russia's military hackers. From a report: The two agencies say Russian hackers used the malware, named Drovorub, was to plant backdoors inside hacked networks. Based on evidence the two agencies have collected, FBI and NSA officials claim the malware is the work of APT28 (Fancy Bear, Sednit), a codename given to the hackers operating out of military unity 26165 of the Russian General Staff Main Intelligence Directorate (GRU) 85th Main SpecialService Center (GTsSS). Through their joint alert, the two agencies hope to raise awareness in the US private and public sectors so IT administrators can quickly deploy detection rules and prevention measures.' -- source: https://linux.slashdot.org/story/20/08/13/174237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Extends its Google Search Deal
by Peter Reutemann 13 Aug '20

13 Aug '20

'Mozilla and Google have extended their search deal for another three years, news outlet ZDNet reported Wednesday, citing sources familiar with thee matter. Mozilla confirmed the news. From a report: The new search deal will ensure Google remains the default search engine provider inside the Firefox browser until 2023 at an estimated price tag of around $400 million to $450 million per year. Mozilla officials are expected to announce the search deal's extension later this fall, in November, when the organization is scheduled to disclose its 2019 financial figures. Terms of the new deal were leaked to this reporter after Mozilla announced plans to lay off more than 250 employees on Wednesday in a move that had many users fearing for the browser maker's future, as Mozilla's current Google search deal was scheduled to expire at the end of the year. However, several sources have confirmed that the organization is sound financially, and the layoffs were part of a restructuring of its core business, with Mozilla moving away from its current role of internet standards steward and experimental approach to its product catalog to more commercially-viable offerings that generate revenues on their own.' -- source: https://tech.slashdot.org/story/20/08/13/0012243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Makes Building Android Apps on Chrome OS Easier
by Peter Reutemann 13 Aug '20

13 Aug '20

'Google today launched ChromeOS.dev, a new site that aims to help developers get started with building Android apps for the company's Linux-based operating system. With today's update, Google is also making it easier to build and test Android applications on Chromebooks. From a report: The new ChromeOS.dev site, which is available in English and Spanish for now, is meant to "help developers maximize their capabilities on the platform through technical resources/tutorials, product announcements, code samples and more," a Google spokesperson told us. As Google notes in today's announcement, in the last quarter, Chromebook unit sales were up 127% year-over-year in the last quarter, compared to 40% for notebook sales in general. To help Android developers do all of their work on a Chromebook if they so desire, Google now offers the full Android Emulator on Chrome OS to test apps right on their Chromebooks. The team also made deploying apps on Chrome OS (M81 and newer) much easier. Developers can now deploy and test apps directly without having to use developer mode or connect devices via USB.' -- source: https://developers.slashdot.org/story/20/08/12/193214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

TikTok Tracked User Data Using Tactic Banned By Google
by Peter Reutemann 12 Aug '20

12 Aug '20

'TikTok skirted a privacy safeguard in Google's Android operating system to collect unique identifiers from millions of mobile devices, data that allows the app to track users online without allowing them to opt out, a Wall Street Journal analysis has found. The tactic, which experts in mobile-phone security said was concealed through an unusual added layer of encryption, appears to have violated Google policies limiting how apps track people and wasn't disclosed to TikTok users. TikTok ended the practice in November, the Journal's testing showed. The identifiers collected by TikTok, called MAC addresses, are most commonly used for advertising purposes. The White House has said it is worried that users' data could be obtained by the Chinese government and used to build detailed dossiers on individuals for blackmail or espionage. In a statement, a spokesperson said the company is "committed to protecting the privacy and safety of the TikTok community. Like our peers, we constantly update our app to keep up with evolving security challenges." The company said "the current version of TikTok does not collect MAC addresses."' -- source: https://yro.slashdot.org/story/20/08/11/2120246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

upcoming meeting
by Peter Reutemann 12 Aug '20

12 Aug '20

Hi everyone With the country moving up levels again today [1], I will reevaluate next week whether we are still allowed to meet on campus for our August WLUG meeting. At this stage, the university only seems to assess events of more than 100 people. However, they are requiring social distancing, which is a bit more difficult when you have a hands-on meeting (wireguard). For the time being, stay safe and be kind! Cheers, Peter [1] https://covid19.govt.nz/updates-and-resources/latest-updates/new-zealands-a… -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android is Becoming a Worldwide Earthquake Detection Network
by Peter Reutemann 12 Aug '20

12 Aug '20

'Google is creating a worldwide, Android phone-powered earthquake alert system. The first part of that system is rolling out today. If you opt in, the accelerometer in your Android phone will become one data point for an algorithm designed to detect earthquakes. Eventually, that system will automatically send warnings to people who could be impacted. From a report: It's a feature made possible through Google's strengths: the staggering numbers of Android phones around the world and clever use of algorithms on big data. As with its collaboration with Apple on exposure tracing and other Android features like car crash detection and emergency location services, it shows that there are untapped ways that smartphones could be used for something more important than doomscrolling. Google is rolling out the system in small stages. First, Google is partnering with the United States Geological Survey and the California Office of Emergency Services to send the agencies' earthquake alerts to Android users in that state. Those alerts are generated by the already-existing ShakeAlert system, which uses data generated by traditional seismometer' -- source: https://tech.slashdot.org/story/20/08/11/1440235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Lays Off 250 Employees While it Refocuses on Commercial Products
by Peter Reutemann 12 Aug '20

12 Aug '20

'The Mozilla Corporation announced today it was laying off approximately 250 staff members in a move to shore up the organization's financial future. From a report: The layoffs were publicly announced in a blog post today. Employees were notified hours before, earlier this morning, via an email sent by Mitchell Baker, Mozilla Corporation CEO and Mozilla Foundation Chairwoman. Baker's message cited the organization's need to adapt its finances to a post-COVID-19 world and re-focus the organization on new commercial services. Baker said that after the onset of the COVID-19 pandemic, Mozilla attempted to minimize the healthcare crisis' financial impact with "immediate cost-saving measures such as pausing our hiring, reducing our wellness stipend and cancelling our All-Hands [meetings]." However, Baker said that Mozilla's "pre-COVID plan is no longer workable." "We have talked about the need for change -- including the likelihood of layoffs -- since the spring. Today these changes become real," the Mozilla CEO said today.' -- source: https://tech.slashdot.org/story/20/08/11/1458214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China Blocking ESNI Connections
by Lawrence D'Oliveiro 11 Aug '20

11 Aug '20

TLS 1.3 (the latest version of the protocol used for “HTTPS” connections) adds a feature called “Encrypted Server Name Indication” (ESNI). This removes a loophole where the initial exchange, in which the browser indicates to the server which (of possibly many) virtual host names it is trying to connect to, is sent unencrypted. Reports <https://www.theregister.com/2020/08/11/china_blocking_tls_1_3_esni/> are saying that the Great Firewall of China is trying to block all such connection attempts, just in case any of them happen to be to “banned” sites. However, it is (currently) possible to manipulate the packet stream in such a way as to fool this filtering, so the connection can go through.

1 0

CrowPi 2 Raspberry-π-Based Laptop Incl Development Board
by Lawrence D'Oliveiro 11 Aug '20

11 Aug '20

Review <https://www.youtube.com/watch?v=l0WGyY7njWQ> of a laptop-styled unit built around a Raspberry π 4. Lift off the (wireless) keyboard, to reveal a built-in development board with a whole bunch of extra components on it for you to play with. Also comes with a few sensors that you can connect to conduct various experiments, plus two game controllers and a remote control. Oh, and some cardboard cut-out-and-fold Minecraft blocks.

1 0

Boeing 747 Navigation Databases Updated Via 3½” Floppy Drives
by Lawrence D'Oliveiro 11 Aug '20

11 Aug '20

A group of security hackers took advantage of British Airways’ decommissioning of its Boeing 747 fleet to have a nose round inside one before the scrap dealers moved in <https://www.theregister.com/2020/08/10/boeing_747_floppy_drive_updates_walk…>. The navigation database has to be updated every 28 days. This is done by bringing along a 3½” floppy disk with the new info and putting it into an onboard drive. On the bright side, there really seemed to be a good separation between the customer-accessible in-flight entertainment systems and those used to manage critical aircraft systems.

2 1

Snapdragon chip flaws put >1 billion Android phones at risk of data theft
by Peter Reutemann 10 Aug '20

10 Aug '20

'A billion or more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week. The vulnerabilities can be exploited when a target downloads a video or other content that’s rendered by the chip. Targets can also be attacked by installing malicious apps that require no permissions at all. >From there, attackers can monitor locations and listen to nearby audio in real time and exfiltrate photos and videos. Exploits also make it possible to render the phone completely unresponsive. Infections can be hidden from the operating system in a way that makes disinfecting difficult. Snapdragon is what’s known as a system on a chip that provides a host of components, such as a CPU and a graphics processor. One of the functions, known as digital signal processing, or DSP, tackles a variety of tasks, including charging abilities and video, audio, augmented reality, and other multimedia functions. Phone makers can also use DSPs to run dedicated apps that enable custom features.' -- source: https://arstechnica.com/information-technology/2020/08/snapdragon-chip-flaw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher Discovers New 'HTTP Request Smuggling Attack' Variants
by Peter Reutemann 10 Aug '20

10 Aug '20

'Some scary new variants of "HTTP request smuggling" have been discovered by Amit Klein, VP of security research at SafeBreach, reports Security Week: Specifically, an HTTP request smuggling attack, which can be launched remotely over the internet, can allow a hacker to bypass security controls, gain access to sensitive data, and compromise other users of the targeted app. While the attack method has been known for more than a decade, it still hasn't been fully mitigated. Klein has managed to identify five new attack variants and he has released proof-of-concept (PoC) exploits. He demonstrated his findings using the Abyss X1 web server from Aprelium and the Squid caching and forwarding HTTP web proxy. The developers of Abyss and Squid have been notified of the vulnerabilities exploited by Klein during his research, and they have released patches and mitigations. One of the attacks bypasses the OWASP ModSecurity Core Rule Set (CRS), which provides generic attack detection rules for ModSecurity or other web application firewalls. OWASP has also released fixes after being notified. Klein told SecurityWeek ahead of his talk on HTTP request smuggling at the Black Hat conference that an attacker needs to find combinations of web servers and proxy servers with "matching" vulnerabilities in order to launch an attack, which makes it difficult to determine exactly how many servers are impacted. However, an attacker can simply try to launch an attack to determine if a system is vulnerable. "The attack is not demanding resource-wise, so there's no downside to simply trying it," Klein said. In his research, he demonstrated a web cache poisoning attack, in which the attacker forces the proxy server to cache the content of one URL for a request of a different URL. He says attacks can be launched en-masse through a proxy server against multiple different web servers or against multiple proxy servers... While there haven't been any reports of HTTP request smuggling being used in the wild, Klein has pointed out that attacks may have been launched but were not detected by the target.' -- source: https://it.slashdot.org/story/20/08/09/0047219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds: Linux 5.8 "One of our Biggest Releases of All Time"
by Peter Reutemann 10 Aug '20

10 Aug '20

'This week saw the release Linux 5.8, which Linus Torvalds called "one of our biggest releases of all time," reports TechRepublic: The new version of the Linux kernel brings a number of updates to Linux 5.7 spanning security, core components, drivers, memory management, networking and improvements to the kernel's design, amongst others. This includes updates for Microsoft's Hyper-V virtualization platform, Intel Tiger Lake Thunderbolt support, improvements to Microsoft's exFAT file system, and support for newer Intel and ARM chips. Torvalds said the kernel had received over 15,000 merge requests and that around 20% of all the files in the kernel source repository had been modified. "That's really a fairly big percentage, and while some of it is scripted, on the whole it's really just the same pattern: 5.8 has simply seen a lot of development," Torvalds said. Translated into numbers, Linux 5.8 includes over 800,000 new lines and over 14,000 changed files. It also received one of the biggest number of merge requests during its merge window — over 14,000 non-merge commits and more than 15,000 including merges, according to Torvalds. "5.8 looks big. Really big," he added.' -- source: https://linux.slashdot.org/story/20/08/09/2046232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Infographic: Ubuntu from 2004 to 20.04 LTS
by Peter Reutemann 09 Aug '20

09 Aug '20

'Today, the first point release of Ubuntu 20.04 LTS went live! To celebrate, we wanted to share how Ubuntu has evolved since the first release in 2004 to where we are today with 20.04. Thanks to those in the community and our users for your contributions and joining us on this journey. Upgrade to Ubuntu 20.04.1 LTS now!' -- source: https://ubuntu.com/blog/infographic-ubuntu-from-2004-to-20-04-lts Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Scientists Rename Human Genes To Stop Microsoft Excel From Misreading Them as Dates
by Peter Reutemann 08 Aug '20

08 Aug '20

'There are tens of thousands of genes in the human genome: minuscule twists of DNA and RNA that combine to express all of the traits and characteristics that make each of us unique. Each gene is given a name and alphanumeric code, known as a symbol, which scientists use to coordinate research. But over the past year or so, some 27 human genes have been renamed, all because Microsoft Excel kept misreading their symbols as dates. From a report: The problem isn't as unexpected as it first sounds. Excel is a behemoth in the spreadsheet world and is regularly used by scientists to track their work and even conduct clinical trials. But its default settings were designed with more mundane applications in mind, so when a user inputs a gene's alphanumeric symbol into a spreadsheet, like MARCH1 -- short for "Membrane Associated Ring-CH-Type Finger 1" -- Excel converts that into a date: 1-Mar. This is extremely frustrating, even dangerous, corrupting data that scientists have to sort through by hand to restore. It's also surprisingly widespread and affects even peer-reviewed scientific work. One study from 2016 examined genetic data shared alongside 3,597 published papers and found that roughly one-fifth had been affected by Excel errors.' -- source: https://science.slashdot.org/story/20/08/06/147226 This auto-interpreting and getting things wrong has always annoyed me about Excel and other spreadsheet applications. Not sure whether there ever was an option to turn off this "auto-detect of content type"... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Yet Another Spreadsheet Screwup
by Lawrence D'Oliveiro 08 Aug '20

08 Aug '20

The British Army had to retract a bunch of notifications about promotions incorrectly sent out <https://www.theregister.com/2020/08/07/army_promotion_excel_snafu/>. I suspect the phrase “incorrectly sorted” means they forgot to select all the right columns before doing a sort of the rows, leading to a scrambling of the data. This kind of thing is all too common.

1 0

The Next Step In SSD Evolution: NVMe Zoned Namespaces Explained
by Peter Reutemann 07 Aug '20

07 Aug '20

'In June we saw an update to the NVMe standard. The update defines a software interface to assist in actually reading and writing to the drives in a way to which SSDs and NAND flash actually works. Instead of emulating the traditional block device model that SSDs inherited from hard drives and earlier storage technologies, the new NVMe Zoned Namespaces optional feature allows SSDs to implement a different storage abstraction over flash memory. This is quite similar to the extensions SAS and SATA have added to accommodate Shingled Magnetic Recording (SMR) hard drives, with a few extras for SSDs. 'Zoned' SSDs with this new feature can offer better performance than regular SSDs, with less overprovisioning and less DRAM. The downside is that applications and operating systems have to be updated to support zoned storage, but that work is well underway. The NVMe Zoned Namespaces (ZNS) specification has been ratified and published as a Technical Proposal. It builds on top of the current NVMe 1.4a specification, in preparation for NVMe 2.0. The upcoming NVMe 2.0 specification will incorporate all the approved Technical Proposals, but also reorganize that same functionality into multiple smaller component documents: a base specification (one for each command set of block, zoned, key-value, and potentially more in the future), and separate specifications for each transport protocol (PCIe, RDMA, TCP). The standardization of Zoned Namespaces clears the way for broader commercialization and adoption of this technology, which so far has been held back by vendor-specific zoned storage interfaces and very limited hardware choices. [...]' -- source: https://hardware.slashdot.org/story/20/08/06/1916230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Can Killing Cookies Save Journalism?
by Peter Reutemann 07 Aug '20

07 Aug '20

'In May 2018, as the European Union’s landmark privacy law, the General Data Protection Regulation, went into effect, the main Dutch public broadcaster set in motion a grand experiment. The leadership at Nederlandse Publieke Omroep—essentially the BBC of the Netherlands—interpreted the law strictly, deciding that visitors to any of its websites would now be prompted to opt in or out of cookies, the tracking technology that enables personalized ads based on someone’s browsing history. And, unlike with most companies, who assume that anyone who skips past a privacy notice is OK with tracking, any NPO visitor who clicked past the obtrusive consent screen without making a choice would be opted out by default. The results weren’t terribly surprising: 90 percent of users opted out. Here is where the ad tech industry would have predicted calamity. A study performed by Google last year, for example, concluded that disabling cookies reduced publisher revenue by more than 50 percent. (Research by an independent team of economists, however, pegged the cookie premium at only 4 percent. Needless to say, there were methodological differences.) If the Google study was right, then NPO should have been heading for financial disaster. The opposite turned out to be true. Instead, the company found that ads served to users who opted out of cookies were bringing in as much or more money as ads served to users who opted in. The results were so strong that as of January 2020, NPO simply got rid of advertising cookies altogether. And rather than decline, its digital revenue is dramatically up, even after the economic shock of the coronavirus pandemic.' -- source: https://www.wired.com/story/can-killing-cookies-save-journalism/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cluster of 295 Chrome Extensions Caught Hijacking Google and Bing Search Results
by Peter Reutemann 07 Aug '20

07 Aug '20

'More than 80 million Chrome users have installed one of 295 Chrome extensions that have been identified to hijack and insert ads inside Google and Bing search results. The malicious extensions were discovered by AdGuard, a company that provides ad-blocking solutions, while the company's staff was looking into a series of fake ad-blocking extensions that were available on the official Chrome Web Store. AdGuard says that most of the extensions (245 out of the 295 extensions) were simplistic utilities that had no other function than to apply a custom background for Chrome's "new tab" page. In addition to the 295 cluster, AdGuard also found a large number of copycat extensions that cloned popular add-ons to capitalize on their brands, and then load malicious code that performed ad fraud or cookie stuffing. ZDNet has the full list of 295 Chrome extensions embedded in their article.' -- source: https://search.slashdot.org/story/20/08/05/213204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Massive 20GB Intel IP Data Breach Floods the Internet, Mentions Backdoors
by Peter Reutemann 07 Aug '20

07 Aug '20

'A leaker today posted on Twitter a link to a file sharing service that contains what an anonymous source claims is a portion of Intel's crown jewels: A 20GB folder of confidential Intel intellectual property. The leaker dubbed the release the "Intel exconfidential Lake Platform Release ;)" The folder has been posted by an anonymous source that claims more is coming soon, and while we don't know the exact specifics of the folder's contents, we have verified that it does exist. In fact, the title of many of the documents do correlate to the list of purported information posted by the leaker: Intel ME Bringup guides + (flash) tooling + samples for various platforms Kabylake (Purley Platform) BIOS Reference Code and Sample Code + Initialization code (some of it as exported git repos with full history) Intel CEFDK (Consumer Electronics Firmware Development Kit (Bootloader stuff)) SOURCES Silicon / FSP source code packages for various platforms Various Intel Development and Debugging Tools Simics Simulation for Rocket Lake S and potentially other platforms Various roadmaps and other documents Binaries for Camera drivers Intel made for SpaceX Schematics, Docs, Tools + Firmware for the unreleased Tiger Lake platform (very horrible) Kabylake FDK training videos Intel Trace Hub + decoder files for various Intel ME versions Elkhart Lake Silicon Reference and Platform Sample Code Some Verilog stuff for various Xeon Platforms, unsure what it is exactly. Debug BIOS/TXE builds for various Platforms Bootguard SDK (encrypted zip) Intel Snowridge / Snowfish Process Simulator ADK Various schematics Intel Marketing Material Templates (InDesign)' -- source: https://slashdot.org/story/20/08/06/199225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome for Android May Soon Send Notifications Reminding You To Use Chrome
by Peter Reutemann 06 Aug '20

06 Aug '20

'For years now, Google Chrome has been an absolute dominant force in the world of web browsers, but since the relaunch of Microsoft Edge based on Google's Chromium, that position has been challenged. Now, Google is preparing to drive more Android owners back to using Chrome through targeted notifications. Over the admittedly brief history of the Internet, there have been a number of fierce competitions, commonly called "browser wars," between companies, in an effort to get more people to use their particular web browser. Mozilla and Netscape waged war against Internet Explorer, and Chrome fought and won against Firefox. Most recently, Microsoft Edge and Samsung Internet have begun to wage war against Chrome on desktop and Android respectively. Now, we've found that Google is preparing to try and win back some of those who have left Chrome for other browsers, starting on Android. Based on our reading of a series of code changes, we believe Google Chrome for Android will send you a notification if you haven't used Chrome in a while.' -- source: https://it.slashdot.org/story/20/08/05/2022204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Online Hacker Court Hearing Gets Hacked
by Lawrence D'Oliveiro 06 Aug '20

06 Aug '20

A bail hearing being conducted via Zoom video conference concerning the hacker who is accused of taking over several Twitter accounts to commit a Bitcoin fraud got “Zoombombed” by unidentified parties who interjected videos of racial slurs, music and porn <https://arstechnica.com/tech-policy/2020/08/zoombomber-crashes-court-hearin…>. Priceless subhead: “Judge will require password next time”.

1 0

Hackers Could Use IoT Botnets To Manipulate Energy Markets
by Peter Reutemann 06 Aug '20

06 Aug '20

'Wired: At the Black Hat security conference on Wednesday, [researchers at the Georgia Institute of Technology] will present their findings, which suggest that high-wattage IoT botnets -- made up of power-guzzling devices like air conditioners, car chargers, and smart thermostats -- could be deployed strategically to increase demand at certain times in any of the nine private energy markets around the US. A savvy attacker, they say, would be able to stealthily force price fluctuations in the service of profit, chaos, or both. The researchers used real, publicly available data from the New York and California markets between May 2018 and May 2019 to study fluctuations in both the "day-ahead market" that forecasts demand and the "real-time market," in which buyers and sellers correct for forecasting errors and unpredictable events like natural disasters. By modeling how much power various hypothetical high-wattage IoT botnets could draw, and crunching the market data, the researchers devised two types of potential attacks that would alter energy pricing. They also figured out how far hackers would be able to push their attacks without the malicious activity raising red flags. "Our basic assumption is that we have access to a high-wattage IoT botnet," says Tohid Shekari, a PhD candidate at the Georgia Institute of Technology who contributed to the research, along with fellow PhD candidate Celine Irvine and professor Raheem Beyah. "In our scenarios, attacker one is a market player; he's basically trying to maximize his own profit. Attacker two is a nation-state actor who can cause financial damage to market players as part of a trade war or cold war. The basic part of either attack is to look at price-load sensitivity. If we change demand by 1 percent, how much is the price going to change as a result of that? You want to optimize the attack to maximize the gain or damage." An attacker could use their botnet's power to increase demand, for instance, when other entities are betting it will be low. Or they could bet that demand will go up at a certain time with certainty that they can make that happen. "The researchers caution that, based on their analysis, much smaller demand fluctuations than you might expect could affect pricing, and that it would take as few as 50,000 infected devices to pull off an impactful attack," the report adds. "Consumers whose devices are unwittingly conscripted into a high-wattage botnet would also be unlikely to notice anything amiss; attackers could intentionally turn on devices to pull power late at night or while people are likely to be out of the house. [...] The researchers calculated that market manipulation campaigns would cause, at most, a 7 percent increase in consumers' home electric bills, likely low enough to go unnoticed." The researchers say market manipulators could take home as much as $245 million a year, and cause as much as $350 million per year in economic damage.' -- source: https://hardware.slashdot.org/story/20/08/04/2213253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

LastPass Will Warn You If Your Passwords Show Up On the Dark Web
by Peter Reutemann 06 Aug '20

06 Aug '20

'LastPass is updating its Security Dashboard with a feature that provides an overview of all your accounts, highlighting any passwords that could pose a security risk. The password manager is also introducing dark web monitoring, although it will require you to be a paid LastPass subscriber. Engadget reports: If you already use LastPass and the Security Dashboard sounds familiar, it's because it builds on the Security Challenge functionality LastPass developer LogMeIn added in 2010. As before, grading is a major aspect of the interface. When you first navigate to the Security Dashboard, you'll see a score of all your logins, followed by a breakdown of passwords that are either old, inactive, weak or reused. You can click or tap on a problematic password to change it, and LastPass will automatically take you to the webpage where you can update your login information. LogMeIn hasn't changed how the app calculates the overall score it gives to each user. But one significant improvement the Security Dashboard brings over the Security Challenge is that you don't need to manually run it each time you want to see the security of your online accounts. The score and steps you can take to improve your online security are there each time you visit that part of the software's interface. With today's update, LogMeIn is also introducing dark web monitoring. When you enable the feature, LastPass will proactively check your online accounts against Enzoic's compromised credentials database. If it detects an issue, it will notify you through both email and the app. Dark web monitoring is available to LastPass Premium, Family and Business subscribers. The dashboard, by contrast, is available to all LastPass users. ' -- source: https://it.slashdot.org/story/20/08/05/2027246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Leaks Passwords For 900+ Enterprise VPN Servers
by Peter Reutemann 06 Aug '20

06 Aug '20

'A hacker has published today a list of plaintext usernames and passwords, along with IP addresses for more than 900 Pulse Secure VPN enterprise servers. ZDNet reports: According to a review, the list includes: IP addresses of Pulse Secure VPN servers, Pulse Secure VPN server firmware version, SSH keys for each server, a list of all local users and their password hashes, admin account details, last VPN logins (including usernames and cleartext passwords), and VPN session cookies. Bank Security, a threat intelligence analyst specialized in financial crime [...] noted that all the Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability. Bank Security believes that the hacker who compiled this list scanned the entire internet IPv4 address space for Pulse Secure VPN servers, used an exploit for the CVE-2019-11510 vulnerability to gain access to systems, dump server details (including usernames and passwords), and then collected all the information in one central repository. Making matters worse, the list has been shared on a hacker forum that is frequented by multiple ransomware gangs. For example, the REvil (Sodinokibi), NetWalker, Lockbit, Avaddonm, Makop, and Exorcist ransomware gangs have threads on the same forum, and use it to recruit members (developers) and affiliates (customers). Many of these gangs perform intrusions into corporate networks by leveraging network edge devices like Pulse Secure VPN servers, and then deploy their ransomware payload and demand huge ransom demands. As Bank Security told ZDNet, companies have to patch their Pulse Secure VPNs and change passwords with the utmost urgency. ' -- source: https://it.slashdot.org/story/20/08/04/2333258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Twitter Says Android Security Bug Gave Access To Direct Messages
by Peter Reutemann 06 Aug '20

06 Aug '20

'Twitter says a security bug may have exposed the private direct messages of its Android app users, but said that there was no evidence that the vulnerability was ever exploited. From a report: The bug could have allowed a malicious Android app running on the same device to siphon off a user's direct messages stored in the Twitter app by bypassing Android's in-built data permissions. But, Twitter said that the bug only worked on Android 8 (Oreo) and Android 9 (Pie), and has since been fixed. A Twitter spokesperson told TechCrunch that the bug was reported by a security researcher "a few weeks ago" through HackerOne, which Twitter uses for its bug bounty program. "Since then, we have been working to keep accounts secure," said the spokesperson. "Now that the issue has been fixed, we're letting people know." Twitter said it waited to let its users know in order to prevent someone from learning about the issue and taking advantage of it before it was fixed.' -- source: https://yro.slashdot.org/story/20/08/05/1728253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cambridge University Goes Microsoft
by Lawrence D'Oliveiro 05 Aug '20

05 Aug '20

Cambridge University, one of the pioneering centres of computer science research (since 1937), is retiring its in-house Hermes e-mail system in favour of moving completely to Microsoft Exchange Online <https://www.theregister.com/2020/08/04/cambridge_uni_decommissioning_hermes…>. Admin David McBride argues that Microsoft “does not implement IETF standards – at least not competently". In particular, he said: "Its IMAP service implementation is sufficiently poor as to lose data in practice, its mail handling has been seen to violate RFC MUST assertions that causes cryptographic email signatures to be rendered invalid, and it has even sometimes generated outbound email that contains invalid MIME data." He added: "Email services that do not competently support IETF standards, such as SMTP, IMAP, MIME and the like, present significant interoperability challenges and will risk leaving us locked in to using a single vendor." According to the info here <https://fanf2.user.srcf.net/photos.html> (linked from a reader comment), Hermes is not some kind of homebrew proprietary system; it is built on well-known open-source components such as Exim and Cyrus.

1 0

Windows 10: HOSTS File Blocking Telemetry Is Now Flagged As a Risk
by Peter Reutemann 05 Aug '20

05 Aug '20

'Starting at the end of July, Microsoft has begun detecting HOSTS files that block Windows 10 telemetry servers as a 'Severe' security risk. Windows 10 users are reporting that Windows Defender had started detectingmodified HOSTS files as a 'SettingsModifier:Win32/HostsFileHijack' threat. So it seems that Microsoft had recently updated their Microsoft Defender definitions to detect when their servers were added to the HOSTS file. Users who utilize HOSTS files to block Windows 10 telemetry suddenly caused them to see the HOSTS file hijack detection. Users who intentionally modify their HOSTS file can allow this 'threat,' but it may enable all HOSTS modifications, even malicious ones, going forward.' -- source: https://tech.slashdot.org/story/20/08/04/143248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 79 Clears Redirect Tracking Cookies Every 24 Hours
by Peter Reutemann 05 Aug '20

05 Aug '20

'Mozilla today started rolling out Enhanced Tracking Protection (ETP) 2.0 in Firefox. While the company technically launched Firefox 79 for Windows, Mac, and Linux last week, it only unveiled its marquee feature today. Firefox 79 by default blocks redirect tracking, also known as bounce tracking, and adds a handful of new developer features. [...] Since enabling Enhanced Tracking Protection by default, Mozilla says it has blocked 3.4 trillion tracking cookies. But the company notes the ad industry has since created workarounds and new ways to collect user data as you browse the web.' -- source: https://news.slashdot.org/story/20/08/04/176239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's Nearby Share' File Sharing Feature is Finally Launching
by Peter Reutemann 05 Aug '20

05 Aug '20

'It will finally be slightly easier to share files, images, links, and other content between Android devices. Google is launching a new Android feature called "Nearby Share" that enables direct sharing between any device running Android 6 and up. Nearby Share is already available on some Pixel and Samsung phones, and Google says it'll arrive on other devices "over the next few weeks." From a report: Nearby Share works very much like Apple's AirDrop feature for the iPhone: you simply select the Nearby Share button on the share menu and then wait for a nearby phone to appear. Then whatever thing you're sharing is sent directly over your transfer method of choice to the other phone. As with AirDrop, you can set your preferred visibility for Nearby Share to different levels of contacts: all, some, or stay hidden. Google says it's even possible to "send and receive files anonymously." (Welcome to AirSlothing, Android users.) Nearby Share also shares files directly via whatever method your two phones deem is fastest: "Bluetooth, Bluetooth Low Energy, WebRTC or peer-to-peer Wi-Fi," which Google says should allow it to work offline.' -- source: https://tech.slashdot.org/story/20/08/04/1935221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Decades-Old Email Flaws Could Let Attackers Mask Their Identities
by Peter Reutemann 05 Aug '20

05 Aug '20

'At the Black Hat security conference on Thursday, researchers will present "darn subtle" flaws in industry-wide protections used to ensure that emails come from the address they claim to. From a report: The study looked at the big three protocols used in email sender authentication -- Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) -- and found 18 instances of what the researchers call "evasion exploits." The vulnerabilities don't stem from the protocols themselves, but from how different email services and client applications implement them. Attackers could use these loopholes to make spearphishing attacks even harder to detect. "I think I'm a savvy, educated user and the reality is, no, that's actually not enough," says Vern Paxson, cofounder of the network traffic analysis firm Corelight and a researcher at the University of California, Berkeley, who worked on the study along with Jianjun Chen, a postdoctoral researcher at the International Computer Science Institute, and Jian Jiang, senior director of engineering at Shape Security. "Even users who are pretty savvy are going to look at the indicators that Gmail or Hotmail or others provide and be fooled," Paxson says. Think about when you hand a friend a birthday card at their party. You probably only write their first name on the outside of the envelope, and maybe underline it or draw a heart. If you mail that letter instead, though, you need the recipient's full name and detailed address, a stamp, and ultimately a postmark with a date on it. Sending email across the internet works similarly. Though email services only require you to fill out the "To" and "Subject" fields, there's a whole list of more detailed information getting filled out behind the scenes. Those industry-standard "headers," as they're known, include date and time sent and received, language, a unique identifier called a Message-ID, and routing information.' -- source: https://it.slashdot.org/story/20/08/04/2037238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome and Edge Rise In Popularity. Firefox, Opera, and Safari Drop.
by Peter Reutemann 04 Aug '20

04 Aug '20

'July's statistics from web analytics firm Net Applications showed continuing changes in the most frequently-used web browsers. Softpedia reports: Last month, Google Chrome increased its market share from 70.19% to 71.00%, while Microsoft Edge jumped from 8.07% to 8.46%... The migration to the Chromium engine allowed Microsoft to turn Edge into a cross-platform browser, and this is one of the reasons that contributed to the growth of the new app. Edge is now available not only on Windows 10, but also on Windows 7, Windows 8, Windows 8.1, and even macOS. At the same time, Microsoft is also working on a Linux version of the browser, and a preview build is expected by the end of the year. But what made Microsoft Edge the second most-used desktop browser out there so fast after the switch to Chromium is definitely Microsoft offering it as the default browser in Windows 10. But what about Firefox? And Opera, and Apple's Safari? Computerworld reports: A decade ago, Mozilla's browser may have dreamed of upsetting the then-order of things, taking its April 2010 share of 25.1% and parlaying it into victory over IE — down to 61.2% by then... But that was Firefox's peak. At the end of July, Firefox stood at 7.3%, down three-tenths of a percentage point from the previous month... Firefox let its second-place spot (far, far behind Chrome) slip away in March, when Edge snatched it. That did not change in July. The gap between the two more than doubled, in fact, to 1.2 points. On almost every browser share metric, Firefox is in trouble... Since the end of January, Firefox has been stuck in the 7s; for the eight months before that, it was mired in the 8s; and between May 2018 and March 2019, Firefox floundered in the 9s. The trend is crystal clear... Elsewhere in Net Applications' numbers, Apple's Safari plunged to 3%, a loss of six-tenths of a point, its lowest mark since late 2008. Opera software's Opera also took a dive, ending July at 0.8%, a decline of three-tenths of a point. Those numbers have to be frightening to both those browsers' makers.' -- source: https://news.slashdot.org/story/20/08/03/028217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Package management mistake borking some Ubuntu machines running WireGuard
by Eric Light 04 Aug '20

04 Aug '20

Morning folks! For those who watch WireGuard, Jason Donenfeld is giving the Canonical kernel team a damn roasting after they bungled a Provides statement in about half of their Linux kernel manifests... which borks certain systems running WireGuard. For example, systems with the linux-image-oem kernel will try to install the linux-image-gke kernel (meant for the Google Kubernetes Engine), in order to receive the wireguard-modules package, leading to Proper Breakage. Donenfeld: "I'll note that this is at least the third time Canonical has forgotten the "Provides:" line for kernel packages. I'd highly recommend they put some time into double checking their procedures. [...] Usually things go quite a bit better with the WireGuard side of things, but this seems pretty par for the course with _Ubuntu_ and Canonical's kernel team. We've had perpetual issues over the last 6 months with getting Canonical to release high quality packages in a timely manner. A pretty large portion of my time is spent dealing with these bugs and Ubuntu in general." Looks like Canonical's kernel packaging team are already working on it, after Jason Donenfeld escalated a bug report earlier this morning. E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

1 0

Red Hat Security Update Renders Systems Unbootable
by Peter Reutemann 04 Aug '20

04 Aug '20

'A recently released Red Hat update for the BootHole Vulnerability (firehose link) is causing systems to become unbootable. It is widely reported that updates to the shim, grub2 and kernel packages in RHEL and CentOS 7 and 8 are leaving various systems that use secure boot unbootable. Current recommendations are to avoid updating your system until the issue is resolved, or at least avoid updating the shim, grub2 and kernel packages. Update, shared by PAjamian: Red Hat is now recommending that users do not apply grub2, fwupd, fwupdate or shim updates until new packages are available.' -- source: https://linux.slashdot.org/story/20/07/31/158212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 4

O/T: Waikato-based laptop repairer
by David McNab 01 Aug '20

01 Aug '20

Hi all, Apologies for being slightly off-topic. Does anyone know of a computer repairer in/around Hamilton, who can do board-level troubleshooting and repair on laptops, without having to "send it to Auckland"? I've got a Gigabyte i7 laptop which became unable to charge its battery a couple of years ago. I was able to run it plugged into the mains since then. But just now, it won't even start up at all. I'd like someone to do some quick tests to determine if it's a feasible repair and, if so, give a cost estimate. Oh, but it was running Ubuntu, so not completely off-topic ;) All suggestions appreciated Cheers David

1 0

Allowing PBL'ed IP addresses in Postfix
by David McNab 31 Jul '20

31 Jul '20

Hi, Has anyone had experience with configuring Postfix to allow inbound client SMTP connections from NZ-based IP addresses that have been Policy Block Listed (PBL'ed) by their ISP? Spark have PBL'ed most or all of their home and small business fibre/*DSL connection IP addresses. 2degrees have PBL'ed most/all of their cellular data IP addresses. I'm trying to support a user to send email from their cellphone email client. Cheers David

4 5

Bug In Grub2 Breaks Secure Boot (Yawn)
by Lawrence D'Oliveiro 30 Jul '20

30 Jul '20

Seems a vulnerability has been found in everyone’s favourite bootloader <https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-sec…> which allows a bypass of the “Secure Boot” mechanism in modern UEFI-based machines. But given that so many other bypasses already exist, nobody seems especially worried about this. For example, the article references an attempt by Microsoft to revoke the certification of (an obsolete version of) a secure bootloader from Kaspersky Lab with a vulnerability in it; the revocation caused so many headaches for users that it had to be rolled back.

1 0

NoiseTorch
by Peter Reutemann 28 Jul '20

28 Jul '20

Hi everyone Angus mentioned NoiseTorch at last night's meeting as a way of avoiding noise from being recorded when using microphones: 'NoiseTorch is an easy to use open source application for Linux with PulseAudio. It creates a virtual microphone that suppresses noise, in any application. Use whichever conferencing or VOIP application you like and simply select the NoiseTorch Virtual Microphone as input to torch the sound of your mechanical keyboard, computer fans, trains and the likes.' -- source: https://github.com/lawl/NoiseTorch Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Stole GitHub and GitLab OAuth Tokens From Git Analytics Firm Waydev
by Peter Reutemann 28 Jul '20

28 Jul '20

'Waydev, an analytics platform used by software companies, has disclosed a security breach that occurred earlier this month. From a report: The company says that hackers broke into its platform and stole GitHub and GitLab OAuth tokens from its internal database. Waydev, a San Francisco-based company, runs a platform that can be used to track software engineers' work output by analyzing Git-based codebases. To do this, Waydev runs a special app listed on the GitHub and GitLab app stores. When users install the app, Waydev receives an OAuth token that it can use to access its customers' GitHub or GitLab projects. Waydev stores this token in its database and uses it on a daily basis to generate analytical reports for its customers. Waydev CEO and co-founder Alex Circei told ZDNet today in a phone call that hackers used a blind SQL injection vulnerability to gain access to its database, from where they stole GitHub and GitLab OAuth tokens. The hackers then used some of these tokens to pivot to other companies' codebases and gain access to their source code projects.' -- source: https://tech.slashdot.org/story/20/07/27/1918237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting suggestions?
by Peter Reutemann 26 Jul '20

26 Jul '20

Hi everyone For our first in-person meeting after the lockdown on July 27th, any ideas for topics? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

World’s Fastest Computer Is ARM
by Lawrence D'Oliveiro 26 Jul '20

26 Jul '20

Looking at the June Top500 list <https://top500.org/lists/top500/list/2020/06/>, the current number 1, Japan’s Fugaku, uses over 7 million A64FX cores and close to 5 petabytes of RAM. Numbers 2 and 3 are based on IBM’s POWER architecture, while number 4 is a Chinese RISC-based machine, which might have some resemblance to the DEC Alpha <https://en.wikipedia.org/wiki/Sunway_(processor)>, or MIPS, or not. It’s not until 5th place does x86 make an appearance.

1 0

Popular Chinese-Made Drone Is Found To Have Security Weakness
by Peter Reutemann 24 Jul '20

24 Jul '20

'Cybersecurity researchers revealed on Thursday a newfound vulnerability in an app that controls the world's most popular consumer drones, threatening to intensify the growing tensions between China and the United States. From a report: In two reports, the researchers contended that an app on Google's Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft. The world's largest maker of commercial drones, DJI has found itself increasingly in the cross hairs of the United States government, as have other successful Chinese companies. The Pentagon has banned the use of its drones, and in January the Interior Department decided to continue grounding its fleet of the company's drones over security fears. DJI said the decision was about politics, not software vulnerabilities. For months, U.S. government officials have stepped up warnings about the Chinese government's potentially exploiting weaknesses in tech products to force companies there to give up information about American users. Chinese companies must comply with any government request to turn over data, according to American officials. "Every Chinese technology company is required by Chinese law to provide information they obtain, or information stored on their networks, to Chinese authorities if requested to do so," said William R. Evanina, director of the National Counterintelligence and Security Center. "All Americans should be concerned that their images, biometrics, locational and other data stored on Chinese apps must be turned over to China's state security apparatus." The drone vulnerability, said American officials, is the kind of security hole that worries Washington.' -- source: https://it.slashdot.org/story/20/07/23/1437214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
by Lawrence D'Oliveiro 23 Jul '20

23 Jul '20

This paper <http://people.cs.uchicago.edu/%7Eravenben/publications/abstracts/fawkes-use…>, presented at USENIX Security 2020, discusses techniques for allowing you to continue to share images of yourself online while making them resistant to automated exploitation by “deep-learning” facial-recognition software. The researchers found that they could make subtle distortions to facial images, imperceptible to the human eye, that would severely confuse recognition services from major providers like Microsoft and Amazon. (Found from Bruce Schneier <https://www.schneier.com/blog/archives/2020/07/fawkes_digital_.html>.)

1 0

We test Mozilla’s new Wireguard-based $5/mo VPN service
by Peter Reutemann 23 Jul '20

23 Jul '20

'Mozilla, the open source company best known for the Firefox Web browser, made its VPN service generally available in the United States this month. The cross-platform VPN is based on Wireguard and delivered in partnership with well-known and especially techie-friendly VPN provider Mullvad. Mullvad itself was, to the best of our knowledge, the first publicly available VPN provider to offer Wireguard support back in 2017. The Mozilla VPN service costs $4.95 per month and offers server endpoints in 30-plus countries. It currently has VPN clients available for Windows 10, Android, and iOS—but users of other operating systems, such as MacOS and Linux, are going to have to wait. Mozilla says that support for MacOS and Linux is coming soon—but unfortunately, even if you're an advanced user who understands Wireguard configs, you can't just roll your own connection now. The service authenticates via Firefox cloud account. When you sign up for a Mozilla VPN subscription, you'll be asked to create a Firefox account if you don't already have one. The Firefox account is an SSO (Single Sign On) service which uses oauth2, much like a Google account—but it's not tied to a Google account, so even if you sign up using a Gmail address tied to an Android device, that device won't be automatically logged in. Aside from the Firefox-based oauth2 integration, Mozilla's VPN appears to effectively be a Mullvad VPN, with a different client application and different billing entity. It is a bit less expensive through Mozilla, though—Mullvad costs €5 per month. This makes Mozilla's offering about $0.80 per month cheaper, at current exchange rates.' -- source: https://arstechnica.com/gadgets/2020/07/we-test-mozillas-new-wireguard-base… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lambton Property Management Privacy Breach
by Lawrence D'Oliveiro 22 Jul '20

22 Jul '20

A whole bunch of tenants who have had dealings with Lambton Property Management have had their confidential personal details compromised, according to TVNZ <https://www.tvnz.co.nz/one-news/new-zealand/thousands-kiwis-could-have-had-…>, <https://www.tvnz.co.nz/one-news/new-zealand/second-researcher-gains-access-…>. Neither of those articles gives much detail about the nature of the breach, but going to the source <https://cybernews.com/security/new-zealand-property-management-company-leak…> confirms it’s another instance of the all-too-frequent situation of an improperly-secured public cloud area.

1 0

Fwd: [NZLUG] Free intro course
by Peter Reutemann 22 Jul '20

22 Jul '20

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message --------- From: DL Neil <...> Date: Wed, Jul 22, 2020 at 4:47 PM Subject: [NZLUG] Free intro course To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> Video-based course providing a basic introduction to Linux. Video 1. What are Linux, open source software, and a distribution? Video 2. Introduction to the shell Video 3. Kernel and user spaces Video 4. Orientation to the graphical user interface Video 5. File management in Linux Video 6. The file system hierarchy Video 7. Editing files using Vim Video 8. Organizing users and groups Video 9. File permissions Video 10. Managing software Video 11. Configuring networking Video 12. Controlling system startup processes Video 13. Introduction to containers Video 14. Overview of cockpit Video 15. Learning more about Red Hat Enterprise Linux 8 https://www.redhat.com/en/services/training/rh024-red-hat-linux-technical-o… -- Regards, =dn _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Incognito Mode Detection Still Works in Chrome Despite Promise To Fix
by Peter Reutemann 22 Jul '20

22 Jul '20

'Websites are still capable of detecting when a visitor is using Chrome's incognito (private browsing) mode, despite Google's efforts last year to disrupt the practice. From a report: It is still possible to detect incognito mode in Chrome, and all the other Chromium-based browsers, such as Edge, Opera, Vivaldi, and Brave, all of which share the core of Chrome's codebase. Furthermore, developers have taken the scripts shared last year and have expanded support to non-Chrome browsers, such as Firefox and Safari, allowing sites to block users in incognito mode across the board. Currently, there is no deadline for a new Chrome update to block incognito mode detections, however, today, Google might be interested more than ever in fixing this issue' -- source: https://yro.slashdot.org/story/20/06/04/1857211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

SUSE Releases Major Linux Update
by Peter Reutemann 22 Jul '20

22 Jul '20

'SUSE has released the next versions of its flagship operating system, SUSE Linux Enterprise (SLE) 15 Service Pack 2 and its latest infrastructure management program, SUSE Manager 4.1. ZDNet reports: SLE 15 SP2 is available on the x86-64, Arm, IBM POWER, IBM Z, and LinuxONE hardware architectures. This new Linux server edition is based on the Linux 5.3 kernel. This new kernel release includes upstream features such as utilization clamping support in the task scheduler, and power-efficient userspace waiting. Other new and noteworthy features include: - Support for migration from openSUSE Leap to SUSE Linux Enterprise Server (SLES). With this, you can try the free, community openSUSE Linux distro, and then, if you find it's a good choice for your business, upgrade to SLES. - Extended Package Search. By using the new Zypper, SUSE's command line package manager, command option -- zypper search-packages -- sysadmins can now search across all SUSE repositories, even unenabled ones. This makes it easier for administrators to find required software packages. - SLE Software Development Kit (SDK) is now integrated into SLE. Development packages are packaged alongside regular packages. - Python 3: SLE 15 offers full support for Python 3 development. SLE still supports Python 2 for the time being. - 389 Directory Server replaces OpenLDAP as the LDAP directory service. - Repository Mirroring Tool (RMT) replaces Subscription Management Tool (SMT). RMT allows mirroring SUSE repositories and custom repositories. You can then register systems directly with RMT. In environments with tightened security, RMT can also proxy other RMT servers. - Better business continuity with improved SLE Live Patching. SUSE claims Live Patching increases system uptime by up to 12 months. SLE Live Patching is also now available for IBM Z and LinuxONE mainframe architectures. As for SUSE Manager 4.1, this is an improved open-source infrastructure management and automation solution that lowers costs, identifies risk, enhances availability, and reduces complexity in edge, cloud, and data center environments. With SUSE Manager you can keep servers, VMs, containers, and clusters secure, healthy, compliant, and low maintenance whether in private, public, or hybrid cloud. That's especially important these days thanks to coronavirus pandemic IT staff disruptions. SUSE Manager 4.1 can also be used with the Salt DevOps program. Its vertical-market brother, SUSE Manager for Retail 4.1, is optimized and tailored specifically for retail. This release comes with enhancements for small store operations, enhanced offline capabilities and image management over Wi-Fi, and enhanced virtual machine management and monitoring capabilities. Simultaneously it can scale retail environments to tens of thousands of end-point devices and help modernize point-of-service rollouts.' -- source: https://linux.slashdot.org/story/20/07/21/2152237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Brings Procmon To Linux
by Peter Reutemann 21 Jul '20

21 Jul '20

'ProcMon for Linux is Microsoft's newest open-source Linux software. ProcMon is a rewritten and re-imagined version of its Processor Monitor found on Windows within their Sysinternals suite. From a report: Microsoft explains, "The Procmon is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system."' -- source: https://it.slashdot.org/story/20/07/20/205232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source Code of Covid Tracker Ireland App Goes Global With Linux Project
by Peter Reutemann 21 Jul '20

21 Jul '20

'The Linux Foundation Public Health initiative has chosen the Covid Tracker Ireland app as one of its first two open-source Covid-19 projects. From a report: Since its launch, more than 1.3m people have downloaded the Covid Tracker Ireland app, which was developed to help track the future spread of the coronavirus. Now, the app has been chosen as one of the first two open-source contact-tracing projects by the newly established Linux Foundation Public Health (LFPH) initiative. Nearform, the Waterford-based company that developed the app with the HSE, has been made one of the initiative's seven premium members, along with Cisco, Doc.ai, Geometer, IBM, Tencent and VMware. Under the project name 'Covid Green', the source code of the Irish app is being made available for other public health authorities and their developers across the world to use and customise. As part of the agreement, Nearform will manage the source code repository on GitHub. In its announcement, the LFPH pointed to the "extraordinarily high" adoption rate of the Covid Tracker Ireland app.' -- source: https://linux.slashdot.org/story/20/07/20/168224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BadPower Attack Corrupts Fast Chargers To Melt or Set Your Device on Fire
by Peter Reutemann 21 Jul '20

21 Jul '20

'Chinese security researchers said they can alter the firmware of fast chargers to cause damage to connected (charging) systems, such as melt the components, or even set devices on fire. Iwastheone shares a report: The technique, named BadPower, was detailed last week in a report published by Xuanwu Lab, a research unit of Chinese tech giant Tencent. According to researchers, BadPower works by corrupting the firmware of fast chargers -- a new type of charger that was developed in the past few years to speed up charging times. A fast charger looks like any typical charger but works using special firmware. This firmware "talks" to a connected device and negotiates a charging speed, based on the device's capabilities. If a fast-charging feature is not supported, the fast charger delivers the standard 5V, but if the device can handle bigger inputs, the fast charger can deliver up to 12V, 20V, or even more, for faster charging speeds. The BadPower technique works by altering the default charging parameters to deliver more voltage than the receiving device can handle, which degrades and damages the receiver's components, as they heat up, bend, melt, or even burn.' -- source: https://tech.slashdot.org/story/20/07/20/1624200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Could Pine64's Cheap Linux Smartphone Replace Your PC?
by Peter Reutemann 20 Jul '20

20 Jul '20

'TechRadar reports on Pine64's new "PinePhone Convergence Package" handset, calling it "a Linux desktop you can keep in your pocket" that can be used as a PC when plugged into an external display and a keyboard. The device costs just $199 and is aimed primarily at Linux enthusiasts. The PinePhone Linux smartphone is based on the Alpine Linux-based PostmarketOS that can be used both in smartphone and desktop modes... The main component that transforms the PinePhone into a PC-like device is its USB-C docking bar that features an HDMI display output, two USB Type-A connectors, and a 10/100Mb Ethernet port. The idea of using a smartphone with an external display and keyboard to run certain applications has not gained much traction neither with HP's Elite x3 Windows Phone 10 handset nor with Samsung's smartphones with its DeX software. Perhaps, since Linux community is generally more inclined to experiment with their gadgets (and their time), Pine64's PinePhone Convergence has a better chance to be actually used as a desktop by its owners. ' -- source: https://linux.slashdot.org/story/20/07/19/2252214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

'Mozilla VPN' Launches in Six Countries
by Peter Reutemann 20 Jul '20

20 Jul '20

'"Starting today, there's a VPN on the market from a company you trust," Mozilla announced Wednesday. Mozilla VPN is now officially available for Windows and Android in six countries: the U.S., Canada, the U.K., Singapore, Malaysia, and New Zealand, and it'll be coming to even more countries later this year, reports the Verge: The service is available for $4.99 a month, and, like other VPNs, it's designed to make your web-browsing more private and secure. As part of the move, the service is being rebranded from Firefox Private Network to Mozilla VPN, a change that was announced last month. Mozilla argues that its VPN service has a couple of advantages over its many competitors. It says it should offer a faster browsing experience in many cases because it's based on a protocol with less than a third of the lines of code of an average VPN service provider. The company is also banking on the reputation it's built up with its privacy-focused browser, and it adds that it only collects the information it needs to run a service and doesn't keep user data logs. The VPN's launch follows beta trials in the US, which also included tests of a VPN built directly into the Firefox browser. Last month, Mozilla announced that it would be testing asking users to pay $2.99 a month for unlimited usage of the extension, which is designed to mask your traffic within the browser rather than at a system-wide level.' -- source: https://tech.slashdot.org/story/20/07/19/0437230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VPN With 'Strict No-Logs Policy' Exposed Millions of User Log Files
by Peter Reutemann 19 Jul '20

19 Jul '20

'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks. Contained within the database were more than 20 million logs including user passwords stored in plain text. User of both UFO VPN free and paid services are affected by the data breach which was discovered by the security research team at Comparitech. Despite the Hong Kong-based VPN provider claiming to have a "strict no-logs policy" and that any data collected is anonymized, Comparitech says that "based on the contents of the database, users' information does not appear to be anonymous at all." A total of 894GB of data was exposed, and the API access records and user logs included: Account passwords in plain text; VPN session secrets and tokens; IP addresses of both user devices and the VPN servers they connected to; Connection timestamps; Geo-tags; Device and OS characteristics; and URLs that appear to be domains from which advertisements are injected into free users' web browsers. Comparitech notes that this runs counter to UFO VPN's privacy policy.' -- source: https://it.slashdot.org/story/20/07/17/2338230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

LibreOffice Ructions
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

From <https://www.theregister.com/2020/07/16/libreoffice_ecosystem_beyond_utterly…>: Michael Meeks: “Words fail me to express how beyond-utterly-broken the existing TDF / desktop model is for the ecosystem around selling desktop LibreOffice.” As you may know, LibreOffice is overseen by The Document Foundation, which is a charity registered in Germany. And it currently has about €1.5 million in the bank. However, owing to peculiarities of German law (or maybe just the way they are interpreting it), none of that money is actually allowed to be spent on software development.

1 0

The Pros & Cons Of Virtual Meetings
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

<https://www.theregister.com/2020/07/16/virtual_internet_governance_meeting_…>: The move to virtual meetings among internet governance bodies has had mixed results ... “Previously, physical intergovernmental meetings were represented by a select few per economy that could afford to travel to these closed-door meetings. Economies with smaller travel budgets and small delegations tend to be at a disadvantage in terms of getting their views adequately represented.” But smaller nations may have another problem: unreliable internet access. ... “In addition, virtual meetings do not lend themselves well to effective ‘corridor chats’, where many private conversations and negotiations take place at the sidelines of the meeting. ...” “Remote participants in a virtual meeting generally come with pre-baked positions that sometimes become intractable due to the lack of opportunities for proper engagement ... [resulting in] the inability to reach a compromise in an effective and efficient manner.”

1 0

New Pine64 phones with upgraded hardware begin shipping in August
by Peter Reutemann 17 Jul '20

17 Jul '20

'Yesterday, Pine64 announced the end of the PinePhone UBPorts Community Edition campaign—but more importantly, the company declared the beginning of the postmarketOS Community Edition campaign. The base version of the new run of PinePhones shares the same $149 price point and the same basic technical specs as the original developer edition—but there's also a new, upgraded "Convergence Package" available at $199. Before anyone gets too excited, we need to make something clear—these devices, while attractively priced, should be considered beta gadgets for tinkerers to experiment and play with. They are not yet fully functional phones, and in their current development status, they are unlikely to be anyone's full-time daily-usage smartphone. The apps don't all work yet—including making calls—and battery life still leaves a lot to be desired.' -- source: https://arstechnica.com/gadgets/2020/07/pine64-launches-postmarketos-editio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 84 Arrives With SameSite Cookie Changes, Web OTP API and Web Animations
by Peter Reutemann 17 Jul '20

17 Jul '20

'Google today launched Chrome 84 for Windows, Mac, Linux, Android, and iOS. Chrome 84 resumes SameSite cookie changes, includes the Web OTP API and Web Animations API, and removes older Transport Layer Security (TLS) versions. [...] First deprecated with Chrome 81 in April, TLS 1.0 and TLS 1.1 have now been completely removed with Chrome 84. This is notable for anyone who manages a website, even if they donâ(TM)t use Chrome at home or at work. TLS is a cryptographic protocol designed to provide communications security over a computer network -- websites use it to secure all communications between their servers and browsers. TLS also succeeds Secure Sockets Layer (SSL) and thus handles the encryption of every HTTPS connection.' -- source: https://it.slashdot.org/story/20/07/16/1444257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA On Securing VPNs
by Lawrence D'Oliveiro 16 Jul '20

16 Jul '20

Bruce Schneier reports <https://www.schneier.com/blog/archives/2020/07/nsa_on_securing.html> on an advisory from the US National Security Agency on how to secure your VPN setup. The document is available in a 10-page or 2-page version. The tips can be summarized as * Reduce the VPN gateway attack surface * Verify on CNSSP-15-compliant algorithms are in use * Avoid using default settings * Remove unused or non-compliant cryptography suites * Apply vendor-provided updates The one about not using default settings I found interesting, the explanation given being that “many vendors provide default configurations, automated configuration scripts, or graphical user interface wizards to aid in the deployment of VPNs”, but that these tools/defaults may prioritize ease of setup over security, and therefore enable extra options that should not be enabled. The longer version gives detailed configuration examples.

1 0

Microsoft urges patching severe-impact, wormable server vulnerability
by Peter Reutemann 16 Jul '20

16 Jul '20

'Microsoft is urgently advising Windows server customers to patch a vulnerability that allows attackers to take control of entire networks with no user interaction and, from there, rapidly spread from computer to computer. The vulnerability, dubbed SigRed by the researchers who discovered it, resides in Windows DNS, a component that automatically responds to requests to translate a domain into the IP address computers need to locate it on the Internet. By sending maliciously formed queries, attackers can execute code that gains domain administrator rights and, from there, take control of an entire network. The vulnerability, which doesn’t apply to client versions of Windows, is present in server versions from 2003 to 2019. SigRed is formally tracked as CVE-2020-1350. Microsoft issued a fix as part of this month's Update Tuesday.' -- source: https://arstechnica.com/information-technology/2020/07/microsoft-urges-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SoftBank To Sell ARM?
by Lawrence D'Oliveiro 15 Jul '20

15 Jul '20

Just four years after acquiring it, SoftBank now wants to sell off Arm Holdings, the company that creates (and licenses) designs for ARM chips <https://www.theregister.com/2020/07/14/softbank_considering_arm_sale_report/>. Besides SoftBank’s well-known string of recent investment missteps, there was this interesting quote: Speaking to The Register, one company insider said SoftBank was dissatisfied with Arm's business model and wanted it to charge more for royalties. But if it does that, it just makes alternatives like RISC-V look more competitive.

1 0

Rust Code In The Linux Kernel?
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Looks like several kernel developers, up to and including Linus Torvalds himself, are receptive <https://www.theregister.com/2020/07/13/rust_code_in_linux_kernel/> towards including code written in Mozilla’s Rust language in the Linux kernel. Albeit Torvalds sees it being used, initially at least, in parts “not very central to the kernel itself”, like drivers. A principal feature of Rust is the strict way it manages memory pointers, to limit the scope for common mistakes like memory leaks and double-frees. But unlike other languages like Java, Go or Kotlin, it does not bake the overhead of garbage collection into the language itself. This makes it more suitable for high-performance and lower-level tasks than those languages. More info here: <https://www.rust-lang.org/>.

1 0

Microsoft’s Dotnet Core Runs Better On Linux Than Windows
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Microsoft now has a (pre-release) extension for Visual Studio <https://www.theregister.com/2020/07/13/microsoft_visual_studio_gets_net/> so that you can not only deploy your Dotnet Core application on Linux, you can now debug it on a genuine Linux environment as well, using WSL 2. Mentioned in passing in that report are a couple of stories of developers finding their apps run better on cloud Linux instances than on Windows ones. So it seems the only thing left running on Windows proper is Visual Studio itself.

1 0

Microsoft Dropping PHP For Windows
by Lawrence D'Oliveiro 13 Jul '20

13 Jul '20

I didn’t know that Microsoft had been offering “official” PHP builds for Windows versions up to 7.x, but that is now due to end <https://www.theregister.com/2020/07/10/microsoft_php/>: they will not supply builds for PHP 8.0 or later. Also interesting to note in the article that Windows IIS’ share of the web server market has fallen precipitously lately, and has become a poor third (or even fourth) behind Apache and Nginx. And Google!?

2 1

Linus Torvalds Hopes Intel's AVX-512 'Dies A Painful Death'
by Peter Reutemann 13 Jul '20

13 Jul '20

'"Linux creator Linus Torvalds had some choice words today on Advanced Vector Extensions 512 (AVX-512) found on select Intel processors," reports Phoronix: In a mailing list discussion stemming from the Phoronix article this week on the compiler instructions Intel is enabling for Alder Lake (and Sapphire Rapids), Linus Torvalds chimed in. The Alder Lake instructions being flipped on in GCC right now make no mention of AVX-512 but only AVX2 and others, likely due to Intel pursuing the subset supported by both the small and large cores in this new hybrid design being pursued. The lack of seeing AVX512 for Alder Lake led Torvalds to comment: I hope AVX512 dies a painful death, and that Intel starts fixing real problems instead of trying to create magic instructions to then create benchmarks that they can look good on. I hope Intel gets back to basics: gets their process working again, and concentrate more on regular code that isn't HPC or some other pointless special case. I've said this before, and I'll say it again: in the heyday of x86, when Intel was laughing all the way to the bank and killing all their competition, absolutely everybody else did better than Intel on FP loads. Intel's FP performance sucked (relatively speaking), and it matter not one iota. Because absolutely nobody cares outside of benchmarks. The same is largely true of AVX512 now - and in the future... After several more paragraphs, Torvalds reaches his conclusion. "Stop with the special-case garbage, and make all the core common stuff that everybody cares about run as well as you humanly can." Phoronix notes that Torvalds' comments came "just weeks after he switched to AMD Ryzen Threadripper for his primary development rig."' -- source: https://linux.slashdot.org/story/20/07/12/1729255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Whither Dotnet Core?
by Lawrence D'Oliveiro 10 Jul '20

10 Jul '20

From <https://www.theregister.com/2020/07/09/net_core_still_a_microsoft/>, people are wondering why there isn’t a greater uptake of Microsoft’s cross-platform, open-source versions of Dotnet and C#: "What's up with non-.NET developers thinking C# is a Windows only, corporate bloatware language? It's not 2005 any more." Yeah, but it’s not clear why we would want *cross-platform* bloatware ...

1 0

“I Am Not A Number!”
by Lawrence D'Oliveiro 10 Jul '20

10 Jul '20

>From <https://www.theregister.com/2020/07/09/bork/>: Your updated gas balance is: £NaN “We want ... calculation.” “You won’t get it!” “By hook or by crook, we will.”

1 0

Chrome and Firefox Are Getting Support For the New AVIF Image Format
by Peter Reutemann 10 Jul '20

10 Jul '20

'The new lightweight and royalty-free AVIF image format is coming to web browsers. Work is almost complete on adding AVIF support to Google Chrome and Mozilla Firefox. From a report: The new image format is considered one of the lightest and most optimized image compression formats, and has already gained praise from companies such as Netflix, which considers it superior to existing image formats such as JPEG, PNG, and even the newer WebP. The acronym of AVIF stands for AV1 Image File Format. As its name hints, AVIF is based on AV1, which is a video codec that was developed in 2015, following a collaboration between Google, Cisco, and Xiph.org (who also worked with Mozilla). At the time, the three decided to pool their respective in-house video codecs (VPX, Thor, and Daala) to create a new one (AV1) that they planned to offer as an open-source and royalty-free alternative to all the commercial video codecs that had fragmented and clogged the video streaming market in the late 2000s and early 2010s.' -- source: https://news.slashdot.org/story/20/07/09/202235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0