- wlug - list.wlug.org.nz

IBM is Moving OpenPower Foundation To The Linux Foundation
by Peter Reutemann 21 Aug '19

21 Aug '19

'IBM makes the Power Series chips, and as part of that has open sourced some of the underlying technologies to encourage wider use of these chips. The open source pieces have been part of the OpenPower Foundation. Today, the company announced it was moving the foundation under The Linux Foundation, and while it was at it, announced it was open sourcing several other important bits. From a report: Ken King, general manager for OpenPower at IBM, says that at this point in his organization's evolution, they wanted to move it under the auspices of the Linux Foundation. But IBM didn't stop there. It also announced that it was open sourcing some of the technical underpinnings of the Power Series chip to make it easier for developers and engineers to build on top of the technology. Perhaps most importantly, the company is open sourcing the Power Instruction Set Architecture (ISA). These are "the definitions developers use for ensuring hardware and software work together on Power," the company explained. King sees open sourcing this technology as an important step for a number of reasons around licensing and governance. "The first thing is that we are taking the ability to be able to implement what we're licensing, the ISA instruction set architecture, for others to be able to implement on top of that instruction set royalty free with patent rights," he explained. The company is also putting this under an open governance workgroup at the OpenPower Foundation.' -- source: https://news.slashdot.org/story/19/08/20/197244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WebKit Introduces New Tracking Prevention Policy
by Peter Reutemann 21 Aug '19

21 Aug '19

'WebKit, the open source HTML engine used by Apple's Safari browser and a number of others, has created a new policy on tracking prevention. The short version is that many forms of tracking will now be treated the same way as security flaws, being blocked or mitigated with no exceptions. While on-site tracking will still be allowed (and is practically impossible to prevent anyway), all forms of cross-site tracking and covert tracking will be actively and aggressively blocked.' -- source: https://it.slashdot.org/story/19/08/20/1522235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

tilix - terminal emulator
by Peter Reutemann 20 Aug '19

20 Aug '19

Hi everyone I've been a long-term user of the gnome terminal and then the mate terminal (after switching to Linux Mint). Despite the tab-support that these terminals offer, there were occasions when I missed being able to tile (ie vertical or horizontal split) in the same window rather than opening another window (and then moving/resizing it to make it fit better). Over the last month or so, I've been trialing "tilix" as my everyday terminal and I have to say that I'm very happy with it! According to the website, tilix is "an advanced GTK3 tiling terminal emulator that follows the Gnome Human Interface Guidelines" Here is the project page (incl screenshots) if you want to know more: https://gnunn1.github.io/tilix-web/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Your HDMI Cable Streaming-Compatible?
by Lawrence D'Oliveiro 20 Aug '19

20 Aug '19

It seems <https://www.stuff.co.nz/sport/rugby/rugby-world-cup/115128021/rugby-world-c…> that some people hoping to watch streams of the Rugby World Cup on a TV or external monitor connected via an HDMI cable from their PC may be out of luck. If the client software thinks you’re trying to record the stream, it will block it. And some cables will trigger this block, even if they’re just connecting to a monitor.

1 0

New Attack exploiting serious Bluetooth weakness can intercept sensitive data
by Peter Reutemann 20 Aug '19

20 Aug '19

'Researchers have demonstrated a serious weakness in the Bluetooth wireless standard that could allow hackers to intercept keystrokes, address books, and other sensitive data sent from billions of devices. Dubbed Key Negotiation of Bluetooth—or KNOB for short—the attack forces two or more devices to choose an encryption key just a single byte in length before establishing a Bluetooth connection. Attackers within radio range can then use commodity hardware to quickly crack the key. From there, attackers can use the cracked key to decrypt data passing between the devices. The types of data susceptible could include keystrokes passing between a wireless keyboard and computer, address books uploaded from a phone to a car dashboard, or photographs exchanged between phones. KNOB doesn't require an attacker to have any previously shared secret material or to observe the pairing process of the targeted devices. The exploit is invisible to Bluetooth apps and the operating systems they run on, making the attack almost impossible to detect without highly specialized equipment. KNOB also exploits a weakness in the Bluetooth standard itself. That means, in all likelihood, that the vulnerability affects just about every device that's compliant with the specification. The researchers have simulated the attack on 14 different Bluetooth chips—including those from Broadcom, Apple, and Qualcomm—and found all of them to be vulnerable. "The Key Negotiation Of Bluetooth (KNOB) attack exploits a vulnerability at the architectural level of Bluetooth," the researchers wrote in a research paper published this week. "The vulnerable encryption key negotiation protocol endangers potentially all standard compliant Bluetooth devices, regardless [of] their Bluetooth version number and implementation details. We believe that the encryption key negotiation protocol has to be fixed as soon as possible."' -- source: https://arstechnica.com/information-technology/2019/08/new-attack-exploitin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should HTTPS Certificates Expire After Just 397 Days?
by Peter Reutemann 19 Aug '19

19 Aug '19

'Google has made a proposal to the unofficial cert industry group that "would cut lifespan of SSL certificates from 825 days to 397 days," reports ZDNet. No vote was held on the proposal; however, most browser vendors expressed their support for the new SSL certificate lifespan. On the other side, certificate authorities were not too happy, to say the least. In the last decade and a half, browser makers have chipped away at the lifespan of SSL certificates, cutting it down from eight years to five, then to three, and then to two. The last change occured in March 2018, when browser makers tried to reduce SSL certificate lifespans from three years to one, but compromised for two years after pushback from certificate authorities. Now, barely two years later after the last change, certificate authorities feel bullied by browser makers into accepting their original plan, regardless of the 2018 vote... This fight between CAs and browser makers has been happening in the shadows for years. As HashedOut, a blog dedicated to HTTPS-related news, points out, this proposal is much more about proving who controls the HTTPS landscape than everything. "If the CAs vote this measure down, there's a chance the browsers could act unilaterally and just force the change anyway," HashedOut said. "That's not without precendent, but it's also never happened on an issue that is traditionally as collegial as this. "If it does, it becomes fair to ask what the point of the CA/B Forum even is. Because at that point the browsers would basically be ruling by decree and the entire exercise would just be a farce." Security researcher Scott Helme "claims that this process is broken and that bad SSL certificates continue to live on for years after being mississued and revoked -- hence the reason he argued way back in early 2018 that a shorter lifespan for SSL certificates would fix this problem because bad SSL certs would be phased out faster." But the article also notes that Timothy Hollebeek, DigiCert's representative at the CA/B Forum argues that the proposed change "has absolutely no effect on malicious websites, which operate for very short time periods, from a few days to a week or two at most. After that, the domain has been added to various blacklists, and the attacker moves on to a new domain and acquires new certificates."' -- source: https://tech.slashdot.org/story/19/08/18/1833223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Patches Three High-Severity Vulnerabilities
by Peter Reutemann 18 Aug '19

18 Aug '19

'Intel's latest patches "stomped out three high-severity vulnerabilities and five medium-severity flaws," reports Threatpost: One of the more serious vulnerabilities exist in the Intel Processor Identification Utility for Windows, free software that users can install on their Windows machines to identify the actual specification of their processors. The flaw (CVE-2019-11163) has a score of 8.2 out of 10 on the CVSS scale, making it high severity. It stems from insufficient access control in a hardware abstraction driver for the software, versions earlier than 6.1.0731. This glitch "may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access" according to Intel. Users are urged to update to version 6.1.0731. Intel stomped out another high-severity vulnerability in its Computing Improvement Program, which is program that Intel users can opt into that uses information about participants' computer performance to make product improvement and detect issues. However, the program contains a flaw (CVE-2019-11162) in the hardware abstraction of the SEMA driver that could allow escalation of privilege, denial of service or information disclosure... A final high-severity flaw was discovered in the system firmware of the Intel NUC (short for Next Unit of Computing), a mini-PC kit used for gaming, digital signage and more. The flaw (CVE-2019-11140) with a CVSS score of 7.5 out of 10, stems from insufficient session validation in system firmware of the NUC. This could enable a user to potentially enable escalation of privilege, denial of service and information disclosure. An exploit of the flaw would come with drawbacks -- a bad actor would need existing privileges and local access to the victim system. The article notes that the patches "come on the heels of a new type of side-channel attack revealed last week impacting millions of newer Intel microprocessors manufactured after 2012."' -- source: https://it.slashdot.org/story/19/08/18/0030201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware, the Longest Active Linux Distro, Finally Has a Patreon Page
by Peter Reutemann 18 Aug '19

18 Aug '19

'"Slackware is the longest active Linux distribution project, founded in 1993," writes TheBAFH (Slashdot reader #68,624). "Today there are many Linux distributions available, but I've remained dedicated to this project as I believe it still holds an important place in the Linux ecosystem," writes Patrick J. Volkerding on a new Patreon page. He adds that Slackware's users "know that Slackware can be trusted not to constantly change the way things work, so that your investment in learning Slackware lasts longer than it would with a system that's a moving target... Your support is greatly appreciated, and will make it possible for me to continue to maintain this project." TheBAFH writes: The authenticity of the Patreon page has been confirmed by Mr. Volkerding in a post in the Slackware forum of LinuxQuestions.org. "I was going to wait to announce it until I had a few more planned updates done in -current that would be getting things closer to an initial 15.0 beta release, but since it's been spotted in the wild I'll confirm it." Slashdot also emailed Patrick J. Volkerding at Slackware.com last summer and confirmed that that is indeed the account that he's posting from on LinuxQuestions. At the time, he was still trying to find the time to get a Patreon page set up. "I've been trying to catch up on nearly a decade of neglecting everything other than Slackware, but I'm at least getting more caught up."' -- source: https://linux.slashdot.org/story/19/08/16/238254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unique Kaspersky AV User ID Allowed 3rd-Party Web Tracking
by Peter Reutemann 15 Aug '19

15 Aug '19

'Kaspersky antivirus solutions injected in the web pages visited by its users an identification number unique for each system. This started in late 2015 and could be used to track a user's browsing interests. From a report: Versions of the antivirus product, paid and free, up to 2019, displayed this behavior that allows tracking regardless of the web browser used, even when users started private sessions. Signaled by c't magazine editor Ronald Eikenberg, the problem was that a JavaScript from a Kaspersky server loaded from an address that included a unique ID for every user. Scripts on a website can read the HTML source and glean the Kaspersky identifier, which Eikenberg determined to remain unchanged on the system.' -- source: https://it.slashdot.org/story/19/08/15/1849235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Found World-Readable Database Used To Secure Buildings Around the Globe
by Peter Reutemann 15 Aug '19

15 Aug '19

'Researchers said they have found a publicly accessible database containing almost 28 million records -- including plain-text passwords, face photos, and personal information -- that was used to secure buildings around the world. Ars Technica reports: Researchers from vpnMentor reported on Wednesday that the database was used by the Web-based Biostar 2 security system sold by South Korea-based Suprema. Biostar uses facial recognition and fingerprint scans to identify people authorized to enter warehouses, municipal buildings, businesses, and banks. vpnMentor said the system has more than 1.5 million installations in a wide range of countries including the U.S., the UK, Indonesia, India, and Sri Lanka. According to vpnMentor, the 23-gigabyte database contained more than 27.8 million records used by Biostar to secure customer facilities. The data included usernames, passwords and user IDs in plaintext, building access logs, employee records including start dates, personal details, mobile device data, and face images. The researchers said the data also included more than 1 million records containing actual fingerprint scans, but the report provided no data to support the claim. "The vpnMentor researchers said they discovered the exposed database on August 5 and privately reported the finding two days later," reports Ars Technica. "The data wasn't secured until Tuesday, six days later."' -- source: https://it.slashdot.org/story/19/08/14/2256231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week
by Lawrence D'Oliveiro 15 Aug '19

15 Aug '19

Well, my nomination, anyway <https://forums.theregister.co.uk/forum/all/2019/08/13/windows_notepad_flaw/…>: ... looking at XP era material with a code profiler is like looking at a Vegas motel room under a strong blacklight. Some things cannot be unseen.

1 0

Tech firms “can and must” put backdoors in encryption, AG Barr says
by Peter Reutemann 15 Aug '19

15 Aug '19

'US Attorney General William Barr today launched a new front in the feds' ongoing fight against consumer encryption, railing against the common security practice and lamenting the "victims" in its wake. "The deployment of warrant-proof encryption is already imposing huge costs on society," Barr claimed in remarks at a cybersecurity conference held at Fordham University Tuesday morning. Barr added that encryption "seriously degrades" law enforcement's ability to "detect and prevent a crime before it occurs," as well as making eventual investigation and prosecution of crime more difficult. The existence of encryption means "converting the Internet and communications into a law-free zone" that criminals will happily take advantage of to do more crimes, Barr added, likening it to a neighborhood that local cops have abandoned. The cost of encryption, he said, is measured in "victims" who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier. He also accused tech firms of "dogmatic" posturing, saying lawful backdoor access "can be and must be" done, adding, "We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement, without materially weakening the security provided by encryption."' -- source: https://arstechnica.com/tech-policy/2019/07/tech-firms-can-and-must-put-bac… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Researcher Makes Legit-Looking iPhone Lightning Cables That Will Hijack Your Computer
by Peter Reutemann 14 Aug '19

14 Aug '19

'A researcher known as MG has modified Lightning cables with extra components to let him remotely connect to the computers that the cables are connected to. "It looks like a legitimate cable and works just like one. Not even your computer will notice a difference. Until I, as an attacker, wirelessly take control of the cable," MG said. Motherboard reports: One idea is to take this malicious tool, dubbed O.MG Cable, and swap it for a target's legitimate one. MG suggested you may even give the malicious version as a gift to the target -- the cables even come with some of the correct little pieces of packaging holding them together. MG typed in the IP address of the fake cable on his own phone's browser, and was presented with a list of options, such as opening a terminal on my Mac. From here, a hacker can run all sorts of tools on the victim's computer. The cable comes with various payloads, or scripts and commands that an attacker can run on the victim's machine. A hacker can also remotely "kill" the USB implant, hopefully hiding some evidence of its use or existence. MG made the cables by hand, painstakingly modifying real Apple cables to include the implant. "In the end, I was able to create 100 percent of the implant in my kitchen and then integrate it into a cable. And these prototypes at Def con were mostly done the same way," he said. MG did point to other researchers who worked on the implant and graphical user interface. He is selling the cables for $200 each. ' -- source: https://apple.slashdot.org/story/19/08/13/2240213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hack in the box: Hacking into companies with “warshipping”
by Peter Reutemann 13 Aug '19

13 Aug '19

'Penetration testers have long gone to great lengths to demonstrate the potential chinks in their clients' networks before less friendly attackers exploit them. But in recent tests by IBM's X-Force Red, the penetration testers never had to leave home to get in the door at targeted sites, and the targets weren't aware they were exposed until they got the bad news in report form. That's because the people at X-Force Red put a new spin on sneaking in—something they've dubbed "warshipping." Using less than $100 worth of gear—including a Raspberry Pi Zero W, a small battery, and a cellular modem—the X-Force Red team assembled a mobile attack platform that fit neatly within a cardboard spacer dropped into a shipping box or embedded in objects such as a stuffed animal or plaque. At the Black Hat security conference here last week, Ars got a close look at the hardware that has weaponized cardboard. We've looked at such devices, typically referred to as "drop boxes," before. Ars even used one in our passive surveillance of an NPR reporter, capturing his network traffic and routing a dump of his packets across the country for us to sift through. Covert drop boxes (once a specialty of Pwnie Express) have taken the form of "wall wart" device chargers, Wi-Fi routers, and even power strips. And mobile devices have also been brought to play, allowing "war walking"—attacks launched remotely as a device concealed in a bag, suitcase, or backpack is carried nonchalantly into a bank, corporate lobby, or other targeted location. But unless you're trying to get your daily steps in, IBM X-Force Red Global Managing Partner and Head Charles Henderson told Ars that you can just let a shipping company do the work for you. "There have been people that have shipped cell phones, things like that," Henderson noted. "The thing that's cool about this is, this is the wall of the box. It can be easily built into the cardboard. If you get a phone shipped to you, you're suspicious of it. If you get a box or maybe a plaque that says you're the new [chief information security officer] of the year, you might not." The plaque might just go right up on the wall. "Put a $13 solar charger panel on the plaque, and that makes it a permanent fixture in a CISO's office... a $13 panel that, and actually, by the time it discharges the battery, between times when we check in, that can charge it back up. So technically you could do pretty much infinite, up to the life of the battery, if you set that in the right place." The hardware has also been planted in a stuffed animal and even inside the case of a normal Wi-Fi router.' -- source: https://arstechnica.com/information-technology/2019/08/hack-in-the-box-hack… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Paid Contractors To Transcribe Users' Audio Chats
by Peter Reutemann 13 Aug '19

13 Aug '19

'Facebook has been paying hundreds of outside contractors to transcribe clips of audio from users of its services, Bloomberg reported Tuesday, citing people with knowledge of the work. From the report: The work has rattled the contract employees, who are not told where the audio was recorded or how it was obtained -- only to transcribe it, said the people, who requested anonymity for fear of losing their jobs. They're hearing Facebook users' conversations, sometimes with vulgar content, but do not know why Facebook needs them transcribed, the people said. Facebook confirmed that it had been transcribing users' audio and said it will no longer do so, following scrutiny into other companies. "Much like Apple and Google, we paused human review of audio more than a week ago," the company said Tuesday. The company said the users who were affected chose the option in Facebook's Messenger app to have their voice chats transcribed. The contractors were checking whether Facebook's artificial intelligence correctly interpreted the messages, which were anonymized. [...] The social networking giant, which just completed a $5 billion settlement with the U.S. Federal Trade Commission after a probe of its privacy practices, has long denied that it collects audio from users to inform ads or help determine what people see in their news feeds.' -- source: https://yro.slashdot.org/story/19/08/13/200217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Landmark 2.80 Release of Open Source Blender 3D With Improved UI Now Available
by Peter Reutemann 11 Aug '19

11 Aug '19

'"In the 3D content creation space, where are lot of professional 3D software costs anywhere from 2K to 8K Dollars a license, people have always hoped that the free, open source 3D software Blender would some day be up to the job of replacing expensive commercial 3D software packages," writes Slashdot reader dryriver: This never happened, not because Blender didn't have good 3D features technically, but rather because the Blender Foundation simply did not listen to thousands of 3D artists screaming for a "more standard UI design" in Blender. Blender's eccentric GUI with reversed left-click-right-click conventions, keyboard shortcuts that don't match commercial software and other nastiness just didn't work for a lot of people. After years of screaming, Blender finally got a much better and more familiar UI design in release 2.80, which can be downloaded here. Version 2.80 has many powerful features, but the standout feature is that after nearly 10 years of asking, 3D artists finally get a better, more standard, more sensible User Interface. This effectively means that for the first time, Blender can compete directly with expensive commercial 3D software made by industry leaders like Autodesk, Maxon, NewTek and SideFX. Why the Blender Foundation took nearly a decade to revise the software's UI is anybody's guess.' -- source: https://news.slashdot.org/story/19/08/11/1842258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Can Swap Space Solve System Performance Issues?
by Peter Reutemann 11 Aug '19

11 Aug '19

'Earlier this week on the Linux kernel mailing list, Artem S. Tashkinov described a low-memory scenario where "the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly..." "I'm afraid I have bad news for the people snickering at Linux here," wrote Chris Siebenmann, a sys-admin at the University of Toronto's CS lab. "If you're running without swap space, you can probably get any Unix to behave this way under memory pressure..." In the old days, this usually was not very much of an issue because system RAM was generally large compared to the size of programs and thus the amount of file-backed pages that were likely to be in memory. That's no longer the case today; modern large programs such as Firefox and its shared libraries can have significant amounts of file-backed code and data pages (in addition to their often large use of dynamically allocated memory, ie anonymous pages). A production engineer (now on Facebook's Web Foundation team) wrote about experiencing similar issues years ago when another company had disabled swapping when they replaced or reinstalled machines -- leading to lots of pages from hosts that had to be dealt with. This week they wrote: I stand by my original position: have some swap. Not a lot. Just a little. Linux boxes just plain act weirdly without it. This is not permission to beat your machine silly in terms of memory allocation, either... If you allocate all of the RAM on the machine, you have screwed the kernel out of buffer cache it sorely needs. Back off. Put another way, disk I/O that isn't brutally slow costs memory. Network I/O costs memory. All kinds of stuff costs memory. It's not JUST the RSS of your process. Other stuff you do needs space to operate. If you try to fill a 2 GB box with 2 GB of data, something's going to have a bad day! You have to leave room for the actual system to run or it's going to grind to a stop.' -- source: https://linux.slashdot.org/story/19/08/10/041223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-like CPU Vulnerability Bypasses Existing Defenses
by Peter Reutemann 11 Aug '19

11 Aug '19

'Researchers from security firm Bitdefender discovered and reported a year ago a new CPU vulnerability that 'abuses a system instruction called SWAPGS and can bypass mitigations put in place for previous speculative execution vulnerabilities like Spectre,' writes Lucian Constantin for CSO. There are three attack scenarios involving SWAPGS, the most serious of which 'can allow attackers to leak the contents of arbitrary kernel memory addresses. This is similar to the impact of the Spectre vulnerability.' Microsoft released mitigations for the vulnerability in July's Patch Tuesday, although details were withheld until August 6 when Bitdefender released its whitepaper and Microsoft published a security advisory.' -- source: https://it.slashdot.org/story/19/08/10/0523206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Remember Autorun.inf Malware In Windows? Turns Out KDE Offers Something Similar
by Peter Reutemann 11 Aug '19

11 Aug '19

'A security researcher has published proof-of-concept (PoC) code for a vulnerability in the KDE software framework. A fix is not available at the time of writing. The bug was discovered by Dominik "zer0pwn" Penner and impacts the KDE Frameworks package 5.60.0 and below. The KDE Frameworks software library is at the base of the KDE desktop environment v4 and v5 (Plasma), currently included with a large number of Linux distributions. The vulnerability occurs because of the way the KDesktopFile class (part of KDE Frameworks) handles .desktop or .directory files. It was discovered that malicious .desktop and .directory files could be created that could be used to run malicious code on a user's computer. When a user opens the KDE file viewer to access the directory where these files are stored, the malicious code contained within the .desktop or .directory files executes without user interaction — such as running the file. Zero user interaction is required to trigger code execution — all you have to do is to browse a directory with a malicious file using any of KDE file system browsing applications like Dolphin. When ZDNet contacted KDE for a comment Tuesday, their spokesperson provided this response. "We would appreciate if people would contact security(a)kde.org before releasing an exploit into the public, rather than the other way around, so that we can decide on a timeline together."' -- source: https://it.slashdot.org/story/19/08/10/2257259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Severe local 0-Day escalation exploit found in Steam Client Services
by Peter Reutemann 09 Aug '19

09 Aug '19

'Earlier today, disgruntled security researcher Vasily Kravets released a zero-day vulnerability in the Windows version of the ubiquitous gaming service Steam. The vulnerability allows any user to run arbitrary code with LOCALSYSTEM privileges using just a very few simple commands. The vulnerability lies within Steam Client Service. The service may be started or stopped by unprivileged users. This becomes a problem because, when run,Steam Client Service automatically sets permissions on a range of registry keys. If a mischievous—or outright malicious—user were to symlink one of these keys to that belonging to another service, it becomes possible for arbitrary users to start or stop that service as well. This becomes even more problematic when you realize that it's possible to pass arguments to services that run under extremely privileged accounts—such as msiserver, the Windows Installer service.' -- source: https://arstechnica.com/gaming/2019/08/severe-local-0-day-escalation-exploi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Journal Ceases Publication
by Peter Reutemann 09 Aug '19

09 Aug '19

'Not too long after Linus Torvalds wrote his own Unix kernel, which he called Linux, in the summer of 1991, a magazine was founded by enthusiasts to focus on the operating system. For nearly three decades Linux Journal has been an authority magazine on all things Linux, but it is now shuttering doors, it said late Wednesday. The announcement comes about two years after the periodical said it would cease to exist, but it was able to find some backing -- from Privacy Internet Access group -- to resume operations later on. The team said on Wednesday that all staff members had been laid off and the company was left with no operating funds to continue in any capacity. It remains committed to keeping the website afloat for another few weeks.' -- source: https://news.slashdot.org/story/19/08/08/1354211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Red Hat Joins the RISC-V Foundation
by Peter Reutemann 08 Aug '19

08 Aug '19

'Red Hat has joined the RISC-V Foundation to help foster this open-source processor ISA. Phoronix reports: While we're still likely years away from seeing any serious RISC-V powered servers at least that can deliver meaningful performance, Red Hat has been active in promoting RISC-V as an open-source processor instruction set architecture and one of the most promising libre architectures we have seen over the years. Red Hat developers have already helped in working on Fedora's RISC-V support and now the IBM-owned company is helping out more and showing their commitment by joining the RISC-V Foundation. Red Hat joins the likes of Google, NVIDIA, Qualcomm, SiFive, Western Digital, IBM, and Samsung as among the many RISC-V members. ' -- source: https://linux.slashdot.org/story/19/08/08/213253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Team Working on Daring Plan To Forcibly Update Old Websites
by Peter Reutemann 08 Aug '19

08 Aug '19

'The developers behind the WordPress open-source content management system (CMS) are working on a plan to forcibly auto-update older versions of the CMS to more recent releases. From a report: The goal of this plan is to improve the security of the WordPress ecosystem, and the internet as a whole, since WordPress installations account for more than 34% of all internet websites. Officially supported versions include only the last six WordPress major releases, which currently are all the versions between v4.7 and v5.2. The plan is to slowly auto-update old WordPress sites, starting with v3.7, to the current minimum supported version, which is the v4.7 release. The WordPress team said it plans to monitor this tiered forced auto-update process for errors and site breakage. If there's something massively wrong, then auto-update can be stopped altogether. If only a few individual sites break, than those site will be rolled back to their previous versions and the owner will be notified via email.' -- source: https://it.slashdot.org/story/19/08/08/1523212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Lands Google, Twitter as Customers With Newest Server Chip
by Peter Reutemann 08 Aug '19

08 Aug '19

'Advanced Micro Devices on Wednesday released the second generation of its processor chip for data centers and said that it had landed Alphabet's Google and Twitter as customers. From a report: AMD competes against Intel to supply chips for data centers that power internet-based services. Both firms have come to rely on data center chips for growth because personal computer sales have stagnated as users shifted to mobile devices. AMD's newest generation of server chip, called EPYC, uses a new chip-making technology from its contract manufacturers that helps the chips have better performance while consuming less power. Intel, which makes chips in its own factories instead of relying on contractors, is behind schedule delivering chips made with its own newer manufacturing process. It plans to release them next year.' -- source: https://tech.slashdot.org/story/19/08/08/1553202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Less TV, More Online
by Lawrence D'Oliveiro 08 Aug '19

08 Aug '19

In Britain, at least <https://www.theregister.co.uk/2019/08/07/punters_switching_off_telly_boxes_…>, people are spending less time watching conventional broadcast TV and more time watching vids on YouTube and Netflix. In related news, famed (and feared) US ratings agency Nielsen <https://www.techdirt.com/articles/20190805/08212442723/after-missing-cord-c…> has fallen on hard times as its broadcast (FTA and cable) company customers suffer a similar trend. The irony was that they were the ones forcing it not to make any measurements of the “cord-cutting” phenomenon, because it made them look bad; and as a result its service has now declined into irrelevance.

1 0

What all the stuff in email headers means—and how to sniff out spoofing
by Peter Reutemann 07 Aug '19

07 Aug '19

'I pretty frequently get requests for help from someone who has been impersonated—or whose child has been impersonated—via email. Even when you know how to "view headers" or "view source" in your email client, the spew of diagnostic wharrgarbl can be pretty overwhelming if you don't know what you're looking at. Today, we're going to step through a real-world set of (anonymized) email headers and describe the process of figuring out what's what. Before we get started with the actual headers, though, we're going to take a quick detour through an overview of what the overall path of an email message looks like in the first place. (More experienced sysadmin types who already know what stuff like "MTA" and "SPF" stand for can skip a bit ahead to the fun part!)' -- source: https://arstechnica.com/information-technology/2019/08/ars-forensic-files-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Skype, Slack, other Electron-based apps can be easily backdoored
by Peter Reutemann 07 Aug '19

07 Aug '19

'The Electron development platform is a key part of many applications, thanks to its cross-platform capabilities. Based on JavaScript and Node.js, Electron has been used to create client applications for Internet communications tools (including Skype, WhatsApp, and Slack) and even Microsoft's Visual Studio Code development tool. But Electron can also pose a significant security risk because of how easily Electron-based applications can be modified without triggering warnings. At the BSides LV security conference on Tuesday, Pavel Tsakalidis demonstrated a tool he created called BEEMKA, a Python-based tool that allows someone to unpack Electron ASAR archive files and inject new code into Electron's JavaScript libraries and built-in Chrome browser extensions. The vulnerability is not part of the applications themselves but of the underlying Electron framework—and that vulnerability allows malicious activities to be hidden within processes that appear to be benign. Tsakalidis said that he had contacted Electron about the vulnerability but that he had gotten no response—and the vulnerability remains. While making these changes required administrator access on Linux and MacOS, it only requires local access on Windows. Those modifications can create new event-based "features" that can access the file system, activate a Web cam, and exfiltrate information from systems using the functionality of trusted applications—including user credentials and sensitive data. In his demonstration, Tsakalidis showed a backdoored version of Microsoft Visual Studio Code that sent the contents of every code tab opened to a remote website.' -- source: https://arstechnica.com/information-technology/2019/08/skype-slack-other-el… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google releases the 6th and final beta for Android Q
by Peter Reutemann 07 Aug '19

07 Aug '19

'We are quickly approaching launch day for Android Q, Google's 29th release of Android. At some point in the near future we should see a statue-unveiling, official confirmation that this is "Android 10," and the highly anticipated "Q" snack name [Editor's suggestion]. First though, we have to see the sixth-and-final beta release out the door, which is happening today. Android Q Beta 6 is rolling out to Pixel phones now and participating third-party devices in the coming weeks. Final APIs for developers were locked down in Beta 4, so Beta 5 and 6 are mostly about squishing bugs and polishing up the final interface. Fully gestural navigation is a major feature of Android Q, and with the Beta 5 launch came the announcement that gesture navigation would not work with third-party home apps at launch, presumably due to a lack of time to work out the pile of bugs that have been reported. Even with third-party home screen compatibility off the table, it seems like Google will be working on gesture navigation down to the wire. Beta 5 came with a new gesture for the Google Assistant and new rules for developers. In Beta 6, Google says it has "made further refinements to Gesture Navigation in Beta 6 based on user feedback" and now has a sensitivity setting for the back gesture. The back gesture involves swiping in from the edge of the screen, which can interfere with apps that require horizontal scrolling. Newly updated apps are supposed to design around the new back gesture; the sensitivity setting should help find a balance for older apps with conflicting swipe areas.' -- source: https://arstechnica.com/gadgets/2019/08/google-releases-the-6th-and-final-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Contractors Are Listening To Some Skype Calls
by Peter Reutemann 07 Aug '19

07 Aug '19

'Contractors working for Microsoft are listening to personal conversations of Skype users conducted through the app's translation service, according to a cache of internal documents, screenshots, and audio recordings obtained by Motherboard. From a report: Although Skype's website says that the company may analyze audio of phone calls that a user wants to translate in order to improve the chat platform's services, it does not say some of this analysis will be done by humans. The Skype audio obtained by Motherboard includes conversations from people talking intimately to loved ones, some chatting about personal issues such as their weight loss, and others seemingly discussing relationship problems. Other files obtained by Motherboard show that Microsoft contractors are also listening to voice commands that users speak to Cortana, the company's voice assistant.' -- source: https://yro.slashdot.org/story/19/08/07/1432204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FFmpeg 4.2, Open-Source Multimedia Framework Released
by Peter Reutemann 07 Aug '19

07 Aug '19

'Dubbed "Ada," the FFMpeg 4.2 series introduces some exciting new features and improvements, among which we can mention support for decoding AV1 files via the libdav1d library, support for ARIB STD-B24 caption (profiles A and C) based on the libaribb24 library, and support for decoding HEVC 4:4:4 content in nvdec and cuviddec. FFmpeg 4.2 also comes with support for decoding HEVC 4:4:4 content in VDPAU (Video Decode and Presentation API for Unix), support for using Clang to compile CUDA kernels, the ability for the mov muxer to write tracks with unspecified language instead of English by default, a GIF parser, as well as the removal of the libndi-newtek component.' -- source: https://news.softpedia.com/news/ffmpeg-4-2-ada-open-source-multimedia-frame… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Catches Russian State Hackers Using IoT Devices To Breach Networks
by Peter Reutemann 06 Aug '19

06 Aug '19

'Hackers working for the Russian government have been using printers, video decoders, and other so-called Internet-of-things devices as a beachhead to penetrate targeted computer networks, Microsoft officials warned on Monday. "These devices became points of ingress from which the actor established a presence on the network and continued looking for further access," officials with the Microsoft Threat Intelligence Center wrote in a post. "Once the actor had successfully established access to the network, a simple network scan to look for other insecure devices allowed them to discover and move across the network in search of higher-privileged accounts that would grant access to higher-value data." Microsoft researchers discovered the attacks in April, when a voice-over-IP phone, an office printer, and a video decoder in multiple customer locations were communicating with servers belonging to "Strontium," a Russian government hacking group better known as Fancy Bear or APT28. In two cases, the passwords for the devices were the easily guessable default ones they shipped with. In the third instance, the device was running an old firmware version with a known vulnerability. While Microsoft officials concluded that Strontium was behind the attacks, they said they weren't able to determine what the group's ultimate objectives were. Microsoft says they have notified the makers of the targeted IoT devices so they can add new protections. "Monday's report also provided IP addresses and scripts organizations can use to detect if they have also been targeted or infected," adds Ars Technica. "Beyond that, Monday's report reminded people that, despite Strontium's above-average hacking abilities, an IoT device is often all it needs to gain access to a targeted network."' -- source: https://it.slashdot.org/story/19/08/06/0115233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Performs Poorly In Low RAM / Memory Pressure Situations On The Desktop
by Peter Reutemann 06 Aug '19

06 Aug '19

'It's been a gripe for many running Linux on low RAM systems especially is that when the Linux desktop is under memory pressure the performance can be quite brutal with the system barely being responsive. The discussion over that behavior has been reignited this week. From a report: Developer Artem S Tashkinov took to the kernel mailing list over the weekend to express his frustration with the kernel's inability to handle low memory pressure in a graceful manner. If booting a system with just 4GB of RAM available, disabling SWAP to accelerate the impact/behavior, and launching a web browser and opening new web pages / tabs can in a matter of minutes bring the system down to its knees. Artem elaborated on the kernel mailing list, "Once you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I'm not entirely sure why). You will not be able to run new applications or close currently running ones. This little crisis may continue for minutes or even longer. I think that's not how the system should behave in this situation. I believe something must be done about that to avoid this stall."' -- source: https://linux.slashdot.org/story/19/08/06/1839206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Final Red Hat Enterprise Linux 7 Version Released
by Peter Reutemann 06 Aug '19

06 Aug '19

'The last RHEL release, RHEL 7.7, is now available for current Red Hat Enterprise Linux subscribers via the Red Hat Customer Portal. ZDNet reports on what's new: RHEL 7.7's most important updates are support for the latest generation of enterprise hardware and remediation for the recently disclosed ZombieLoad vulnerabilities. The latest RHEL 7 also includes network stack performance enhancements. With this release, you can offload virtual switching operations to network interface card (NIC) hardware. What that means for you is, if you're using virtual switching and network function virtualization (NFV), you'll see better network performance on cloud and container platforms such as Red Hat OpenStack Platform and Red Hat OpenShift. RHEL 7.7 users can also use Red Hat's new predictive problem shooter: Red Hat Insights. This uses a software-as-a-service (SaaS)-based predictive analytics approach to spot, assess, and mitigate potential problems to their systems before they can cause trouble. For developers, RHEL 7.7 comes with Python 3.6 interpreter, and the pip and setup tools utilities. Previously, Python 3 versions were available only as a part of Red Hat Software Collections. Moving on to the cloud, RHEL 7.7 Red Hat Image Builder is now supported. This feature, which is also in RHEL 8, enables you to easily create custom RHEL system images for cloud and virtualization platforms such as Amazon Web Services (AWS), VMware vSphere, and OpenStack. To help cloud-native developers, RHEL 7.7 includes full support for Red Hat's distributed-container toolkit -- buildah, podman, and skopeo -- on RHEL workstations. After building on the desktop, programmers can use Red Hat Universal Base Image to build, run, and manage containerized applications across the hybrid cloud.' -- source: https://linux.slashdot.org/story/19/08/06/208202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Half of All Google Chrome Extensions Have Fewer Than 16 Installs
by Peter Reutemann 05 Aug '19

05 Aug '19

'There are 188,620 extensions available on the Chrome Web Store, and while you might think this provides a wide variety of choices for Chrome users, in reality, most of these extensions are dead or dwindling, with very few having active installations. From a report: All in all, about 50% of all Chrome extensions have fewer than 16 installs, meaning that half of the Chrome extension ecosystem is actually more of a ghost town, according to a recent scan of the entire Chrome Web Store conducted by Extension Monitor. Further, 19,379 extensions (just over 10%) have zero installs, and 25,540 extensions (13% of the total) have just one user. The scan found that there are very few Chrome extensions that managed to establish a dedicated userbase. According to Extension Monitor, around 87% of all extensions have fewer than 1,000 installs.' -- source: https://tech.slashdot.org/story/19/08/05/144246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Tests Smartphone With Own OS, Could Potentially Start Selling Them Later This Year
by Peter Reutemann 05 Aug '19

05 Aug '19

'Huawei is testing a smartphone equipped with Hongmeng, the company's self-developed operating system, which could potentially go on sale by the end of this year, Chinese state-media outlet Global Times reported. From a report: The release of a Hongmeng-powered smartphone would mark a major step for China's Huawei, the world's second-biggest maker of smartphones, as U.S. government actions threaten its access to Google's Android operating system. The device will be priced at around 2,000 yuan ($288), the Global Times said on Sunday, citing unnamed sources. That will place the device toward the low-end segment of the smartphone market. Huawei executives have previously described Hongmeng as an operating system designed for internet-of-things products. Last month the company said the first major devices powered by Hongmeng would be its upcoming line of Honor-brand smart TVs.' -- source: https://mobile.slashdot.org/story/19/08/05/1515218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME and KDE Join Forces To Co-Host Linux App Summit
by Peter Reutemann 05 Aug '19

05 Aug '19

'GNOME and KDE are co-hosting this year's Linux App Summit (LAS) in Barcelona from November 12th to 15th. An anonymous reader shared the big announcement: LAS is the first collaborative event co-hosted by the two organizations since the Desktop Summit in 2009. Both organizations are eager to bring their communities together in building an application ecosystem that transcends individual distros and broadens the market for everyone involved. KDE and GNOME will no longer be taking a passive role in the free desktop sector. With the joint influence of the two desktop projects, LAS will shepherd the growth of the FOSS desktop by encouraging the creation of quality applications, seeking opportunities for compensation for FOSS developers, and fostering a vibrant market for the Linux operating system. * "I am excited to see GNOME and KDE working together on LAS, and I believe that the event will help lay down strong foundations for collaborative cross-project development that would benefit Linux users across all distributions and on any compatible device." -- Christel Dahlskjaer, Private Internet Access and freenode Project Lead. * "Together with GNOME, counting with the collaboration of many distributions and application developers, we'll have the opportunity to work side by side, share our perspectives and offer the platform that the next generation of solutions will be built on." -- Aleix Pol Gonzalez, KDE e.V Vice-President says about the inaugural effort about LAS. * "By partnering with KDE we show the desire to build the kind of application ecosystem that demonstrates that Open Source and Free Software are important; the technology and organization we build to achieve this is valuable and necessary." -- GNOME executive director, Neil McGovern * "The desktop wars is not really a thing any more. It makes more sense to work together and pool resources." -- Paul Brown, a KDE Communications Specialist (quoted by ZDNet) ZDNet called the collaboration "a major step forward," giving their story the headline "GNOME and KDE work together on the Linux desktop." But the Twitter feed for the KDE community quickly clarified that KDE "is working with GNOME to create a common, fair, sustainable and open app ecosystem, not a desktop." "The GNOME and KDE communities want to provide users with free and open applications that will respect their privacy and rights. That is what Linux App Summit is about."' -- source: https://linux.slashdot.org/story/19/08/03/0240209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Just Stopped Displaying 'www' and 'https' In Chrome's Address Bar
by Peter Reutemann 04 Aug '19

04 Aug '19

'"Google has finally chopped the 'www' from Chrome's address bar after delaying the controversial move due to a backlash," reports TechRepublic: The move to remove 'www' was initially planned for last year, when Google announced it would cut "trivial subdomains" from the address bar in Chrome 69. Now Google has begun truncating the visible URL in Chrome for desktop and Android, rolling out the change in version 76 of the browser, released this week. By default sites in Chrome now no longer display the "https" scheme or the "www" subdomain, with the visible address starting after this point. To view the full URL, users now have to click the address bar twice on desktop and once on mobile. Google has argued the move is driven by a desire for greater simplicity and usability of Chrome... However the announcement provoked a fresh wave of criticism, from those who say the move will confuse users and even potentially make it easier for them to inadvertently connect to fake sites... There are also some who claim Google's motivation in changing how the URL is displayed may be to make it harder for users to tell whether they are on a page hosted on Google's Accelerated Mobile Pages subdomain... Google says it has also built a Chrome extension that doesn't obfuscate the URL to "help power users recognize suspicious sites and report them to Safe Browsing". Despite the backlash from some online, Chrome isn't the first browser to truncate the URL in this way, with Apple's Safari similarly hiding the full address. ' -- source: https://tech.slashdot.org/story/19/08/03/0317238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Quietly Gives Alexa's Voice Recordings a 'No Human Review' Option
by Peter Reutemann 04 Aug '19

04 Aug '19

'"Amazon Alexa users can now choose whether human reviewers listen to recordings of their exchanges with the AI assistant," reports VentureBeat, citing an Amazon spokesperson. To ensure people don't listen to voice recordings collected following each exchange with Alexa, go to Settings, tap the Alexa Privacy link, then choose Manage How Your Data Improves Alexa. Users can also delete their voice recordings via the Alexa app or Amazon website. The news follows Amazon's introduction of an "Alexa, delete what I said today" voice command in May... Earlier this week, Google and Apple both pledged to suspend some of their voice data review by people. ' -- source: https://yro.slashdot.org/story/19/08/04/0159227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Vulnerabilities Found In WPA3 WiFi Standard
by Peter Reutemann 04 Aug '19

04 Aug '19

'Slashdot reader Artem S. Tashkinov writes: Mathy Vanhoef and Eyal Ronen have recently disclosed two new additional bugs impacting WPA3. The security researched duo found the new bugs in the security recommendations the WiFi Alliance created for equipment vendors in order to mitigate the initial Dragonblood attacks [found by the same two security researchers]. "Just like the original Dragonblood vulnerabilities from April, these two new ones allow attackers to leak information from WPA3 cryptographic operations and brute-force a WiFi network's password," reports ZDNet. More from ZDNet: "[The] Wi-Fi standard is now being updated with proper defenses, which might lead to WPA3.1," Vanhoef said. "Although this update is not backwards-compatible with current deployments of WPA3, it does prevent most of our attacks," the researchers said. But besides just disclosing the two new Dragonblood vulnerabilities, the two researchers also took the chance to criticize the WiFi Alliance again for its closed standards development process that doesn't allow for the open-source community to contribute and prevent big vulnerabilities from making it into the standard in the first place. "This demonstrates that implementing Dragonfly and WPA3 without side-channel leaks is surprisingly hard," the researchers said. "It also, once again, shows that privately creating security recommendations and standards is at best irresponsible and at worst inept." While these type of feedback might be ignored when coming from other researchers, it means more when it comes from Vanhoef. The Belgian researchers is the one who discovered the KRACK attack that broke the WPA2 WiFi authentication standard and forced the WiFi Alliance to develop the WPA3 standard, which it launched in June 2018.' -- source: https://mobile.slashdot.org/story/19/08/04/1821237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Listening Post On VPNs
by Lawrence D'Oliveiro 03 Aug '19

03 Aug '19

This week’s episode of “The Listening Post” on Al Jazeera <https://www.aljazeera.com/programmes/listeningpost/2019/07/vazajato-dirty-d…> covers, in the latter part, an overview of the increasing popularity of VPNs. It also mentions some of their potential pitfalls.

1 0

Did Facebook End The Encryption Debate?
by Peter Reutemann 02 Aug '19

02 Aug '19

'Forbes contributor Kalev Leetaru argues that "the encryption debate is already over -- Facebook ended it earlier this year." The ability of encryption to shield a user's communications rests upon the assumption that the sender and recipient's devices are themselves secure, with the encrypted channel the only weak point... [But] Facebook announced earlier this year preliminary results from its efforts to move a global mass surveillance infrastructure directly onto users' devices where it can bypass the protections of end-to-end encryption. In Facebook's vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be continually updated from a central cloud service, but will run locally on the user's device, scanning each cleartext message before it is sent and each encrypted message after it is decrypted. The company even noted that when it detects violations it will need to quietly stream a copy of the formerly encrypted content back to its central servers to analyze further, even if the user objects, acting as true wiretapping service... If Facebook's model succeeds, it will only be a matter of time before device manufacturers and mobile operating system developers embed similar tools directly into devices themselves, making them impossible to escape... Governments would soon use lawful court orders to require companies to build in custom filters of content they are concerned about and automatically notify them of violations, including sending a copy of the offending content. Rather than grappling with how to defeat encryption, governments will simply be able to harness social media companies to perform their mass surveillance for them, sending them real-time alerts and copies of the decrypted content. Putting this all together, the sad reality of the encryption debate is that after 30 years it is finally over: dead at the hands of Facebook. If the company's new on-device content moderation succeeds it will usher in the end of consumer end-to-end encryption and create a framework for governments to outsource their mass surveillance directly to social media companies, completely bypassing encryption. In the end, encryption's days are numbered and the world has Facebook to thank. ' -- source: https://it.slashdot.org/story/19/07/27/206248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple’s AirDrop and password sharing features can leak iPhone numbers
by Peter Reutemann 02 Aug '19

02 Aug '19

'Apple makes it easy for people to locate lost iPhones, share Wi-Fi passwords, and use AirDrop to send files to other nearby devices. A recently published report demonstrates how snoops can capitalize on these features to scoop up a wealth of potentially sensitive data that in some cases includes phone numbers. Simply having Bluetooth turned on broadcasts a host of device details, including its name, whether it's in use, if Wi-Fi is turned on, the OS version it’s running, and information about the battery. More concerning: using AirDrop or Wi-Fi password sharing broadcasts a partial cryptographic hash that can easily be converted into an iPhone’s complete phone number. The information—which in the case of a Mac also includes a static MAC address that can be used as a unique identifier—is sent in Bluetooth Low Energy packets. The information disclosed may not be a big deal in many settings, such as work places where everyone knows everyone anyway. The exposure may be creepier in public places, such as a subway, a bar, or a department store, where anyone with some low-cost hardware and a little know-how can collect the details of all Apple devices that have BLE turned on. The data could also be a boon to companies that track customers as they move through retail outlets. As noted above, in the event someone is using AirDrop to share a file or image, they’re broadcasting a partial SHA256 hash of their phone number. In the event Wi-Fi password sharing is in use, the device is sending partial SHA256 hashes of its phone number, the user’s email address, and the user’s Apple ID. While only the first three bytes of the hash are broadcast, researchers with security firm Hexway (which published the research) say those bytes provide enough information to recover the full phone number.' -- source: https://arstechnica.com/information-technology/2019/08/apples-airdrop-and-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Open Source Software Comes With a Few Catches
by Peter Reutemann 02 Aug '19

02 Aug '19

'As open source software grows more popular, and important, developers face an existential question: How to make money from something you give away for free? An anonymous reader shares a report: The Open Source Initiative standards body says an open source license must allow users to view the underlying source code, modify it, and share it as they see fit. Independent developers and large companies alike now routinely release software under these licenses. Many coders believe open collaboration results in better software. Some companies open their code for marketing purposes. Open source software now underpins much technology, from smartphone operating systems to government websites. Companies that release software under open source licenses generate revenue in different ways. Some sell support, including Red Hat, which IBM acquired for $34 billion earlier this month. Others, like cloud automation company HashiCorp, sell proprietary software based on the open source components. But with the rise of cloud computing, developers see their open source code being bundled into services and sold by other companies. Amazon, for example, sells a cloud-hosted service based on the popular open source database Redis, which competes with a similar cloud-hosted service offered by Redis Labs, the sponsor of the open source project. To protect against such scenarios, companies behind popular open source projects are restricting how others can use their software. Redis Labs started the trend last year when it relicensed several add-ons for its core product under terms that essentially prohibit offering those add-ons as part of a commercial cloud computing service. That way, Amazon and other cloud providers can't use those add-ons in their competing Redis services. Companies that want the functionality provided by those add-ons need to develop those features themselves, or get permission from Redis Labs. [...] Analytics company Confluent and database maker CockroachDB added similar terms to their licenses, preventing cloud computing companies from using some or all of their code to build competing services. Taking a slightly different tack, MongoDB relicensed its flagship database product last year under a new "Server Side Public License" (SSPL) that requires companies that sell the database system as a cloud service also release the source code of any additional software they include.' -- source: https://news.slashdot.org/story/19/08/01/1522211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office 365 Declared Illegal In German Schools Over Privacy Concerns
by Lawrence D'Oliveiro 01 Aug '19

01 Aug '19

Rules over data access mean that none of the cloud-based suites (whether from Apple, Google or Microsoft) can be used in the German state of Hesse <https://arstechnica.com/information-technology/2019/07/germany-threatens-to…>. Who will blink first?

2 2

GitHub Starts Blocking Developers In Countries Facing US Trade Sanctions
by Peter Reutemann 01 Aug '19

01 Aug '19

'After a developer based in the Crimea region of Ukraine was blocked from GitHub this week, the Microsoft-owned software development platform said it has started restricting accounts in countries facing U.S. trade sanctions. GitHub lists Crimea, Cuba, Iran, North Korea, and Syris as countries facing U.S. sanctions. ZDNet reports: As the developer reports, his website https://tkashkin.tk, which is hosted on GitHub, now returns a 404 error. He also can't create new private GitHub repositories or access them. While his website could easily be moved to another hosting provider, the block does pose a challenge for his work on GameHub, which has an established audience on GitHub. GitHub does offer developers an appeal form to dispute restrictions but [the developer] told ZDNet that, at this point, there's nothing to gain by appealing the restriction. "It is just pointless. My account is flagged as restricted and, in order to unflag it, I have to provide a proof that I don't live in Crimea. I am in fact a Russian citizen with Crimean registration, I am physically in Crimea, and I am living in Crimea my entire life," he said. "For individual users, who are not otherwise restricted by U.S. economic sanctions, GitHub currently offers limited restricted services to users in these countries and territories. This includes limited access to GitHub public repository services for personal communications only," it says. GitHub notes on its page about U.S. trade controls that its paid-for on-premise software -- aimed to enterprise users -- may be an option for users in those circumstances. "Users are responsible for ensuring that the content they develop and share on GitHub.com complies with the U.S. export control laws, including the EAR (Export Administration Regulations) and the U.S. International Traffic in Arms Regulations (ITAR)," GitHub says. "The cloud-hosted service offering available at Github.com has not been designed to host data subject to the ITAR and does not currently offer the ability to restrict repository access by country. If you are looking to collaborate on ITAR- or other export-controlled data, we recommend you consider GitHub Enterprise Server, GitHub's on-premises offering."' -- source: https://tech.slashdot.org/story/19/07/26/2157202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Reveals Fistful of Flaws In Apple's iMessage App
by Peter Reutemann 31 Jul '19

31 Jul '19

'Google researchers have shared details of five flaws in Apple's iMessage software that could make its devices vulnerable to attack. The BBC reports: In one case, the researchers said the vulnerability was so severe that the only way to rescue a targeted iPhone would be to delete all the data off it. Another example, they said, could be used to copy files off a device without requiring the owner to do anything to aid the hack. Apple released fixes last week. But the researchers said they had also flagged a sixth problem to Apple, which had not been rectified in the update to its mobile operating system. Apple's own notes about iOS 12.4 indicate that the unfixed flaw could give hackers a means to crash an app or execute commands of their own on recent iPhones, iPads and iPod Touches if they were able to discover it. Apple has not commented on this specific issue, but has urged users to install the new version of iOS, which addresses Google's other discoveries as well as a further range of glitches and threats. One of the two Google researchers involved - Natalie Silvanovich - intends to share more details of her findings at a presentation at the Black Hat conference in Las Vegas next month.' -- source: https://apple.slashdot.org/story/19/07/30/237228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Hottest Phones For the Next Billion Users Aren't Smartphones
by Peter Reutemann 31 Jul '19

31 Jul '19

'Millions of first-time internet consumers from the Ivory Coast to India and Indonesia are connecting to the web on smart feature phones that cost only about $25. "[T]hese hybrid phones, fueled by inexpensive mobile data, provide some basic apps and internet access in addition to calling and texting," the Wall Street Journal reports. >From the report: While global smartphone sales began sliding last year as markets became saturated, smart feature phone shipments tripled to around 75 million from 2017, according to research firm Counterpoint. Some 84 million are likely to be shipped this year. Even as rich nations start to roll out 5G technologies, some 3.4 billion people around the world remain cut off from the internet, according to We Are Social, another research firm. Most of them already use traditional, unconnected mobile phones, meaning they can easily make the transition to similarly shaped devices capable of high-speed web connections. Smart feature phones aren't only inexpensive, but they also have physical keypads that are less intimidating than touch screens for those new to the technology. Meanwhile, their batteries last for days, a bonus in places where electricity is unreliable. There is a trade-off for the low price. The devices typically have slower and less powerful components, only basic cameras and their screens are usually just a few inches in size, factors that contribute to their longer battery life. There also are fewer apps available for smart feature phones.' -- source: https://mobile.slashdot.org/story/19/07/30/2317234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 76 Arrives With Flash Blocked By Default
by Peter Reutemann 31 Jul '19

31 Jul '19

'Google today launched Chrome 76 for Windows, Mac, Linux, Android, and iOS. The release includes Adobe Flash blocked by default, Incognito mode detection disabled, multiple PWA improvements, and more developer features. You can update to the latest version now using Chrome's built-in updater or download it directly from google.com/chrome. Google has been taking baby steps to kill off Flash for years. In 2015, Chrome started automatically pausing less important Flash content. In 2016, Chrome started blocking "behind the scenes" Flash content and using HTML5 by default. In July 2017, however, Adobe said it would kill Flash by 2020. With Chrome 76, Flash is now blocked by default. Users can still turn it on in settings, but next year, Flash will be removed from Chrome entirely.' -- source: https://apple.slashdot.org/story/19/07/30/2059214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Bill Would Ban Autoplay Videos and Endless Scrolling
by Peter Reutemann 31 Jul '19

31 Jul '19

Though not relevant to NZ legally speaking, it is still good to see that there is movement to avoid design that disadvantages the user: 'A new bill, sponsored by Sen. Josh Hawley (R-MO), targets snapstreaks, YouTube autoplay, and endless scrolling that, the bill alleges, are designed in a way to make services "addictive." Reader Zorro writes: Hawley's Social Media Addiction Reduction Technology Act, or the SMART Act, would ban these features that work to keep users on platforms longer, along with others, like Snapstreaks, that incentivize the continued use of these products. If approved, the Federal Trade Commission and Health and Human Services could create similar rules that would expire after three years unless Congress codified them into law. "Big tech has embraced a business model of addiction," Hawley said. "Too much of the 'innovation' in this space is designed not to create better products, but to capture more attention by using psychological tricks that make it difficult to look away." Deceptive design played an enormous part in last week's FTC settlement with Facebook, and Hawley's bill would make it unlawful for tech companies to use dark patterns to manipulate users into opting into services. For example, "accept" and "decline" checkboxes would need to be the same font, color, and size to help users make better, more informed choices. "Social media companies deploy a host of tactics designed to manipulate users in ways that undermines their wellbeing," said Josh Golin, executive director of campaign for a Commercial Free Childhood.' -- source: https://news.slashdot.org/story/19/07/30/1742213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple's AWDL Protocol Plagued By Flaws That Enable Tracking and MitM Attacks
by Peter Reutemann 31 Jul '19

31 Jul '19

'Apple Wireless Direct Link (AWDL), a protocol installed on over 1.2 billion Apple devices, contains vulnerabilities that enable attackers to track users, crash devices, or intercept files transferred between devices via man-in-the-middle (MitM) attacks. From a report: These are the findings of a research project that started last year at the Technical University of Darmstadt, in Germany, and has recently concluded, and whose findings researchers will be presenting later this month at a security conference in the US. The project sought to analyze the Apple Wireless Direct Link (AWDL), a protocol that Apple rolled out in 2014 and which also plays a key role in enabling device-to-device communications in the Apple ecosystem. While most Apple end users might not be aware of the protocol's existence, AWDL is at the core of Apple services like AirPlay and AirDrop, and Apple has been including AWDL by default on all devices the company has been selling, such as Macs, iPhones, iPads, Apple watches, Apple TVs, and HomePods. But in the past five years, Apple has never published any in-depth technical details about how AWDL works. This, in turn, has resulted in very few security researchers looking at AWDL for bugs or implementation errors.' -- source: https://apple.slashdot.org/story/19/07/30/1723254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

200 Million Devices -- Some Mission-Critical -- Vulnerable To Remote Takeover
by Peter Reutemann 29 Jul '19

29 Jul '19

'About 200 million Internet-connected devices -- some that may be controlling elevators, medical equipment, and other mission-critical systems -- are vulnerable to attacks that give attackers complete control, researchers warned on Monday. In all, researchers with security firm Armis identified 11 vulnerabilities in various versions of VxWorks, a slimmed-down operating system that runs on more than 2 billion devices worldwide. Billed collectively as Urgent 11, the vulnerabilities consist of six remote code flaws and five less-severe issues that allow things like information leaks and denial-of-service attacks. None of the vulnerabilities affects the most recent version of VxWorks or any of the certified versions of the OS, including VxWorks 653 or VxWorks Cert Edition. For the 200 million devices Armis estimated are running a version that's susceptible to a serious attack, however, the stakes may be high. Because many of the vulnerabilities reside in the networking stack known as IPnet, they can often be exploited by little more than boobytrapped packets sent from outside the Internet. Depending on the vulnerability, exploits may also be able to penetrate firewalls and other types of network defenses. The most dire scenarios are attacks that chain together multiple exploits that trigger the remote takeover of multiple devices. "Such vulnerabilities do not require any adaptations for the various devices using the network stack, making them exceptionally easy to spread," Armis researchers wrote in a technical overview. "In most operating systems, such fundamental vulnerabilities in the crucial networking stacks have become extinct, after years of scrutiny unravelled and mitigated such flaws." VxWorks-maker Wind River says the latest release of VxWorks "is not affected by the vulnerability, nor are any of Wind Rivers' safety-critical products that are designed for safety certification, such as VxWorks 653 and VxWorks Cert Edition used in critical infrastructure." Wind River issued patches last month and is in the process of notifying affected customers of the threat.' -- source: https://it.slashdot.org/story/19/07/29/2059248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source RISC-V License Helps Alibaba Sidestep US Trade War
by Peter Reutemann 29 Jul '19

29 Jul '19

'"RISC-V is open source, so it's much more resistant to government bans," reports Tom's Hardware: The Alibaba Group Holding, China's largest e-commerce company, unveiled its first self-designed chip, Xuantie 910, based on the open source RISC-V instruction set architecture. As reported by Nikkei Asian Review, the chip will target edge computing and autonomous driving, while the RISC-V's open source license may help Alibaba side-step the U.S. trade war altogether. Alibaba doesn't intend to manufacture the chips itself. Instead, it could outsource production to other Chinese semiconductor companies, such as Semiconductor Manufacturing International Corp. According to Nikkei, the Chinese government has been encouraging wealthy Chinese companies from various industries to enter the semiconductor industry in recent years. The government's efforts accelerated when the trade war with the U.S. started last year. It reportedly forced foreign companies to transfer their technology and IP to Chinese companies if they wanted any chance at the local Chinese market. "Most Chinese companies are still wary about whether Arm's architecture and Intel's architecture and technical support would remain accessible amid tech tension and further geopolitical uncertainties," Sean Yang, an analyst at research company CINNO in Shanghai, said, according to Nikkei. "It would be very helpful for China to increase long-term semiconductor sufficiency if big companies such as Alibaba jump in to build a chip (design) platform which smaller Chinese developers can just use without worrying about being cut off from supplies." The article also notes that using RISC-V will give Alibaba "the ability to completely customize and extend the ISA of the processors built on top of it without having to get permission from any company first."' -- source: https://news.slashdot.org/story/19/07/29/0224256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'No More Ransom' Decryption Tools Prevent $108M In Ransomware Payments
by Peter Reutemann 29 Jul '19

29 Jul '19

'On the three-year anniversary of the No More Ransom project, Europol announced today that users who downloaded and decrypted files using free tools made available through the No More Ransom portal have prevented ransomware gangs from making profits estimated at at least $108 million... However, an Emsisoft spokesperson told ZDNet that the $108 million estimate that Europol shared today is "actually a huge underestimate. They're based on the number of successful decryptions confirmed by telemetry -- in other words, when the tools phone home to confirm they've done their job," Emsisoft told ZDNet... Just the free decryption tools for the GandCrab ransomware alone offered on the No More Ransom website have prevented ransom payments of nearly $50 million alone, Europol said. The project, which launched in July 2016, now hosts 82 tools that can be used to decrypt 109 different types of ransomware. Most of these have been created and shared by antivirus makers like Emsisoft, Avast, and Bitdefender, and others; national police agencies; CERTs; or online communities like Bleeping Computer. By far the most proficient member has been antivirus maker Emsisoft, which released 32 decryption tools for 32 different ransomware strains... All in all, Europol said that more than three million users visited the site and more than 200,000 users downloaded tools from the No More Ransom portal since its launch. One Emisoft researcher said they were "pretty proud" of their decryptor for MegaLocker, "as not only did it help thousands of victims, but it really riled up the malware author."' -- source: https://it.slashdot.org/story/19/07/28/2358258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Penetration Testing Toolkit Includes Exploit For 'Incredibly Dangerous' Bluekeep Vulnerability
by Peter Reutemann 28 Jul '19

28 Jul '19

'In May, Microsoft released a patch for a bug in several versions of Windows that is so bad that the company felt it even had to release a fix for Windows XP, an operating system that (has been unsupported) for five years. That vulnerability is known as BlueKeep, and it has kept a lot of security researchers up at night. They are worried that someone could write an exploit for it and make a worm that could wreak havoc the way WannaCry or NotPetya -- two viruses that spread almost uncontrollably all over the world locking thousands of computers -- did.... Researchers were so worried about this vulnerability that for months, no one has published the code for a proof-of-concept exploit. In other words, no one wanted to be the guy to even prove that this type of malware was even possible to write. Until now. On Tuesday, Immunity, a long time US government contractor, announced that it had developed an exploit for BlueKeep and included it into its penetration testing toolkit Canvas, which is available only to paying subscribers. Canvas customers, can now exploit this bug using Immunity's own code. ZDNet notes that Canvas licenses "cost between thousands and tens of thousands of US dollars," but also adds that "hackers have been known to pirate or legitimately buy penetration testing tools."' -- source: https://tech.slashdot.org/story/19/07/27/042203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In 80 Days, Google Will Require Chrome Extensions To Request 'The Least Amount of Data'
by Peter Reutemann 28 Jul '19

28 Jul '19

'"Google is giving Chrome extension makers until October 15 to minimize the amount of data they collect during browser sessions or face expulsion from the Chrome Web Store," reports PC Magazine: The change addresses how the extensions generally need to request certain permissions from your browser in order to function. However, some of these permissions can be pretty powerful; they can include the ability to take desktop screenshots, capture audio from a microphone, and collect data from the local file system, among other things, which can open the door to potential abuse. The risks prompted Google to work toward securing the 180,000+ Chrome extensions on the company's official web store. "We're requiring extensions to only request access to the least amount of data," the company said in a Tuesday blog post. "While this has previously been encouraged of developers, now we're making this a requirement for all extensions."' -- source: https://yro.slashdot.org/story/19/07/27/0420225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Focused Android Q Still Lets Advertisers Track You
by Peter Reutemann 28 Jul '19

28 Jul '19

'"The upcoming version of the Android operating system is taking a strong focus on privacy," reports SD Times, "but the Electronic Frontier Foundation (EFF) believes it could still do better." Android Q's new privacy features include: user control over app access to device location, new limits on access to files in shared external storage, restrictions on launching activities, and restrictions on access to the device's hardware and sensors... "However, in at least one area, Q's improvements are undermined by Android's continued support of a feature that allows third-party advertisers, including Google itself, to track users across apps," Bennett Cyphers, engineer for the EFF, wrote in a post. "Furthermore, Android still doesn't let users control their apps' access to the Internet, a basic permission that would address a wide range of privacy concerns." According to Cyphers, while Android Q has new restrictions on non-resettable device identifies, it will allow unrestricted access for its own tracking identifier [called "advertising ID"]... "Facebook and other targeting companies allow businesses to upload lists of ad IDs that they have collected in order to target those users on other platforms," he wrote... "On Android, there is no way for the user to control which apps can access the ID, and no way to turn it off. While we support Google taking steps to protect other hardware identifiers from unnecessary access, its continued support of the advertising ID -- a "feature" designed solely to support tracking -- undercuts the company's public commitment to privacy," he wrote... Cypher also noted that while Apple's iOS has similar identifiers for advertisers that contradict with its privacy campaign, it does enable users to turn off the tracking. In fact, Android Q also ships with an "opt out of ad personalization" checkbox where users can indicate that they don't want Google's identifier to track them, Cyphers reports -- but "the checkbox doesn't affect the ad ID in any way. "It only encodes the user's 'preference', so that when an app asks Android whether a user wants to be tracked, the operating system can reply 'no, actually they don't.' Google's terms tell developers to respect this setting, but Android provides no technical safeguards to enforce this policy."' -- source: https://yro.slashdot.org/story/19/07/27/0526206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Airbus A350 Software Bug Forces Airlines To Turn Planes Off and On Every 149 Hours
by Peter Reutemann 26 Jul '19

26 Jul '19

'Some models of Airbus A350 airliners still need to be hard rebooted after exactly 149 hours, despite warnings from the EU Aviation Safety Agency (EASA) first issued two years ago. In a mandatory airworthiness directive (AD) reissued earlier this week, EASA urged operators to turn their A350s off and on again to prevent "partial or total loss of some avionics systems or functions." The revised AD, effective from tomorrow (26 July), exempts only those new A350-941s which have had modified software pre-loaded on the production line. For all other A350-941s, operators need to completely power the airliner down before it reaches 149 hours of continuous power-on time. Concerningly, the original 2017 AD was brought about by "in-service events where a loss of communication occurred between some avionics systems and avionics network" (sic). The impact of the failures ranged from "redundancy loss" to "complete loss on a specific function hosted on common remote data concentrator and core processing input/output modules." In layman's English, this means that prior to 2017, at least some A350s flying passengers were suffering unexplained failures of potentially flight-critical digital systems.' -- source: https://it.slashdot.org/story/19/07/25/1932229 Oh dear... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VLC player has a critical flaw – and there’s no patch yet
by Peter Reutemann 25 Jul '19

25 Jul '19

'On the flip side, there are currently no known cases of the vulnerability being exploited in the wild Germany’s national Computer Emergency Response Team (CERT-Bund) has issued a security advisory to alert users of VLC media player of a severe vulnerability affecting this extremely popular open-source software. “A remote, anonymous attacker can exploit the vulnerability in VLC to execute arbitrary code, cause a denial-of-service condition, exfiltrate information, or manipulate files,” said CERT-Bund, which also discovered the security loophole. The memory-corruption flaw is known to reside in the player’s latest release, 3.0.7.1, but may also be present in its earlier versions. It affects the program’s Windows, Linux and UNIX versions and has earned a score of 4 out of 5 on the German agency’s severity scale.' -- source: https://cybersafe.mcttrainingconsultant.com/?p=14585 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Advanced mobile surveillanceware, made in Russia, found in the wild
by Peter Reutemann 24 Jul '19

24 Jul '19

'Researchers have discovered some of the most advanced and full-featured mobile surveillanceware ever seen. Dubbed Monokle and used in the wild since at least March 2016, the Android-based application was developed by a Russian defense contractor that was sanctioned in 2016 for helping that country’s Main Intelligence Directorate meddle in the 2016 US presidential election. Monokle uses several novel tools, including the ability to modify the Android trusted-certificate store and a command-and-control network that can communicate over Internet TCP ports, email, text messages, or phone calls. The result: Monokle provides a host of surveillance capabilities that work even when an Internet connection is unavailable.' -- source: https://arstechnica.com/information-technology/2019/07/advanced-mobile-surv… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'The Raspberry Pi 4 Needs a Fan'
by Peter Reutemann 24 Jul '19

24 Jul '19

'Author and programmer Jeff Geerling explains in a blog post why the new Raspberry Pi 4 needs a fan. Unlike previous Pis that didn't require a fan or heatsink to avoid CPU throttling, the Pi 4 is a different beast and "pretty much demands a fan," writes Geerling. "Not only does the CPU get appreciably hot even under normal load, there are a number of other parts of the board that heat up to the point they are uncomfortable to touch." After 5 minutes at idle, he recorded the CPU/System-on-a-Chip (SoC) was around 60C, and it climbed to the 60-70C range when using the USB ports. "[I]magine if you're truly using the Pi 4 as a desktop replacement, with at least one external USB 3.0 hard drive attached, WiFi connected and transferring large amounts of data, a USB keyboard and mouse, a few browser windows open (the average website these days might as well be an AAA video game with how resource-intense it is), a text editor, and a music player," writes Geerling. "This amount of load is enough to cause the CPU to throttle in less than 10 minutes." So, Geerling did what any programmer and DIYer would do and decided to add a fan himself to the official case -- and in addition to the blog post describing the process, he made a 22-minute-long video showing you what he did. From the post: Without any ventilation, it's kind of a little plastic oven inside the Pi 4 case. A heat sink might help in some tiny way, but that heat has nowhere to go! So I decided to follow the lead of Redditor u/CarbyCarberson and put a fan in the top cover. [...] After installing the fan, I booted the Pi and ran "stress --cpu 4" and let it go for an hour. The entire time, the CPU's temperature stayed at or under 60C (140F), a full 20C lower than the throttling point. There are some other options which may be even easier than modifying the official case, like the Fan Shim from Pimoroni or purchasing a 3rd party case with a fan built in. But this option was easy enough and all I needed to complete the project was a $4 fan and a $7 hole saw drill bit (which I can use for other projects in the future). ' -- source: https://hardware.slashdot.org/story/19/07/17/2254204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Fortnite' Creator Epic Games Supports Blender Foundation With $1.2 Million
by Peter Reutemann 24 Jul '19

24 Jul '19

'Apparently having a lot of people playing Fortnite is good for the open source community too. Epic Games' MegaGrants program just awarded the Blender Foundation with $1.2 million over the next three years...to further the success of the free and open source 3D creation suite. It's part of the company's $100 million "MegaGrants" program, according to the announcement. "Open tools, libraries and platforms are critical to the future of the digital content ecosystem," said Tim Sweeney, founder and CEO of Epic Games. "Blender is an enduring resource within the artistic community, and we aim to ensure its advancement to the benefit of all creators."' -- source: https://games.slashdot.org/story/19/07/21/1551251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chances of destructive BlueKeep exploit rise with new explainer posted online
by Peter Reutemann 23 Jul '19

23 Jul '19

'A security researcher has published a detailed guide that shows how to execute malicious code on Windows computers still vulnerable to the critical BlueKeep vulnerability. The move significantly lowers the bar for writing exploits that wreak the kinds of destructive attacks not seen since the WannaCry and NotPetya attacks of 2017, researchers said. As of three weeks ago, more than 800,000 computers exposed to the Internet were vulnerable to the exploit, researchers from security firm BitSight said last week. Microsoft and a chorus of security professionals have warned of the potential for exploits to sow worldwide disruptions. The risk of the bug, found in Microsoft's implementation of the remote desktop protocol, stems from the ability for attacks to spread from one vulnerable computer to another with no interaction required of end users.' -- source: https://arstechnica.com/information-technology/2019/07/explainer-for-exploi… May you live in interesting times (as a Windows users)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cycling through windows of same application
by Peter Reutemann 23 Jul '19

23 Jul '19

Hi everyone Just learned something new by accident... ;-) Using "Alt+`" (the key above Tab), you can limit the cycling to the windows of that application, e.g., all Firefox or LibreOffice Writer/Calc windows in a workspace. Useful alternative to "Alt+Tab" which cycles through all Windows in a workspace. >From the looks of it, cycling through multiple terminal windows doesn't work. I presume, this is because they are different processes rather than child windows. Tested on Linux Mint 19.1 MATE desktop. -- source: https://askubuntu.com/questions/1160167 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

SUSE Names Melissa Di Donato New CEO
by Peter Reutemann 22 Jul '19

22 Jul '19

'Melissa Di Donato, SAP's former COO, has been named SUSE's new CEO. ZDNet reports: London-based Di Donato is a well-known technology leader. In particular, she has a proven track record in sales and business operations. Besides being SAP's COO, she was also the company's chief revenue officer. In SAP's latest quarter, SAP saw an increase of 11% year-over-year revenues. Much of that came from the cloud -- where SAP saw 40% year-over-year growth. SAP's cloud is built on SUSE's Linux servers and OpenStack cloud. Di Donato succeeds Nils Brauckmann. While officially Brauckmann is retiring, there seems to be more to the story. On LinkedIn, Brauckmann wrote: "I care very deeply for the SUSE business and its employees, and this difficult decision is based entirely on personal reasons. I am pleased to be handing over the reins to such a talented and accomplished leader as Melissa Di Donato." In his SUSE statement, Brauckman added: "She is a proven and dynamic change agent, and many of her achievements have occurred in subscription businesses that exist in high-growth cloud environments." In April, then-CEO Nils Brauchmann said his company would soon be the largest independent Linux company. This comes after Brauckmann delivered eight years of continuous expansion during his tenure, including record-breaking revenues in FY18, reports ZDNet. "Under Di Donato's leadership, SUSE will continue to focus on growth and expansion. What that means is she's expected to advance SUSE's core business and emerging technologies, both organically and through add-on acquisitions."' -- source: https://linux.slashdot.org/story/19/07/22/2038259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dropbox Brings Back Support For ZFS, XFS, Btrfs And eCryptFS On Linux
by Peter Reutemann 22 Jul '19

22 Jul '19

'Speaking of Dropbox, the online storage cloud service has enabled support for ZFS and XFS on 64-bit Linux systems, and eCryptFS and Btrfs on all Linux systems. The move comes after it recently pulled support for all file storage systems on Linux except Ext4. From a report: Dropbox stopped supporting folder syncing to drives with filesystems it deemed "uncommon", which on Linux meant anything but Ext4, upsetting quite a few users. The reason cited for this was that "a supported file system is required as Dropbox relies on extended attributes (X-attrs) to identify files in the Dropbox folder and keep them in sync", which doesn't really make sense since there are many filesystems that support xattr (extended attributes) on Linux. After this change was announced, various workarounds started to appear online, including one that I posted on Linux Uprising. There was even a new unofficial, open source Dropbox client developed for this reason (which is also much lighter than the official client by the way). But this didn't last long though, as last week, the Dropbox 77.3.127 beta changelog says that Dropbox has added back support for ZFS (on 64-bit systems only), XFS (on 64bit systems only), Btrfs and eCryptFS.' -- source: https://hardware.slashdot.org/story/19/07/22/1534200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This pixel tracking demo shows how easy it is to make a creepy surveillance tool
by Peter Reutemann 19 Jul '19

19 Jul '19

'The Superhuman controversy from earlier this month, in which a former Silicon Valley exec blew the lid off a series of controversial email surveillance tools offered by the up-and-coming startup, has prompted a bit of soul searching among those in the tech industry. But in twisted fashion, the public blasting of a company like Superhuman has been the tech equivalent of opening Pandora’s Box, unearthing all sorts of free and easily available tools that have done this for years and can be employed by anyone with just the tiniest shred of tech savvy. For instance, an open source, Python-based web tool called Supertracker has popped up on Github, courtesy of Delian Asparouhov, an investor with the venture capital firm Founder’s Fund. It lets anyone create their own tracking pixel, coyly disguised as either a transparent image, an image of the pokémon pikachu, or a not-so-subtle magnifying glass. Creating it is as easy as inputting a user name, picking a tracking pixel image, and hitting the enter key. From there, you can save the image, paste it in the body of any email, and send it off. Whoever opens it will have the when and even the where transmitted back to you. Of course, you can do similar styles of tracking with any number of available Superhuman competitors and browser extensions. But Asparouhov’s tool has the added benefit of walking you through the process step by step and laying out just how simple it is to siphon away this kind of sensitive info with a few simple lines of code. (He also outlines some good defenses against this type of surveillance.) ' -- source: https://www.theverge.com/2019/7/19/20700843 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China's Tech Giants Have a Second Job: Helping Beijing Spy on Its People
by Peter Reutemann 19 Jul '19

19 Jul '19

'Tencent and Alibaba are among the firms that assist authorities in hunting down criminal suspects, silencing dissent and creating surveillance cities. From a report: Alibaba Group's sprawling campus has collegial workspaces, laid-back coffee bars and, on the landscaped grounds, a police outpost. Employees use the office to report suspected crimes to the police, according to people familiar with the operation. Police also use it to request data from Alibaba for their own investigations, these people said, tapping into the trove of information the tech giant collects through its e-commerce and financial-payment networks. In one case, the police wanted to find out who had posted content related to terrorism, said a former Alibaba employee. "They came to me and asked me for the user ID and information," he recalled. He turned it over. The Chinese government is building one of the world's most sophisticated, high-tech systems to keep watch over its citizens, including surveillance cameras, facial-recognition technology and vast computers systems that comb through terabytes of data. Central to its efforts are the country's biggest technology companies, which are openly acting as the government's eyes and ears in cyberspace. Companies including Alibaba Group Holding, Tencent Holdings and Baidu, are required to help China's government hunt down criminal suspects and silence political dissent. Their technology is also being used to create cities wired for surveillance.' -- source: https://yro.slashdot.org/story/19/07/19/1443207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Says Hongmeng OS Isn't Designed as an Android Replacement
by Peter Reutemann 19 Jul '19

19 Jul '19

'Huawei reportedly wants to keep using Google's Android operating system in its phones instead of jumping to its self-developed Hongmeng system. From a report: Company senior vice president Catherine Chen told reporters in Brussels this week that the Hongmeng OS isn't even designed for phones, according to Chinese state news agency Xinhua. Chen apparently said Hongmeng is for industrial use, noting that it contains far fewer lines of code than a phone OS, and has much lower latency than a phone, meaning it can process a very high volume of data messages with little delay. Latest episode in a confusing narrative about what Huawei even intends to do. The company's executives have previously said on record that its homegrown operating system is designed to replace Android on its handsets. One executive said the operating system would be released by last month -- a target that Huawei has missed.' -- source: https://tech.slashdot.org/story/19/07/19/1524253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Rust-Based TLS Library Outperformed OpenSSL in Almost Every Category
by Peter Reutemann 19 Jul '19

19 Jul '19

'A tiny and relatively unknown TLS library written in Rust, an up-and-coming programming language, outperformed the industry-standard OpenSSL in almost every major category. From a report: The findings are the result of a recent four-part series of benchmarks carried out by Joseph Birr-Pixton, the developer behind the Rustls library. The findings showed that Rustls was 10% faster when setting up and negotiating a new server connection, and between 20 and 40% faster when setting up a client connection. But while handshake speeds for new TLS connections are important, most TLS traffic relies on resuming previously negotiated handshakes. Here, too, Rustls outperformed the aging OpenSSL, being between 10 and 20% in resuming a connection on the server-side, and being between 30 and 70% quicker to resume a client connection. Furthermore, Rustls also fared better in sheer bulk performance -- or the speed at which data is transferred over the TLS connection. Birr-Pixton said Rustls could send data 15% faster than OpenSSL, and receive it 5% faster as well.' -- source: https://tech.slashdot.org/story/19/07/19/1546224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

My browser, the spy: How extensions slurped up browsing histories from 4M users
by Peter Reutemann 18 Jul '19

18 Jul '19

'When we use browsers to make medical appointments, share tax returns with accountants, or access corporate intranets, we usually trust that the pages we access will remain private. DataSpii, a newly documented privacy issue in which millions of people’s browsing histories have been collected and exposed, shows just how much about us is revealed when that assumption is turned on its head. DataSpii begins with browser extensions—available mostly for Chrome but in more limited cases for Firefox as well—that, by Google's account, had as many as 4.1 million users. These extensions collected the URLs, webpage titles, and in some cases the embedded hyperlinks of every page that the browser user visited. Most of these collected Web histories were then published by a fee-based service called Nacho Analytics, which markets itself as “God mode for the Internet” and uses the tag line “See Anyone’s Analytics Account.” Web histories may not sound especially sensitive, but a subset of the published links led to pages that are not protected by passwords—but only by a hard-to-guess sequence of characters (called tokens) included in the URL. Thus, the published links could allow viewers to access the content at these pages. (Security practitioners have long discouraged the publishing of sensitive information on pages that aren't password protected, but the practice remains widespread.)' -- source: https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slack Resets Passwords For 1% of Its Users Because of 2015 Hack
by Peter Reutemann 18 Jul '19

18 Jul '19

'Slack published more details about a password reset operation that ZDNet reported earlier today. According to a statement the company published on its website, the password reset operation is related to the company's 2015 security breach. In March 2015, Slack said hackers gained access to some Slack infrastructure, including databases storing user credentials. Hackers stole hashed passwords, but they also planted code on the company's site to capture plaintext passwords that users entered when logging in. At the time, Slack reset passwords for users who it believed were impacted, and also added support for two-factor authentication for all accounts. But as ZDNet reported earlier today, the company recently received a batch of Slack users credentials, which prompted the company to start an investigation into its source and prepare a password reset procedure. "We immediately confirmed that a portion of the email addresses and password combinations were valid, reset those passwords, and explained our actions to the affected users," Slack said. In a message on its website, Slack said this batch of credentials came via its bug bounty program. The company said it initially believed the data came from users who had their PCs infected with malware, or users who reused passwords across different services.' -- source: https://tech.slashdot.org/story/19/07/18/1610221 Yep, been one of them... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Explore Using Rust
by Peter Reutemann 18 Jul '19

18 Jul '19

'Microsoft plans to explore using the Rust programming language as an alternative to C, C++, and others, as a way to improve the security posture of its and everyone else's apps. From a report: The announcement was made yesterday by Gavin Thomas, Principal Security Engineering Manager for the Microsoft Security Response Center (MSRC). "You're probably used to thinking about the Microsoft Security Response Center as a group that responds to incidents and vulnerabilities," Thomas said. "We are a response organization, but we also have a proactive role, and in a new blog series we will highlight Microsoft's exploration of safer system programming languages, starting with Rust." The end game is to find a way to move developers from the aging C and C++ programming language to so-called "memory-safe languages." Memory-safe languages, such as Rust, are designed from the ground up with protections against memory corruption vulnerabilities, such as buffer overflows, race conditions, memory leaks, use-after free and memory pointer-related bug' -- source: https://developers.slashdot.org/story/19/07/17/1630241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Warn When Saved Logins are Found in Data Breaches
by Peter Reutemann 18 Jul '19

18 Jul '19

'Starting in Firefox 70, Mozilla aims to have the browser report when any of your saved logins were found in data breaches. This will be done through their partnership with the Have I Been Pwned data breach site. From a report: Mozilla is slowly integrating their independent Firefox Monitor service and the new Firefox Lockwise password manager directly into Firefox. Mozilla is also considering premium services based around these features in the future. As part of this integration, Firefox will scan the saved login names and passwords and see if they were exposed in a data breach listed on Have I been Pwned. If one is found, Firefox will alert the user and prompt them to change their password. This new feature will only work, though, for data breaches that exposed passwords and when the password was saved prior to an associated data breach.' -- source: https://news.slashdot.org/story/19/07/17/1933231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Join us at the Red Hat & Ingram Micro Partner Day!
by Roger Hardy 17 Jul '19

17 Jul '19

Below was the source of that. In my experience, this is usually more sales than technical, but can be interesting all the same. Sorry for the spam..... What’s new with Red Hat?To make sure our emails get to your inbox, add imnz_ms(a)ingrammicro.co.nz to your address book.Email not displaying correctly? View it in your browser.Dear Rodger, You’re invited to join Ingram Micro and Red Hat as we bring you the very first Red Hat Partner Day. We’ll be presenting updates and insights on the newest technologies and architectures in hybrid multi-cloud solutions to help you: Learn how Red Hat's latest technologies can help you and your customers break down the barriers to true hybrid and multi-cloud environments.Understand how to use automation and intelligent management of cloud technologies to reduce security risks and exposures.Find out what’s new and happening at Red Hat.LOCATIONSAucklandRydges Hotel Hobson Room Tuesday, 23 July 2019 8:30 am - 11:40 am WellingtonThe Intercontinental Wellington Room Thursday, 25 July 2019 8:30 am - 11:40 amAGENDA8:30 - 9:30Breakfast9:30 - 9:35Welcome9:30 - 10:15Red Hat Enterprise Linux 8 with Insights and Ansible Automation10:15 - 10:55Red Hat OpenShift Container Platform 4: Enterprise Kubernetes & the Future of Open Hybrid Cloud10:55 - 11:10Industry Trends11:10 - 11:40Panel Discussion on Strategic portfolio Hybrid Cloud Register Now For more information, please contact: helen.chan(a)ingrammicro.com.Ingram Micro (N.Z.) Ltd 78 Apollo Drive, Rosedale, Auckland 0632nz.ingrammicro.com Follow on Twitter Follow on Linkedin Like on Facebook Copyright © 2019, All rights reserved. Our mailing address is: Ingram Micro New Zealand 78 Apollo Drive Rosedale Auckland, 0632 New Zealand Standard terms and conditions apply View our privacy policy Update preferences Unsubscribe

1 0

Red Hat Tech Talk: Hybrid Cloud New Zealand
by Peter Reutemann 17 Jul '19

17 Jul '19

Just saw the following (free, I believe) event come through on the NZOSS mailing list and thought people on here might be interested as well: Red Hat Tech Talk: Hybrid Cloud New Zealand At this afternoon event, meet our experts, hear what's new at Red Hat and get the latest insights on: - How to deliver innovative apps through containers - Security, compliance and governance for apps and workloads that run on a mix of public and private clouds - Automation and management capabilities for genuine portability of workloads into public cloud - How Red Hat Enterprise Linux 8 and Red Hat OpenShift 4 are transformational for hybrid clouds Select from two cities: Auckland - 23 July Wellington - 25 July Event registration: https://events.redhat.com/profile/form/index.cfm?PKformID=0x69788abcd# Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Giving Greylisting A Try
by Lawrence D'Oliveiro 15 Jul '19

15 Jul '19

I have decided to try installing sqlgrey on my VPS to see if that cuts down on the volume of spam. The basic idea is more than a decade old, and I can’t find much in the way of newer testimonials as to how wonderful it continues to be. On the other hand, I can’t see anyone saying it is now a terrible idea that should have a stake put through its heart and buried in an unmarked grave at midnight and forgotten. (Actually I’m posting this message just to see how legitimate mail makes it through the greylist obstacle course; it’s only been running less than an hour, and has already blocked 10 spam messages so far.)

2 7

meeting next Monday
by Peter Reutemann 15 Jul '19

15 Jul '19

Hi everyone We have a WLUG meeting next Monday: "Ben Radburnd will showcase GalliumOS (https://galliumos.org/) on his Chromebook." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884291/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Does Ubuntu's Post-Unity Future Look Like?
by Peter Reutemann 14 Jul '19

14 Jul '19

'Following Canonical's pivot away from its internally-developed Unity user interface and Mir display server, Ubuntu has enjoyed two relatively low-drama years, as the Linux Desktop market homogenized during its transition back to a customized GNOME desktop. In a review of the most recent release, TechRepublic's Jack Wallen declared that "Ubuntu 19.04 should seriously impress anyone looking for a fast and reliable Linux desktop platform." Largely, it's been a slow-and-steady pace for Ubuntu since the pivot from Unity to GNOME, though the distribution made headlines for plans to end support for 32-bit support. This prompted Valve, operators of games marketplace Steam, to re-think its approach toward Ubuntu, which it previously characterized as "as the best-supported path for desktop users." TechRepublic's James Sanders interviewed Will Cooke, director of engineering for Ubuntu Desktop at Canonical, about the distribution's long-term plans for legacy 32-bit support, shipping a desktop in a post-Unity-era Ubuntu, and why Linux should be the first choice for users migrating from Windows 7 prior to the end of support. >From the interview: When we did the switch to GNOME Shell from Unity, we did a survey [asking] people straightforward questions like, "What sort of features do you want to see continue in Ubuntu Desktop?" The answer came through very, very clearly that people liked having the launcher on the left, and they wanted to keep that feature there. They liked having desktop icons and they wanted to keep that feature there. We've made decisions based on data from our user base, from our community. They have provided that feedback and we've done what the majority of people want. Sometimes that doesn't go with the ideals of GNOME design, but we're comfortable with delivering what we see as value on top of GNOME. That's delivering a product which gives people consistency between the old days of Unity 7, and the new days of GNOME Shell. That transition was as easy as possible, everybody had a chance to have a say in it, and the answers were pretty clear. ' -- source: https://linux.slashdot.org/story/19/07/13/0425257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux 5.2?
by Peter Reutemann 14 Jul '19

14 Jul '19

'Linux 5.2 has been released. This release includes Sound Open Firmware, a project that brings open source firmware to DSP audio devices; open firmware for many Intel products is also included. This release also improves the Pressure Stall Information resource monitoring to make it usable by Android; the mount API has been redesigned with new syscalls; the BFQ I/O scheduler has gained some performance improvements; a new CLONE_PIDFD flag lets clone(2) return pidfs usable by pidfd_send_signal(2); Ext4 has gained support for case-insensitive name lookups; there is also a new device mapper target that simulates a device that has failing sectors and/or read failures; open source drivers for the ARM Mali t4xx and newer 6xx/7xx have been added. Many other new drivers, features and changes can be found in the changelog. But there's more besides supporting "a handful of extra ARM-powered single-board computers," according to CRN: The biggest feature in 5.2 is probably support for Intel's forthcoming Comet Lake architecture, which will power the tenth generation of its Core desktop and mobile CPUs due. The new silicon is due to ship late in 2019 and appear in products early the next year. Linux 5.2 also includes many tweaks that improve its performance on laptops.' -- source: https://linux.slashdot.org/story/19/07/13/0436246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Patches Two New Security Flaws
by Peter Reutemann 14 Jul '19

14 Jul '19

'This week Intel announced two new patches, according to Tom's Hardware: The flaw in the processor diagnostic tool (CVE-2019-11133) is rated 8.2 out 10 on the CVSS 3.0 scale, making it a high-severity vulnerability. The flaw [found by security researcher Jesse Michael from Eclypsium] "may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access," according to Intel's latest security advisory. Versions of the tool that are older than 4.1.2.24 are affected. The second vulnerability, found by Intel's internal team, is a medium-severity vulnerability in Intel's SSD DC S4500/S4600 series sold to data center customers. The flaw found in the SSD firmware versions older than SCV10150 obtained a 5.3 score on the CVSS 3.0 scale, so it was labeled medium-severity. The bug may allow an unprivileged user to enable privilege escalation via physical access. As one of the flaws was uncovered by Intel itself and for the other the Eclypsium research coordinated with Intel for its disclosure, Intel was able to have ready the patches in time for the public announcement. ' -- source: https://slashdot.org/story/19/07/13/2027223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PC Sales Are Up--Or Are They?
by Lawrence D'Oliveiro 12 Jul '19

12 Jul '19

Another report highlighting the usual discrepancy in analysis of PC sales between IDC and Gartner <https://arstechnica.com/information-technology/2019/07/gartner-idc-agree-th…>: the difference seems down to the fact that one includes Chromebooks in their definition of a “PC”, while the other one counts Microsoft Surface tablets instead. Obvious conclusion: if it weren’t for Chromebooks, the PC market would be a pretty gloomy place indeed.

1 0

The Most Clever 'Zip Bomb' Ever Made Explodes a 46MB File To 4.5 Petabytes
by Peter Reutemann 11 Jul '19

11 Jul '19

'Programmer and engineer David Fifield has unveiled a brand-new Zip bomb that explodes a 46-megabyte file to 4.5 petabytes of data. Fifield's new type of "Zip bomb" or "compression bomb" is particularly novel because he "figured out how to 'overlap' files inside of a Zip archive, allowing for compression rates far beyond those of a traditional archive," reports Motherboard. From the report: In an email interview, Fifield noted that, while 42.zip (which has a 106 billion-to-one compression ratio and has been hosted on the same single-serving website for at least 15 years) gets much of the attention, he finds later attempts more technically interesting. "eI find 42.zip inspiring on an aesthetic level -- not so much the file itself but the circumstances around it," Fifield said. "It's like folklore. There must have been many examples of the same basic idea, but for whatever reason 42.zip is the one that had staying power." Fifield noted that part of what makes his process possible was by coming up with ways to handle cyclic redundancy checks, or CRCs, a basic error-correction functionality baked into Zip, PNG, Ethernet, and numerous other technical standards. Messing around with CRC -- 32 checksums, as they're called, was where Fifield said he learned the most. Fifield, who will present his findings at the USENIX Workshop on Offensive Technologies (WOOT) conference next month, noted that while the work itself adds to a history of research and likely will be superseded in the future, its benefit from an awareness standpoint is importan' -- source: https://hardware.slashdot.org/story/19/07/10/2341251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linode Democratizes Cloud GPUs: Brings Powerful Nvidia GPUs To Its Linux Cloud
by Peter Reutemann 11 Jul '19

11 Jul '19

'Linode today launched new GPU-optimized cloud computing instances tailored specifically for developers and businesses requiring massive parallel computational power. The new instances are built on NVIDIA Quadro RTX 6000 GPU cards with all three major types of processing cores (CUDA, Tensor, and Real-Time Ray Tracing) available to users. Linode is one of the first cloud providers to deploy NVIDIA's latest GPU architecture. These new GPU instances give scientists, artists, and engineers working on artificial intelligence, graphic visualization, and complex modeling a cost-competitive alternative to hyperscale cloud providers.' -- source: https://linux.slashdot.org/story/19/07/10/1826238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Academics Steal Data From Air-Gapped Systems Via a Keyboard's LEDs
by Peter Reutemann 11 Jul '19

11 Jul '19

'The Caps Lock, Num Lock, and Scroll Lock LEDs on a keyboard can be used to exfiltrate data from a secure air-gapped system, academics from an Israeli university have proved. From a report: The attack, which they named CTRL-ALT-LED, is nothing that regular users should worry about but is a danger for highly secure environments such as government networks that store top-secret documents or enterprise networks dedicated to storing non-public proprietary information. he attack requires some pre-requisites, such as the malicious actor finding a way to infect an air-gapped system with malware beforehand. CTRL-ALT-LED is only an exfiltration method. But once these prerequisites are met, the malware running on a system can make the LEDs of an USB-connected keyboard blink at rapid speeds, using a custom transmission protocol and modulation scheme to encode the transmitted data. A nearby attacker can record these tiny light flickers, which they can decode at a later point, using the same modulation scheme used to encode it.' -- source: https://it.slashdot.org/story/19/07/10/1836232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samba 4.11 Removes SMB1 File-Sharing Protocol Version By Default
by Peter Reutemann 11 Jul '19

11 Jul '19

'Samba says version 4.11.0 will switch off previously on-by-default support for the aging and easily subverted SMB1 protocol. Slashdot reader Jeremy Allison - Sam shares a report from The Register detailing the new changes: The open-source SMB toolkit's developers say the Samba 4.11 build, currently in preview, will by default set SMB2_02 as the earliest supported version of the Windows file-sharing protocol. Admins will still have the option to allow SMB1 on their servers if they so choose, but support will be turned off by default. The move by Samba to drop SMB1 can be seen as long overdue, given that Microsoft has been moving to get rid of the file-server protocol version from its operating systems for several years now, even before it was revealed to be one of the NSA's favorite weak points to exploit. ' -- source: https://tech.slashdot.org/story/19/07/10/2119238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Contractors Are Secretly Listening To Your Assistant Recordings
by Peter Reutemann 11 Jul '19

11 Jul '19

'A new report from Belgian broadcaster VRT News describes the process by which Google Home recordings end up being listened to by contractors -- and the scary part is that it apparently doesn't take much, if anything, to start a recording. While the recordings are not listened to live, audio clips are sent to subcontractors. The Next Web reports: VRT, with the help of a whistleblower, was able to listen to some of these clips and subsequently heard enough to discern the addresses of several Dutch and Belgian people using Google Home -- in spite of the fact some hadn't even uttered the words "Hey Google," which are supposed to be the device's listening trigger. The person who leaked the recordings was working as a subcontractor to Google, transcribing the audio files for subsequent use in improving its speech recognition. They got in touch with VRT after reading about Amazon Alexa keeping recordings indefinitely. According to the whistleblower, the recordings presented to them are meant to be carefully annotated, with notes included about the speakers presumed identity and age. From the sound of the report, these transcribers have heard just about everything. Personal information? Bedroom activities? Domestic violence? Yes, yes, and yes. While VRT only listened to recordings from Dutch and Belgian users, the platform the whistleblower showed them had recordings from all over the world -- which means there are probably thousands of other contractors listening to Assistant recordings. The VRT report states that the Google Home Terms of Service don't mention that recordings might be listened to by other humans. The report says that the recordings are identified by numbers rather than user names, but VRT "was able to pick up enough data from the recordings to find the addresses of the users in question, and even confront some of the users in the recordings -- to their great dismay," reports The Next Web. What does Google have to say about all this? That they only transcribe and use "about 0.2% of all audio clips" to improve their voice recognition technology.' -- source: https://yro.slashdot.org/story/19/07/10/2153210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet group brands Mozilla ‘internet villain’ for supporting DNS privacy feature
by Peter Reutemann 10 Jul '19

10 Jul '19

'An industry group of internet service providers has branded Firefox browser maker Mozilla an “internet villain” for supporting a DNS security standard. The U.K.’s Internet Services Providers’ Association (ISPA), the trade group for U.K. internet service providers, nominated the browser maker for its proposed effort to roll out the security feature, which they say will allow users to “bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK.” Mozilla said late last year it was planning to test DNS-over-HTTPS to a small number of users.' -- source: https://techcrunch.com/2019/07/05/isp-group-mozilla-internet-villain-dns-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Snap App Remains Hopelessly Outdated
by Peter Reutemann 10 Jul '19

10 Jul '19

'The official Skype Snap app for Linux has not been updated in nearly six months, and Microsoft is yet to say why. When introducing the cross-distro build in early 2018, the company said the Skype Snap app would give it the "... ability to push the latest features straight to our users, no matter which device or distribution they happen to use." Clearly, not. Because at the time of writing this post the Skype Snap app sits on version 8.34.0.78, which the Snapcraft store reports was 'last updated' in November 2018. However, the "regular" Linux version available to download from the Skype website is on version 8.47.0.73, released June 2019.' -- source: https://linux.slashdot.org/story/19/07/09/2014250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Closes Its $34 Billion Acquisition of Red Hat
by Peter Reutemann 09 Jul '19

09 Jul '19

'IBM closed its $34 billion acquisition of Red Hat, the companies announced Tuesday. From a report: The deal was originally announced in October, when the companies said IBM would buy all shares in Red Hat for $190 each in cash. The acquisition of Red Hat, an open-source, enterprise software maker, marks the close of IBM's largest deal ever. It's one of the biggest in U.S. tech history. Excluding the AOL-Time Warner merger, it follows the $67 billion deal between Dell and EMC in 2016 and JDS Uniphase's $41 billion acquisition of optical-component supplier SDL in 2000. Under the deal, Red Hat will now be a unit of IBM's hybrid cloud division, according to the original announcement. The companies said Red Hat's CEO, Jim Whitehurst, would join IBM's senior management team and report to CEO Ginni Rometty. IBM previously said it hoped its acquisition of Red Hat will help it do more work in the cloud, one of its four key growth drivers, which are also social, mobile and analytics. The company lags behind Amazon and Microsoft in the cloud infrastructure business. IBM has seen three consecutive quarters of declining year-over-year revenue. But some analysts are hopeful about the Red Hat deal's opportunity to bring in new business.' -- source: https://linux.slashdot.org/story/19/07/09/1740223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Logitech Wireless USB Dongles Vulnerable To New Hijacking Flaws
by Peter Reutemann 09 Jul '19

09 Jul '19

'A security researcher has publicly disclosed new vulnerabilities in the USB dongles (receivers) used by Logitech wireless keyboards, mice, and presentation clickers. New submitter raikoseagle shares a report: The vulnerabilities allow attackers to sniff on keyboard traffic, but also inject keystrokes (even into dongles not connected to a wireless keyboard) and take over the computer to which a dongle has been connected. When encryption is used to protect the connection between the dongle and its paired device, the vulnerabilities also allow attackers to recover the encryption key. Furthermore, if the USB dongle uses a "key blacklist" to prevent the paired device from injecting keystrokes, the vulnerabilities allow the bypassing of this security protection system. Marcus Mengs, the researcher who discovered these vulnerabilities, said he notified Logitech about his findings, and the vendor plans to patch some of the reported issues, but not all.' -- source: https://it.slashdot.org/story/19/07/09/182246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Admits To Faulty USB-C Design On the Pi 4
by Peter Reutemann 09 Jul '19

09 Jul '19

'The Raspberry Pi 4 was announced two weeks ago as a major new upgrade to the line of cheap single-board hobbyist computers. The Pi 4 featured a faster CPU, options for up to 4GB of RAM, and a new, modern USB-C port for power delivery. The Pi 4 was the Raspberry Pi Foundation's first ever USB-C device, and, well, they screwed it up. As detailed by Tyler Ward, the Raspberry Pi 4 has a non-compliant USB-C charging port and doesn't work with as many chargers as it should. Thanks to the open nature of Raspberry Pi (even the schematics are online!), Ward was able to discover that Raspberry Pi just didn't design its USB-C port correctly. Two "CC" pins on a USB-C port are supposed to each get their own 5.1K ohms resistor, but Raspberry Pi came up with its own circuit design that allows them to share a single resistor. This is not a compliant design and breaks compatibility with some of the more powerful USB-C chargers out there. Whether your USB-C charger works with the Pi 4 has to do with whether it uses an "e-marked" cable. E-marked cables are fully featured USB-C cables with chips inside that negotiate power management, accessory modes, data rates, and other communication specs. Since the Pi 4 USB-C port is wired incorrectly, these smart cables will detect the Pi 4 as an "Audio Adaptor Accessory" and refuse to charge them. Usually, e-marked cables are more expensive and come with larger, higher-powered items, like a USB-C laptop. After reports started popping up on the Internet, Raspberry Pi cofounder Eben Upton admitted to TechRepublic that "A smart charger with an e-marked cable will incorrectly identify the Raspberry Pi 4 as an audio adapter accessory and refuse to provide power." Upton went on to say, "I expect this will be fixed in a future board revision, but for now users will need to apply one of the suggested workarounds. It's surprising this didn't show up in our (quite extensive) field testing program."' -- source: https://hardware.slashdot.org/story/19/07/09/1934205 I'll stick with my RPi3 for the time being... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Blocks UAE Bid To Become an Internet Security Guardian After Hacking Reports
by Peter Reutemann 09 Jul '19

09 Jul '19

'Firefox browser maker Mozilla is blocking the United Arab Emirates' government from serving as one of its internet security gatekeepers, citing Reuters reports on a UAE cyber espionage program. From a report: Mozilla said in a statement on Tuesday it was rejecting the UAE's bid to become a globally recognized internet security watchdog, empowered to certify the safety of websites for Firefox users. Mozilla said it made the decision because cybersecurity firm DarkMatter would have administered the gatekeeper role and it had been linked by Reuters and other reports to a state-run hacking program. Reuters reported in January that Abu Dhabi-based DarkMatter provided staff for a secret hacking operation, codenamed Project Raven, on behalf of an Emirati intelligence agency. The unit was largely comprised of former U.S. intelligence officials who conducted offensive cyber operations for the UAE government. Former Raven operatives told Reuters that many DarkMatter executives were unaware of the secretive program, which operated from a converted Abu Dhabi mansion away from DarkMatter's headquarters.' -- source: https://tech.slashdot.org/story/19/07/09/1945241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 68 Arrives With Darker Reader View, Recommended Extensions, and IT Customizations
by Peter Reutemann 09 Jul '19

09 Jul '19

'Mozilla today launched Firefox 68 for Windows, Mac, Linux, Android, and iOS. Firefox 68 includes a darker reader view, recommended extensions, IT Pro customizations, and more. From a report: As part of this release, Mozilla has curated a list of recommended extensions "that have been thoroughly reviewed for security, usability, and usefulness." You can find the list on the Get Add-ons page in the Firefox Add-ons Manager (about:addons). While Firefox has had dark mode for months, the Reader View's dark contrast only covered the text area. Now, when you change the contrast to dark, all sections of the site (including sidebars and toolbars) will be immersed in dark mode. With Firefox 60, Mozilla introduced an enterprise version of the browser that employers can customize. This let IT professionals configure Firefox for their organization, either using Group Policy on Windows or a JSON file that works across Windows, Mac, and Linux. With Firefox 68, Mozilla has added more enterprise policies -- to configure or remove the new tab page, turn off search suggestions, and so on.' -- source: https://news.slashdot.org/story/19/07/09/1959238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After 25 Months, Debian 10 'buster' Released
by Peter Reutemann 07 Jul '19

07 Jul '19

'"After 25 months of development the Debian project is proud to present its new stable version 10 (code name 'buster'), which will be supported for the next 5 years thanks to the combined work of the Debian Security team and of the Debian Long Term Support team." In this release, GNOME defaults to using the Wayland display server instead of Xorg. Wayland has a simpler and more modern design, which has advantages for security. However, the Xorg display server is still installed by default and the default display manager allows users to choose Xorg as the display server for their next session. Thanks to the Reproducible Builds project, over 91% of the source packages included in Debian 10 will build bit-for-bit identical binary packages. This is an important verification feature which protects users against malicious attempts to tamper with compilers and build networks. Future Debian releases will include tools and metadata so that end-users can validate the provenance of packages within the archive. For those in security-sensitive environments AppArmor, a mandatory access control framework for restricting programs' capabilities, is installed and enabled by default. Furthermore, all methods provided by APT (except cdrom, gpgv, and rsh) can optionally make use of "seccomp-BPF" sandboxing. The https method for APT is included in the apt package and does not need to be installed separately... Secure Boot support is included in this release for amd64, i386 and arm64 architectures and should work out of the box on most Secure Boot-enabled machines. The announcement touts Debian's "traditional wide architecture support," arguing that it shows Debian "once again stays true to its goal of being the universal operating system." It ships with several desktop applications and environments, including the following: - Cinnamon 3.8 - GNOME 3.30 - KDE Plasma 5.14 - LXDE 0.99.2 - LXQt 0.14 - MATE 1.20 - Xfce 4.12 "If you simply want to try Debian 10 'buster' without installing it, you can use one of the available live images which load and run the complete operating system in a read-only state via your computer's memory... Should you enjoy the operating system you have the option of installing from the live image onto your computer's hard disk."' -- source: https://linux.slashdot.org/story/19/07/07/0426205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This Week On GitHub
by Lawrence D'Oliveiro 07 Jul '19

07 Jul '19

Just some random things I found: * BOOTSTRA.386 <https://github.com/kristopolous/BOOTSTRA.386> -- a Bootstrap theme to make your website look like a text display from the 1980s. Does require JavaScript. * GitHarvester <https://github.com/metac0rtex/GitHarvester> -- scans through GitHub repos for wp-config.php files that people might have “accidentally” published. Those familiar with WordPress may realize that this file can contain such sensitive things username and password information for connecting to a MySQL database. * Arduino-TV-B-Gone <https://github.com/shirriff/Arduino-TV-B-Gone>. TV-B-Gone was intended as a universal remote that could switch off any TV. This project implements the same thing on an Arduino. And they wonder why we can’t have nice things ...

1 0

Privacy-First Browsers Look To Take the Shine Off Google's Chrome
by Peter Reutemann 06 Jul '19

06 Jul '19

'Google's Chrome now reigns as the biggest browser on the block, and the company is facing challenges similar to Microsoft's from competitors, as well as government scrutiny. But Google faces a new wrinkle -- a growing realization among consumers that their every digital move is tracked. "I think Cambridge Analytica acted as a catalyst to get people aware that their data could be used in ways they didn't expect," said Peter Dolanjski, the product lead for Mozilla's Firefox web browser, referring to the scandal in which a political consulting firm obtained data on millions of Facebook users and their friends. And in something of a poetic role reversal, Microsoft is positioning itself to pick up the slack from people who may be fed up with Google's Chrome browser and its questionable privacy practices. Microsoft is expected to release an overhaul of its latest browser, called Edge, in the coming months. Microsoft is just one of a number of companies and organizations looking to take a piece out of Google -- some using the company's own open-source software. One name that might be familiar to most consumers -- Mozilla's Firefox browser -- is also a veteran of the "browser wars" of two decades ago. The nonprofit Mozilla, which has been biting at the heels of leading browsers for most of its existence, is introducing more aggressive privacy settings to try to stand out and take advantage of the privacy stumbles by Google and other tech giants.' -- source: https://news.slashdot.org/story/19/07/05/152233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Maintains a List of Everything You Ever Bought Using Gmail, Even if You Delete All Your Emails
by Peter Reutemann 06 Jul '19

06 Jul '19

'In May, I wrote up something weird I spotted on Google's account management page. I noticed that Google uses Gmail to store a list of everything you've purchased, if you used Gmail or your Gmail address in any part of the transaction. If you have a confirmation for a prescription you picked up at a pharmacy that went into your Gmail account, Google logs it. If you have a receipt from Macy's, Google keeps it. If you bought food for delivery and the receipt went to your Gmail, Google stores that, too. You get the idea, and you can see your own purchase history by going to Google's Purchases page. Google says it does this so you can use Google Assistant to track packages or reorder things, even if that's not an option for some purchases that aren't mailed or wouldn't be reordered, like something you bought at a store. At the time of my original story, Google said users can delete everything by tapping into a purchase and removing the Gmail. It seemed to work if you did this for each purchase, one by one. This isn't easy -- for years worth of purchases, this would take hours or even days of time. So, since Google doesn't let you bulk-delete this purchases list, I decided to delete everything in my Gmail inbox. That meant removing every last message I've sent or received since I opened my Gmail account more than a decade ago. Despite Google's assurances, it didn't work.' -- source: https://tech.slashdot.org/story/19/07/05/1728200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fake Samsung Firmware Update App Tricks More Than 10 Million Android Users
by Peter Reutemann 06 Jul '19

06 Jul '19

'Over ten million users have been duped in installing a fake Samsung app named "Updates for Samsung" that promises firmware updates, but, in reality, redirects users to an ad-filled website and charges for firmware downloads. From a report: "I have contacted the Google Play Store and asked them to consider removing this app," Aleksejs Kuprins, malware analyst at the CSIS Security Group, told ZDNet this week in an interview, after publishing a report on the app's shady behavior earlier today. The app takes advantage of the difficulty in getting firmware and operating system updates for Samsung phones, hence the high number of users who have installed it. "It would be wrong to judge people for mistakenly going to the official application store for the firmware updates after buying a new Android device," the security researcher said. "Vendors frequently bundle their Android OS builds with an intimidating number of software, and it can easily get confusing."' -- source: https://tech.slashdot.org/story/19/07/05/1456200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Set To Offer Ad-Free News Consumption Capability on Firefox For $5 Per Month
by Peter Reutemann 06 Jul '19

06 Jul '19

'As previously announced, Mozilla has started to tease the launch of a new $5 monthly subscription to a variety of online news publishers that involves no ads. The idea is that a single, low subscription fee gives you access to a number of sites with the ads removed. From a report: You pay a monthly fee to Mozilla, and this money is shared with its partners to help fund an ad-free internet experience. More than this, Mozilla says that the subscription fee will also grant access to audio versions of articles, article synchronization and more. In a page which promises people the chance to "support the sites you love, avoid the ads you hate", Mozilla says: "We've partnered with some of the world's greatest publishers to bring you a better journalism experience. We share your payment directly with the sites you read. They make more money which means they can bring you great content without needing to distract you with ads just to keep the lights on.' -- source: https://news.slashdot.org/story/19/07/05/1712247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost a Third of World's Top VPNs Are Secretly Owned By Chinese Firms, Study Finds
by Peter Reutemann 06 Jul '19

06 Jul '19

'Almost a third (30%) of the world's top virtual private network (VPN) providers are secretly owned by six Chinese companies, according to a study by privacy and security research firm VPNpro. The study shows that the top 97 VPNs are run by just 23 parent companies, many of which are based in countries with lax privacy laws. Six of these companies are based in China and collectively offer 29 VPN services, but in many cases, information on the parent company is hidden to consumers. Researchers at VPNpro have pieced together ownership information through company listings, geolocation data, the CVs of employees and other documentation. In some instances, ownership of different VPNs is split amongst a number of subsidiaries. For example, Chinese company Innovative Connecting owns three separate businesses that produce VPN apps: Autumn Breeze 2018, Lemon Cove and All Connected. In total, Innovative Connecting produces 10 seemingly unconnected VPN products, the study shows. Although the ownership of a number of VPN services by one company is not unusual, VPNpro is concerned that so many are based in countries with lax or non-existence privacy laws. ' -- source: https://tech.slashdot.org/story/19/07/05/1944235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0