- wlug - list.wlug.org.nz

Exodus Intelligence Details Zero-Day Vulnerabilities In Tails OS
by Peter Reutemann 22 Jul '14

22 Jul '14

"Tails OS, the Tor-reliant privacy-focused operating system made famous by Edward Snowden, contains a number of zero-day vulnerabilities that could be used to take control of the OS and execute code remotely. At least that's according to zero-day exploit seller Exodus Intelligence, which counts DARPA amongst its customer base. The company plans to tell the Tails team about the issues "in due time", said Aaron Portnoy, co-founder and vice president of Exodus, but it isn't giving any information on a disclosure timeline. This means users of Tails are in danger of being de-anonymised. Even version 1.1, which hit public release today (22 July 2014), is affected. Snowden famously used Tails to manage the NSA files. The OS can be held on a USB stick and leaves no trace once removed from the drive. It uses the Tor network to avoid identification of the user, but such protections may be undone by the zero-day exploits Exodus holds." -- source: http://tech.slashdot.org/story/14/07/22/165231 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Linux Saturday Workshop
by Bruce Kingsbury 22 Jul '14

22 Jul '14

I'll be running another Saturday Linux Workshop this weekend; Saturday July 26th, 2014 10:00 am – 2:00 pm *Te Whare O Te Ata* 60a Sare Cres Hamilton, 3214 07 8557804 This is a GNU/Linux-focused workshop where people can bring their PCs, Laptops, Pi's, Android devices etc for trouble-shooting and to learn or try out new skills. All visitors welcome - light lunch provided - gold coin donation appreciated

2 1

The "Rickmote Controller" Can Hijack Any Google Chromecast
by Peter Reutemann 21 Jul '14

21 Jul '14

'Dan Petro, a security analyst for the Bishop Fox IT consulting firm, built a proof of concept device that's able to hack into any Google Chromecasts nearby to project Rick Astley's "Never Gonna Give You Up," or any other video a prankster might choose. The "Rickmote," which is built on top of the $35 Raspberry Pi single board computer, finds a local Chromecast device, boots it off the network, and then takes over the screen with multimedia of one's choosing. But it gets worse for the victims: If the hacker leaves the range of the device, there's no way to regain control of the Chromecast. Unfortunately for Google, this is a rather serious issue with the Chromecast device that's not too easy to fix, as the configuration process is an essential part of the Chromecast experience.' -- source: http://tech.slashdot.org/story/14/07/21/1956258 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

meeting next Monday
by Peter Reutemann 21 Jul '14

21 Jul '14

Hi there We have a meeting coming up next Monday: "The Yubikey is one time password generator that conveniently connects a USB keyboard to your PC. It is port powered and small enough to kept on your keyring. The Yubikey uses Yubico's authentication server and can be used conveniently with Lastpass.com to provide two factor authentication to your online password vault. Third parties have written yubikey authentication mechanisms to secure restricted access to Apache webservers. There are many other applications and there are alternative hardware yubikeys capable of connection to smart phones. The authentication server technology is open source allowing users to create their own authentication servers. Yubico provides their service for free. At roughly $US25 a key, the technology is very competitively priced (cf RSA tokens) and well within the price range of most enthusiasts. Unfortunately, Google doesn't (yet) provide it as an option for their two factor authentication. The presenter will talk about lastpass.com and apache authentication." http://www.meetup.com/WaikatoLinuxUsersGroup/events/185499622/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Slackware Turns 21 Years Old
by Peter Reutemann 21 Jul '14

21 Jul '14

"It was on this day in 1993 that Patrick Volkerding announced the Slackware 1.00 release that was inspired by the Softlanding Linux System. Slackware remains kicking after 21 years of guidance by its leader Patrick Volkerding. The most recent release of Slackware is version 14.1 that took place late last year with the Linux 3.10 kernel -- a long way from the initial Slackware 1.00 release that used the pre-1.0 Linux kernel (0.99.11). " -- source: http://www.phoronix.com/scan.php?page=news_item&px=MTc0Mzc Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

MicroxWin Creates Linux Distribution That Runs Debian/Ubuntu & Android Apps
by Peter Reutemann 21 Jul '14

21 Jul '14

"VolksPC who developed MicroXwin as a lightweight X Window Server has come up with their own Linux distribution. Setting apart VolksPC's distribution from others is that it's based on both Debian and Android and has the capability to run Debian/Ubuntu/Android apps together in a native ARM experience. The implementation doesn't depend on VNC or other similar solutions of the past that have tried to join desktop apps with mobile Android apps. This distribution is also reportedly compatible with all Android applications. The distribution is expected to begin shipping on an ARM mini-PC stick." -- source: http://news.slashdot.org/story/14/07/20/1218256 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linux Needs Resource Management For Complex Workloads
by Peter Reutemann 21 Jul '14

21 Jul '14

'Resource management and allocation for complex workloads has been a need for some time in open systems, but no one has ever followed through on making open systems look and behave like an IBM mainframe, writes Henry Newman at Enterprise Storage Forum. Throwing more hardware at the problem is a costly solution that won't work forever, he notes. Newman writes: "With next-generation technology like non-volatile memories and PCIe SSDs, there are going to be more resources in addition to the CPU that need to be scheduled to make sure everything fits in memory and does not overflow. I think the time has come for Linux – and likely other operating systems – to develop a more robust framework that can address the needs of future hardware and meet the requirements for scheduling resources. This framework is not going to be easy to develop, but it is needed by everything from databases and MapReduce to simple web queries."' -- source: http://linux.slashdot.org/story/14/07/20/0317216 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

FreeBSD 9.3 Released
by Peter Reutemann 16 Jul '14

16 Jul '14

"The FreeBSD Release Engineering Team is pleased to announce the availability of FreeBSD 9.3-RELEASE. This is the fourth release of the stable/9 branch, which improves on the stability of FreeBSD 9.2-RELEASE and introduces some new features. Some of the highlights: ZFS bookmarks, OpenSSL 0.9.8za, OpenSSH 6.6p1, SNI, BIND 9.9.5. For a complete list of new features and known problems, please see the online release notes and errata list." -- source: http://bsd.slashdot.org/story/14/07/16/2227253 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

LibreSSL PRNG Vulnerability Patched
by Peter Reutemann 16 Jul '14

16 Jul '14

'The OpenBSD project late last night rushed out a patch for a vulnerability in the LibreSSL pseudo random number generator (PRNG). The flaw was disclosed two days ago by the founder of secure backup company Opsmate, Andrew Ayer, who said the vulnerability was a "catastrophic failure of the PRNG." OpenBSD founder Theo de Raadt and developer Bob Beck, however, countered saying that the issue is "overblown" because Ayer's test program is unrealistic. Ayer's test program, when linked to LibreSSL and made two different calls to the PRNG, returned the exact same data both times. "It is actually only a problem with the author's contrived test program," Beck said. "While it's a real issue, it's actually a fairly minor one, because real applications don't work the way the author describes, both because the PID (process identification number) issue would be very difficult to have become a real issue in real software, and nobody writes real software with OpenSSL the way the author has set this test up in the article."' -- source: http://linux.slashdot.org/story/14/07/16/1950235 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Only a few days old, OpenSSL fork LibreSSL is declared “unsafe for Linux”
by Peter Reutemann 16 Jul '14

16 Jul '14

'The first "preview" release of OpenSSL alternative LibreSSL is out, and already a researcher says he has found a "catastrophic failure" in the version for Linux. Update: A few hours after this article was published, OpenBSD founder Theo de Raadt emailed Ars and wrote: "It is way overblown. This will never happen in real code." The vulnerability, cataloged as CVE-2014-2970, already has been patched, with modified code located here.' -- source: http://bit.ly/WgjO57 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0