- wlug - list.wlug.org.nz

Zero-day privilege escalation disclosed for Android
by Peter Reutemann 05 Sep '19

05 Sep '19

'Researchers have disclosed a zero-day vulnerability in the Android operating system that gives a major boost to attackers who already have a toe-hold on an affected device. The privilege-escalation flaw is located in the V4L2 driver, which Android and other Linux-based OSes use to capture real-time video. The vulnerability results from a "lack of validating the existence of an object prior to performing operations on the object," researchers with Trend Micro's Zero Day Initiative said in a blog post published Wednesday. Attackers who already have untrusted code running with low privileges on a device can exploit the bug to access privileged parts of the Android kernel. The severity score is rated a 7.8 out of a possible 10 points.' -- source: https://arstechnica.com/information-technology/2019/09/android-zeroday-give… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Free Software Advocate Richard Stallman Spoke at Microsoft Research This Week
by Peter Reutemann 05 Sep '19

05 Sep '19

'Free Software advocate Richard M. Stallman gave a talk at Microsoft Campus yesterday. Stallman was invited by Microsoft Research. Stallman's talk was related -- as most of his talks -- with Free Software, Privacy and the GPLv3. He also had a list of small requests to Microsoft: "make Github push users to better software license hygiene, make hardware manufacturers to publish their hardware specs, make it easier to workaround Secure Boot." While Microsoft has changed its attitude toward Open Source Software in the last years, this does not mean RMS has made peace with Microsoft: "If you're wondering whether Stallman's distaste for Microsoft has lessened over the years, his personal home page makes it clear that it has not".' -- source: https://news.slashdot.org/story/19/09/05/1720205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 10 Launches Today, and Pixel Phones Get the Day One Update
by Peter Reutemann 04 Sep '19

04 Sep '19

'Android 10 is finally finished! The next big Android update, which we've been examining for most of the year as the "Android Q Beta," starts rolling out to devices today. As usual, Android 10 is arriving on Pixel phones first (even the three-year-old Pixel 1), and Google says it is "working with a number of partners to launch or upgrade devices to Android 10 this year." Google has introduced a new branding strategy for Android, by the way, so there's no "Q" snack name with this release. In 2019, it's just "Android 10." Android 10 brings a number of changes to the world's most popular mobile operating system. First up, devices are getting "fully gestural" navigation, which lets you navigate around the phone with swipe gestures. Just like the implementation on the iPhone X, gesture navigation removed the need for a dedicated space for navigation buttons, allowing for more space for app content. There's finally full support for a dark theme, which will turn the entire system UI and any supported apps from the usual black text on a white background to white text on a black background. (That option significantly reduces the amount of light a phone puts out and saves battery life on OLED displays.) Google has also promised dark mode support for "all" of the Google apps in time for Android 10's launch, so we should be seeing updates to Gmail, Google Play, Google Maps, and a million other Google apps sometime soon. Other features of Android 10 include a faster share sheet, a "bubbles" API for floating apps, 230 new emoji, improved security and privacy options, and smarter notification panel.' -- source: https://tech.slashdot.org/story/19/09/03/218224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

InvizBox 2 redefines what “privacy” routers can do
by Peter Reutemann 04 Sep '19

04 Sep '19

'Four years ago, in the wake of some controversy over another Kickstarter-based launch, a team in Ireland decided to produce a better Wi-Fi router for travel privacy. Called the InvizBox, the router was focused on making connecting to privacy-focused network services such as VPNs and the Tor anonymizing network easier. A lot has happened since then. And now, InvizBox has released a new iteration of its wired Wi-Fi router, the InvizBox 2. Two years ago, the InvizBox team achieved its crowd-funding goals to move ahead with this design. After a long road, that funding has finally paid off. Totally open source, bundled with a VPN service capable of delivering up to 100 megabits per second of traffic (your broadband willing), and painless to configure, this little disc-shaped router is powerful enough to be a primary home router—or it can be used on the road when plugged into a potentially unfriendly local network to tunnel users out to safety. The router can also be used in concert with InvizBox Go—a mobile Wi-Fi router with VPN capability—to create a safe tunnel back to your home network. The base price for InvizBox 2 is $99, but there's a discount available right now for orders through the InvizBox site.' -- source: https://arstechnica.com/information-technology/2019/09/invizbox-2-redefines… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Interview With Eben Upton
by Lawrence D'Oliveiro 03 Sep '19

03 Sep '19

Head of the Raspberry π Foundation, Eben Upton, chats to The Register <https://www.theregister.co.uk/2019/09/03/eben_upton_pi_store/> about his wildly successful brainchild. All models put together are shipping 6 million units per year. Increasing numbers of them are going to system integrators in China, who are building them into commercial products that are then sold worldwide. Asked whether Windows 10 IoT Edition will ever run on the π 4: "We have nothing to share", said Upton, before sighing that it was "a shame." Also: ... back when the original Pi launched, Upton said the questions were: "Can you run Office? Can you run Internet Explorer?" Now, the question (which will be music to Linux fans' ears) is "Can you run Chromium?" as the Microsoft requirement dwindles. Somehow I get the feeling that Windows 10 on Raspberry π is a dying product ...

1 0

Over 47,000 Supermicro Servers Are Exposing BMC Ports on the Internet
by Peter Reutemann 03 Sep '19

03 Sep '19

'Catalin Cimpanu, writing for ZDNet: More than 47,000 workstations and servers, possibly more, running on Supermicro motherboards are currently open to attacks because administrators have left an internal component exposed on the internet. These systems are vulnerable to a new set of vulnerabilities named USBAnywhere that affect the baseboard management controller (BMC) firmware of Supermicro motherboards. Patches are available to fix the USBAnywhere vulnerabilities, but Supermicro and security experts recommend restricting access to BMC management interfaces from the internet, as a precaution and industry best practice.' -- source: https://tech.slashdot.org/story/19/09/03/2029210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Exploits Are Now Worth More Than iOS Exploits for the First Time
by Peter Reutemann 03 Sep '19

03 Sep '19

'Zerodium, a company which claims it buys and then resells software exploits to government and law enforcement agencies, has updated its price list today, and Android exploits are worth more than iOS exploits for the first time ever. From a report: According to the company, starting today, a zero-click (no user interaction) exploit chain for Android can get hackers and security researchers up to $2.5 million in rewards. A similar exploit chain impacting iOS is worth only $2 million. Zerodium's new price for Android exploits is almost twelve times more when compared to the maximum of $200,000 the company was willing to offer a year ago, and even 100 times more than Zerodium was paying for some of the lower-impact Android exploits. Zerodium has timed its announcement with Google's official release for Android 10, scheduled for late' -- source: https://tech.slashdot.org/story/19/09/03/164253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 69 Ratchets Up Tracking Protection, Switching it On by Default
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla has switched on Firefox's tracking protection feature for everyone on Windows and Android, dialing up its effort to protect privacy from website publishers and advertisers that would like to keep tabs on your online behavior. From a report: Mozilla enabled tracking protection for new Firefox users in June, but now it's on for everyone, the nonprofit said Tuesday. Tracking protection is all the rage among browser makers, including Apple's Safari, Brave Software's Brave and Microsoft's new Chromium-based Edge. Even Google's Chrome, long the laggard among major browsers, is starting to tackle the problem. It's a thorny issue for websites and advertisers that seek to improve advertising revenue by targeting ads based on their assessment of your interests. "Currently over 20% of Firefox users have Enhanced Tracking Protection on. With today's release, we expect to provide protection for 100% of ours users by default," Mozilla said in a blog post Tuesday.' -- source: https://news.slashdot.org/story/19/09/03/1322212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming Firefox Update Will Decrease Power Usage on macOS by Up To Three Times
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla teased today an upcoming update for Firefox on macOS that it says will reduce power consumption by a factor of up to three. From a report: The primary beneficiaries of this upcoming update are Macbook users, who can now expect longer battery lives while using Firefox. Firefox's increased battery consumption has been a problem for Mozilla, and a black stain on the Firefox Quantum release -- a revamped, performance-centric version of the older Firefox browser. While Firefox Quantum has received praises for its increased page loading speeds, Macbook users haven't been that delighted, especially when they're mobile and have to rely on the notebook's battery as long as possible.' -- source: https://news.slashdot.org/story/19/09/03/0654202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

mailman server upgrade
by Peter Reutemann 03 Sep '19

03 Sep '19

Hi everyone The university will be upgrading the mailman server on Monday Sept 2nd, which also hosts the WLUG mailing list. Unfortunately, the email I received notifying me about the upgrade did not state when or how long the outage will be, only that the new admin interface will be available after 5pm (NZ time). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1