- wlug - list.wlug.org.nz

Red Hat Joins the RISC-V Foundation
by Peter Reutemann 08 Aug '19

08 Aug '19

'Red Hat has joined the RISC-V Foundation to help foster this open-source processor ISA. Phoronix reports: While we're still likely years away from seeing any serious RISC-V powered servers at least that can deliver meaningful performance, Red Hat has been active in promoting RISC-V as an open-source processor instruction set architecture and one of the most promising libre architectures we have seen over the years. Red Hat developers have already helped in working on Fedora's RISC-V support and now the IBM-owned company is helping out more and showing their commitment by joining the RISC-V Foundation. Red Hat joins the likes of Google, NVIDIA, Qualcomm, SiFive, Western Digital, IBM, and Samsung as among the many RISC-V members. ' -- source: https://linux.slashdot.org/story/19/08/08/213253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Team Working on Daring Plan To Forcibly Update Old Websites
by Peter Reutemann 08 Aug '19

08 Aug '19

'The developers behind the WordPress open-source content management system (CMS) are working on a plan to forcibly auto-update older versions of the CMS to more recent releases. From a report: The goal of this plan is to improve the security of the WordPress ecosystem, and the internet as a whole, since WordPress installations account for more than 34% of all internet websites. Officially supported versions include only the last six WordPress major releases, which currently are all the versions between v4.7 and v5.2. The plan is to slowly auto-update old WordPress sites, starting with v3.7, to the current minimum supported version, which is the v4.7 release. The WordPress team said it plans to monitor this tiered forced auto-update process for errors and site breakage. If there's something massively wrong, then auto-update can be stopped altogether. If only a few individual sites break, than those site will be rolled back to their previous versions and the owner will be notified via email.' -- source: https://it.slashdot.org/story/19/08/08/1523212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Lands Google, Twitter as Customers With Newest Server Chip
by Peter Reutemann 08 Aug '19

08 Aug '19

'Advanced Micro Devices on Wednesday released the second generation of its processor chip for data centers and said that it had landed Alphabet's Google and Twitter as customers. From a report: AMD competes against Intel to supply chips for data centers that power internet-based services. Both firms have come to rely on data center chips for growth because personal computer sales have stagnated as users shifted to mobile devices. AMD's newest generation of server chip, called EPYC, uses a new chip-making technology from its contract manufacturers that helps the chips have better performance while consuming less power. Intel, which makes chips in its own factories instead of relying on contractors, is behind schedule delivering chips made with its own newer manufacturing process. It plans to release them next year.' -- source: https://tech.slashdot.org/story/19/08/08/1553202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Less TV, More Online
by Lawrence D'Oliveiro 08 Aug '19

08 Aug '19

In Britain, at least <https://www.theregister.co.uk/2019/08/07/punters_switching_off_telly_boxes_…>, people are spending less time watching conventional broadcast TV and more time watching vids on YouTube and Netflix. In related news, famed (and feared) US ratings agency Nielsen <https://www.techdirt.com/articles/20190805/08212442723/after-missing-cord-c…> has fallen on hard times as its broadcast (FTA and cable) company customers suffer a similar trend. The irony was that they were the ones forcing it not to make any measurements of the “cord-cutting” phenomenon, because it made them look bad; and as a result its service has now declined into irrelevance.

1 0

What all the stuff in email headers means—and how to sniff out spoofing
by Peter Reutemann 07 Aug '19

07 Aug '19

'I pretty frequently get requests for help from someone who has been impersonated—or whose child has been impersonated—via email. Even when you know how to "view headers" or "view source" in your email client, the spew of diagnostic wharrgarbl can be pretty overwhelming if you don't know what you're looking at. Today, we're going to step through a real-world set of (anonymized) email headers and describe the process of figuring out what's what. Before we get started with the actual headers, though, we're going to take a quick detour through an overview of what the overall path of an email message looks like in the first place. (More experienced sysadmin types who already know what stuff like "MTA" and "SPF" stand for can skip a bit ahead to the fun part!)' -- source: https://arstechnica.com/information-technology/2019/08/ars-forensic-files-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Skype, Slack, other Electron-based apps can be easily backdoored
by Peter Reutemann 07 Aug '19

07 Aug '19

'The Electron development platform is a key part of many applications, thanks to its cross-platform capabilities. Based on JavaScript and Node.js, Electron has been used to create client applications for Internet communications tools (including Skype, WhatsApp, and Slack) and even Microsoft's Visual Studio Code development tool. But Electron can also pose a significant security risk because of how easily Electron-based applications can be modified without triggering warnings. At the BSides LV security conference on Tuesday, Pavel Tsakalidis demonstrated a tool he created called BEEMKA, a Python-based tool that allows someone to unpack Electron ASAR archive files and inject new code into Electron's JavaScript libraries and built-in Chrome browser extensions. The vulnerability is not part of the applications themselves but of the underlying Electron framework—and that vulnerability allows malicious activities to be hidden within processes that appear to be benign. Tsakalidis said that he had contacted Electron about the vulnerability but that he had gotten no response—and the vulnerability remains. While making these changes required administrator access on Linux and MacOS, it only requires local access on Windows. Those modifications can create new event-based "features" that can access the file system, activate a Web cam, and exfiltrate information from systems using the functionality of trusted applications—including user credentials and sensitive data. In his demonstration, Tsakalidis showed a backdoored version of Microsoft Visual Studio Code that sent the contents of every code tab opened to a remote website.' -- source: https://arstechnica.com/information-technology/2019/08/skype-slack-other-el… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google releases the 6th and final beta for Android Q
by Peter Reutemann 07 Aug '19

07 Aug '19

'We are quickly approaching launch day for Android Q, Google's 29th release of Android. At some point in the near future we should see a statue-unveiling, official confirmation that this is "Android 10," and the highly anticipated "Q" snack name [Editor's suggestion]. First though, we have to see the sixth-and-final beta release out the door, which is happening today. Android Q Beta 6 is rolling out to Pixel phones now and participating third-party devices in the coming weeks. Final APIs for developers were locked down in Beta 4, so Beta 5 and 6 are mostly about squishing bugs and polishing up the final interface. Fully gestural navigation is a major feature of Android Q, and with the Beta 5 launch came the announcement that gesture navigation would not work with third-party home apps at launch, presumably due to a lack of time to work out the pile of bugs that have been reported. Even with third-party home screen compatibility off the table, it seems like Google will be working on gesture navigation down to the wire. Beta 5 came with a new gesture for the Google Assistant and new rules for developers. In Beta 6, Google says it has "made further refinements to Gesture Navigation in Beta 6 based on user feedback" and now has a sensitivity setting for the back gesture. The back gesture involves swiping in from the edge of the screen, which can interfere with apps that require horizontal scrolling. Newly updated apps are supposed to design around the new back gesture; the sensitivity setting should help find a balance for older apps with conflicting swipe areas.' -- source: https://arstechnica.com/gadgets/2019/08/google-releases-the-6th-and-final-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Contractors Are Listening To Some Skype Calls
by Peter Reutemann 07 Aug '19

07 Aug '19

'Contractors working for Microsoft are listening to personal conversations of Skype users conducted through the app's translation service, according to a cache of internal documents, screenshots, and audio recordings obtained by Motherboard. From a report: Although Skype's website says that the company may analyze audio of phone calls that a user wants to translate in order to improve the chat platform's services, it does not say some of this analysis will be done by humans. The Skype audio obtained by Motherboard includes conversations from people talking intimately to loved ones, some chatting about personal issues such as their weight loss, and others seemingly discussing relationship problems. Other files obtained by Motherboard show that Microsoft contractors are also listening to voice commands that users speak to Cortana, the company's voice assistant.' -- source: https://yro.slashdot.org/story/19/08/07/1432204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FFmpeg 4.2, Open-Source Multimedia Framework Released
by Peter Reutemann 07 Aug '19

07 Aug '19

'Dubbed "Ada," the FFMpeg 4.2 series introduces some exciting new features and improvements, among which we can mention support for decoding AV1 files via the libdav1d library, support for ARIB STD-B24 caption (profiles A and C) based on the libaribb24 library, and support for decoding HEVC 4:4:4 content in nvdec and cuviddec. FFmpeg 4.2 also comes with support for decoding HEVC 4:4:4 content in VDPAU (Video Decode and Presentation API for Unix), support for using Clang to compile CUDA kernels, the ability for the mov muxer to write tracks with unspecified language instead of English by default, a GIF parser, as well as the removal of the libndi-newtek component.' -- source: https://news.softpedia.com/news/ffmpeg-4-2-ada-open-source-multimedia-frame… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Catches Russian State Hackers Using IoT Devices To Breach Networks
by Peter Reutemann 06 Aug '19

06 Aug '19

'Hackers working for the Russian government have been using printers, video decoders, and other so-called Internet-of-things devices as a beachhead to penetrate targeted computer networks, Microsoft officials warned on Monday. "These devices became points of ingress from which the actor established a presence on the network and continued looking for further access," officials with the Microsoft Threat Intelligence Center wrote in a post. "Once the actor had successfully established access to the network, a simple network scan to look for other insecure devices allowed them to discover and move across the network in search of higher-privileged accounts that would grant access to higher-value data." Microsoft researchers discovered the attacks in April, when a voice-over-IP phone, an office printer, and a video decoder in multiple customer locations were communicating with servers belonging to "Strontium," a Russian government hacking group better known as Fancy Bear or APT28. In two cases, the passwords for the devices were the easily guessable default ones they shipped with. In the third instance, the device was running an old firmware version with a known vulnerability. While Microsoft officials concluded that Strontium was behind the attacks, they said they weren't able to determine what the group's ultimate objectives were. Microsoft says they have notified the makers of the targeted IoT devices so they can add new protections. "Monday's report also provided IP addresses and scripts organizations can use to detect if they have also been targeted or infected," adds Ars Technica. "Beyond that, Monday's report reminded people that, despite Strontium's above-average hacking abilities, an IoT device is often all it needs to gain access to a targeted network."' -- source: https://it.slashdot.org/story/19/08/06/0115233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0