- wlug - list.wlug.org.nz

Microsoft Details How China-Linked Crew’s Malware Hides Scheduled Windows Tasks
by Lawrence D'Oliveiro 18 Apr '22

18 Apr '22

Seems every week there is something new to learn about the (in)security of Microsoft Windows. In this description <https://www.theregister.com/2022/04/14/microsoft-tarrask-malware-in-windows/> of a malware attack, the software infection creates a scheduled task to automatically reinstall itself if it has been removed. So far, no big deal: on *nix we have cron, and systemd timers, that do much the same thing. But on Windows, these scheduled tasks have “security descriptors” -- basically, ACLs, as far as I have been able to determine, that control who can manage these tasks or even see them. So if a program creates a task and deletes all its security descriptors, the task effectively becomes invisible to the normal Windows admin tools. Except, it can still be seen and managed through its Registry entries. So, having write access to the Registry lets you bypass the entire security-descriptor mechanism, yet it still does not let you see these tasks in any other way? Like the “security” those higher-level tools think they are enforcing is a complete mirage, and end up making the system, not more, but less, secure.

1 0

Git For Windows Issues Update To Fix Running-Someone-Else's-Code Vulnerability
by Peter Reutemann 14 Apr '22

14 Apr '22

'The Git team has issued an update to fix a bug in Git for Windows that "affects multi-user hardware where untrusted parties have write access to the same hard disk," reports The Register. Specifically, the update is concerned with CVE-2022-24765. From the report: Arguably, if an "untrusted party" has write access to a hard disk, then all bets are off when it comes to the nooks and crannies of a PC anyway. In this case, the miscreants would only need to create the folder c:\.git, "which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory," according to NIST. The result is that Git would use the config in the directory. NIST went on to list potentially vulnerable products, which included Visual Studio. "Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash." The Git team was little blunter about the vulnerability, and warned that "Merely having a Git-aware prompt that runs 'git status' (or 'git diff') and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user." [...] To deal with the issue, the Git team recommends an update. Alternatively, a user could create that .git folder themselves and remove read/write access as workaround or "define or extend 'GIT_CEILING_DIRECTORIES' to cover the parent directory of the user profile," according to NIST. ' -- source: https://it.slashdot.org/story/22/04/13/2140258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tim Cook Invokes Eisenhower
by Lawrence D'Oliveiro 13 Apr '22

13 Apr '22

Apple’s CEO gave a speech at a gathering of the International Association of Privacy Professionals <https://arstechnica.com/gadgets/2022/04/tim-cook-delivers-speech-railing-ag…>, where he claimed that Apple has “a commitment to protecting people from a data industrial complex built on a foundation of surveillance”. He particularly hates regulatory proposals to force Apple and other platform owners to allow sideloading of apps, claiming That means data-hungry companies would be able to avoid our privacy rules, and once again track our users against their will. In other words, we should trust companies like his to keep their word, and not fall back on Big Bad Government Regulation. If it weren’t for Governments, the world would end up run by corporations. Which would you prefer?

1 0

Trend says hackers have weaponized SpringShell to install Mirai malware
by Peter Reutemann 12 Apr '22

12 Apr '22

'Researchers on Friday said that hackers are exploiting the recently discovered SpringShell vulnerability to successfully infect vulnerable Internet of Things devices with Mirai, an open source piece of malware that wrangles routers and other network-connected devices into sprawling botnets. The Internet’s biggest players are all affected by critical Log4Shell 0-day When SpringShell (also known as Spring4Shell) came to light last Sunday, some reports compared it to Log4Shell, the critical zero-day vulnerability in the popular logging utility Log4J that affected a sizable portion of apps on the Internet. That comparison proved to be exaggerated because the configurations required for SpringShell to work were by no means common. To date, there are no real-world apps known to be vulnerable. Researchers at Trend Micro now say that hackers have developed a weaponized exploit that successfully installs Mirai. A blog post they published didn’t identify the type of device or the CPU used in the infected devices. The post did, however, say a malware file server they found stored multiple variants of the malware for different CPU architectures.' -- source: https://arstechnica.com/information-technology/2022/04/trend-says-hackers-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox downloads PDF files to home directory when viewing
by Peter Reutemann 12 Apr '22

12 Apr '22

Hi everyone One annoying new feature that showed up in Firefox recently is that it downloads PDF files to my home directory rather then /tmp when I'm only viewing them. The following thread discusses this: https://support.mozilla.org/en-US/questions/1370409 All you have to do is go to the configuration ("about:config" in URL bar) and change the following option to "false: browser.download.improvements_to_download_panel Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The End Of Byte Magazine
by Lawrence D'Oliveiro 12 Apr '22

12 Apr '22

I’ve been browsing through a few more of those old issues of Byte magazine, up to its shutdown in 1998. In the final, July, issue, among the items promised as “coming up in August”, was a “software lab report” on “free Unixes”: “We test Linux and FreeBSD to see how they measure up against their commercial cousins as servers and development platforms”. Presumably as per the typical magazine publishing pipeline, that report had already been done and written up by that point; I wonder if it ever got published anywhere ... Linux had been getting a few small mentions in the prior issues, along with other free software such as Perl for website development. Though the writers kept referring to these as “freeware” ... Also in that issue was a mention of an unusual new PC design, called the “Rock City”, from a company called the Panda Project. It was the shape of a cube, balanced on one corner (where the stand was attached). Hunting around, I found a short item, with one small, intriguing-looking picture, here <https://www.fatsofa.com/rockcity.html>. The actual company website is of course long gone; I tried looking for copies at archive.org, but while the text of the website back to 1998 is there, the pictures are not.

2 1

Raspberry Pi OS Ditches Longtime User Account For Security Reasons
by Peter Reutemann 09 Apr '22

09 Apr '22

'Ars Technica: Since its launch, the Raspberry Pi OS (and most operating systems based on it) has shipped with a default "pi" user account, making it simpler to boot up a Pi and start working without needing to hook up the device to a monitor or go through a multi-step setup process. But as of today, that's changing -- new installs of the Raspberry Pi OS are shedding that default user account for both security and regulatory reasons. Raspberry Pi Foundation software engineer Simon Long explains the thinking in this blog post. "[The "pi" user account] could potentially make a brute-force attack slightly easier, and in response to this, some countries are now introducing legislation to forbid any Internet-connected device from having default login credentials," he writes. This move will improve the Pi operating system's security. Before, even if you assigned a good password to the "pi" account, attackers could still assume with a reasonable degree of certainty that most Raspberry Pi boards were using the "pi" username. Many Pi OS-based operating systems also ship with the default "pi" user account enabled and are completely passwordless, requiring extra steps to assign the account a password in the first place. The flip side is that the change could break some software and scripts, particularly those that are hard-coded to use the "pi" user account and home folder. "[T]he Raspberry Pi OS now boots into a dedicated setup mode the first time you start it up instead of running the setup wizard as an app in the normal desktop environment," adds Ars. "And that setup wizard now prompts you to create a username and password rather than simply assigning a password to the default 'pi' user account. To aid with setup, the wizard can now pair Bluetooth keyboards and mice without requiring you to plug in a USB accessory first." The new version of the Pi OS also includes experimental support for the Wayland display server protocol, but Long says most people should ignore it for now since it's explicitly labeled as "experimental."' -- source: https://hardware.slashdot.org/story/22/04/08/2032252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Plans To Drop Support For Legacy BIOS Systems
by Peter Reutemann 08 Apr '22

08 Apr '22

'The Fedora 37 development team is considering dropping support for non-UEFI BIOS. Linuxiac reports: The Unified Extensible Firmware Interface, or UEFI, is a modern method of handling the boot process. UEFI is similar to Legacy; however, the boot data is stored in a .efi file rather than the firmware. In the case of Fedora, while the change may take some time, the new Fedora x86_64 installations will no longer work on non-UEFI platforms. On x86_64 architectures, Fedora 37 will mark legacy BIOS installation as deprecated in favor of UEFI. While systems already using Legacy BIOS to boot will continue to be supported, new Legacy BIOS installations on these architectures will be impossible. ' -- source: https://linux.slashdot.org/story/22/04/07/2049257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese Hackers Abuse VLC Media Player To Launch Malware Loader
by Peter Reutemann 08 Apr '22

08 Apr '22

'Security researchers have uncovered a long-running malicious campaign from hackers associated with the Chinese government who are using VLC Media Player to launch a custom malware loader. BleepingComputer reports: The campaign appears to serve espionage purposes and has targeted various entities involved in government, legal, and religious activities, as well as non-governmental organizations (NGOs) on at least three continents. This activity has been attributed to a threat actor tracked as Cicada (a.k.a. menuPass, Stone Panda, Potassium, APT10, Red Apollo) that has been active for more than 15 years, since at least 2006. Brigid O Gorman of Symantec Threat Hunter Team told BleepingComputer that the attacker uses a clean version of VLC with a malicious DLL file in the same path as the media player's export functions. The technique is known as DLL side-loading and it is widely used by threat actors to load malware into legitimate processes to hide the malicious activity. Apart from the custom loader, which O Gorman said Symantec does not have a name but has been seen in previous attacks attributed to Cicada/APT10, the adversary also deployed a WinVNC server to gain remote control over victim systems. The attacker also executed the Sodamaster backdoor on compromised networks, a tool believed to be used exclusively by the Cicada threat group since at least 2020. Sodamaster runs in the system memory (fileless) and is equipped to evade detection by looking in the registry for clues of a sandbox environment or by delaying its execution. The malware can also collect details about the system, search for running processes, and download and execute various payloads from the command and control server. [...] The attackers' dwell time on the networks of some of the discovered victims lasted for as long as nine months, the researchers note in a report today. ' -- source: https://it.slashdot.org/story/22/04/06/2144218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

disable "Pocket" in Firefox
by Peter Reutemann 08 Apr '22

08 Apr '22

Hi everyone If you find that "Pocket" in Firefox is getting in your way or you simply don't want to use it, just do the following to disable it: - in the URL bar, type about:config (and click on "show all") - and toggle "extensions.pocket.enabled" to "false" >From here: https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0