- wlug - list.wlug.org.nz

Eight New Meltdown-Like Flaws Found
by Peter Reutemann 06 May '18

06 May '18

'Researchers have found eight new flaws in computer central processing units that resemble the Meltdown and Spectre bugs revealed in January, a German computing magazine reported on Thursday. The magazine, called c't, said it was aware of Intel Corp's plans to patch the flaws, adding that some chips designed by ARM Holdings, a unit of Japan's Softbank, might be affected, while work was continuing to establish whether Advanced Micro Devices chips were vulnerable... The magazine said Google Project Zero, one of the original collective that exposed Meltdown and Spectre in January, had found one of the flaws and that a 90-day embargo on going public with its findings would end on May 7... "Considering what we have seen with Meltdown and Spectre, we should expect a long and painful cycle of updates, possibly even performance or stability issues," said Yuriy Bulygin, chief executive officer of hardware security firm Eclypsium and a former Intel security researcher. "Hopefully, Meltdown and Spectre led to improvements to the complicated process of patching hardware." Neowin now reports that Intel "is expected to release microcode updates in two waves; one in May, and the other in August."' -- source: https://it.slashdot.org/story/18/05/05/1730203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drive-by Rowhammer attack uses GPU to compromise an Android phone
by Peter Reutemann 03 May '18

03 May '18

'Over the past few years, there has been a steady evolution in Rowhammer, the once largely theoretical attack that exploits physical defects in memory chips to tamper with the security of the devices they run on. On Thursday, researchers are unveiling the most practical demonstration yet of Rowhammer's power and reach: an exploit that remotely executes malicious code on Android phones by harnessing their graphical processors.' -- source: https://arstechnica.com/information-technology/2018/05/drive-by-rowhammer-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More Dead Microsoft Technologies
by Lawrence D'Oliveiro 01 May '18

01 May '18

A roundup <http://www.theregister.co.uk/2018/05/01/windows_10_april_update_casualties/> of what’s gone in the latest Windows 10 update mentions that HomeGroup, Microsoft’s attempt to let a bunch of machines share files and printers on an ad-hoc basis, has now gone the way of Windows Home Server and Windows Media Center. Also it looks like XPS, Microsoft’s NIH alternative to PDF, has also bitten the dust. And the Windows Help Viewer may be next...

1 0

Fedora 28 Featuring GNOME 3.28 Released
by Peter Reutemann 01 May '18

01 May '18

'Fedora 28 has many new features, but one in particular will surely excite desktop/workstation users -- GNOME 3.28, which introduces Thunderbolt 3 support and improved laptop battery life. Fedora has long used GNOME as the default desktop environment, and best of all, it is mostly a stock affair -- no silly tweaks enabled by default. In other words, you get a very pure GNOME experience, making Fedora Workstation the preferred OS for many hardcore fans of the DE. "GNOME 3.28 adds the capability to favorite files, folders, and contacts for easier organization and access. Additionally, the new application Usage is included to help users more easily diagnose and resolve performance and capacity issues," says The Fedora Project.' -- source: https://linux.slashdot.org/story/18/05/01/1727233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

USB 3.2 Work Is On The Way For The Linux 4.18 Kernel: Report
by Peter Reutemann 30 Apr '18

30 Apr '18

'USB 3.2 was announced last summer as an incremental update to the USB standard to double the bandwidth for existing USB Type-C cables. We haven't seen much in the way of USB 3.2 mentions in the Linux kernel yet but then again we haven't really seen USB 3.2 devices yet. USB 3.2 brings a multi-lane operation mode for hosts and devices using existing Type-C cables as well as a minor update to the USB hub specification. USB 3.2 allows for new 10 Gbit/s and 20 Gbit/s rates using two lanes, USB 3.2 Gen 1x2 and USB 3.2 Gen 2x2, respectively. It looks like kernel developers are now working on getting their USB 3.2 Linux support in order. We were tipped off that as of last week there are some USB 3.2 patches queued in the usb-next tree maintained by Greg Kroah-Hartman's.' -- source: https://linux.slashdot.org/story/18/04/30/1558201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sinclair ZX Spectrum Designer Rick Dickinson Succumbs To Cancer
by Lawrence D'Oliveiro 27 Apr '18

27 Apr '18

Rick Dickinson, the designer for several machines sold by Sinclair in the 1980s, has died <http://www.theregister.co.uk/2018/04/26/rick_dickinson_dies/>. More recently, he was involved in the campaign to create the “ZX Spectrum Next” machine. Commenters have offered up some useful links: his Flickr gallery <https://www.flickr.com/photos/9574086(a)N02/albums> with some peeks at concept renders, and this item <https://www.youtube.com/watch?v=TAwHIcdidzI> from 2003 where he talks about his designs for Sinclair.

1 0

Microsoft Quarterly Report
by Lawrence D'Oliveiro 27 Apr '18

27 Apr '18

Just some items I found notable from here <https://arstechnica.com/gadgets/2018/04/even-windows-revenue-is-up-in-micro…>: * Office 365 is up, traditional MS Office is down. * Corporate sales of Windows are up, while consumer sales are down (“below the general decline of the PC market”). In each case, the former is growing faster than the latter is declining, so overall business is up.

1 0

Linux At The Leading Edge Of Enterprise-Level Storage
by Lawrence D'Oliveiro 26 Apr '18

26 Apr '18

First of all, some background (as I understand it): * “NVMe” is a standard for accessing storage (normally flash rather than hard drives) via a PCI-E bus <https://en.wikipedia.org/wiki/NVM_Express>. * “NVME-oF” (“NVMe over Fabrics”) (mentioned in the above article) is a further spec that allows one node to access storage attached to another node. Sounds like NBD, really <https://en.wikipedia.org/wiki/Network_block_device>, though the term “RDMA” (“Remote Direct Memory Access”) gets tossed around. So, this article <http://www.theregister.co.uk/2018/04/26/nvme_fabric_over_fibre_channel/> says things like NVME-oF “has to be implemented across network or fabric and, so far, Ethernet, with ROCE (RDMA over Converged Ethernet), is the favoured one”, though other lower-layer protocols also work. In particular, the writer is interviewing an industry guru about the prospects for FC-NVMe, which uses Fibre Channel as the transport. A couple of quotes caught my eye: Since the low-level driver isn't a part of the OS, like NVMe-oF, but rather supplied by the HBA vendor (Emulex or QLogic), the deployment for OSes outside the Linux model should be more agile... You must run a recent version of Linux; no other OSes have NVMe-oF drivers available (yet). In other words, NVME-oF is pretty much Linux-only at the moment. But it would be hardware-independent, which should mean you can mix and match storage from different vendors. Unlike FC-NVMe, where the “HBA vendor” needs to supply hardware-specific drivers. In other, other words, NVME-oF works only on Linux, but makes you “hardware-agile”, while FC-NVMe is hardware-specific but should (hopefully) be “OS-agile”. Which kind of “agility” will turn out to be more important, I wonder?

1 0

Drupal Warns of New Remote-Code Bug, the Second in Four Weeks
by Peter Reutemann 26 Apr '18

26 Apr '18

'For the second time in a month, websites that use the Drupal content management system are confronted with a stark choice: install a critical update or risk having your servers infected with ransomware or other nasties. From a report: Maintainers of the open-source CMS built on the PHP programming language released an update patching critical remote-code vulnerability on Wednesday. The bug, formally indexed as CVE-2018-7602, exists within multiple subsystems of Drupal 7.x and 8.x. Drupal maintainers didn't provide details on how the vulnerability can be exploited other than to say attacks work remotely. The maintainers rated the vulnerability "critical" and urged websites to patch it as soon as possible.' -- source: https://developers.slashdot.org/story/18/04/25/1956214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Was Our Census Data Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

According to this article <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12038826>, when we were filling out our census data online last month, it was actually going through the servers of a company called Incapsula, which was scanning the unencrypted data for malware. Since the company is based in the US, this naturally raises concerns about US Government access to the data of NZ residents and citizens. On the one hand, the article says “this is not a data breach”, but on the other hand Adding to the researchers' concerns, Stats NZ's digital key that is required to decrypt the data sent over TLS secured connections is now distributed across Incapsula's global network, Teague and Culnane said. "Our non-exhaustive search found that servers in Australia, the US, as well as New Zealand, all had the Stats NZ key," they added. Digital TLS keys are supposed to be protected and should only be kept on the servers that they relate to, the researchers said. If keys are leaked, attackers could use them to impersonate Stats NZ servers. and further down they use the phrase “clear security flaw”. Stats NZ insists the company is trusted and “Goverment-approved”. Given it’s also protecting the GCSB, I guess that is already very literally true.

1 0