- wlug - list.wlug.org.nz

SSH protects the world’s most sensitive networks. It just got a lot weaker
by Peter Reutemann 20 Dec '23

20 Dec '23

'Named Terrapin, the new hack works only when an attacker has an active adversary-in-the middle position on the connection between the admins and the network they remotely connect to. Also known as a man-in-the-middle or MitM attack, this occurs when an attacker secretly positioned between two parties intercepts communications and assumes the identity of both the recipient and the sender. This provides the ability to both intercept and to alter communications. While this position can be difficult for an attacker to achieve, it’s one of the scenarios from which SSH was thought to have immunity. For Terrapin to be viable, the connection it interferes with also must be secured by either "ChaCha20-Poly1305" or "CBC with Encrypt-then-MAC," both of which are cipher modes added to the SSH protocol (in 2013 and 2012, respectively). A scan performed by the researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice. At its core, Terrapin works by altering or corrupting information transmitted in the SSH data stream during the handshake—the earliest stage of a connection, when the two parties negotiate the encryption parameters they will use to establish a secure connection. The attack targets the BPP, short for Binary Packet Protocol, which is designed to ensure that adversaries with an active position can't add or drop messages exchanged during the handshake. Terrapin relies on prefix truncation, a class of attack that removes specific messages at the very beginning of a data stream.' -- source: https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-inte… This SUSE knowledge base entry lists some configuration changes that one can apply (section "Additional Information"): https://www.suse.com/de-de/support/kb/doc/?id=000021295 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 121 Now Available With Wayland Enabled By Default
by Peter Reutemann 19 Dec '23

19 Dec '23

'Firefox 121 has arrived with Wayland support to be used by default on modern Linux desktops. Phoronix's Michael Larabel writes: Some Linux distributions and package builds have been using the native Wayland path for a while but now it's great to see the upstream builds make this default change as we get ready to embark on the 2024 Linux desktop. With my testing of Firefox 121 on Wayland, it's been working out well. X.Org/X11 support remains in place for those not using a Wayland-based desktop environment. Firefox 121 also adds Voice Control command support on macOS, adds an option to always force-underline links within websites, Firefox now includes a floating button to help in creation within PDFs, various CSS feature additions, and other developer enhancements. Firefox 121 also now supports tail call elimination in WebAssembly for enhancing support for functional languages. ' -- source: https://news.slashdot.org/story/23/12/18/2359227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Previews Linux-Powered Windows AI Studio
by Lawrence D'Oliveiro 18 Dec '23

18 Dec '23

Microsoft is offering a preview version of “Windows AI Studio”, which lets you run a fixed (for now) set of pre-trained models within Visual Studio Code on Windows. However, your Windows installation must also have Ubuntu installed under WSL2 for this to work <https://www.theregister.com/2023/12/14/windows_ai_studio_preview/>. Quote: There is, however, a certain ironic deliciousness in noting that Microsoft's local AI development on Windows requires Linux under the hood. Windows is still needed for the Visual Studio Code extension, but even that might change. Microsoft said: "We are currently planning for other platform support." When I first heard about WSL2, I predicted that Microsoft would, not from any conscious plan but simply from following the path of least resistance (and cost), start to rely on the Linux kernel more and more for important Windows functionality. I think this represents a step along that path.

1 0

Microsoft Division Will Not Use Microsoft’s Own Cloud
by Lawrence D'Oliveiro 15 Dec '23

15 Dec '23

LinkedIn (which is owned by Microsoft) has decided it will not be moving its datacentre operations onto Microsoft Azure after all <https://www.theregister.com/2023/12/14/linkedin_abandons_migration_to_micro…>. The plan was originally announced four years ago. Then last year they decided to back off a bit, and go for a “hybrid cloud” model. And now, the whole cloud part is gone. Seems they were not going for a refactor of their services to take advantage of cloud-native functionality, instead they were trying to “lift and shift” their existing software. This could be a reflection on the inflexibility of Azure, or on the difficulty of maintenance of that existing LinkedIn infrastructure. Either way, it does not exactly make Microsoft look good. Not to mention the four years it took to realize the whole project was a waste of time.

1 0

Proton Mail Finally Gets a Desktop App For Encrypted Email and Calendar
by Peter Reutemann 15 Dec '23

15 Dec '23

'The Verge: Proton has released a desktop version of its Proton Mail app that will give users full access to both Proton Mail and Proton Calendar and (eventually) the ability to view your emails offline. The desktop app is available in beta is optimized for both Windows and macOS, and encrypts sent emails end-to-end just like with the browser version, according to the Swiss company, while offline access to emails will be available "soon." [...] It's important to note that you'll still need internet access to both send and encrypt your emails on Proton. But the offline feature will let you view and draft emails while traveling, during a power outage, or any other situation where you don't have access to the internet. Proton is also bringing encrypted auto-forwarding to paid users, both on its desktop and browser versions, though the encryption for forwards will only apply when the forwarded emails go to other Proton users. The company says it has made improvements to Proton Calendar, too, including a fully searchable web version. Not everyone will be able to access Proton's desktop app right away. Proton is restricting access to its paid "Visionary" tier for legacy users at first (though the company is reopening subscriptions to that tier through January 3rd, 2024). The plan is to make the desktop app available to all users in early 2024. ' -- source: https://it.slashdot.org/story/23/12/14/1916258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Not Being Swayed to Write in Rust (Yet)
by Ben Cottrell 13 Dec '23

13 Dec '23

I've enjoyed learning how to make performant software, and I've been led to some fantastic toolkits for C++. Some of my favourites include Qt and Boost. Unfortunately, it seems like no amount of pointer container classes, design patterns or static checkers are going to make modern C++ any safer. I don't want to abandon the ship and shift to a garbage collected languages, although they do come in handy, especially Java, as I've used it with ANTLR for testing grammars. These frameworks seem to complement each other nicely, and some scripting in JavaScript is handy for wrangling data as well. I find Rust cumbersome, with regards to naming styles, and error handling. I like the conveniences of the package and toolchain management rolled with Rust, but they aren't enough to sway me from C++. I would like something like the borrow checker being available in C++, and say, MSVC or GCC having more user-friendly compiler error messages. Maybe C++ is too slow to adapt, and Rust will take its place, if comparable frameworks become more popular. Competition is good for innovation anyway. Regards, Ben

2 1

'Lenovo B41-30 80LF' Laptop. WiFi not werking. Hardware flt.
by B. Eagle Burt 13 Dec '23

13 Dec '23

I am currently running Devuan Linux OS. The cable/eth0 connection WAS UP & RUNNINNING UNTIL MY INCESSESSANT FIDDLING AROUND WITH Network Manager Screwed that up too ... :-(( I have tried ALL the various Commands/Options of 'nmcli' & found that the WiFi Hardware Device/wlan0 was missing. I have searched & searched Lenovo websites to no avail. I have also spoken with a Lenovo support (NZ) technician who did not exactly inspire confidence. It was his suggestion for me to contact the WLUG. I WAS going to purchase a WiFi Adapter (onboard) from Trademe, but he thought that a PCI MINI card would be too small for this model of Laptop. The Lenovo site does not have any WiFi Adapters for sale. A friend suggested that I purchase a USB WiFi Adapter, which I did - 'tp-link AC600 Nano Wireless USB Adapter' BUT I discovered that there is not a Linux driver for it yet... so THAT was a waste of $40-odd. Anyone with a cheap old PCI WiFi or USB WiFi Adapter Driver for Linux or Any advice welcomed. Thank you for your consideration of this, my first, WLUG List Post. 'b'ye! - B. Gilbert

2 1

Stealthy Linux rootkit found in the wild after going undetected for 2 years
by Peter Reutemann 11 Dec '23

11 Dec '23

'Stealthy and multifunctional Linux malware that has been infecting telecommunications companies went largely unnoticed for two years until being documented for the first time by researchers on Thursday. Researchers from security firm Group-IB have named the remote access trojan “Krasue,” after a nocturnal spirit depicted in Southeast Asian folklore “floating in mid-air, with no torso, just her intestines hanging from below her chin.” The researchers chose the name because evidence to date shows it almost exclusively targets victims in Thailand and “poses a severe risk to critical systems and sensitive data given that it is able to grant attackers remote access to the targeted network. According to the researchers: - Krasue is a Linux Remote Access Trojan that has been active since 20 and predominantly targets organizations in Thailand. - Group-IB can confirm that telecommunications companies were targeted by Krasue. - The malware contains several embedded rootkits to support different Linux kernel versions. - Krasue’s rootkit is drawn from public sources (3 open-source Linux Kernel Module rootkits), as is the case with many Linux rootkits. - The rootkit can hook the `kill()` syscall, network-related functions, and file listing operations in order to hide its activities and evade detection. - Notably, Krasue uses RTSP (Real-Time Streaming Protocol) messages to serve as a disguised “alive ping,” a tactic rarely seen in the wild. - This Linux malware, Group-IB researchers presume, is deployed during the later stages of an attack chain in order to maintain access to a victim host. - Krasue is likely to either be deployed as part of a botnet or sold by initial access brokers to other cybercriminals. - Group-IB researchers believe that Krasue was created by the same author as the XorDdos Linux Trojan, documented by Microsoft in a March 2022 blog post, or someone who had access to the latter’s source code.' -- source: https://arstechnica.com/security/2023/12/stealthy-linux-rootkit-found-in-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How AlmaLinux's Community Supported RHEL Binary Compatibility
by Peter Reutemann 10 Dec '23

10 Dec '23

'Linux magazine interviewed an AlmaLinux official about what happened after their distro pivoted to binary compatibility with Red Hat Enterprise Linux rather than being a downstream build: Linux Magazine: What prompted AlmaLinux to choose ABI over 1:1 compatibility with RHEL? benny Vasquez, chair of the AlmaLinux OS Foundation: The short answer is our users. Overwhelmingly, our users made it clear that they chose AlmaLinux for its ease of use, the security and stability that it provides, and the backing of a diverse group of sponsors. All of that together meant that we didn't need to lock ourselves into copying RHEL, and we could continue to provide what our users needed. Moreover, we needed to consider what our sponsors would be able to help us provide, and how we could best serve the downstream projects that now rely on AlmaLinux. The rippling effects of any decision that we make are beyond measure at this point, so we consider all aspects of our impact and then move forward with confidence and intention. LM: How did AlmaLinux's mission of improving the Linux ecosystem for everyone influence this decision? bV: We strongly believe that the soul of open source means working together, providing value where there is a gap, and helping each other solve problems. If we participate in an emotional reaction to a business's change, we will then be distracted and potentially hurt users and the Enterprise Linux ecosystem overall. By remaining focused on what is best (though not easiest), and adapting to the ecosystem as it is today, we will provide a better and more stable operating system. LM: What opportunities does the ABI route offer over 1:1 compatibility? bV: By liberating ourselves from the 1:1 promise, we have been able to do a few small things that have proven to be a good testing ground for what will come in the future. Specifically, we shipped a couple of smallish, but extremely important, security patches ahead of Red Hat, offering quicker security to the users of AlmaLinux... This also opens the door for other features and improvements that we could add back in or change, as our users need. We have already seen greater community involvement, especially around these ideas. LM: Does the ABI route pose any extra challenges? bV: The obvious one is that building from CentOS Stream sources takes more effort, but I think the more important challenge (and the one that will only be solved with consistency over time) is the one of proving that we will be able to deliver on the promise... We will continue on our goal of becoming the home for all users that need Enterprise Linux for free, but in the next year I expect that we will see an expansion in the number of kernels we support and see some new and exciting SIGs spun up around other features or use cases, as the community continues to standardize on how to achieve their goals collectively. Linux magazine notes that in August AlmaLinux added two new repositories, Testing and Synergy. "Testing, currently available for AlmaLinux 8 and 9, offers security updates before they are approved and implemented upstream. Synergy contains packages requested by community members that currently aren't available in RHEL or Extra Packages for Enterprise Linux (EPEL, a set of extra software packages maintained by the Fedora SIG that are not available in RHEL or CentOS Stream)." The article also points out that "On the upside, AlmaLinux can now include comments in their patches for greater transparency. Users will see where the patch comes from, which was not an option before." Vasquez tells the magazine, "I think folks will be seriously happy about what they find as we release the new versions, namely, the consistency, stability, and security that they've come to expect from us."' -- source: https://linux.slashdot.org/story/23/12/09/2121242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ext4 corruption bug in Linux kernel 6.1.64-1
by Eliot Blennerhassett 10 Dec '23

10 Dec '23

(I haven't read the details yet, but worth being cautious...) ext4 corruption bug in Linux kernel 6.1.64-1 that was in last night's debian point release Avoid booting into 6.1.64-1, if you have already done so the suggestion is to boot to a previous kernel, 6.1.55-1 or earlier debian 12.3 release has been delayed. Thanks to those who are working to update the kernel for the release! Bug report - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057843 "IMPORTANT: do NOT upgrade to new stable point release" on debian-user mailing list (Received via mastodon https://floss.social/@FLOX_advocate/111552470597771898) -- Eliot

1 0