- wlug - list.wlug.org.nz

eternal terminal
by Peter Reutemann 18 Aug '22

18 Aug '22

Hi everyone Facing recurring ssh connection interruptions with long running processes, my go-to solution is to use "screen" on the remote server. But that doesn't get around the problem of my ssh sessions being defunct or closed ("broken pipe"). Doing a quick internet search, I've just come across "eternal terminal": "Eternal Terminal (ET) is a remote shell that automatically reconnects without interrupting the session. " https://eternalterminal.dev/ https://github.com/MisterTea/EternalTerminal Does anybody have any experience with it? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Android could go 64-bit only in 2023, starting with the Pixel tablet
by Peter Reutemann 18 Aug '22

18 Aug '22

'Android 13 hit AOSP the other day, and included in the code source dump is an interesting commit spotted by Esper's Mishaal Rahman. It sounds like Google is planning to—or at least experimenting with—moving the upcoming Pixel tablet to a 64-bit-only build of Android. The commit doesn't beat around the bush, saying: "Move tangor to 64-bit only." "Tangor" is the codename for the already-announced Pixel tablet. iOS, with its single hardware manufacturer, has been 64-bit only since 2017. Android has a million moving parts split across a bunch of different companies, so getting to 64-bit only is going to be a long road. Getting there is worth the effort, though, with a promise of increased performance and additional security features. The Google Play app ecosystem is probably furthest along in supporting 64 bit. Any apps written entirely in Java or Kotlin already get automatic 64-bit compatibility from the system. Google mandated that Google Play apps using native code (usually these are games) needed to provide 64-bit versions back in 2019. There were exceptions for a few popular SDKs like Adobe Air and Unity, but these exceptions were ended in August 2021, when all apps were required to have 64-bit versions. As for hardware, every SoC should support 64-bit by now, and some flagship Android SoCs are actually reducing their ability to run 32-bit code. Any flagship chip following the recommended ARM design only supports 32-bit processing on three of the eight cores—the other five are 64-bit only. ARM wants to drop 32-bit support entirely from its 2023 flagship SoC design, but there are already rumors stating that Qualcomm doesn't want to follow that recommended design. The most likely reason is because of China. Google's 64-bit app requirements apply only to apps in Google Play, which doesn't exist in China. China has a big collection of competing app stores with more lax policies, so 32-bit apps have not been phased out as aggressively. China is working on this issue, though, with the top-five Chinese app stores—from Alibaba, Baidu, OPPO, Tencent, and Xiaomi—agreeing to ban 32-bit-only apps by the end of this month. There's also the issue of 64-bit compatibility among packed-in apps from OEM skins, which app store rules don't apply to. Rahman found another commit that suggests 64-bit-only support might be a regular feature of 2023's Android 14, so the Pixel tablet, which is already officially confirmed for next year, is looking like a test run to see how everything goes.' -- source: https://arstechnica.com/gadgets/2022/08/google-might-give-the-pixel-tablet-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Update Chrome now to patch actively exploited zero-day
by Peter Reutemann 18 Aug '22

18 Aug '22

'Google announced an update on Wednesday to the Stable channel of its Chrome browser that includes a fix for an exploit that exists in the wild. CVE-2022-2856 is a fix for "insufficient validation of untrusted input in Intents," according to Google's advisory. Intents are typically a way to pass data from inside Chrome to another application, such as the share button on Chrome's address bar. As noted by the Dark Reading blog, input validation is a common weakness in code. The exploit was reported by Ashley Shen and Christian Resell of the Google Threat Analysis Group, and that's all the information we have for now. Details of the exploit are currently tucked behind a wall in the Chromium bugs group and are restricted to those actively working on related components and registered with Chromium. After a certain percentage of users have applied the relevant updates, those details may be revealed. Google says the update—104.0.5112.101 for Mac and Linux and 104.0.5112.102/101 for Windows—will "roll out over the coming days/weeks," but you can (and should) manually update Chrome now (check the "About" section of your settings). There are 10 other security fixes included in the update. Dark Reading notes that this is Chrome's fifth zero-day vulnerability disclosed in 2022.' -- source: https://arstechnica.com/information-technology/2022/08/update-chrome-now-to… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VLC-Developer VideoLan Says India Blocking Site Endangers Its Own Citizens
by Peter Reutemann 17 Aug '22

17 Aug '22

'VideoLan, the developer of popular media player VLC, says Indian telecom operators have been blocking its website since February of this year in a move that is potentially impacting some users in one of the open source firm's largest markets. From a report: "Most major ISPs [internet service providers] are banning the site, with diverse techniques," VideoLan president and lead developer Jean-Baptiste Kempf said of the blocking in India, in an email to TechCrunch. India represents 10% of all VLC users worldwide, he said. The website's traffic has seen an overall drop of 20% as a result of the blocking in India. [...] VLC, downloaded over 3.5 billion times worldwide, is a local media player that doesn't require internet access or connection to any particular service online for the vast majority of its features. But by blocking the website, India is pushing its citizens to "shady websites that are running hacked version of VLC. So they are endangering their own citizens with this ban," Kempf added.' -- source: https://developers.slashdot.org/story/22/08/16/146257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Releases Android 13, Rolling Out First To Pixel Phones
by Peter Reutemann 16 Aug '22

16 Aug '22

'This year's major Android update, Android 13, is officially releasing today for Googleâ(TM)s Pixel phones, the search giant has announced. >From a report: The annual update is getting an official release a little earlier than usual, following Android 12's release last October and Android 11's release in September 2020. The list of updates arriving with this year's version of Android is likely to be familiar if you've been keeping up with Android 13's beta releases. There's the ability to customize non-Google app icons to match your homescreen wallpaper that we saw in Android 13's first developer preview, a new permission to cut down on notification spam, and a new option to limit which of your photos and videos an app can access. Back in January, we wrote that Google planned to spend this year catching up with Apple's ecosystem integrations, and there's more evidence of this in Android 13's official release. The update includes support for spatial audio with head tracking, which is designed to make sounds appear as though they're coming from a fixed point in space when you move your head while wearing compatible headphones, similar to a feature Apple offers for its AirPods. Today's post doesn't say exactly which headphones this will work with, but Google previously announced it would be updating its Pixel Buds Pro to offer support for spatial audio. Secondly, there's the ability to stream messages from apps including Google Messages directly to a Chromebook, similar to iMessage on the Mac.' -- source: https://tech.slashdot.org/story/22/08/15/1747228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 Arrives With Performance Improvements and More Rust Coming
by Peter Reutemann 16 Aug '22

16 Aug '22

'Linux creator Linus Torvalds has announced the first release candidate for the Linux kernel version 6.0, but he says the major number change doesn't signify anything especially different about this release. ZDNet: While there is nothing fundamentally different about this release compared with 5.19, Torvalds noted that there were over 13,500 non-merge commits and over 800 merged commits, meaning "6.0 looks to be another fairly sizable release." According to Torvalds, most of the updates are improvements to the GPU, networking and sound. Torvalds stuck to his word after releasing Linux kernel 5.19 last month, when he flagged he would likely call the next release 6.0 because he's "starting to worry about getting confused by big numbers again." On Sunday's release of Linux 6.0 release candidate version 1 (rc-1), he explained his reasoning behind choosing a new major version number and its purpose for developers. Again, it's about avoiding confusion rather than signaling that the release has major new features. His threshold for changing the lead version number was .20 because it is difficult to remember incremental version numbers beyond that. "Despite the major number change, there's nothing fundamentally different about this release - I've long eschewed the notion that major numbers are meaningful, and the only reason for a 'hierarchical; numbering system is to make the numbers easier to remember and distinguish," said Torvalds. Torvalds lamented some Rust-enabling code didn't make it into the release. The Register adds: "I actually was hoping that we'd get some of the first rust infrastructure, and the multi-gen LRU VM, but neither of them happened this time around," he mused, before observing "There's always more releases. This is one of those releases where you should not look at the diffstat too closely, because more than half of it is yet another AMD GPU register dump," he added, noting that Intel's Gaudi2 Ai processors are also likely to produce plenty of similar kernel additions. "The CPU people also show up in the JSON files that describe the perf events, but they look absolutely tiny compared to the 'asic_reg' auto-generated GPU and AI hardware definitions," he added.' -- source: https://linux.slashdot.org/story/22/08/15/199255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NetBSD 9.3: A 2022 OS That Can Run On Late-1980s Hardware
by Peter Reutemann 14 Aug '22

14 Aug '22

'Version 9.3 of NetBSD is here, able to run on very low-end systems and with that authentic early-1990s experience. The Register reports: Version 9.3 comes some 15 months after NetBSD 9.2 and boasts new and updated drivers, improved hardware support, including for some recent AMD and Intel processors, and better handling of suspend and resume. The next sentence in the release announcement, though, might give some readers pause: "Support for wsfb-based X11 servers on the Commodore Amiga." This is your clue that we are in a rather different territory from run-of-the-mill PC operating systems here. A notable improvement in NetBSD 9.3 is being able to run a graphical desktop on an Amiga. This is a 2022 operating system that can run on late-1980s hardware, and there are not many of those around. NetBSD supports eight "tier I" architectures: 32-bit and 64-bit x86 and Arm, plus MIPS, PowerPC, Sun UltraSPARC, and the Xen hypervisor. Alongside those, there are no less than 49 "tier II" supported architectures, which are not as complete and not everything works -- although almost all of them are on version 9.3 except for the version for original Acorn computers with 32-bit Arm CPUs, which is still only on NetBSD 8.1. There's also a "tier III" for ports which are on "life support" so there may be a risk Archimedes support could drop to that. This is an OS that can run on 680x0 hardware, DEC VAX minicomputers and workstations, and Sun 2, 3, and 32-bit SPARC boxes. In other words, it reaches back as far as some 1970s hardware. Let this govern your expectations. For instance, in VirtualBox, if you tell it you want to create a NetBSD guest, it disables SMP support. ' -- source: https://tech.slashdot.org/story/22/08/12/1958253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Urges Windows Users To Run Patch For DogWalk Zero-Day Exploit
by Peter Reutemann 14 Aug '22

14 Aug '22

'Computerworld reports: Despite previously claiming the DogWalk vulnerability did not constitute a security issue, Microsoft has now released a patch to stop attackers from actively exploiting the vulnerability. [...] The vulnerability, known as CVE-2022-34713 or DogWalk, allows attackers to exploit a weakness in the Windows Microsoft Support Diagnostic Tool (MSDT). By using social engineering or phishing, attackers can trick users into visiting a fake website or opening a malicious document or file and ultimately gain remote code execution on compromised systems. DogWalk affects all Windows versions under support, including the latest client and server releases, Windows 11 and Windows Server 2022. The vulnerability was first reported in January 2020 but at the time, Microsoft said it didn't consider the exploit to be a security issue. This is the second time in recent months that Microsoft has been forced to change its position on a known exploit, having initially rejected reports that another Windows MSDT zero-day, known as Follina, posed a security threat. A patch for that exploit was released in June's Patch Tuesday update. ' -- source: https://tech.slashdot.org/story/22/08/12/2037213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's New Bug Bounties Include Their Custom Linux Kernel's Experimental Security Mitigations
by Peter Reutemann 14 Aug '22

14 Aug '22

'Google uses Linux "in almost everything," according to the leader of Google's "product security response" team — including Chromebooks, Android smartphones, and even Google Cloud. "Because of this, we have heavily invested in Linux's security — and today, we're announcing how we're building on those investments and increasing our rewards." In 2020, we launched an open-source Kubernetes-based Capture-the-Flag (CTF) project called, kCTF. The kCTF Vulnerability Rewards Program lets researchers connect to our Google Kubernetes Engine (GKE) instances, and if they can hack it, they get a flag, and are potentially rewarded. All of GKE and its dependencies are in scope, but every flag caught so far has been a container breakout through a Linux kernel vulnerability. We've learned that finding and exploiting heap memory corruption vulnerabilities in the Linux kernel could be made a lot harder. Unfortunately, security mitigations are often hard to quantify, however, we think we've found a way to do so concretely going forward.... First, we are indefinitely extending the increased reward amounts we announced earlier this year, meaning we'll continue to pay $20,000 — $91,337 USD for vulnerabilities on our lab kCTF deployment to reward the important work being done to understand and improve kernel security. This is in addition to our existing patch rewards for proactive security improvements. Second, we're launching new instances with additional rewards to evaluate the latest Linux kernel stable image as well as new experimental mitigations in a custom kernel we've built. Rather than simply learning about the current state of the stable kernels, the new instances will be used to ask the community to help us evaluate the value of both our latest and more experimental security mitigations. Today, we are starting with a set of mitigations we believe will make most of the vulnerabilities (9/10 vulns and 10/13 exploits) we received this past year more difficult to exploit. For new exploits of vulnerabilities submitted which also compromise the latest Linux kernel, we will pay an additional $21,000 USD. For those which compromise our custom Linux kernel with our experimental mitigations, the reward will be another $21,000 USD (if they are clearly bypassing the mitigations we are testing). This brings the total rewards up to a maximum of $133,337 USD. We hope this will allow us to learn more about how hard (or easy) it is to bypass our experimental mitigations..... With the kCTF VRP program, we are building a pipeline to analyze, experiment, measure and build security mitigations to make the Linux kernel as safe as we can with the help of the security community. We hope that, over time, we will be able to make security mitigations that make exploitation of Linux kernel vulnerabilities as hard as possible. "We don't care about vulnerabilities; we care about exploits," Vela told the Register. "We expect the vulnerabilities are there, they will get patched, and that's nice and all. But the whole idea is what do to beyond just patching a couple of vulnerabilities." In total, Google paid out $8.7 million in rewards to almost 700 researchers across its various VPRs last year. "We are just one actor in the whole community that happens to have economic resources, financial resources, but we need the community to help us make the Kernel better," Vela said. "If the community is engaged and helps us validate the mitigations that we have, then, we will continue growing on top of that. But the whole idea is that we need to see where the community wants us to go with this...." [I]t's not always about the cash payout, according to Vela, and different bug hunters have different motivations. Some want money, some want fame and some just want to solve an interesting problem, Vela said. "We are trying to find the right combination to captivate people." ' -- source: https://linux.slashdot.org/story/22/08/13/064239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Find Vulnerability In Software Underlying Discord, Microsoft Teams, and Other Apps
by Peter Reutemann 12 Aug '22

12 Aug '22

'Motherboard reports: A group of security researchers found a series of vulnerabilities in the software underlying popular apps like Discord, Microsoft Teams, Spotify and many others, which are used by tens of millions of people all over the world. At the Black Hat cybersecurity conference in Las Vegas on Thursday, the researchers presented their findings, detailing how they could have hacked people who use Discord, Microsoft Teams, and the chat app Element by exploiting the software underlying all of them: Electron, which is a framework built on the open source Chromium and the cross-platform javascript environment Node JS. In all these cases, the researchers submitted vulnerabilities to Electron to get them fixed, which earned them more than $10,000 in rewards. The bugs were fixed before the researchers published their research. Aaditya Purani, one of the researchers who found these vulnerabilities, said that "regular users should know that the Electron apps are not the same as their day-to-day browsers," meaning they are potentially more vulnerable. In the case of Discord, the bug Purani and his colleagues found only required them to send a malicious link to a video. With Microsoft Teams, the bug they found could be exploited by inviting a victim to a meeting. In both cases, if the targets clicked on these links, hackers would have been able to take control of their computers, Purani explained in the talk. For him, one of the main takeaways of their research is that Electron is risky precisely because users are very likely to click on links shared in Discord or Microsoft Teams.' -- source: https://it.slashdot.org/story/22/08/11/211256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0