- wlug - list.wlug.org.nz

Raspberry Pi-Powered Anti-Tracking Tool Checks If You're Being Followed
by Peter Reutemann 12 Aug '22

12 Aug '22

'Matt Edmondson, a hacker and digital forensics expert, built a Raspberry Pi-powered anti-tracking tool that "scans for nearby devices and alerts you if the same phone is detected multiple times within the past 20 minutes," reports Wired. The device, which can be carried around or placed in a car, consists of parts that cost around $200 in total. From the report: The homemade system works by scanning for wireless devices around it and then checking its logs to see whether they also were present within the past 20 minutes. It was designed to be used while people are on the move rather than sitting in, say, a coffee shop, where it would pick up too many false readings. The anti-tracking tool, which can sit inside a shoebox-sized case, is made up of a few components. A Raspberry Pi 3 runs its software, a Wi-Fi card looks for nearby devices, a small waterproof case protects it, and a portable charger powers the system. A touchscreen shows the alerts the device produces. Each alert may be a sign that you are being tailed. The device runs Kismet, which is a wireless network detector, and is able to detect smartphones and tablets around it that are looking for Wi-Fi or Bluetooth connections. The phones we use are constantly looking for wireless networks around them, including networks they've connected to before as well as new networks. Edmondson says Kismet makes a record of the first time it sees a device and then the most recent time it was detected. But to make the anti-tracking system work, he had to write code in Python to create lists of what Kismet detects over time. There are lists for devices spotted in the past five to 10 minutes, 10 to 15 minutes, and 15 to 20 minutes. If a device appears twice, an alert flashes up on the screen. The system can show a phone's MAC address, although this is not much use if it's been randomized. It can also record the names of Wi-Fi networks that devices around it are looking for -- a phone that's trying to connect to a Wi-Fi network called Langley may give some clues about its owner. "If you have a device on you, I should see it," he says. In an example, he showed WIRED that a device was looking for a network called SAMSUNGSMART. To stop the system from detecting your own phone or those of other people traveling with you, it has an "ignore" list. By tapping one of the device's onscreen buttons, it's possible to "ignore everything that it has already seen." Edmondson says that in the future, the device could be modified to send a text alert instead of showing them on the screen. He is also interested in adding the capability to detect tire-pressure monitoring systems that could show recurring nearby vehicles. A GPS unit could also be added so you can see where you were when you were being tracked, he says. [...] Edmondson has no plans to make the device into a commercial product, but he says the design could easily be copied and reused by anyone with some technical knowledge. Many of the parts involved are easy to obtain or may be lying around the homes of people in tech communities. For those interested, Edmondson open-sourced its underlying code and plans to present the research project at the Black Hat security conference in Las Vegas this week.' -- source: https://yro.slashdot.org/story/22/08/11/2143207 Anybody interested in exploring that project and demoing it at our September meeting slot? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGX, Intel's Supposedly Impregnable Data Fortress, Has Been Breached Yet Again
by Peter Reutemann 10 Aug '22

10 Aug '22

'Intel's latest generation of CPUs contains a vulnerability that allows attackers to obtain encryption keys and other confidential information protected by the company's software guard extensions, the advanced feature that acts as a digital vault for security users' most sensitive secrets. From a report: Abbreviated as SGX, the protection is designed to provide a fortress of sorts for the safekeeping of encryption keys and other sensitive data, even when the operating system or a virtual machine running on top is maliciously compromised. SGX works by creating trusted execution environments that protect sensitive code and the data it works with from monitoring or tampering by anything else on the system. SGX is a cornerstone of the security assurances many companies provide to users. Servers used to handle contact discovery for the Signal Messenger, for instance, rely on SGX to ensure the process is anonymous. Signal says running its advanced hashing scheme provides a "general recipe for doing private contact discovery in SGX without leaking any information to parties that have control over the machine, even if they were to attach physical hardware to the memory bus." The example is purely hypothetical. Signal spokesperson Jun Harada wrote in an email: "Intel alerted us to this paper... and we were able to verify that the CPUs that Signal uses are not impacted by the findings of this paper and therefore are not vulnerable to the stated attack." Key to the security and authenticity assurances of SGX is its creation of what are called "enclaves," or blocks of secure memory. Enclave contents are encrypted before they leave the processor and are written in RAM. They are decrypted only after they return. The job of SGX is to safeguard the enclave memory and block access to its contents by anything other than the trusted part of the CPU.' -- source: https://it.slashdot.org/story/22/08/09/1814258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NVIDIA Publishes 73k Lines Worth Of 3D Header Files For Fermi Through Ampere GPUs
by Peter Reutemann 10 Aug '22

10 Aug '22

'In addition to NVIDIA being busy working on transitioning to an open-source GPU kernel driver, yesterday they made a rare public open-source documentation contribution... NVIDIA quietly published 73k lines worth of header files to document the 3D classes for their Fermi through current-generation Ampere GPUs. Phoronix's Michael Larabel reports: To NVIDIA's Open-GPU-Docs portal they have posted the 73k lines worth of 3D class header files covering RTX 30 "Ampere" GPUs back through the decade-old GeForce 400/500 "Fermi" graphics processors. These header files define the classes used to program the 3D engine of the GPU, the texture header and texture sampler layout are documented, and other 3D-related programming bits. Having all of these header files will be useful to the open-source Nouveau driver developers to save on their reverse-engineering and guessing/uncertainty over certain bits. NVIDIA's Open GPU Kernel Driver is for only GeForce RTX 20 "Turing" series and newer, so it's great seeing NVIDIA now posting this documentation going back to Fermi which is squarely to help the open-source community / Nouveau. [...] The timing of NVIDIA opening these 3D classes back to Fermi is interesting and potentially tied to SIGGRAPH 2022 happening this week. Those wanting to grab NVIDIA's latest open-source GPU documentation can find it via this GitHub repository. ' -- source: https://news.slashdot.org/story/22/08/09/2225215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Phone Carrier That Doesn't Track Your Browsing Or Location
by Peter Reutemann 10 Aug '22

10 Aug '22

'Wired reports: As marketers, data brokers, and tech giants endlessly expand their access to individuals' data and movements across the web, tools like VPNs or cookie blockers can feel increasingly feeble and futile. Short of going totally off the grid forever, there are few options for the average person to meaningfully resist tracking online. Even after coming up with a technical solution last year for how phone carriers could stop automatically collecting users' locations, researchers Barath Raghavan and Paul Schmitt knew it would be challenging to convince telecoms to implement the change. So they decided to be the carrier they wanted to see in the world. The result is a new company, dubbed Invisv, that offers mobile data designed to separate users from specific identifiers so the company can't access or track customers' metadata, location information, or mobile browsing. Launching in beta today for Android, the company's Pretty Good Phone Privacy or PGPP service will replace the mechanism carriers normally use to turn cell phone tower connection data into a trove of information about users' movements. And it will also offer a Relay service that disassociates a user's IP address from their web browsing. PGPP's ability to mask your phone's identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a "yes" or "no" about whether a device should get service. On the PGPP "Mobile Pro" plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There's also a "Mobile Core" plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month. Both of these plans also include PGPP's Relay service. Similar to Apple's iCloud Private Relay, PGPP's Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you're looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay -- in this case, Invisv -- but the information about the page you're trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you're trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay. In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. The carrier is still working to bring its services to Apple's iOS. It's also worth noting that Invisv only offers mobile data; there are no voice calling services.' -- source: https://yro.slashdot.org/story/22/08/08/219258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Amazon's Roomba Deal Is Really About Mapping Your Home
by Peter Reutemann 09 Aug '22

09 Aug '22

'Bloomberg: Amazon.com hasn't just bought a maker of robot vacuum cleaners. It's acquired a mapping company. To be more precise: a company that can make maps of your home. The company announced a $1.7 billion deal on Friday for iRobot, the maker of the Roomba vacuum cleaner. And yes, Amazon will make money from selling those gadgets. But the real value resides in those robots' ability to map your house. As ever with Amazon, it's all about the data. A smart home, you see, isn't actually terribly smart. It only knows that your Philips Hue lightbulbs and connected television are in your sitting room because you've told it as much. It certainly doesn't know where exactly the devices are within that room. The more it knows about a given space, the more tightly it can choreograph the way they interact with you. The smart home is clearly a priority for Amazon. Its Echo smart speakers still outsell those from rivals Apple and Google, with an estimated 9.9 million units sold in the three months through March, according to the analysis firm Strategy Analytics. It's complemented that with a $1 billion deal for the video doorbell-maker Ring in 2018, and the wi-fi company Eero a year later. But you still can't readily buy the Astro, Amazon's household robot that was revealed with some fanfare last year, is still only available in limited quantities. That, too, seemed at least partly an effort to map the inside of your property, a task that will now fall to iRobot. The Bedford, Mass.-based company's most recent products include a technology it calls Smart Maps, though customers can opt out of sharing the data. Amazon said in a statement that protecting customer data is "incredibly important." Slightly more terrifying, the maps also represent a wealth of data for marketers. The size of your house is a pretty good proxy for your wealth. A floor covered in toys means you likely have kids. A household without much furniture is a household to which you can try to sell more furniture. This is all useful intel for a company such as Amazon which, you may have noticed, is in the business of selling stuff.' -- source: https://slashdot.org/story/22/08/08/2039234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism's 'Librem 5 USA' Smartphone Achieves Major New Shipping Milestone
by Peter Reutemann 08 Aug '22

08 Aug '22

'Purism posted an announcement Thursday about their privacy-focused "Librem 5 USA" smartphones. "New orders placed today will ship within our standard 10-business-day window." The Librem 5 USA now joins the Librem Mini and Librem 14 as a post-Just In Time product, one where instead of relying on Just In Time supply chains to manufacture a product just as we need it, we have invested in maintaining much larger inventories so that we can better absorb future supply chain issues that may come our way. For anyone who is new to the product, the Librem 5 USA is our premium phone that shares the same hardware design and features as our mass-produced Librem 5, but with electronics we make in the USA using a separate electronics supply chain that sources from US suppliers whenever possible. This results in a tighter, more secure supply chain for the Librem 5 USA. The Librem 5 USA uses the same PureOS as our other computers and so it runs the same desktop Linux applications you might be used to, just on a small screen. PureOS on the Librem 5 USA demonstrates real convergence, where the device becomes more than just a phone, it becomes a full-featured pocket-sized computer that can act like a desktop when connected to a monitor, keyboard and mouse, or even a laptop (or tablet!) when connected to a laptop docking station. All of your files and all of your software remains the same and follows you where you go. Applications just morph from the smaller screen to the larger screen when docked, just like connecting a external monitor to a laptop. Everyone who has backed the Librem 5 and Librem 5 USA projects hasn't just supported the production of the hardware itself, they have also supported a massive, multi-year software development effort to bring the traditional Linux desktop to a phone form-factor. Projects such as Phosh (the GUI), Phoc (the Compositor), Squeekboard (the Keyboard), Calls (for calling), Chats (for texting and messaging), and libhandy/libadwaita (libraries to make GTK applications adaptive) all required massive investment and many of these projects have already been moved to the GNOME infrastructure to better share our effort with a larger community. We are delighted to see that many other mobile projects have recognized the quality of our efforts and adopted our software into their own projects.... The Librem 5 USA was designed for longevity and because we support right to repair, we also offer a number of spare parts in our shop, including replacement modems so you can make sure you support all the cellular bands in a particular continent, replacement batteries for when you ultimately wear out your existing battery, and plenty of other spare parts that haven't had sufficient demand to post formally on our shop (yet). If you need a spare part that isn't yet on the shop, just ask.' -- source: https://linux.slashdot.org/story/22/08/07/0528255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Development Suddenly Resumes on Linux Distro CutefishOS
by Peter Reutemann 08 Aug '22

08 Aug '22

'Last month fans were worried about CuteFish OS, with its domain timing out, emails going unanswered, and a Twitter feed that hadn't posted anything since March. But "now it looks like the original development team behind CuteFishOS is coming back to life," according to this report from The New Stack — with a Reddit user planning a fork now saying that's been put on hold, since "I'd be duplicating work for no reason." Last Sunday — on July 31st — CuteFish's official repository on GitHub was updated with a new announcement in its profile. "Your Favorite CutefishOS are back now!" [sic] It also promised "New website in the works (coming soon)." and pointed to a new URL. You can see the changes happening right before your eyes. That website's domain — OpenFish.org — was registered just ten days ago, on Thursday, July 28th — and it's still a work in progress. On Thursday afternoon it was pointing to a non-English-language page hosted on the Pakistani cloud platform QCloud — but by Thursday night it was showing a testing page for a NGNIX HTTP server running Red Hat Enterprise Linux. And there's now also a new README file in CuteFish's GitHub repository listing five items as "progressing." The first item is "official website preparation," but other items include collating the previous pull requests and issues, "fix the existing problem," and eventually adding new features. The sole contributor to the repository appears to be a Chinese coder going under the name of Biukang. "We are preparing for the restart of CutefishOS," says Biukang's GitHub profile now. But the article still hails last month's discussion of a fork as "a chance to see open source communities mobilizing into action just to fill a perceived void."' -- source: https://linux.slashdot.org/story/22/08/06/0019243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DreamWorks Animation To Release Renderer As Open-Source Software
by Peter Reutemann 07 Aug '22

07 Aug '22

'With annual CG confab SIGGRAPH slated to start Monday in Vancouver, DreamWorks Animation announced its intent to release its proprietary renderer, MoonRay, as open-source software later this year. Hollywood Reporter reports: MoonRay has been used on feature films such as How to Train Your Dragon: The Hidden World, Croods: A New Age, The Bad Guys and upcoming Puss in Boots: The Last Wish. MoonRay uses DreamWorks' distributed computation framework, Arras, also to be included in the open-source code base. "We are thrilled to share with the industry over 10 years of innovation and development on MoonRay's vectorized, threaded, parallel, and distributed code base," said Andrew Pearce, DWA's vp of global technology. "The appetite for rendering at scale grows each year, and MoonRay is set to meet that need. We expect to see the code base grow stronger with community involvement as DreamWorks continues to demonstrate our commitment to open source."' -- source: https://news.slashdot.org/story/22/08/05/229228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Backlash, GitLab U-Turns on Deleting Dormant Projects
by Peter Reutemann 07 Aug '22

07 Aug '22

'"GitLab has reversed its decision to automatically delete projects that are inactive for more than a year and belong to its free-tier users," reports the Register. Thursday GitLab tweeted: "We discussed internally what to do with inactive repositories. We reached a decision to move unused repos to object storage. Once implemented, they will still be accessible but take a bit longer to access after a long period of inactivity." But the Register says they've seen internal documents from "well-placed sources" showing that GitLab had originally "hoped the move would save it up to $1 million a year and help make its SaaS business sustainable." And the company had spent a long time preparing for such a move: Documents we have seen gave staff notice of an internal meeting scheduled for August 9. The agenda for the meeting lays out the plan to delete dormant code repositories... Other internal documents seen by The Register mention the possible use of object storage to archive projects but express concerns that doing so would increase GitLab's costs by creating a need for multiple redundant backups. We have also seen internal discussions confirming the automation code to delete inactive projects was completed by the end of July, and was ready to roll out after months of debate and development work. One of our sources told us [Thursday] that it was online pressure, led by The Register's reporting, that forced a dramatic rethink at the GitHub rival. Word of the deletion policy as a money-saving exercise sparked fury on Twitter and Reddit. On GitLab's Twitter feed Thursday, someone raised an interesting point about GitLab's new promise to move inactive repos into object storage. "Wait, does 'inactive' mean repositories that have no new commits? Or only those without new commits AND without read access by cloning / fetching?" And GitLab's CEO/co-founder Sid Sijbrandij replied, "We're not sure yet. Probably all write operations would keep a project active, creating an issue, a merge request, pushing changes to a branch, etc. We might also keep it active as long as people are doing read operations such as cloning, forking, etc." Friday Sijbrandij tweeted this status update: "Archived projects is a user activated state that signals intent. We're not sure yet but very likely the storage type used is orthogonal to that. Our current plan for object storage would keep the repos visible to everyone."' -- source: https://developers.slashdot.org/story/22/08/06/0417218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Browser's Stricter Privacy Protection Will Also Apply To Microsoft Scripts Now
by Peter Reutemann 06 Aug '22

06 Aug '22

'After a revelation in May that DuckDuckGo's (DDG) privacy-focused web browser allows Microsoft tracking scripts on third-party websites, the company now says it will start blocking those too. From a report: DuckDuckGo's browser had third-party tracker loading protection by default that already blocked scripts embedded on websites from Facebook, Google, and others, but until now Microsoft's scripts from the Bing and LinkedIn domains (but not its third-party cookies) had a pass. A security researcher named Zach Edwards pointed out the exclusion that he apparently uncovered while auditing the browser's privacy claims, and noted it is especially curious because Microsoft is the partner that delivers ads in DDG's search engine (while promising not to use that data to create a monitored profile of users to target ads, instead relying on context to decide which ones it should show). DuckDuckGo CEO Gabe Weinberg said at the time that the reason for it was a search syndication agreement with Microsoft, and that more updates on third-party tracker preventions were coming. A backlash ensued, with some seizing on DuckDuckGo's own words that "tracking is tracking," a phrase the company used against Google's cookie-replacing "privacy sandbox" ad technology. Now Weinberg writes in a blog post, "I've heard from a number of users and understand that we didn't meet their expectations around one of our browser's web tracking protections." DuckDuckGo is vowing to be more transparent about what trackers its browser and extensions are protecting users from, making its tracker blocklists available and offering users more information on how its tracking protections with a new help page.' -- source: https://yro.slashdot.org/story/22/08/05/173203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0