- wlug - list.wlug.org.nz

Bruce Schneier: Blockchain And Trust
by Lawrence D'Oliveiro 12 Feb '19

12 Feb '19

Another thoughtful essay <https://www.schneier.com/blog/archives/2019/02/blockchain_and_.html> from the well-known computer-security guru: Trust is essential to society. As a species, humans are wired to trust one another. Society can't function without trust, and the fact that we mostly don't even think about it is a measure of how well trust works. .... Most blockchain enthusiasts have a unnaturally narrow definition of trust. They're fond of catchphrases like "in code we trust," "in math we trust," and "in crypto we trust." This is trust as verification. But verification isn't the same as trust. .... Any blockchain system will have to coexist with other, more conventional systems. Modern banking, for example, is designed to be reversible. Bitcoin is not. That makes it hard to make the two compatible, and the result is often an insecurity. Steve Wozniak was scammed out of $70K in bitcoin because he forgot this. .... Honestly, cryptocurrencies are useless. They're only used by speculators looking for quick riches, people who don't like government-backed currencies, and criminals who want a black-market way to exchange money.

1 0

Android Phones Can Be Hacked Remotely By Viewing Malicious PNG Image
by Peter Reutemann 12 Feb '19

12 Feb '19

'An innocent-looking image -- sent either via the internet or text -- could open your Android phone up to hacking. "While this certainly doesn't apply to all images, Google discovered that a maliciously crafted PNG image could be used to hijack a wide variety of Androids -- those running Android Nougat (7.0), Oreo (8.0), and even the latest Android OS Pie (9.0)," reports CSO Online. From the report: The latest bulletin lists 42 vulnerabilities in total -- 11 of which are rated as critical. The most severe critical flaw is in Framework; it "could enable a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process." Although Google had no report of the security flaws being actively exploited, it remains to be seen if and how long it will take before attackers use the flaw for real-world attacks. Android owners were urged to patch as soon as security updates becomes available. But let's get real: Even if your Android still receives security updates, there's no telling how long it will be (weeks or months) before manufacturers and carriers get it together to push out the patches. ' -- source: https://yro.slashdot.org/story/19/02/11/2338245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry π Goes Retail
by Lawrence D'Oliveiro 11 Feb '19

11 Feb '19

The Raspberry Pi Foundation has opened its first retail shop, in its home town of Cambridge <https://www.theregister.co.uk/2019/02/11/pi_shop/>. Some video here <https://www.bbc.com/news/uk-england-cambridgeshire-47143411>.

1 0

Raspberry Pi Gets Its Own Brick-and-Mortar Retail Store
by Peter Reutemann 08 Feb '19

08 Feb '19

'The Raspberry Pi, believe it or not, now has its very own retail store. From a report: Located on the first floor of the Grand Arcade in Cambridge, U.K., the Raspberry Pi Store is open through the day, every day, and sells everything from Raspberry Pi microcomputers and accessories, to branded coffee mugs, soft toys, and more. [...] Despite its popularity -- more than 19 million Raspberry Pi units have been sold since 2012 -- the Raspberry Pi still feels a little niche to merit its own dedicated retail store. Indeed, most people who would be interested in building their own electronic gadgets from scratch are likely well-versed in the wonders of online retail. But conversely, that is likely the same reason why the Raspberry Pi Foundation wants its own space in the physical retail realm: it needs a new audience.' -- source: https://news.slashdot.org/story/19/02/07/1332202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice 6.2 Brings New Interfaces, Performance Improvements To the Open Source Office Suite
by Peter Reutemann 08 Feb '19

08 Feb '19

'New interface styles and feature improvements are available in version 6.2 of LibreOffice -- the most popular open-source office suite -- released Thursday by The Document Foundation. As with any software update, bug fixes and feature enhancements are present, making this release a significant upgrade, particularly for users coming from Microsoft Office, or working with files created with those programs. LibreOffice now supports SVG-based icons for toolbars in the Breeze, Colibre, and Elementary icon sets as an experimental feature, to better support HiDPI displays increasingly found in notebook PCs. The Elementary icon set was also improved significantly, adding a 32px PNG version, and fixing inconsistencies between the 16, 24, and 32px versions, as well as adding more icons across the set to prevent reverting to defaults. In LibreOffice 6.2, the "Tabbed" interface is now available for Writer, Calc, Impress, and Draw, and is considered sufficiently stable to be a default option. This interface mimics the oft-maligned "Ribbon interface" in Office 2007. The "traditional" Office-style toolbar is default, though the Tabbed interface can be enabled through the "View > User Interface" menus.' -- source: https://news.slashdot.org/story/19/02/07/1737222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blender Wins Annie Award
by Lawrence D'Oliveiro 06 Feb '19

06 Feb '19

The “Annies” are the annual awards given out by the International Animated Film Society, aka ASIFA-Hollywood. As part of these, there is a special prize known as the Ub Iwerks award for technical advancement in the art of animation, named for the Disney animator who so famously brought Mickey Mouse to life, back in the day. This is only given out in any particular year when the judges feel that somebody deserves it. Well, the latest winner is none other than Blender, the open-source CG software. Past winners have included software, companies and people, but this appears to be the first time that a piece of Free software has been so honoured. <http://www.cgchannel.com/2018/12/blender-creator-ton-roosendaal-wins-annie-…> <https://www.blender.org/news/ton-roosendaal-and-blender-to-receive-asifa-ho…>

1 0

Old Computer Gear
by Andrew Crosby 06 Feb '19

06 Feb '19

Hi Guys I'm moving cities shortly and have a couple of decades of old computer and electronic gear to pass along. Mainly periferals and parts from AT/ATX era, Also have some old laptops getting up core2duo era, and not sure what else I'll find while I pack. Anyone around here interested in that sort of stuff. Cheers

2 4

Attackers Can Track Kids' Locations Via Connected Watches
by Peter Reutemann 31 Jan '19

31 Jan '19

'A gamut of kids' GPS-tracking watches are exposing sensitive data involving 35,000 children -- including their location, in real time. Researchers from Pen Test Partners specifically took a look at the Gator portfolio of watches from TechSixtyFour. The Gator line had been in the spotlight in 2017 for having a raft of vulnerabilities, called out by the Norwegian Consumers Council in its WatchOut research. "A year on, we decided to have a look at the Gator watch again to see how their security had improved," said Vangelis Stykas, in a Tuesday posting. "Guess what: a train wreck. Anyone could access the entire database, including real-time child location, name, parents' details etc. Not just Gator watches either -- the same back end covered multiple brands and tens of thousands of watches." "At issue was an easy-to-exploit, severe privilege-escalation vulnerability: The system failed to validate that the user had the appropriate permission to take admin control," reports Threatpost. "An attacker with access to the watch's credentials simply needed to change the user level parameter in the backend to an admin designation, which would provide access to all account information and all watch information." ' -- source: https://it.slashdot.org/story/19/01/30/2337239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Passing Around a Megaleak of 2.2 Billion Records
by Peter Reutemann 31 Jan '19

31 Jan '19

'When hackers breached companies like Dropbox and LinkedIn in recent years -- stealing 71 and 117 million passwords, respectively -- they at least had the decency to exploit those stolen credentials in secret, or sell them for thousands of dollars on the dark web. Now, it seems, someone has cobbled together those breached databases and many more into a gargantuan, unprecedented collection of 2.2 billion unique usernames and associated passwords, and is freely distributing them on hacker forums and torrents, throwing out the private data of a significant fraction of humanity like last year's phone book. Earlier this month, security researcher Troy Hunt identified the first tranche of that mega-dump, named Collection #1 by its anonymous creator, a set of cobbled-together breached databases Hunt said represented 773 million unique usernames and passwords. Now other researchers have obtained and analyzed an additional vast database called Collections #2-5, which amounts to 845 gigabytes of stolen data and 25 billion records in all. After accounting for duplicates, analysts at the Hasso Plattner Institute in Potsdam, Germany, found that the total haul represents close to three times the Collection #1 batch.' -- source: https://tech.slashdot.org/story/19/01/31/1452201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Security Flaw Impacts 5G, 4G, and 3G Telephony Protocols
by Peter Reutemann 31 Jan '19

31 Jan '19

'A new vulnerability has been discovered in the upcoming 5G cellular mobile communications protocol. Researchers have described this new flaw as more severe than any of the previous vulnerabilities that affected the 3G and 4G standards. From a report: Further, besides 5G, this new vulnerability also impacts the older 3G and 4G protocols, providing surveillance tech vendors with a new flaw they can abuse to create next-gen IMSI-catchers that work across all modern telephony protocols. This new vulnerability has been detailed in a research paper named "New Privacy Threat on 3G, 4G, and Upcoming5G AKA Protocols," published last year. According to researchers, the vulnerability impacts AKA, which stands for Authentication and Key Agreement, a protocol that provides authentication between a user's phone and the cellular networks. The AKA protocol works by negotiating and establishing keys for encrypting the communications between a phone and the cellular network.' -- source: https://it.slashdot.org/story/19/01/31/1913237 Yeah, don't think so that I'm gonna upgrade from my stone tablets any time soon... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Criminals Are Tapping Into the Phone Network Backbone to Empty Bank Accounts
by Peter Reutemann 31 Jan '19

31 Jan '19

'Sophisticated hackers have long exploited flaws in SS7, a protocol used by telecom companies to coordinate how they route texts and calls around the world. Those who exploit SS7 can potentially track phones across the other side of the planet, and intercept text messages and phone calls without hacking the phone itself. From a report: This activity was typically only within reach of intelligence agencies or surveillance contractors, but now Motherboard has confirmed that this capability is much more widely available in the hands of financially-driven cybercriminal groups, who are using it to empty bank accounts. So-called SS7 attacks against banks are, although still relatively rare, much more prevalent than previously reported. Motherboard has identified a specific bank -- the UK's Metro Bank -- that fell victim to such an attack. The news highlights the gaping holes in the world's telecommunications infrastructure that the telco industry has known about for years despite ongoing attacks from criminals. The National Cyber Security Centre (NCSC), the defensive arm of the UK's signals intelligence agency GCHQ, confirmed that SS7 is being used to intercept codes used for banking. "We are aware of a known telecommunications vulnerability being exploited to target bank accounts by intercepting SMS text messages used as 2-Factor Authentication (2FA)," The NCSC told Motherboard in a statement. "Some of our clients in the banking industry or other financial services; they see more and more SS7- based [requests],â Karsten Nohl, a researcher from Security Research Labs who has worked on SS7 for years, told Motherboard in a phone call. "All of a sudden you have someone's text messages."' -- source: https://tech.slashdot.org/story/19/01/31/1925241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Compute Module 3+ Launches for the Tiny Linux Computers from $25
by Peter Reutemann 30 Jan '19

30 Jan '19

'Raspberry Pi Compute Module 3+ follows on the footsteps of the Raspberry Pi Compute Module 3 (CM3) series announced in January 2017, offering owners of the tiny Linux computers a general-purpose, cost-efficient, and much simpler SBC (Single-board Computer), allowing them to slot it in and out of any device. It comes with 10x the ARM performance, 8x the Flash capacity, and 2x the RAM capacity of CM3. While Raspberry Pi Compute Module 3+ uses the same board as CM3, it brings improved thermal design, the Broadcom BCM2837B0 application processor from the Raspberry Pi 3 Model B+ single-board computer, but running at 1.2GHz instead of 1.4GHz, up to 32GB eMMC Flash memory, improved PCB thermal design to better support high loads without getting hot, and 1GB LPDDR2 SDRAM.' -- source: https://news.softpedia.com/news/raspberry-pi-compute-module-3-plus-launches… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Get started with eDEX-UI, a Tron-influenced terminal program for tablets and desktops
by Peter Reutemann 30 Jan '19

30 Jan '19

'eDEX-UI is a cross-platform terminal program designed for tablets and desktops that was inspired by the user interface in Tron. It has five terminals in a tabbed interface, so it is easy to switch between tasks, as well as useful displays of system information.' -- source: https://opensource.com/article/19/1/productivity-tool-edex-ui Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19.1: A sneaky popular distro skips upheaval, offers small upgrades
by Peter Reutemann 29 Jan '19

29 Jan '19

'While Ubuntu and Red Hat grabbed most of the Linux headlines last year, Linux Mint, once the darling of the tech press, had a relatively quiet year. Perhaps that's understandable with IBM buying Red Hat and Canonical moving back to the GNOME desktop. For the most part Linux Mint and its developers seemed to keep their heads down, working away while others enjoyed the limelight. Still, the Linux Mint team did churn out version 19, which brought the distro up to the Ubuntu 18.04 base. Mint 18.1 review: Forget about Wayland and get comfy with the command line While the new release may not have garnered mass attention, and probably isn't anyone's top pick for "the cloud," Linux Mint nevertheless remains the distro I see most frequently in the real world. When I watch a Linux tutorial or screen cast on YouTube, odds are I'll see the Linux Mint logo in the toolbar. When I see someone using Linux at the coffee shop, it usually turns out to be Linux Mint. When I ask fellow Linux users which distro they use, the main answers are Ubuntu... and Linux Mint. All of that is anecdotal, but it still points to a simple truth. For a distro that has seen little press lately, Linux Mint manages to remain popular with users. There's a good reason for that popularity: Linux Mint just works. It isn't "changing the desktop computer paradigm," or "innovating" in "groundbreaking" ways. The team behind Mint is just building a desktop operating system that looks and functions a lot like every other desktop operating system you've used, which is to say you'll be immediately comfortable and stop thinking about your desktop and start using it to do actual work. It's worth asking then, why switch from what I have now to Mint? Well, if you're happy with what you have now, stick with whatever it is. But if "it" happens to be Windows 10, well, hope you haven't tried to upgrade yet. Or if what you have now happens to be Ubuntu prior to 18.04 and you're dreading the upgrade to GNOME, suddenly Mint is worth a look. The project recently released version 19.1, which comes in three desktop flavors. There are two homegrown projects, Cinnamon (really Linux Mint's main desktop) and MATE, which started as a kind of Cinnamon light and has since become a very capable desktop in its own right. On top of those, there's also an XFCE version. Previously, there was also a KDE version of Linux Mint, but it was dropped last year because the KDE stack is different enough that all the bits that make Linux Mint, well, Minty, just didn't work with KDE. Diehard Mint and KDE fans can still get KDE working via a PPA, but it's not officially supported by Linux Mint.' -- source: https://arstechnica.com/gadgets/2019/01/linux-mint-19-1-a-sneaky-popular-di… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 66 blocks auto-playing sound by default
by Peter Reutemann 29 Jan '19

29 Jan '19

'Few things are more annoying when browsing the internet than media that plays automatically, particularly if it makes noise. Mozilla is hip to this, and beginning in version 66, its Firefox browser will block automatically-playing audio by default. Websites won't be able to play audio without user interaction. On desktop, a notification pops up asking whether you want the website to play media automatically, while on mobile, media will play silently until you interact with the player. The beta version of Firefox 66 for Android is hitting the Play Store today. The APK of the beta isn't available just yet, but you can grab a nightly version of Firefox 66 on APK Mirror. The stable release is expected to be available in March.' -- source: https://www.androidpolice.com/2019/01/29/firefox-66-blocks-auto-playing-sou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Project Manager Says Mozilla Should Get Down From Its 'Philosophical Ivory Tower, ' Cease Firefox Development
by Peter Reutemann 29 Jan '19

29 Jan '19

'A Microsoft program manager has caused a stir on Twitter over the weekend by suggesting that Firefox-maker Mozilla should give up on its own rendering engine and move on with Chromium. "Thought: It's time for @mozilla to get down from their philosophical ivory tower. The web is dominated by Chromium, if they really 'cared' about the web, they would be contributing instead of building a parallel universe that's used by less than five percent?" wrote Kenneth Auchenberg, who builds web developer tools for Microsoft's Visual Studio Code. Auchenberg's post referred to Mozilla's response to Microsoft's announcement in December that it would scrap Edge's EdgeHTML rendering engine for Chromium's. The move will leave Firefox's Gecko engine as the only alternative to Chromium, which is used by Opera and dozens of other browsers. Few people agreed with Auchenberg, including engineers from both Mozilla and Chromium. Long-serving Mozillian Asa Dotzler was not impressed. "Just because your employer gave up on its own people and technology doesn't mean that others should follow," Dotzler replied to Auchenberg. Auchenberg clarified that he didn't want to see Mozilla vanish, but said it should reorganize into a research institution "instead of trying to to justify themselves with the 'protectors of the web' narrative."' -- source: https://news.slashdot.org/story/19/01/29/0016211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 65 Arrives With Content Blocking Controls, and Support for WebP and AV1
by Peter Reutemann 29 Jan '19

29 Jan '19

'Firefox 65, the latest version of Mozilla's web browser, is now available for Windows, Mac, Linux, and Android platforms. The release brings simplified Content Blocking controls for Enhanced Tracking Protection, support for WebP image support with the Windows client getting an additional feature: support for AV1 format. From a report: Across all platforms, Firefox can now handle Google's WebP image format. WebP supports both lossy and lossless compression and promises the same image quality as existing formats at smaller file sizes. Firefox 65 for desktop brings redesigned controls for the Content Blocking section to let users choose their desired level of privacy protection. You can access it by either clicking on the small "i" icon in the address bar and clicking on the gear on the right side under Content Blocking or by going to Preferences, Privacy & Security, and then Content Blocking. Next, Firefox now supports AV1, the royalty-free video codec developed by the Alliance for Open Media. AV1 improves compression efficiency by more than 30 percent over the codec VP9, which it is meant to succeed. Lastly, Firefox's new Task Manager page (just navigate to about:performance or find it under "Other" in the main menu) is complete. Introduced in Firefox 64, Task Manager now reports memory usage for tabs and add-ons.' -- source: https://news.slashdot.org/story/19/01/29/1442237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Debian APT and PHP Pear Patches Highlight Vulnerability In Package Management Infrastructure?
by Peter Reutemann 27 Jan '19

27 Jan '19

'"Time and again, security experts and vendors alike will recommend to organizations and end users to keep software and systems updated with the latest patches," reports eWeek. "But what happens when the application infrastructure that is supposed to deliver those patches itself is at risk?" That's what open-source and Linux users were faced with this past week with a pair of projects reporting vulnerabilities. On January 22, the Debian Linux distribution reported a vulnerability in its APT package manager that is used by end users and organizations to get application updates. That disclosure was followed a day later, on January 23, with the PHP PEAR (PHP Extension and Application Repository) shutting down its primary website, warning that it was the victim of a data breach. PHP PEAR is a package manager that is included with many Linux distributions as part of the open-source PHP programming language binaries.... In the Debian APT case, a security researcher found a flaw, reported it, and the open-source project community responded rapidly, fixing the issue. With PHP PEAR issue, researchers with the Paranoids FIRE (Forensics, Incident Response and Engineering) Team reported that they discovered a tainted file on the primary PEAR website... Both PHP PEAR and Debian have issued updates fixing their respective issues. While both projects are undoubtably redoubling their efforts now with different security technologies and techniques, the simple fact is that the two issues highlight a risk with users trusting updating tools and package management systems. ' -- source: https://linux.slashdot.org/story/19/01/26/0350252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hope for Linux
by Ian Stewart 24 Jan '19

24 Jan '19

I am one of the volunteers that looks after the IT equipment at a community centre. The equipment includes 5 x PC's located in a room for the public to use. These PC's were originally donated with a single drive that has Windows 10. We add another drive which we make the Sata-0 drive, and move the cable for the Windows 10 drive so it is on the Sata-2 port. On the drive that we have added we install Ubuntu-Mate. By default, when the PC's power on, they boot up Ubuntu-Mate. Over the summer holidays the main users of these PC's are local children in the age range of 6 to 10 years old. I recently walked into the room which has the PC's and one of children recognised me as the IT repair man. The boy came over to me, and pointing at one of the PC's he said, "It's broken. It doesn't work." I looked across at the PC and saw that it was displaying a Windows 10 screen that appeared to be functioning OK, and noticed that there was nobody sitting using this computer. The other four PC's were running Ubuntu-Mate and children were busy using them. I said to the boy, "Yes it does look like its broken. I'll fix it." I proceeded to shutdown Windows 10, and found the Ubuntu-Mate drive had failed to the extent that it wasn't being recognised by the BIOS. I replaced the failed drive, installed Ubuntu-Mate from a USB stick, and told the boy it was fixed and he could use it again. I thought it was an encouraging sign that what these children perceive as a normal PC is one that is running Ubuntu-Mate and what they perceive as a broken PC is one that is running Windows 10. cheers, Ian

3 2

If you installed PEAR PHP in the last 6 months, you may be infected
by Peter Reutemann 24 Jan '19

24 Jan '19

'Officials with the widely used PHP Extension and Application Repository have temporarily shut down most of their website and are urging users to inspect their systems after discovering hackers replaced the main package manager with a malicious one. “If you have downloaded this go-pear.phar [package manager] in the past six months, you should get a new copy of the same release version from GitHub (pear/pearweb_phars) and compare file hashes,” officials wrote on the site’s blog. "If different, you may have the infected file.” The officials didn’t say when the hack of their Web server occurred or precisely what the malicious version of go-pear.phar did to infected systems. Initial indications, however, look serious. For starters, the advice applies to anyone who has downloaded the package manager in the past six months. That suggests the hack may have occurred in the timeframe of last July, and no one noticed either it or the tainted download until this week.' -- source: https://arstechnica.com/information-technology/2019/01/pear-php-site-breach… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Web Apps Can Turn Browser Extensions Into Backdoors
by Peter Reutemann 24 Jan '19

24 Jan '19

'"Threatpost has a link to some recent research about ways web pages can exploit browser extensions to steal information or write files," writes Slashdot reader jbmartin6. "Did we need another reason to be deeply suspicious of any browser extension? Not only do they spy on us for their makers, now other people can use them to spy on us as well. The academic paper is titled 'Empowering Web Applications with Browser Extensions' (PDF)." From the report: "An attacker [uses] a script that is present in a web application currently running in the user browser. The script either belongs to the web application or to a third party. The goal of the attacker is to interact with installed extensions, in order to access user sensitive information. It relies on extensions whose privileged capabilities can be exploited via an exchange of messages with scripts in the web application," researchers wrote. They added, "Even though content scripts, background pages and web applications run in separate execution contexts, they can establish communication channels to exchange messages with one another... APIs [are used] for sending and receiving (listening for) messages between the content scripts, background pages and web applications." The researcher behind the paper focused on a specific class of web extension called "WebExtensions API," a cross-browser extensions system compatible with major browsers including Chrome, Firefox, Opera and Microsoft Edge. After analyzing 78,315 extensions that used the specific WebExtension API, it found 3,996 that were suspicious. While it seems voluminous, they noted that research found a small number of vulnerable extensions overall, and that concern should be measured. However, "browser vendors need to review extensions more rigorously, in particular take into consideration the use of message passing interfaces in extensions."' -- source: https://it.slashdot.org/story/19/01/23/2256252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Free Software Evangelist Richard Stallman is Haunted by Stalin's Dream
by Peter Reutemann 23 Jan '19

23 Jan '19

'Richard Stallman recently visited Mandya, a small town about 60 miles from Bengaluru, India, to give a talk. On the sidelines, Indian news outlet FactorDaily caught up with Stallman for an interview. In the wide-ranging interview, Stallman talked about companies that spy on users, popular Android apps, media streaming and transportation apps, smart devices, DRM, software backdoors, subscription software, and Apple and censorship. An excerpt from the interview: If you are carrying a mobile phone, it is always tracking your movements and it could have been modified to listen to the conversations around you. I call this product Stalin's dream. What would Stalin have wanted to hand out to every inhabitant of the former Soviet Union? Something to track that person's movements and listen to the person's conservations. Fortunately, Stalin could not do it because the technology didn't exist. Unfortunately for us, now it does exist and most people have been pressured or lured into carrying around such a Stalin's dream device, but not me. I am suspicious of new digital technology. I expect it to have new malicious functionalities. It has happened so many times that I have learned to expect this, so I have always checked before I start using some new digital technology. I asked to find out what is nasty about it and I found out these two things. It was something like 20 years ago, and I decided it was my duty as a citizen to refuse, regardless of whatever convenience it might offer me. To surrender my freedom in this way was failing to defend a free society. This is why I do not have a portable phone. I refuse to carry a portable phone. I never have one and unless things change, I never will. I do use portable phones, lots of different ones. If I needed to call someone right now, I would ask one of you, "Could you please make a call for me?" If I am on a bus and it is late and I need to tell somebody that I am going to arrive late, there is always some other passenger in the bus who will make a call for me or send a text for me. Practically speaking, it is not that hard.' -- source: https://yro.slashdot.org/story/19/01/23/1759203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Proposes Changes To Chromium Browser That Will Break Content-Blocking Extensions, Including Various Ad Blockers
by Peter Reutemann 23 Jan '19

23 Jan '19

'"Google engineers have proposed changes to the open-source Chromium browser that will break content-blocking extensions, including various ad blockers," reports The Register. "The drafted changes will also limit the capabilities available to extension developers, ostensibly for the sake of speed and safety. Chromium forms the central core of Google Chrome, and, soon, Microsoft Edge." From the report: In a note posted Tuesday to the Chromium bug tracker, Raymond Hill, the developer behind uBlock Origin and uMatrix, said the changes contemplated by the Manifest v3 proposal will ruin his ad and content blocking extensions, and take control of content away from users. Manifest v3 refers to the specification for browser extension manifest files, which enumerate the resources and capabilities available to browser extensions. Google's stated rationale for making the proposed changes is to improve security, privacy and performance, and supposedly to enhance user control. But one way Google would like to achieve these goals involves replacing the webRequest API with a new one, declarativeNetRequest. The webRequest API allows extensions to intercept network requests, so they can be blocked, modified, or redirected. This can cause delays in web page loading because Chrome has to wait for the extension. In the future, webRequest will only be able to read network requests, not modify them. The declarativeNetRequest allows Chrome (rather than the extension itself) to decide how to handle network requests, thereby removing a possible source of bottlenecks and a potentially useful mechanism for changing browser behavior. The report notes that Adblock Plus "should still be available" since "Google and other internet advertising networks apparently pay Adblock Plus to whitelist their online adverts." ' -- source: https://tech.slashdot.org/story/19/01/23/0048202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 4.0 Released With Vulkan Support, Initial Direct3D 12 and Better HiDPI
by Peter Reutemann 23 Jan '19

23 Jan '19

'Michael Larabel writes via Phoronix: Wine 4.0 is now officially available as the new annual stable release to Wine for running Windows programs and games on Linux and other operating systems. Following seven weekly release candidates, Wine 4.0 was ready to ship today as judged by Wine founder Alexandre Julliard. Wine 4.0 is a big release bringing initial Vulkan graphics API support, Direct3D CSMT is enabled by default, early Direct3D 12 support via VKD3D, continued HiDPI work, various OpenGL improvements, multi-sample D3D texture support, 64-bit improvements, continued Android support, and much more.' -- source: https://linux.slashdot.org/story/19/01/23/0124236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 21 Jan '19

21 Jan '19

Hi everyone I'm using 2D animation as theme for next Monday's meeting: "Let's pool our resources and figure out/discover software that can be used for 2D animations. Open-source candidates could be GIMP (https://www.gimp.org/) and Synfig Studio (https://www.synfig.org/)" https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884244/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4