- wlug - list.wlug.org.nz

Node.js Event-Stream Hack Reveals Open Source 'Developer Infrastructure' Exploit
by Peter Reutemann 02 Dec '18

02 Dec '18

'"[O]n Nov. 26 it was publicly revealed that a widely deployed open-source Node.js programming language module known as event-stream had been injected with malicious code that looked to steal cryptocurrency wallets," reports eWeek, adding "The event-stream library has over two million downloads." An anonymous reader quotes Ars Technica: The backdoor came to light [November 20th] with this report from Github user Ayrton Sparling. Officials with the NPM, the open source project manager that hosted event-stream, didn't issue an advisory until six days later.... "This compromise was not targeting module developers in general or really even developers," an NPM official told Ars in an email. "It targeted a select few developers at a company, Copay, that had a very specific development environment set up. Even then, the payload itself didn't run on those developers' computers; rather, it would be packaged into a consumer-facing app when the developers built a release. The goal was to steal Bitcoin from this application's end users...." According to the Github discussion that exposed the backdoor, the longtime event-stream developer no longer had time to provide updates. So several months ago, he accepted the help of an unknown developer. The new developer took care to keep the backdoor from being discovered. Besides being gradually implemented in stages, it also narrowly targeted only the Copay wallet app. The malicious code was also hard to spot because the flatmap-stream module was encrypted. The attack is the latest to exploit weaknesses in a widely used supply chain to target downstream end users... The supply-chain attacks show one of the weaknesses of open source code. Because of its openness and the lack of funds of many of its hobbyist developers and users, open source code can be subject to malicious modifications that often escape notice. "The time has come," concludes Ars Technica, "for maintainers and users of open source software to devise new measures to better police the millions of packages being used all around us." Sophos' security blog also asks why so many developers "immediately and blindly trusted the new maintainer," and shared a concerned comment from developer named Chris Northwood.' -- source: https://it.slashdot.org/story/18/12/01/2217231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Australia Has Rushed Through Its Copyright Amendment Bill
by Lawrence D'Oliveiro 30 Nov '18

30 Nov '18

Seems like the Aussie government has disregarded <https://www.theregister.co.uk/2018/11/28/australia_to_build_a_pirateproof_f…> <https://www.techdirt.com/articles/20181127/13425541113/australian-parliamen…> most of the objections to its plan to impose more draconian copyright restrictions on Internet usage. Rightsholders will be able to get injunctions against sites whose “primary effect” (no longer just “primary purpose”) is to facilitate copyright infringement, and they will also have “adaptive injunctions”, meaning they can reinterpret an existing court order as circumstances change, instead of having to go back to court to get a new order. You’d think a statement like “The Government has zero tolerance for online piracy. It is theft...” should be an instant disqualification from making any kind of statement about copyright law...

1 0

Mass Router Hack Exposes Millions of Devices To Potent NSA Exploit
by Peter Reutemann 29 Nov '18

29 Nov '18

'More than 45,000 Internet routers have been compromised by a newly discovered campaign that's designed to open networks to attacks by EternalBlue, the potent exploit that was developed by, and then stolen from, the National Security Agency and leaked to the Internet at large, researchers say. From a report: The new attack exploits routers with vulnerable implementations of Universal Plug and Play to force connected devices to open ports 139 and 445, content delivery network Akamai said in a blog post. As a result, almost 2 million computers, phones, and other network devices connected to the routers are reachable to the Internet on those ports. While Internet scans don't reveal precisely what happens to the connected devices once they're exposed, Akamai said the ports --which are instrumental for the spread of EternalBlue and its Linux cousin EternalRed -- provide a strong hint of the attackers' intentions. The attacks are a new instance of a mass exploit the same researchers documented in April. They called it UPnProxy because it exploits Universal Plug and Play -- often abbreviated as UPnP -- to turn vulnerable routers into proxies that disguise the origins of spam, DDoSes, and botnets.' -- source: https://tech.slashdot.org/story/18/11/29/1849254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Proprietary Software Subverts Security Of Your PC
by Lawrence D'Oliveiro 28 Nov '18

28 Nov '18

Audio company Sennheiser has just issued a fix <https://arstechnica.com/information-technology/2018/11/sennheiser-discloses…> for a really nasty vulnerability where their software for Windows and Mac would install a special fake browser certificate that the machine would continue to trust thereafter, even after the software was removed. Unfortunately, because the installation also included the private key for that certificate (which is never supposed to be distributed), it could then be exploited by arbitrary third parties to trick such machines into trusting random sites.

1 0

Deleting Windows Server Child Folder Changes Parent Folder Permissions
by Lawrence D'Oliveiro 28 Nov '18

28 Nov '18

<https://www.theregister.co.uk/2018/11/28/microsoft_windows_10_server_2016_p…>: ... Microsoft's support team [said] initially that the behaviour was by design and introduced in Windows Server 2016. Interestingly, it only occurs when folders are deleted (or cut and pasted) using File Explorer. Using the command line makes things behave as one would expect. It also only occurred when using a local path. Deleting using a UNC path was fine.

1 0

Half of all Phishing Sites Now Have the Padlock
by Peter Reutemann 27 Nov '18

27 Nov '18

'You may have heard you should look for the padlock symbol at the top of a website before entering your password or credit card information into an online form. It's well-meaning advice, but new data shows it isn't enough to keep your sensitive information secure. From a report: Recent data from anti-phishing company PhishLabs shows that 49 percent of all phishing sites in the third quarter of 2018 bore the padlock security icon next to the phishing site domain name as displayed in a browser address bar. That's up from 25 percent just one year ago, and from 35 percent in the second quarter of 2018. This alarming shift is notable because a majority of Internet users have taken the age-old "look for the lock" advice to heart, and still associate the lock icon with legitimate sites. A PhishLabs survey conducted last year found more than 80% of respondents believed the green lock indicated a website was either legitimate and/or safe. In reality, the https:// part of the address (also called "Secure Sockets Layer" or SSL) merely signifies the data being transmitted back and forth between your browser and the site is encrypted and can't be read by third parties. The presence of the padlock does not mean the site is legitimate, nor is it any proof the site has been security-hardened against intrusion from hackers.' -- source: https://it.slashdot.org/story/18/11/27/1521240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 26 Nov '18

26 Nov '18

Hi everyone Just a friendly reminder that our AGM is next Monday: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ In order to be eligible to vote, "only those people who were paid members in the previous financial year and who have signed a membership form for the then-current financial year will be eligible to vote." (https://github.com/WLUG/charter/blob/master/rules_140120.pdf) See you next Monday! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Two Linux Kernels Revert Performance-Killing Spectre Patches
by Peter Reutemann 25 Nov '18

25 Nov '18

'Friday Greg Kroah-Hartman released stable point releases of Linux kernel 4.19.4, as well as 4.14.83 and 4.9.139. While they were basic maintenance updates, the 4.19.4 and 4.14.83 releases are significant because they also reverted the performance-killing Spectre patches (involving "Single Thread Indirect Branch Predictors", or STIBP) that had been back-ported from Linux 4.20, according to Phoronix: There is improved STIBP code on the way for Linux 4.20 that by default just applies STIBP to SECCOMP threads and processes requesting it via prctl() but otherwise is off by default (that behavior can also be changed via kernel parameters). Once that code is ready to go for Linux 4.20, we may see it then back-ported to these stable trees. Aside from reverting STIBP, these point releases just have various fixes in them as noted for 4.19.4, 4.14.83, and 4.9.139. Last Sunday Linus Torvalds complained that the performance impact of the STIPB code "was clearly way more expensive than people were told," according to ZDNet: "When performance goes down by 50 percent on some loads, people need to start asking themselves whether it was worth it. It's apparently better to just disable SMT entirely, which is what security-conscious people do anyway," wrote Torvalds. "So why do that STIBP slow-down by default when the people who *really* care already disabled SMT?"' -- source: https://linux.slashdot.org/story/18/11/24/2320228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Cybersecurity Group Touts Its New Open Source Private VPN
by Peter Reutemann 25 Nov '18

25 Nov '18

'Alphabet's cybersecurity division Jigsaw has designed a new open source private VPN aimed at journalists and the people sending them data. "Their work makes them more vulnerable to attack," said Santiago Andrigo, Jigsaw's product manager. "It can get really scary when they're outed and you're passing over information." Unscrupulous VPN providers can steal your identity, peek in on your data, inject their own ads on non-secure pages, or analyze your browsing habits and sell that information to advertisers, says one Jigsaw official. And you can't know for sure whether you can trust them, no matter what they say in the app store. "Journalists should be aware that their online activities might be subject to surveillance either by government agencies, their internet service providers or a hacker with malicious intent," said Laura Tich, technical evangelist for Code for Africa, a resource for African journalists. "As surveillance becomes ubiquitous in today's world, journalists face an increasing challenge in establishing secure communication in the digital space." The new private VPN, dubbed "Outline", is specifically designed to be resistant to censorship — because it's harder to detect as a VPN (and therefore is less likely to be blocked). Outline uses an encrypted socks5 proxy that looks like normal internet traffic. Once the user chooses a server location, Outline spins up a DigitalOcean server on Ubuntu, installs Docker, and imports an image of the actual server. It's been named Outline because in places where internet use may be restricted — it gives you a line out.' -- source: https://yro.slashdot.org/story/18/11/25/0117226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Gmail Bug Allows Sending Messages Anonymously
by Peter Reutemann 25 Nov '18

25 Nov '18

'Earlier this week software developer Tim Cotten discovered a serious glitch in Gmail. An anonymous reader quotes BleepingComputer: Tampering with the 'From:' header by replacing some text with an <object>, <script> or <img> tag causes the interface to show a blank space instead of the sender's address.... Opening the email does not help, either, as the sender's address continues to remain hidden and shows no info even when hovering on it, an action that typically reveals the details.... Trying to reply to the message is also of no help. Cotten attempted this thinking that Gmail would read the original email headers and determine the destination. "Wrong again! Gmail is at a complete loss at what to do!" Cotten writes in a blog post that details his new finding.... Using the Show Original option, which allows users with more experience to trace an email, the desired detail is still unavailable in the user-friendly view. Looking at the raw info, however, shows the source address buried at the end of the <img> tag Cotten used in his experiment. He didn't even have to spell correctly the data type to trigger the bug. Unfortunately, it is highly unlikely that the average Gmail user will be able to navigate to this area and determine who the apparently anonymous message is coming from. Due to this, for these users the risk of phishing is high. Cotten's bug report "relies on his previous discovery that proved how a malformed 'From:' header allows placing an arbitrary email address in the sender field," the article points out, also noting a third recently-reported Gmail bug that "allows fraudsters to create a 'mailto:' link that populates the destination field in the app with whatever address they want; the latter was reported about 19 months ago to Google and is still present in the Gmail app for Android." "According to the developer, one solution Google could implement to avoid forging the From field is to properly check the email headers and deny communication with an anomalous structure in the sender or recipient fields. Another method proposed by Cotten is Joran Greef's project Ronomon, which can trigger errors when email specifications are not followed." Threatpost reported Tuesday that Google "did not respond to a request for comment."' -- source: https://it.slashdot.org/story/18/11/25/1731238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Potentially disastrous Rowhammer bitflips can bypass ECC protections
by Peter Reutemann 22 Nov '18

22 Nov '18

'In early 2015, researchers unveiled Rowhammer, a cutting-edge hack that exploits unfixable physical weaknesses in the silicon of certain types of memory chips to transform data they stored. In the 42 months that have passed since then, an enhancement known as error-correcting code (or ECC) available in higher-end chips was believed to be an absolute defense against potentially disastrous bitflips that changed 0s to 1s and vice versa. Research published Wednesday has now shattered that assumption.' -- source: https://arstechnica.com/information-technology/2018/11/potentially-disastro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Have We Reached Peak Silicon Valley?
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121638…>: ... global smartphone sales saw their first year-on-year fall in history at the end of 2017. Apple seemed unaffected at the time, but its latest quarterly results now show falls in unit sales, as a result of which it will stop reporting them in future. >From beginnings that we might date to around the mid-1970s, PC sales (and development) went on an uninterrupted upward curve right through the 1990s, only starting to stutter around about the 2000s. The smartphone revolution, even if it includes the Symbian era and not just Android and Apple, has not lasted quite as long. So what new information-processing technology will ignite the mass market next? If any?

2 1

Germany Proposes Rules For Home Router Security
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

The federal German body responsible for information security has published some recommendations for how consumers’ internet routers should behave by default, including limiting the initially-enabled services, requiring firewall functionality, and mandating the deletion of all personal data on a factory reset <https://www.theregister.co.uk/2018/11/20/germany_versus_openwrt_ccc/>. This looks like a welcome first step, even if some argue it doesn’t go far enough.

1 0

Microsoft Azure Outage Fixed, Office 365 Still Broken
by Lawrence D'Oliveiro 20 Nov '18

20 Nov '18

They fixed Azure by turning the multi-factor authentication servers off and on again <https://www.theregister.co.uk/2018/11/19/microsoft_azure_office_outage_late…>. Lawrence “You Couldn’t Make This Up” D’Oliveiro

2 1

Microsoft Disputing Its NZ Tax Payments
by Lawrence D'Oliveiro 19 Nov '18

19 Nov '18

The IRD is demanding that Microsoft NZ pay more tax <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121627…>. This is over the whole notorious business of “transfer pricing”, where sales by multinational corporations are recorded in jurisdictions where they attract less tax, rather than where the customers are located. Looks like there have already been some changes to this, though obviously the dispute would be over whether those changes are enough: From February 2018, the local unit's accounts were extended to include the distribution of computer software and hardware, having previously covered marketing. The change effectively means local product sales are being captured. Concomitant with this: The changes to Microsoft's revenue recognition also seem to route GST through the local unit, with GST payments of $8.1 million in the year ended June 30, compared to just $13,441 a year earlier. Man, that’s quite a jump. All of Microsoft’s NZ customers incurring just $13,441 in GST over an entire year ...

1 0

A little collection of cool unix terminal/console/curses tools
by Peter Reutemann 19 Nov '18

19 Nov '18

'Kristof Kovacs: Just a list of 20 (now 28) tools for the command line. Some are little-known, some are just too useful to miss, some are pure obscure -- I hope you find something useful that you weren't aware of yet! Use your operating system's package manager to install most of them. (Thanks for the tips, everybody!) ' -- source: https://kkovacs.eu/cool-but-obscure-unix-tools Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mark Shuttleworth Reveals Ubuntu 18.04 Will Get a 10-Year Support Lifespan
by Peter Reutemann 18 Nov '18

18 Nov '18

'At the OpenStack Summit in Berlin last week, Ubuntu Linux founder Mark Shuttleworth said in a keynote that Ubuntu 18.04 Long Term Support (LTS) support lifespan would be extended from five years to 10 years. "I'm delighted to announce that Ubuntu 18.04 will be supported for a full 10 years," said Shuttleworth, "In part because of the very long time horizons in some of industries like financial services and telecommunications but also from IoT where manufacturing lines for example are being deployed that will be in production for at least a decade." ZDNet reports: Ubuntu 18.04 released in April 2018. While the Ubuntu desktop gets most of the ink, most of Canonical's dollars comes from server and cloud customers. It's for these corporate users Canonical first extended Ubuntu 12.04 security support, then Ubuntu 14.04's support, and now, preemptively, Ubuntu 18.04. In an interview after the keynote, Shuttleworth said Ubuntu 16.04, which is scheduled to reach its end of life in April 2021, will also be given a longer support life span. When it comes to OpenStack, Shuttleworth promised again to support versions of OpenStack dating back to 2014's IceHouse. Shuttleworth said, "What matters isn't day two, what matters is day 1,500." He also doubled-down on Canonical's promise to easily enable OpenStack customers to migrate from one version of OpenStack to another. Generally speaking, upgrading from one version of OpenStack is like a root canal: Long and painful but necessary. With Canonical OpenStack, you can step up all the way from the oldest supported version to the newest one with no more than a second of downtime. ' -- source: https://news.slashdot.org/story/18/11/17/1748205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Uber Joins Linux Foundation Cementing Commitment To Open Source Tools
by Peter Reutemann 15 Nov '18

15 Nov '18

'At the 2018 Uber Open Summit, Uber announced it was joining the Linux Foundation as a Gold Member, making a firm commitment to using and contributing to open source tools. TechCrunch reports: Uber CTO Thuan Pham sees the Linux Foundation as a place for companies like his to nurture and develop open source projects. "Open source technology is the backbone of many of Uber's core services and as we continue to mature, these solutions will become ever more important," he said in a blog post announcing the partnership. "Uber has made significant investments in shared software development and community collaboration through open source over the years, including contributing the popular open source project Jaeger, a distributed tracing system, to the Linux Foundation's Cloud Native Computing Foundation in 2017," an Uber spokesperson told TechCrunch. As the report mentions, it took the ride-hailing service a long time for them to join the Linux Foundation. "Uber has been long known for making use of open source in its core tools working on over 320 open source projects and repositories from 1500 contributors involving over 70,000 commits, according to data provided by the company," reports TechCrunch.' -- source: https://linux.slashdot.org/story/18/11/15/226212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's 'Privacy Not Included' Gift Report Highlights Security Concerns
by Peter Reutemann 15 Nov '18

15 Nov '18

'Mozilla has released its second annual "Privacy Not Included" guide that rates 70 products to help give you an idea as to how secure or insecure they are. "We want to provide people information about how to make informed decisions when shopping for gifts that are connected to the internet," says Ashley Boyd, vice president of advocacy at Mozilla. "These products are becoming really popular. And in some cases, it's easy to forget that they're even connected to the internet." Wired reports: Among the important signifiers of a trustworthy stocking stuffer, according to Mozilla's rubric: the use of encryption, pushing automatic software security updates, strong password hygiene, a way to deal with vulnerabilities should they arise, and a privacy policy that doesn't take a PhD to parse. The most surprising result of Mozilla's testing may be how many products actually earned its seal of approval. Thirty-three of the 70 items in the "Privacy Not Included" guide passed muster; fans of the Nintendo Switch, Google Home, and Harry Potter Kano Coding Kit can sleep a little easier. On the other end of the scale, Mozilla highlighted seven products that may not hit the mark -- yes, including the sous vide wand, the Anova Precision Cooker. Also scoring low marks in Mozilla's accounting: the DJI Spark Selfie Drone (no encryption, does not require users to change the default password), the Parrot Bebop 2 drone (no encryption, complex privacy policy), and unsurprisingly, at least one baby monitor. The remaining 30 items on the list all exist somewhere in the murky middle, usually because Mozilla was unable to confirm at least one attribute. Which may be the real takeaway from the report: Typically, you have no reasonable way to find out if a given internet-connected device is secure. "If you can't tell, that says that there's a problem of communication between manufacturers and consumers," says Boyd. "We would love for makers of these products to be more clear and more transparent about what they're doing and not doing. That's a big place we think change is needed." ' -- source: https://tech.slashdot.org/story/18/11/15/0042210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A New Raspberry Pi 3 Model A+ Has Arrived With Bluetooth 4.2 and Dual-Band Wi-Fi For $25
by Peter Reutemann 15 Nov '18

15 Nov '18

'Raspberry Pi has introduced a new version of one of its most popular models just in time to stuff your stocking: the Model A+. And this time around, it's even more attractive. From a report: The Raspberry Pi 3 Model A+ costs $25, $5 more than the previous generation, but has a lot more going for it. Just like the top-of-the-line Model B+, the new Model A+ has a 1.4GHz 64-bit quad-core processor, and you'll also get dual-band Wi-Fi (2.4GHz + 5 GHz), a feature that was missing from the previous A+. And you'll have to use it, since the A+ doesn't have an Ethernet port. It does, however, have Bluetooth 4.2 on board. For $10 less than the $35 Model B+, you'll also only get a single USB port (versus four on the B+) as well as 512MB of RAM (versus 1GB on the B+). But otherwise, the devices are identical, with a full-size HDMI port, CSI camera port, DSI display port, stereo output and composite video port, and a micro SD port. The Raspberry Pi 3 Model A+ isn't the cheapest Pi model available -- the Zero costs $5 and the Zero W costs just $10 -- but it rounds out the options nicely. The new model is available now through Raspberry Pi retailers.' -- source: https://hardware.slashdot.org/story/18/11/15/1846205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM
by Peter Reutemann 15 Nov '18

15 Nov '18

Hi everyone For those who weren't at the meeting last night or aren't on meetup.com, the WLUG AGM is next month: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ProtonVPN Passes 1 Million Users and Launches on iOS
by Peter Reutemann 14 Nov '18

14 Nov '18

'Encrypted email service provider ProtonMail has launched its standalone VPN app for iOS devices. From a report: The announcement comes more than a year after ProtonVPN launched globally for desktop users and 10 months after it landed on Android, so the iOS launch has been a long time coming. There is, of course, no shortage of VPN apps out there already, but ProtonMail has built a solid reputation in the encrypted communications realm since it was founded out of CERN in 2013. Following the launch of its privacy-focused email service nearly three years ago, the company subsequently added two-factor authentication (2FA), Tor support, an encrypted contacts manager, and of course a VPN service. ProtonMail offers various pricing tiers for ProtonVPN, ranging from free to $24 per month. Those who choose not to pay can access three countries' servers, with access on one device, but will have slower speeds, while the top $24/month tier offers access on 10 devices with server access in all available countries. In related news, ProtonMail said that ProtonVPN now has 1 million users globally.' -- source: https://yro.slashdot.org/story/18/11/14/1646222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discover Seven New Meltdown and Spectre Attacks
by Peter Reutemann 14 Nov '18

14 Nov '18

'A team of nine academics has revealed today seven new CPU attacks. The seven impact AMD, ARM, and Intel CPUs to various degrees. From a report: Two of the seven new attacks are variations of the Meltdown attack, while the other five are variations on the original Spectre attack -- two well-known attacks that have been revealed at the start of the year and found to impact CPUs models going back to 1995. Researchers say they've discovered the seven new CPU attacks while performing "a sound and extensible systematization of transient execution attacks" -- a catch-all term the research team used to describe attacks on the various internal mechanisms that a CPU uses to process data, such as the speculative execution process, the CPU's internal caches, and other internal execution stages. The research team says they've successfully demonstrated all seven attacks with proof-of-concept code. Experiments to confirm six other Meltdown-attacks did not succeed, according to a graph published by researchers.' -- source: https://it.slashdot.org/story/18/11/14/181225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

USB Hardware Firewall
by Lawrence D'Oliveiro 14 Nov '18

14 Nov '18

You may know that it is possible for USB devices to be created that do malicious things to your PC by committing deceptions right at the USB protocol level. This kind of thing cannot be defeated by antivirus software or erased by, for example, reformatting a USB stick. For example, a device that is labelled as a USB storage stick could actually identify to the PC as two devices, one the actual storage device and the other a keyboard, that feeds malicious keystrokes at carefully-chosen times. Alternatively, it can detect when the PC is booting, and activate a separate partition containing a virus, which is otherwise invisible to antivirus software, at only that point. More details about such possibilities are available here <https://opensource.srlabs.de/projects/badusb>. Here <https://github.com/robertfisk/USG/wiki> is an interesting project to create a hardware device that will act as a “firewall” for untrusted USB devices, to prevent malicious protocol exchanges from occurring between them and your PC. If you don’t want to build your own, there’s a link in the readme to buy NZ-made ones.

1 0

World’s Top Three Most Powerful Supercomputers Are Non-Intel
by Lawrence D'Oliveiro 13 Nov '18

13 Nov '18

Machines based on IBM’s Power9 architecture have taken the top two spots in the list of the world’s most powerful (publicly-known) supercomputers <https://www.theregister.co.uk/2018/11/13/500_supercomputers_list/>. China’s Sunway TaihuLight machine, which is based on some derivative of MIPS, is in third place, with another Chinese machine, the highest-ranking Intel-based one, coming next. There is also the first ARM-based beastie, built by HP Enterprises, appearing on the list, at number 203.

1 0