- wlug - list.wlug.org.nz

Ubuntu 17.10 Artful Aardvark Released
by Peter Reutemann 19 Oct '17

19 Oct '17

'Canonical has made available the download links for Ubuntu 17.10 "Artful Aardvark". It comes with a range of new features, changes, and improvements including GNOME as the default desktop, Wayland display server by default, Optional X.org server session, Mesa 17.2 or Mesa 17.3, Linux kernel 4.13 or kernel 4.14, new Subiquity server installer, improved hardware support, new Ubuntu Server installer, switch to libinput, an always visible dock using Dash to Dock GNOME Shell extension, and Bluetooth improvements with a new BlueZ among others. ' -- source: https://news.slashdot.org/story/17/10/19/0943200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung To Let Proper Linux Distros Run on Galaxy Smartphones
by Peter Reutemann 19 Oct '17

19 Oct '17

'Samsung has announced it will soon become possible to run actual proper Linux on its Note8, Galaxy S8 and S8+ smartphones -- and even Linux desktops. Yeah, yeah, we know Android is built on Linux, but you know what we mean. Samsung said it's working on an app called "Linux on Galaxy" that will let users "run their preferred Linux distribution on their smartphones utilizing the same Linux kernel that powers the Android OS." "Whenever they need to use a function that is not available on the smartphone OS, users can simply switch to the app and run any program they need to in a Linux OS environment," Samsung says. The app also allows multiple OSes to run on a device. Linux desktops will become available if users plug their phones into the DeX Station, the device that lets a Galaxy 8 run a Samsung-created desktop-like environment when connected to the DeX and an external monitor.' -- source: https://linux.slashdot.org/story/17/10/19/0524234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EU: No Encryption Backdoors But, Let's Help Each Other Crack That Crypto
by Peter Reutemann 19 Oct '17

19 Oct '17

'The European Commission has proposed that member states help each other break into encrypted devices by sharing expertise around the bloc. From a report: In an attempt to tackle the rise of citizens using encryption and its effects on solving crimes, the commission decided to sidestep the well-worn, and well-ridiculed, path of demanding decryption backdoors in the stuff we all use. Instead, the plans set out in its antiterrorism measures on Wednesday take a more collegiate approach -- by offering member states more support when they actually get their hands on an encrypted device. "The commission's position is very clear -- we are not in favour of so-called backdoors, the utilisation of systemic vulnerabilities, because it weakens the overall security of our cyberspace, which we rely upon," security commissioner Julian King told a press briefing. "We're trying to move beyond a sometimes sterile debate between backdoors or no backdoors, and address some of the concrete law enforcement challenges. For instance, when [a member state] gets a device, how do they get information that might be encrypted on the device." [...] Share the wealth. "Some member states are more equipped technically to do that [extract information from a seized device] than others," King said. "We want to make sure no member state is at a disadvantage, by sharing the tech expertise among the member states and reinforcing the support that Europol can offer."' -- source: https://yro.slashdot.org/story/17/10/19/1440200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Engineers Explore Ways To Stop In-Browser Cryptocurrency Miners in Chrome
by Peter Reutemann 19 Oct '17

19 Oct '17

'Google Chrome engineers are considering adding a special browser permission that will thwart the rising trend of in-browser cryptocurrency miners. Discussions on the topic of in-browser miners have been going on the Chromium project's bug tracker since mid-September when Coinhive, the first such service, launched. "Here's my current thinking," Ojan Vafai, a Chrome engineering working on the Chromium project, wrote in one of the recent bug reports. "If a site is using more than XX% CPU for more than YY seconds, then we put the page into 'battery saver mode' where we aggressively throttle tasks and show a toast [notification popup] allowing the user to opt-out of battery saver mode. When a battery saver mode tab is backgrounded, we stop running tasks entirely. I think we'll want measurement to figure out what values to use for XX and YY, but we can start with really egregious things like 100% and 60 seconds. I'm effectively suggesting we add a permission here, but it would have unusual triggering conditions [...]. It only triggers when the page is doing a likely bad thing." An earlier suggestion had Google create a blacklist and block the mining code at the browser level. That suggestion was shut down as being too impractical and something better left to extensions.' -- source: https://tech.slashdot.org/story/17/10/19/1618222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Targeted Fuzzing Is Improving Linux Security, Linus Torvalds Says
by Peter Reutemann 19 Oct '17

19 Oct '17

'On the sidelines of announcing the fifth release candidate for the Linux kernel version 4.14, Linus Torvalds said fuzzing, which involves stress testing a system by generating random code to induce errors, is helping the community find and fix a range of security vulnerabilities. He wrote: The other thing perhaps worth mentioning is how much random fuzzing people are doing, and it's finding things. We've always done fuzzing (who remembers the old "crashme" program that just generated random code and jumped to it? We used to do that quite actively very early on), but people have been doing some nice targeted fuzzing of driver subsystems etc, and there's been various fixes (not just this last week either) coming out of those efforts. Very nice to see.' -- source: https://linux.slashdot.org/story/17/10/19/171206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IoT Cybersecurity: What’s Plan B?
by Lawrence D'Oliveiro 19 Oct '17

19 Oct '17

Whither the Internet Of Things? Markets, as we've repeatedly learned over the past century, are terrible mechanisms for improving the safety of products and services. It was true for automobile, food, restaurant, airplane, fire, and financial-instrument safety. The reasons are complicated, but basically, sellers don't compete on safety features because buyers can't efficiently differentiate products based on safety considerations. The race-to-the-bottom mechanism that markets use to minimize prices also minimizes quality. Without government intervention, the IoT remains dangerously insecure. The US government has no appetite for intervention, so we won't see serious safety and security regulations, a new federal agency, or better liability laws. We might have a better chance in the EU. Depending on how the General Data Protection Regulation on data privacy pans out, the EU might pass a similar security law in 5 years. No other country has a large enough market share to make a difference. <https://www.schneier.com/blog/archives/2017/10/iot_cybersecuri.html>

1 0

GPL Abuse In The Linux Kernel
by Lawrence D'Oliveiro 18 Oct '17

18 Oct '17

The questionable legal activities of a former Linux kernel developer <http://www.theregister.co.uk/2017/10/18/linux_kernel_community_enforcement_…> have driven a bunch of senior kernel figures to issue a “Community Enforcement Statement” to try to put a stop to this sort of thing in the future. What’s interesting about this is their admission that the GPL 2.0 has “ambiguities … that no one in our community has ever considered part of compliance”. And to fix it, their Statement “adopts the same termination provisions we are all familiar with from GPL-3.0 as an Additional Permission giving companies confidence that they will have time to come into compliance if a failure is identified”. Do you remember back when GPL 3.0 came out, and Linus Torvalds and other senior kernel figures issued a statement claiming that they were quite happy with GPL 2.0, they had no intention of moving to GPL 3.0, which he quite publicly loathed? Seems like now they are slowly coming to a realization of the reasons why GPL 3.0 was created in the first place...

1 0

Ah, The Joys Of Debian Unstable ...
by Lawrence D'Oliveiro 17 Oct '17

17 Oct '17

Did my (roughly) monthly system upgrades over the last couple of days. Debian has changed the default Python version for the “python3” command to 3.6. (And Blender now requires that version for building as well.) Didn’t notice anything broken until today, when I tried to print something on my HP inkjet. Turns out the various HP/CUPS-related packages with version number 3.17 want the system default Python to be 3.5, not 3.6. In situations like these, the first thing I have learned to try is to manually download older versions of packages from <http://ftp.debian.org/debian/> and install them with “dpkg -i”. For reference, these are the packages I downgraded: dpkg -i hplip-data_3.16.11+repack0-3_all.deb dpkg -i libhpmud0_3.16.11+repack0-3_amd64.deb dpkg -i libsane-hpaio_3.16.11+repack0-3_amd64.deb dpkg -i printer-driver-hpcups_3.16.11+repack0-3_amd64.deb dpkg -i hplip_3.16.11+repack0-3_amd64.deb And it worked. My printer now prints again. Presumably this will be sorted out in time for my next upgrade ...

1 3

Unlikely Things Running Linux
by Lawrence D'Oliveiro 16 Oct '17

16 Oct '17

>From the International Space Station and Large Hadron Collider, through self-driving cars, an electric motorbike and a solar-powered surfboard, down to a milking machine, Computer Engineer Barbie and a crockpot, Brian Lunduke presents a quick tour of just some of the unlikely places you will find a computer running Linux <https://www.youtube.com/watch?v=xPbAXKMCDkY>. Complete with a sting in the tail for those who uncritically subscribe to the old “do one thing and do it well” misconception...

1 0

meeting suggestions?
by Peter Reutemann 16 Oct '17

16 Oct '17

Hi everyone Since we had no volunteers for demoing "Sogo Groupware Server" (Roger?), does anybody else have a topic for next Monday's meeting? Ubuntu 17.10 should be out then... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

qTox – An Open Source P2P Instant Messaging and VoIP App
by Peter Reutemann 16 Oct '17

16 Oct '17

'As you probably already know, GNU/Linux has no shortage of VoIP apps. We’ve written on Wire and Discord. And we even compiled a list of The 10 Best Instant Messaging Apps for Linux. Today, we’ve got a new app to add to our list of instant messaging apps and it goes by the name of qTox. qTox is a free and open source p2p instant messaging, audio and video calls app and is (apparently) the most feature-rich Tox client. As a powerful Tox client, it follows Tox’s design guidelines while maintaining a uniform UI/UX across all the major platforms. It is built with privacy as its paramount goal and the team has even made a public statement that user safety is their priority and nothing in the world can change that.' -- source: https://www.fossmint.com/qtox-an-open-source-p2p-instant-messaging-and-voip… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Subsystem for Linux graduates in Windows 10 Fall Creators Update
by Peter Reutemann 16 Oct '17

16 Oct '17

'Interested in running Linux on Windows 10 with Windows Subsystem for Linux (WSL), but nervous about it being both a beta and only available in Windows 10 developer mode? Your worries are over. In the Windows 10 Fall Creators Update (WinFCU) WSL has graduated to being a Windows 10 feature that can be run by any user. Tested for over a year, WSL on WinFCU is bringing many new features to this combination of the Linux Bash shell and Windows. Besides WSL no longer being a beta or requiring users to be in developer mode, the new features include: Install Linux distros via the Windows Store - WSL now runs multiple Linux distros - WSL comes to Windows Server & Microsoft Azure VMs - WSL now supports USB/serial comms - Miscellaneous fixes and improvements Besides Ubuntu, the new WSL-supported Linux distros are SUSE's community openSUSE and its corporate SUSE Linux Enterprise Server (SLES). Fedora and other distros will arrive in the store shortly.' -- source: http://www.zdnet.com/article/windows-subsystem-for-linux-graduates-in-windo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Munich Plans New Vote on Dumping Linux For Windows 10
by Peter Reutemann 16 Oct '17

16 Oct '17

'The city of Munich has suggested it will cost too much to carry on using Linux alongside Windows, despite having spent millions of euros switching PCs to open-source software... "Today, with a Linux client-centric environment, we are often confronted with major difficulties and additional costs when it comes to acquiring and operating professional application software," the city council told the German Federation of Taxpayers. Running Linux will ultimately prove unsustainable, suggests the council, due to the need to also keep a minority of Windows machines to run line-of-business software incompatible with Linux. "In the long term, this situation means that the operation of the non-uniform client landscape can no longer be made cost-efficient"... Since completing the multi-year move to LiMux, a custom-version of the Linux-based OS Ubuntu, the city always kept a smaller number of Windows machines to run incompatible software. As of last year it had about 4,163 Windows-based PCs, compared to about 20,000 Linux-based PCs. The assessment is at odds with a wide-ranging review of the city's IT systems by Accenture last year, which found that most of the problems stem not from the use of open-source software, but from inefficiencies in how Munich co-ordinates the efforts of IT teams scattered throughout different departments. Dr. Florian Roth, leader of the Green Party at Munich City Council, said the review had also not recommended a wholesale shift to Windows. "The Accenture report suggested to run both systems because the complete 'rollback' to Windows and MS Office would mean a waste of experience, technology, work and money," he said... The city's administration is investigating how long it would take and how much it would cost to build a Windows 10 client for use by the city's employees. Once this work is complete, the council will vote again in November on whether this Windows client should replace LiMux across the authority from 2021. A taxpayer's federation post urged "Penguin, adieu!" -- while also admitting that returning to Windows "will devour further tax money in the millions," according to TechRepublic. "The federation's post also makes no mention of the licensing and other savings achieved by switching to LiMux, estimated to stand at about €10m."' -- source: https://linux.slashdot.org/story/17/10/15/2344244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Has Already Fixed the Wi-Fi Attack Vulnerability; Android Will Be Patched Within Weeks
by Peter Reutemann 16 Oct '17

16 Oct '17

'Microsoft says it has already fixed the problem for customers running supported versions of Windows. From a report: "We have released a security update to address this issue," says a Microsoft spokesperson in a statement to The Verge. "Customers who apply the update, or have automatic updates enabled, will be protected. We continue to encourage customers to turn on automatic updates to help ensure they are protected." Microsoft is planning to publish details of the update later today. While it looks like Android and Linux devices are affected by the worst part of the vulnerabilities, allowing attackers to manipulate websites, Google has promised a fix for affected devices "in the coming weeks." Google's own Pixel devices will be the first to receive fixes with security patch level of November 6, 2017, but most other handsets are still well behind even the latest updates. Security researchers claim 41 percent of Android devices are vulnerable to an "exceptionally devastating" variant of the Wi-Fi attack that involves manipulating traffic, and it will take time to patch older devices.' -- source: https://mobile.slashdot.org/story/17/10/16/166220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of High-Security Crypto Keys Crippled by Newly Discovered Flaw
by Peter Reutemann 16 Oct '17

16 Oct '17

'Slovak and Czech researchers have found a vulnerability that leaves government and corporate encryption cards vulnerable to hackers to impersonate key owners, inject malicious code into digitally signed software, and decrypt sensitive data, reports ArsTechnica. From the report: The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it's located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest. The flaw is the one Estonia's government obliquely referred to last month when it warned that 750,000 digital IDs issued since 2014 were vulnerable to attack. Estonian officials said they were closing the ID card public key database to prevent abuse. On Monday, officials posted this update. Last week, Microsoft, Google, and Infineon all warned how the weakness can impair the protections built into TPM products that ironically enough are designed to give an additional measure of security to high-targeted individuals and organizations.' -- source: https://it.slashdot.org/story/17/10/16/1736252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nobel Prize Winner Argues Tech Companies Should Be Changing The World
by Peter Reutemann 16 Oct '17

16 Oct '17

'Tech companies are competing to serve the wealthy, argues the winner of the 2006 Nobel Peace Prize, complaining there's no "global vision," with big innovations instead "designed and dedicated mostly for commercial successes... while trillions of dollars are invested in developing robotics and artificial intelligence for military and commercial purposes, there is little interest in applying technology to overcome the massive human problems of the world." A genius in the tech industry "can dedicate his work to creating a medical breakthrough that will save thousands of lives -- or he can develop an app that will let people amuse themselves." As an exception, he cites the low-cost Endless computer, which runs Linux and has 50,000 Wikipedia articles pre-installed to enable offline research -- plus more than 100 applications -- for a price of just $79. "One part of Endless's business is operated like a conventional, profit-seeking company, while the other part is a social business that provides underserved populations with educational, health, and creative services they were once denied. Endless is already being shipped around the globe by four of the five largest computer manufacturers. It has become the leading PC platform in Indonesia and much of Southeast Asia. It has also been selected as the standard operating system for the Brazilian Ministry of Education, and in coming months it will be adopted as the primary platform by a number of other Latin American countries." The article is by Muhammad Yunus, who pioneered the concepts of microcredit and microfinance, and is taken from his new book, A World of Three Zeros: The New Economics of Zero Poverty, Zero Unemployment, and Zero Net Carbon Emission' -- source: https://news.slashdot.org/story/17/10/15/1739212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Olimex ships $284 open source Linux laptop kit
by Peter Reutemann 15 Oct '17

15 Oct '17

'Olimex is shipping its open source, Alwinner A64 based Teres-A64 laptop kit, with an 11.6-in LCD, 2GB RAM, 16GB eMMC, 9500mAh battery, and an Ubuntu Mate OS. Back in February, Bulgaria-based Olimex, which is known for its open spec OLinuXino SBCs like the Allwinner A64 based A64-OLinuXino, announced an open source laptop kit based on the same quad-core, Cortex-A53 SoC called the Teres-1. The Ubuntu Mate-supported laptop kit took longer than expected, but it’s finally here as the Teres-A64, selling for 240 Euros ($284) instead of 225 Euros.' -- source: http://linuxgizmos.com/olimex-ships-open-source-linux-laptop-and-tips-new-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu 17.10 (Artful Aardvark) Is Now in Final Freeze, Launches October 19
by Peter Reutemann 15 Oct '17

15 Oct '17

'Work on Ubuntu 17.10 begun six months ago, on April 20, when the toolchain was uploaded to the repository, with the main goal of replacing our beloved Unity user interface with the latest GNOME 3 desktop environment. Two Alpha and Beta milestones later, Ubuntu 17.10 is now officially in Final Freeze stage. "As of now, artful has entered the Final Freeze period in preparation for the final release of Ubuntu 17.10 next week," said Adam Conrad, Software Engineer at Canonical, in a mailing list announcement. "The current uploads in the queue will be reviewed and either accepted or rejected as appropriate by pre-freeze standards." Of course, this means that developers won't be able to update any of the packages they maintain, except for those that fix critical bugs affecting the ISO images or the installer. Patches for 0-day security vulnerabilities are also welcome during the Final Freeze stage, which will last until next week, on October 19, 2017.' -- source: http://news.softpedia.com/news/ubuntu-17-10-artful-aardvark-is-now-in-final… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Switch to Xorg from Wayland in Ubuntu 17.10 [Quick Tip]
by Peter Reutemann 15 Oct '17

15 Oct '17

"One of the main new features in Ubuntu 17.10 is the addition of Wayland as the default display server. As more and more Linux distributions are moving away from the legacy X.Org server and Wayland seems to be the top alternative. While Wayland maybe the future, it really is in future. At least for Ubuntu 17.10. The issue here is that a number of Linux desktop applications still depend on X.Org. They don’t support Wayland very well." -- source: https://itsfoss.com/switch-xorg-wayland/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Android ransomware "DoubleLocker"
by Eric Light 15 Oct '17

15 Oct '17

Anyone out there still trust Adobe Flash Player? "DoubleLocker can change the device’s PIN, preventing victims from accessing their devices, and also encrypts the data it finds in them – a combination that has not been seen previously in the Android ecosystem. [...] It is distributed mostly as a fake Adobe Flash Player through compromised websites. First, it changes the device’s PIN, effectively blocking the victim from using it. The new PIN is set to a random value which the attackes neither store nor send anywhere, so it’s impossible for the user or a security expert to recover it. After the ransom is paid, the attacker can remotely reset the PIN and unlock the device. Second, DoubleLocker encrypts all files from the device’s primary storage directory. It utilizes the AES encryption algorithm, appending the extension “.cryeye”. “The encryption is implemented properly, which means that, unfortunately, there is no way to recover the files without receiving the encryption key from the attackers,” says Štefanko. https://www.welivesecurity.com/2017/10/13/doublelocker-innovative-android-m… -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

1 0

SUSE Shares Linux-Themed Music Video Parodies
by Peter Reutemann 15 Oct '17

15 Oct '17

'German Linux company SUSE Linux is well-known for its Linux and other open source solutions. It is also known for producing videos for geeks and debuting them at its annual SUSECon conference. This year, in Prague, was no different. The company, which marked its 25th year on 2 September, came up with two videos, one to mark the occasion and the other all about Linux and open source. Both videos are parodies of well-known songs: the video Linus Said is based on "Momma Said", while 25 Years is a parody of "7 Years". Some of the lyrics in both SUSE videos would be meaningless to the average person -- but every word will ring a bell, sometimes a very poignant one, with geeks. And that's the primary audience it targets. The article embeds both videos -- and also links to the music videos they're parodying. And it includes links to SUSE's two previous annual music video parodies -- Uptime Funk (based on Bruno Mars' blockbuster hit "Uptown Funk"), and Can't Stop the SUSE, a parody of Justin Timberlake's "Can't Stop the Feeling".' -- source: https://linux.slashdot.org/story/17/10/15/0137205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unpatched Exploit Lets You Clone Key Fobs and Open Subaru Cars
by Peter Reutemann 15 Oct '17

15 Oct '17

'Tom Wimmenhove, a Dutch electronics designer, has discovered a flaw in the key fob system used by several Subaru models, a vulnerability the vendor has not patched and could be abused to hijack cars. The issue is that key fobs for some Subaru cars use sequential codes for locking and unlocking the vehicle, and other operations. These codes -- called rolling codes or hopping code -- should be random, in order to avoid situations when an attacker discovers their sequence and uses the flaw to hijack cars. This is exactly what Wimmenhove did. He created a device that sniffs the code, computes the next rolling code and uses it to unlock cars... The researcher said he reached out to Subaru about his findings. "I did [reach out]. I told them about the vulnerability and shared my code with them," Wimmenhove told BleepingComputer. "They referred me to their 'partnership' page and asked me to fill in a questionnaire. It didn't seem like they really cared and I haven't heard back from them." His Subaru-cracking feat -- documented in a video -- was accomplished using a $25 Raspberry Pi B+ and two dongles, one for wifi ($2) and one for a TV ($8), plus a $1 antenna and a $1 MCX-to-SMA convertor.' -- source: https://tech.slashdot.org/story/17/10/14/230254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Everybody Has To Be A Software Company Now
by Lawrence D'Oliveiro 14 Oct '17

14 Oct '17

Wireless speakers made by Pure no longer work with Apple’s newest phone OS, because it has dropped the ability to run 32-bit apps--everything must now be 64-bit-only <http://www.theregister.co.uk/2017/10/12/ios_11_knackers_neglected_pure_conn…>: Part of the problem, it seems, is Pure's inability to maintain and update its own apps, and it is most likely not alone in this respect: companies that have outsourced their mobile app programming are finding themselves locked out of iOS 11 because they can't get the code or the tools or the people to rebuild their contract-developed software. The iOS App Store shows that the last update to Pure Connect was on June 25, 2015, more than two years ago, so Pure has been without a mobile developer for a while, it seems. More and more consumer products need ongoing software updates now. But the companies selling those products are having trouble getting to grips with that fact.

3 2

Impersonating Password Prompts
by Lawrence D'Oliveiro 13 Oct '17

13 Oct '17

An old problem which never seems to be quite solved: how do you distinguish pieces of software on a platform that have a legitimate need to request a password from you, from those which don’t? <https://www.schneier.com/blog/archives/2017/10/impersonating_i.html>

1 0

XikiHub: The Social Command Line
by Peter Reutemann 13 Oct '17

13 Oct '17

'In 2014, Craig Muth developed an open source alternative shell called Xiki (executable wiki) which combined shell and GUI concepts and tried making the shell console more friendly and powerful. The selection was easier with arrow keys or with mouse clicks and there was the option to create menus to access other tools with ease. And, all of this was made possible for beginners with little to no knowledge about the command line. ' [see archive link here: https://list.waikato.ac.nz/pipermail/wlug/2014-June/012983.html] 'Now, Xiki is going a step further with XikiHub by adding a social element to commands. XikiHub aims to be a social repository where you can discover thousands of examples and interfaces contributed from users all over the world. You can pick up the one you like, create your own and contribute it to the social repository. The idea behind XikiHub is to create a social platform where any Xiki user can share a command he/she created that can be picked up and used by any other user. It will include a quick install step that will provide the option to review before installing a command.' -- source: https://itsfoss.com/xikihub-social-command-line/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0