- wlug - list.wlug.org.nz

Greg Kroah-Hartman Chastises Critic, Says Linux Foundation Strongly Supports Kernel Developers
by Peter Reutemann 09 Oct '23

09 Oct '23

'It started when Linux blogger Bryan Lunduke complained about how the Linux Foundation was reducing the six-year long-term support (LTS) window for the Linux kernel to two years. Lunduke argued that the Foundation seemed more interested in funding compliance best practices — as well as artificial intelligence and blockchain projects. In an online discussion, Linux kernel maintainer Greg Kroah-Hartman had this response: Did anyone think to actually ask the developer who is maintaining the long-term support kernel versions why he made that change (back in February?), i.e. me...? No, I guess that would take too much effort, and wouldn't result in such a click-bait headline. "LTS kernels are no longer supported for 6 years because it turns out no one used them." doesn't have that same fun sound... In a second comment Kroah-Hartman also clarified that in fact "The amount of resources and other stuff that the Linux Foundation provides to the Linux kernel community has increased over the years, including last year. " Just because new people are brought in with new projects (that the LF member companies want to host) does not mean that somehow less is being given to the kernel community at all. It is not a zero-sum game here at all, that's not how the LF works in any way. Again, this would have been easy to verify if someone just asked us. So to repeat, no "abandonment" is happening here at all, the opposite is happening, just like it has for the entirety of the Linux Foundation's existence, support has grown every year. ' -- source: https://linux.slashdot.org/story/23/10/08/0131214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Red Hat, Ubuntu, Debian, and Gentoo Release Patches for 'Looney Tunables' Linux Vulnerability
by Peter Reutemann 09 Oct '23

09 Oct '23

'Thursday ZDNet reported... As security holes go, CVE-2023-4911, aka "Looney Tunables," isn't horrid. It has a Common Vulnerability Scoring System score of 7.8, which is ranked as important, not critical. On the other hand, this GNU C Library's (glibc) dynamic loader vulnerability is a buffer overflow, which is always big trouble, and it's in pretty much all Linux distributions, so it's more than bad enough. After all, its discoverers, the Qualys Threat Research Unit, were able to exploit "this vulnerability (a local privilege escalation that grants full root privileges) on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13." Other distributions are almost certainly vulnerable to attack. The one major exception is the highly secure Alpine Linux. Thanks to this vulnerability, it's trivial to take over most Linux systems as a root user. As the researchers noted, this exploitation method "works against almost all of the SUID-root programs that are installed by default on Linux...." The good news is that Red Hat, Ubuntu, Debian, and Gentoo have all released their own updates. In addition, the upstream glibc code has been patched with the fix. If you can't patch it, Red Hat has a script that should work on most Linux systems to mitigate the problem by setting your system to terminate any setuid program invoked with GLIBC_TUNABLES in the environment.' -- source: https://linux.slashdot.org/story/23/10/08/2133244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Tries To Dump Windows' Notoriously Insecure RNDIS Protocol
by Peter Reutemann 05 Oct '23

05 Oct '23

'ZDNet: Microsoft's proprietary protocol, Remote Network Driver Interface Specification (RNDIS), started with a good idea. It would enable hardware vendors to add networking support to USB devices without having to build them from scratch. There was only one little problem. RNDIS has no security to speak of. As Greg Kroah-Hartman, the Linux Foundation fellow responsible for stable Linux kernel releases, wrote in November 2022 on the Linux Kernel Mailing List (LKML), "The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on any system that uses it with untrusted hosts or devices. Because the protocol is impossible to make secure, just disable all RNDIS drivers to prevent anyone from using them again." He added, in another message, "The protocol was never designed to be used with untrusted devices. It was created, and we implemented support for it, when we trusted USB devices that we plugged into our systems, AND we trusted the systems we plugged our USB devices into." That's no longer the case. Kroah-Hartman concluded, "Today, with untrusted hosts and devices, it's time just to retire this protocol. As I mentioned in the patch comments, Android disabled this many years ago in their devices, with no loss of functionality." [...] But now, sick and tired of having a built-in Windows security exploit in Linux, Kroah-Hartman has decided that enough was enough. He's disabled all the RNDIS protocol drivers in Linux's Git repository. That means that while the RNDIS code is still in the Linux kernel, if you try to build Linux using this new patch, all your RNDIS drivers will be broken and won't build. This is one step short of purging RNDIS from Linux.' -- source: https://tech.slashdot.org/story/23/10/04/2119243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerabilities in Supermicro BMCs could allow for unkillable server rootkits
by Peter Reutemann 05 Oct '23

05 Oct '23

'If your organization uses servers that are equipped with baseboard management controllers from Supermicro, it may be time, once again, to patch seven high-severity vulnerabilities that attackers could exploit to gain control of them. And sorry, but the fixes must be installed manually. Typically abbreviated as BMCs, baseboard management controllers are small chips that are soldered onto the motherboard of servers inside data centers. Administrators rely on these powerful controllers for various remote management capabilities, including installing updates, monitoring temperatures and setting fan speeds accordingly, and reflashing the UEFI system firmware that allows servers to load their operating systems during reboots. BMCs provide these capabilities and more, even when the servers they’re connected to are turned off. The potential for vulnerabilities in BMCs to be exploited and used to take control of servers hasn’t been lost on hackers. In 2021, hackers exploited a vulnerability in BMCs from HP Enterprise and installed a custom rootkit, researchers from Amnpardaz, a security firm in Iran, reported that year. ILObleed, as the researchers named the rootkit, hid inside the iLO, a module in HPE BMCs that’s short for Integrated Lights-Out. ILObleed was programmed to destroy data stored on disk. If admins reinstalled the operating system, iLObleed would remain intact and reactivate the disk-wiping attack repeatedly. The unknown attackers responsible took control of the BMCs by exploiting a vulnerability HPE had fixed four years earlier. In June, the National Security Agency urged admins to follow guidance to prevent such incidents.' -- source: https://arstechnica.com/security/2023/10/vulnerabilities-in-supermicro-bmcs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 14 officially releases for Pixel phones
by Peter Reutemann 05 Oct '23

05 Oct '23

'Android 14 is out today, along with a new Pixel phone. The OS is shipping to supported Pixel devices now, which means the Pixel 4a (5G) and every variant of the Pixel 5, 6, and 7, plus the Fold and Tablet. The big feature this year is a somewhat customizable home screen. You can pick from several different lock screen clock styles and customize the two bottom app shortcuts. This feels like a response to iOS 16's lock screen widgets (a feature Android used to have back in the 4.2 days) but not nearly as customizable. It's honestly hard to highlight a second Android 14 feature because this is one of the smallest Android releases ever. The first feature Google mentions in its blog post is a new wallpaper picker. On the Pixel 8, Android now has a built-in text-to-image AI wallpaper maker, presumably a feature that lets the Android team adhere to Google's "mandatory AI" company mandate. There's also a new monochrome theme if you're tired of all those "Material You" colors. Next up, we have... a redesigned battery charging indicator in the status bar? Updates to Android's runtime? You can make the screen and camera LED flash when a notification comes in. There's Ultra HDR image support, a sharable "Health Connect" data repository for fitness apps, and that phone-as-PC-webcam feature is launching.' -- source: https://arstechnica.com/gadgets/2023/10/android-14-officially-releases-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Shift Happens: The History Of The Typewriter/Computer Keyboard
by Lawrence D'Oliveiro 04 Oct '23

04 Oct '23

Everything you always wanted to know about typing keyboards, but were afraid to ask, has now been compiled into a two-volume work of over 1200 pages, which is available for preorder <https://arstechnica.com/culture/2023/10/shift-happens-is-a-beautifully-desi…>. Coincidentally or not, this year is also the 150th anniversary of the QWERTY keyboard layout. Did you know that, back in the latter 19th century, there was a battle over whether it was better to have fewer typing keys with more shift modifier keys, or to give more characters their own keys and use fewer shifts? The question was seemingly settled, not by any issue of technical superiority one way or the other, but just because models with fewer keys in total were popular in the marketplace for other reasons. But what was the significance of the key with the three dots on it on the first-ever typewriter with a proper QWERTY keyboard?

1 0

shellcheck
by Peter Reutemann 04 Oct '23

04 Oct '23

Hi everyone Something useful I came across the other day: https://www.shellcheck.net/ finds bugs in your shell scripts. You can cabal, apt, dnf, pkg or brew install it locally right now. The above website lets you paste and analyze scripts, if you want to give it a spin. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Lichee Pi 4A: Serious RISC-V Desktop Computing
by Lawrence D'Oliveiro 02 Oct '23

02 Oct '23

This video on Christopher Barnatt’s “Explaining Computers” channel <https://www.youtube.com/watch?v=1apoFXZ9ad8> just came across my feed. It’s an unboxing and initial review of a Sipeed Lichee Pi 4A, a RISC-V-based rival to the Raspberry Pi. Seems the RISC-V desktop ecosystem is approaching maturity rapidly; he was able to boot up the preinstalled Debian system and run included apps like LibreOffice, GIMP and Chromium just fine (albeit with some audio/video performance hiccups in the last one). He says in the video that he was going to spend a week trying to do all his computing on RISC-V machines, with a report on the results due out on Sunday UK time (I suppose Monday our time).

1 2

Vulnerabilities In Exim MTA
by Lawrence D'Oliveiro 30 Sep '23

30 Sep '23

This article <https://arstechnica.com/security/2023/09/critical-vulnerabilities-in-exim-t…> reports on six different security vulnerabilities in the Exim mail transfer agent (MTA), with uncertain status on their fixes. It seems like patches for three of them are available, but only in a private repo, with no clarification of who has access to this repo. Seems like there has been poor communication between Zero Day Initiative (the group that discovered the vulnerabilities) and the Exim project, going back over a year, on these issues. An MTA is the piece of software that receives mail from other machines for users on the local machine (or on other, related machines that it is responsible for), and also forwards mail sent from local users, destined for users on other machines. Exim is the default MTA you get on a Debian installation, if you don’t choose something else (e.g. Postfix). Not sure about Debian derivatives.

1 0

Raspberry Pi 5
by Lawrence D'Oliveiro 28 Sep '23

28 Sep '23

Just heard about the new-generation Raspberry Pi. Here’s a video about a prerelease unit <https://www.youtube.com/watch?v=9hYfQ7bRgZg> which I haven’t even watched yet.

1 0

Linux Interop Is Maturing Fast… Thanks To A Games Console
by Lawrence D'Oliveiro 28 Sep '23

28 Sep '23

Interesting report <https://www.theregister.com/2023/09/27/osseu_steam_os_3/> from the recent European Open Source Summit, about the work being done at Valve and others to improve the ability of the Linux-based Steam Deck handheld console to play games written for Microsoft Windows. And not just to have them playable, but to have them run well, with performance comparable to Microsoft Windows machines. The result, so far, is thousands of games that are usable on the Steam Deck. As a proportion of the total number of games, if I interpret the numbers on the protondb.com home page correctly, that’s 60%—or at least, 60% of games tried by those who submitted reports to the compatibility database. Which is a pretty respectable number. Not enough for world domination yet, but enough to keep the Steam Deck selling, by all accounts. Seems like issues with graphics APIs are not the main problem any more. Now there is a new one: thread/process communication/synchronization primitives. Windows doesn’t use the POSIX/Linux ones, it has a whole set of its own ones, with their own peculiar behaviours. The WINE folks have made a valiant effort to map these onto Linux APIs, but their compatibility layer cannot avoid becoming a performance bottleneck, and it appears this has become a problem for a lot of games. So now there are proposals to add new features to the Linux kernel specifically to make it easier to emulate these idiosyncratic Windows APIs.

1 0

Google quietly corrects previously submitted disclosure for critical webp 0-day
by Peter Reutemann 27 Sep '23

27 Sep '23

'Google has quietly resubmitted a disclosure of a critical code-execution vulnerability affecting thousands of individual apps and software frameworks after its previous submission left readers with the mistaken impression that the threat affected only the Chrome browser. The vulnerability originates in the libwebp code library, which Google created in 2010 for rendering images in webp, a then new format that resulted in files that were up to 26 percent smaller as compared to PNG images. Libwebp is incorporated into just about every app, operating system, or other code library that renders webp images, most notably the Electron framework used in Chrome and many other apps that run on both desktop and mobile devices. Two weeks ago, Google issued a security advisory for what it said was a heap buffer overflow in WebP in Chrome. Google’s formal description, tracked as CVE-2023-4863, scoped the affected vendor as “Google” and the software affected as “Chrome,” even though any code that used libwebp was vulnerable. Critics warned that Google’s failure to note that thousands of other pieces of code were also vulnerable would result in unnecessary delays in patching the vulnerability, which allows attackers to execute malicious code when users do nothing more than view a booby-trapped webp image. On Monday, Google submitted a new disclosure that’s tracked as CVE-2023-5129. The new entry correctly lists libwebp as the affected vendor and affected software. It also bumps up the severity rating of the vulnerability, from 8.8 out of a possible 10 to 10.' -- source: https://arstechnica.com/security/2023/09/google-quietly-corrects-previously… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GPUs From All Major Suppliers Are Vulnerable To New Pixel-Stealing Attack
by Peter Reutemann 27 Sep '23

27 Sep '23

'Ars Technica: GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper (PDF) published Tuesday. The cross-origin attack allows a malicious website from one domain -- say, example.com -- to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains. [...] GPU.zip works only when the malicious attacker website is loaded into Chrome or Edge. The reason: For the attack to work, the browser must: 1. allow cross-origin iframes to be loaded with cookies 2. allow rendering SVG filters on iframes and 3. delegate rendering tasks to the GPU For now, GPU.zip is more of a curiosity than a real threat, but that assumes that Web developers properly restrict sensitive pages from being embedded by cross-origin websites. End users who want to check if a page has such restrictions in place should look for the X-Frame-Options or Content-Security-Policy headers in the source. "This is impactful research on how hardware works," a Google representative said in a statement. "Widely adopted headers can prevent sites from being embedded, which prevents this attack, and sites using the default SameSite=Lax cookie behavior receive significant mitigation against personalized data being leaked. These protections, along with the difficulty and time required to exploit this behavior, significantly mitigate the threat to everyday users. We are in communication and are actively engaging with the reporting researchers. We are always looking to further improve protections for Chrome users." An Intel representative, meanwhile, said that the chipmaker has "assessed the researcher findings that were provided and determined the root cause is not in our GPUs but in third-party software." A Qualcomm representative said "the issue isn't in our threat model as it more directly affects the browser and can be resolved by the browser application if warranted, so no changes are currently planned." Apple, Nvidia, AMD, and ARM didn't comment on the findings. ' -- source: https://it.slashdot.org/story/23/09/26/2031222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux's Multi-Grain Timestamps Short-Lived: Removed From The Kernel After A Few Weeks
by Peter Reutemann 26 Sep '23

26 Sep '23

'Phoronix: One of the new features merged for the Linux 6.6 kernel was multi-grained timestamps for the VFS layer and wiring it up for the EXT4, Btrfs, XFS, and Tmpfs file-systems. This alternative though to coarse-grained timestamps ended up exposing some problems and this week ahead of Linux 6.6-rc3, the feature has been stripped entirely from the kernel. Multi-grain timestamps were intended for addressing cases where the current coarse-grained timestamps can be ineffective for updating creation/modification times with a lot of I/O potentially happening within the once per jiffy timestamp... Multi-grained timestamps though were only to be selectively enabled to avoid the performance overhead. Christian Brauner of Microsoft who originally submitted the feature for Linux 6.6 went ahead and submitted the pull request, which has already been honored, for dropping the short-lived kernel feature... "As there are multiple solutions discussed the honest thing to do here is not to fix this up or disable it but to cleanly revert. The general infrastructure will probably come back but there is no reason to keep this code in mainline." ' -- source: https://linux.slashdot.org/story/23/09/25/009244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Creates 'Dark Style' GNOME Extension for Ubuntu 23.10
by Peter Reutemann 25 Sep '23

25 Sep '23

'In GNOME Shell there's a dark background for the Quick Settings menu, the calendar applet, and desktop notification-- but in Ubuntu 23.10, "the default Yaru theme uses a light style for GNOME Shell elements," according to the blog OMG Ubuntu. "But there's a new GNOME extension that lets you change this without affecting the rest of your desktop..." You can make GNOME Shell dark in Ubuntu by turning the 'Dark Style' toggle on but that also makes apps use a dark theme too. Not everyone wants that; they want a 'mixed' look... [I]f you would like to use dark GNOME Shell elements in Ubuntu 23.10 without using the dark mode preference (which, as said, will turn your apps dark too) then the Dark Style GNOME extension is exactly what you need. It only works with Ubuntu 23.10 and GNOME 45.' -- source: https://tech.slashdot.org/story/23/09/24/2317206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android phones get PC webcam capabilities in the latest beta
by Peter Reutemann 25 Sep '23

25 Sep '23

'Here's a fun new use for your Android phone: A PC webcam! In the latest Android beta, plugging a phone into a PC will reveal a new option in the USB Preferences menu for webcam functionality. Just pick that option instead of the default "file transfer," and the phone camera will register itself as a webcam. Then you can fire up Zoom and start video calling. The Android build with this feature is "Android 14 QPR1 Beta 1." Android's getting confusing with all these overlapping betas, but the current stable version is still Android 13. Android 14, currently on its 10th beta/developer preview, will most likely be out alongside the Pixel 8 in October. Android 14 QPR1 is the quarterly release after the first stable build of Android 14, and it should be out around December. (QPR stands for quarterly platform release.) These happen between major releases, often marketed as "feature drops." Right now, Android 13 is technically "Android 13 QPR3."' -- source: https://arstechnica.com/gadgets/2023/09/android-phones-get-pc-webcam-capabi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Behind the Scenes at 'Have I Been Pwned'
by Peter Reutemann 25 Sep '23

25 Sep '23

'The founder of the data-breach notification site Have I Been Pwned manages "the largest known repository of stolen data on the planet," reports Australia's public broadcaster ABC, including over 6 billion email address. Yet with no employees, Troy Hunt manages all of the technical and operational aspects single-handedly, and "has ended up playing an oddly central role in global cybersecurity." Troy is very careful with how he handles what he finds. He only collects (and encrypts) the mobile numbers, emails and passwords that he finds in the breaches, discarding the victims' names, physical addresses, bank details and other sensitive information. The idea is to let users find out where their data has been leaked from, but without exposing them to further risk. Once he identifies where a data breach has occurred, Troy also contacts the organisation responsible to allow it to inform its users before he does. This, he says, is often the hardest step of the process because he has to convince them it's legitimate and not some kind of scam itself. He's not required to give organisations this opportunity, much less persist when they ignore his messages or accuse him of trying to shake them down for money. But there's evidence that this approach is working. Despite the legal grey area he has operated in for a decade now, he's avoided being sued by any of the organisations responsible for the 705 breaches that are now searchable on Have I Been Pwned. These days, major tech companies like Mozilla and 1Password use Have I Been Pwned, and Troy likes to point out that dozens of national governments and law enforcement agencies also partner with his service... "He's not a company that's audited. He's just a dude on the web," says Jane Andrew, an expert on data breaches at the University of Sydney. "I think it's so shocking that this is where we find out information about ourselves. She says governments and law enforcement have, in general, left it to individuals to deal with the fallout from data breaches... Without an effective global regulator, Professor Andrew says, a crucial part of the world's cybersecurity infrastructure is left to rely on the goodwill of this one man on the Gold Coast.' -- source: https://it.slashdot.org/story/23/09/24/201233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LMDE-5 download
by john 24 Sep '23

24 Sep '23

I recently decided to try LMDE-5 Mate version. I found all my usual download sources were returning a 404 error, Checked again at 9.35am https://blog.linuxmint.com/?p=4281 Has this been pulled for some reason??

2 1

Linux gives up on 6-year LTS kernels, says they’re too much work
by Peter Reutemann 21 Sep '23

21 Sep '23

'The LTS (long-term support) period for the Linux kernel is being cut down. In 2017, the kernel jumped from two years of support to six. Now, six years later, it turns out that's a lot of work. ZDNet reports that at the Open Source Summit Europe this week (videos will be out in a few weeks), Linux Weekly News executive editor Jonathan Corbet announced the Linux kernel will return to two years of LTS support. The plan to cut back down to two years isn't instant. The Linux community is still honoring the current end-of-life timelines, so 6.1, 5.15, 5.10, 5.4, 4.19, and 4.14 are still six years, but new kernels will only get two years. Even this six-year window was supposed to be an optional thing when it started, with the release page FAQ saying, "Each new longterm kernel usually starts with only a 2-year projected EOL that can be extended further if there is enough interest from the industry at large to help support it for a longer period of time." The reality was that everything received a six-year life span, and now that will no longer be the case. Corbet cited a mix of lack of use and a lack of support for why Linux is cutting back on LTS kernels. Corbet says, "There's really no point to maintaining [old kernels] for that long because people are not using them." The other big problem is the burnout from maintainers, which are often unpaid and could use a lot more support from the billion-dollar companies that benefit from using Linux.' -- source: https://arstechnica.com/gadgets/2023/09/linux-gives-up-on-6-year-lts-thats-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The Signal Protocol used by 1+ billion people is getting a post-quantum makeover
by Peter Reutemann 21 Sep '23

21 Sep '23

'The Signal Foundation, maker of the Signal Protocol that encrypts messages sent by more than a billion people, has rolled out an update designed to prepare for a very real prospect that’s never far from the thoughts of just about every security engineer on the planet: the catastrophic fall of cryptographic protocols that secure some of the most sensitive secrets today. The Signal Protocol is a key ingredient in the Signal, Google RCS, and WhatsApp messengers, which collectively have more than 1 billion users. It’s the engine that provides end-to-end encryption, meaning messages encrypted with the apps can be decrypted only by the recipients and no one else, including the platforms enabling the service. Until now, the Signal Protocol encrypted messages and voice calls with X3DH, a specification based on a form of cryptography known as Elliptic Curve Diffie-Hellman. [...] There is little disagreement, however, that there will come a day when many of the most widely used forms of encryption will die at the hands of quantum computing. To head off that doomsday eventuality, engineers and mathematicians have been developing a new class of PQC, short for post-quantum cryptography. The PQC added to the Signal Protocol on Monday is called PQXDH. It uses the same X3DH specification the Signal Protocol has always employed. On top, it adds an additional layer of encryption using Crystals-Kyber, one of four PQC algorithms the National Institute of Standards and Technology selected last year as a potential replacement to ECC and other quantum-vulnerable forms of encryption.' -- source: https://arstechnica.com/security/2023/09/signal-preps-its-encryption-engine… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Terraform Fork Gets Renamed OpenTofu, Joins Linux Foundation
by Peter Reutemann 21 Sep '23

21 Sep '23

'TechCrunch: When HashiCorp announced it was changing its Terraform license in August, it set off a firestorm in the open source community, and actually represented an existential threat to startups that were built on top of the popular open source project. The community went into action and within weeks they had written a manifesto, and soon after that launched an official fork called OpenTF. Today, that group went a step further when the Linux Foundation announced OpenTofu, the official name for the Terraform fork, which will live forever under the auspices of the foundation as an open source project. At the same time, the project announced it would be applying for entry into the Cloud Native Computing Foundation (CNCF). "OpenTofu is an open and community-driven response to Terraform's recently announced license change from a Mozilla Public License v2.0 (MPLv2) to a Business Source License v1.1 providing everyone with a reliable, open source alternative under a neutral governance model," the foundation said in a statement. The name is deliberately playful says Yevgeniy (Jim) Brikman from the OpenTofu founding team, who is also co-founder of Gruntwork. "I'm glad your reaction was to laugh. That's a good thing. We're trying to keep things a little more humorous," Brikman told TechCrunch, but the group is dead serious when it comes to building an open fork. [...] "The first thing was to get an alpha release out there. So you can go to the OpenTofu website and download OpenTofu and start using it and trying it out," he said. "Then the next thing is a stable release. That's coming in the very near future, but there's work to do. Once you have a stable release, people can start using it. Then we can start growing adoption, and once we start growing adoption, some of the big players will start stepping in when some of the big players start stepping in other big players will start stepping in as well."' -- source: https://linux.slashdot.org/story/23/09/20/1951214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese hackers have unleashed a never-before-seen Linux backdoor
by Peter Reutemann 19 Sep '23

19 Sep '23

'Researchers have discovered a never-before-seen backdoor for Linux that’s being used by a threat actor linked to the Chinese government. The new backdoor originates from a Windows backdoor named Trochilus, which was first seen in 2015 by researchers from Arbor Networks, now known as Netscout. They said that Trochilus executed and ran only in memory, and the final payload never appeared on disks in most cases. That made the malware difficult to detect. Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass. Other groups eventually used it, and its source code has been available on GitHub for more than six years. Trochilus has been seen being used in campaigns that used a separate piece of malware known as RedLeaves. In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021. By searching VirusTotal for the file name, libmonitor.so.2, the researchers located an executable Linux file named “mkmon”. This executable contained credentials that could be used to decrypt libmonitor.so.2 file and recover its original payload, leading the researchers to conclude that “mkmon” is an installation file that delivered and decrypted libmonitor.so.2. The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation. The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component. SprySOCKS implements the usual backdoor capabilities, including collecting system information, opening an interactive remote shell for controlling compromised systems, listing network connections, and creating a proxy based on the SOCKS protocol for uploading files and other data between the compromised system and the attacker-controlled command server.' -- source: https://arstechnica.com/security/2023/09/never-before-seen-linux-backdoor-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Linux Mint Debian Edition' Begins Public Beta Testing
by Peter Reutemann 18 Sep '23

18 Sep '23

'This week saw the public beta-testing release of "Linux Mint Debian Edition". Besides listing download locations, its release notes also list out the project's three goals: - Ensure Linux Mint would be able to continue to deliver the same user experience - See how much work would be involved if Ubuntu was ever to disappear. - Guarantee the software we develop is compatible outside of Ubuntu. 9to5Linux reports: Based on the Debian GNU/Linux 12 "Bookworm" operating system series, Linux Mint Debian Edition 6 is powered by the long-term supported Linux 6.1 LTS kernel series and features the latest Cinnamon 5.8 desktop environment that was introduced with the Linux Mint 21.2 "Victoria" release in July 2023â¦ [T]his release comes with a new look and feel thanks to newly added folder icons with different color variants, improved consistency of tooltips to look the same across different apps and desktops, support for symbolic icons that adapt to their background, and full support for HEIF and AVIF' -- source: https://linux.slashdot.org/story/23/09/16/2147219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

KSMBD Finally Reaches 'Stable' State in Release Candidate for Linux Kernel 6.6
by Peter Reutemann 18 Sep '23

18 Sep '23

'When Linus Torvalds announced Linux kernel 6.6's first release candidate, it included a newly-stable version of KSMBD, which is Samsung's in-kernel server for the SMB protocol (for sharing files/folders/printers over a network). An announcement in 2021 had said that "For many cases the current userspace server choices were suboptimal either due to memory footprint, performance or difficulty integrating well with advanced Linux features." LWN noted at the time that Linux has been using "the user-space Samba solution since shortly after the beginning." In a sense, ksmbd is not meant to compete with Samba; indeed, it has been developed in cooperation with the Samba project. It is, however, meant to be a more performant and focused solution than Samba is; at this point, Samba includes a great deal of functionality beyond simple file serving. Ksmbd claims significant performance improvements on a wide range of benchmarks...One other reason — which tends to be spoken rather more quietly — is that a new implementation can be licensed under GPLv2, while Samba is GPLv3. The Register notes that when Samba switched to GPL 3, "one result was that Apple dropped Samba from Mac OS X and replaced it with its own, in-house server called SMBX." And they also remember that a month after its debut in 2021, "Linux sysadmins got to enjoy KSMBD's first security exploit." What's changed now is that it has faced considerable security testing and as a result it is no longer marked as experimental. It's been developed with the assistance of the Samba team, which itself documents how to use it. It's compatible with existing Samba configuration files. As the team says, "It is not meant to replace the existing Samba fileserver 'smbd', but rather be an extension and will integrate with Samba in the future...." KSMBD is also important in that placing such core server functionality right inside the kernel represents a significant potential attack surface for crackers... The new bcachefs file system will not be going into kernel 6.6, and its developer is not happy. "It's taken some time to get KSMBD to a state that was considered stable," points out Linux magazine. That time has come, and KSMBD is planned for Linux kernel 6.6.: But why is KSMBD important? First off, it promises considerable performance gains and better support for modern features such as Remote Direct Memory Access (RDMA)... KSMBD also adds enhanced security, considerably better performance for both single and multi-thread read/write, better stability, and higher compatibility. In the end, hopefully, this KSMBD will also mean easier share setups in Linux without having to jump through the same hoops one must with the traditional Samba setup.' -- source: https://linux.slashdot.org/story/23/09/16/0412208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Error message.
by john 14 Sep '23

14 Sep '23

Hi All, I attempted to install Warpinator using this guide: https://ubunlog.com/en/warpinator-sends-and-receives-files-on-a-local-netwo… I thought the install was a success even though I needed to issue "|sudo apt install -f"| On running the program from a terminal a sad outcome appears....... john(a)johnbuntu:~$ warpinator Gtk-Message: 09:36:55.896: Failed to load module "xapp-gtk3-module" 2023-09-14 09:36:56,719::warpinator: Initializing Warpinator 2023-09-14 09:36:57,000::warpinator: Starting server on xxx.xxx.x.x Any help will be much appreciated.. Cheers John..

2 1