- wlug - list.wlug.org.nz

A wide range of routers are under attack by new, unusually sophisticated malware
by Peter Reutemann 29 Jun '22

29 Jun '22

'An unusually advanced hacking group has spent almost two years infecting a wide range of routers in North America and Europe with malware that takes full control of connected devices running Windows, macOS, and Linux, researchers reported on Tuesday. So far, researchers from Lumen Technologies' Black Lotus Labs say they've identified at least 80 targets infected by the stealthy malware, infecting routers made by Cisco, Netgear, Asus, and DayTek. Dubbed ZuoRAT, the remote access Trojan is part of a broader hacking campaign that has existed since at least the fourth quarter of 2020 and continues to operate. The discovery of custom-built malware written for the MIPS architecture and compiled for small office and home office routers is significant, particularly given its range of capabilities. Its ability to enumerate all devices connected to an infected router and collect the DNS lookups and network traffic they send and receive and remain undetected is the hallmark of a highly sophisticated threat actor.' -- source: https://arstechnica.com/information-technology/2022/06/a-wide-range-of-rout… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MNT shrinks its open source Reform laptop into a 7-inch pocket PC throwback
by Peter Reutemann 29 Jun '22

29 Jun '22

'A few months ago, we reviewed the MNT Reform, which attempts to bring the dream of entirely open source hardware to an audience that doesn't want to design and build a laptop totally from scratch. Now, MNT is bringing its open-hardware ethos to a second PC, a 7-inch "Pocket Reform" laptop that recalls the design of old clamshell Pocket PCs, just like the big Reform references the design of chunky '90s ThinkPads. The Pocket Reform borrows many of the big Reform laptop's design impulses, including a low-profile mechanical keyboard and trackball-based pointing device and a chunky, retro-throwback design. The device includes a 7-inch 1080p screen, a pair of USB-C ports (one of which is used for charging), a microSD slot for storage expansion, and a micro HDMI port for connecting to a display when you're at your desk.' -- source: https://arstechnica.com/gadgets/2022/06/mnt-reform-laptops-open-hardware-ap… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Is Cautiously Optimistic About Bringing Rust Into Linux Kernel's Next Release
by Peter Reutemann 29 Jun '22

29 Jun '22

'ZDNet: For over three decades, Linux has been written in the C programming language. Indeed, Linux is C's most outstanding accomplishment. But the last few years have seen a growing momentum to make the Rust programming language Linux's second Linux language. At the recent Open Source Summit in Austin, Texas, Linux creator Linus Torvald said he could see Rust making it into the Linux kernel as soon as the next major release. "I'd like to see the Rust infrastructure merging to be started in the next release, but we'll see." Linux said after the summit. "I won't force it, and it's not like it's going to be doing anything really meaningful at that point -- it would basically be the starting point. So, no promises." Now, you may ask: "Why are they adding Rust at all?" Rust lends itself more easily to writing secure software. Samartha Chandrashekar, an AWS product manager, said it "helps ensure thread safety and prevent memory-related errors, such as buffer overflows that can lead to security vulnerabilities." Many other developers agree with Chandrashekar. Torvalds also agrees and likes that Rust is more memory-safe. "There are real technical reasons like memory safety and why Rust is good to get in the kernel." Mind you, no one is going to be rewriting the entire 30 or so million lines of the Linux kernel into Rust. As Linux developer Nelson Elhage said in his summary of the 2020 Linux Plumber's meeting on Rust in Linux: "They're not proposing a rewrite of the Linux kernel into Rust; they are focused only on moving toward a world where new code may be written in Rust." The three areas of potential concern for Rust support are making use of the existing APIs in the kernel, architecture support, and dealing with application binary interface (ABI) compatibility between Rust and C.' -- source: https://linux.slashdot.org/story/22/06/28/0448235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Releases Firefox 102
by Peter Reutemann 29 Jun '22

29 Jun '22

'Today, Mozilla released Firefox 102. New features include: * Tired of too many windows crowding your screen? You can now disable automatic opening of the download panel every time a new download starts. Read more. * Firefox now mitigates query parameter tracking when navigating sites in ETP strict mode. * Subtitles and captions for Picture-in-Picture (PiP) are now available at HBO Max, Funimation, Dailymotion, Tubi, Disney+ Hotstar, and SonyLIV. This allows you to view video in a small window pinned to a corner of the screen while navigating between apps or browsing content on the main screen. But do not get fooled, the most important feature is that this release is an ESR, this is super-important of a host of reasons: * Firefox ESR is the basis for KaiOS (an evolution of BootToGecko), an OS for Semi-Smart Phones very popular in India (100milion+), SE Asia + Africa (~60Milion), so, whatever made the cut in 102 will define the base capabilities for KaiOS for the next year. * Firefox ESR is the basis for Thunderbird, so, if you use Thunderbird or a derivative, whatever made the cut in 102 will underpin Thunderbird for the next year. * Many popular Linux distros (like Debian or Kali) use Firefox ESR as the default browser. * Many companies and organizations use Firefox ESR as their default browser, and many SW development companies certify Firefox ESR as an alowed browser for their SW. So, 102 is a very important release, becuase it brings a year of advances to ESR.' -- source: https://news.slashdot.org/story/22/06/28/198214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Turkish Municipal District Switched to GNU/Linux
by Peter Reutemann 28 Jun '22

28 Jun '22

'Today I learned Turkey's Scientific and Technological Research Council has a subsidiary developing a GNU/Linux distro called Pardus, "redesigned to be used in accordance with the practices and habits of users in Turkey." And this week the Free Software Foundation published a post from the proud project leader of Pardus, explaining exactly why open source was chosen in the district of Eyüpsultan (on the European side of Istanbul) and how they got it implemented: After the municipal elections held in 2014, the new administration realized (through internal financial analysis reports) that a large amount of money was being spent on licensing proprietary software. Looking to cut costs, management asked for a study to be carried out for solutions. As the Eyüpsultan municipality's IT department, we recommended to replace Microsoft Windows with Pardus GNU/Linux instead. We described our preference to transition to free software as "the desire to be independent from a company as well as the savings to be gained from cutting hefty license fees." Additionally, we spoke about how the four freedoms would improve things outside of the budget. For example, we told the administration that users, when using free software, can fully benefit from the rights they have over the programs running on their computers. We also informed everyone that, when the software they run is proprietary, it means that a company claims rights over the user, and that such a claim of ownership can place restrictions on users in how they may or may not use the software. We told them that this is unacceptable. Arguments such as these were among the deciding factors that influenced our transition to free software. The plan was presented to the municipal administration and widely accepted. The municipal administration approved the project, and in January, 2015, the Eyüpsultan municipality started using free software applications such as LibreOffice (e.g. Writer, Calc, Impress, etc.). Prior to the implementations, basic user training on LibreOffice software was provided to the personnel of the institution. Over time, users were gradually and steadily directed to free systems, and, notably, without receiving backlash from users.... Training was an important item in the transition to Pardus GNU/Linux. Besides an online support forum, they've also set up a live call center to answer questions. "I think we may be the only distribution that helps with issues via a call center." So how do they feel now about that transition, eight years later? Free software has many advantages, including flexibility, high performance, major cost savings from licensing fees, independence from any particular company, and compliance with interoperability standards. Therefore, the transition of Eyüpsultan municipality to free software has resulted in benefits that were both strategic and practical. We believe, in the near future, more organizations will need to understand the philosophy of free software and the opportunities that free software provides. The municipal budget has freed up money as a result of the moving from proprietary software to free software. The savings from the "proprietary software licenses" line of the budget was applied to the district in the form of new projects. The money goes now to, among other things, increasing the number of new parks and gardens, bicycle paths, and security cameras in the parks. Additionally, by increasing the number of classes we provide technical training, we started to provide classes in robotics and computation to young people. The Eyüpsultan municipality is now increasing the opportunities for students to further develop their personalities, abilities, goals, and self-discovery. It introduces young people to technology and encourages them to produce new technologies. One final effect of using free software? It encourages others to do the same: As a result of this brave decision, many of the Istanbul district municipalities have started working to switch or have already made the switch to the Pardus GNU/Linux operating system. Institutions in other cities of the country have also expressed growing interest by asking questions about the Pardus operating system and free software.' -- source: https://news.slashdot.org/story/22/06/27/0154233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ventoy - new bootable USB solution
by Peter Reutemann 27 Jun '22

27 Jun '22

Hi everyone This tool just came up during our WLUG meeting: ventoy 'Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHD(x)/EFI files. With ventoy, you don't need to format the disk over and over, you just need to copy the image files to the USB drive and boot it. You can copy many image files at a time and ventoy will give you a boot menu to select them. You can also browse ISO/WIM/IMG/VHD(x)/EFI files in local disk and boot them. x86 Legacy BIOS, IA32 UEFI, x86_64 UEFI, ARM64 UEFI and MIPS64EL UEFI are supported in the same way. Both MBR and GPT partition style are supported in the same way. Most type of OS supported(Windows/WinPE/Linux/Unix/ChromeOS/Vmware/Xen...) 900+ ISO files are tested (List). 90%+ distros in distrowatch.com supported (Details).' https://github.com/ventoy/ https://www.ventoy.net/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux Foundation Podcast: 'Untold Stories of Open Source'
by Peter Reutemann 27 Jun '22

27 Jun '22

'The nonprofit Linux Foundation pays Linus Torvalds' salary and supports many other open source projects. But they also launched a new podcast series this week covering "The Untold Stories of Open Source." "Each week we explore the people who are supporting Open Source projects, how they became involved with it, and the problems they faced along the way," explains the podcast's GitHub page (where you can put in a pull request to suggest future episodes or track the project's progress.) The podcast is available on its official web page, as well as on Spotify, Apple, Google, or "wherever you listen to your podcasts," according to an announcement from the Linux Foundation. An introductory page says the podcast will be "used to inform the Linux and Open Source communities as to the current state in development of open source initiatives and Linux Foundation Projects. It is vendor neutral, with no interviews of commercial product vendors or sales teams." Here's the first four episodes: - Balancing Priorities at the Cloud Native Computing Foundation, with Priyanka Sharma, general manager - A Life in Open Source, with Brian Behlendorf, general manager at Open Source Security Foundation - A New Model for Technical Training, with Clyde Seepersad, senior vice president of the Linux Foundation's training/certification project - The Business Side of Open Source, with Patrick Debois, "godfather of DevOps"' -- source: https://news.slashdot.org/story/22/06/25/0041218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TIL: Bracketed-Paste Mode
by Lawrence D'Oliveiro 26 Jun '22

26 Jun '22

I’ve been noticing one or two little quirks of the KDE Konsole terminal emulator lately. One is, when I copy and paste multiple lines of commands at once, they don’t get executed one by one, in fact they don’t get executed at all: I still have to press Enter afterwards to execute them. Another is, if I forget to type CTRL-SHIFT-V to do the paste, but do CTRL-V instead (the standard Unix control character which means “enter next character literally”), the pasted text gets prefixed with “«esc»[200~” and followed by a “~” character. If it wasn’t for that CTRL-V, that escape-sequence prefix would be interpreted by the terminal emulator. (Actually it turns out that ending “~” is actually part of the sequence “«esc»[201~”, which was being misinterpreted in that case because it did not follow a proper “«esc»[200~” sequence.) It turns out both of these behaviours are by design. That special escape sequence activates “bracketed-paste” mode <https://cirw.in/blog/bracketed-paste>. This is a safety feature to guard against malicious commands: it means the paste on its own is never enough to execute anything. So the user always gets a chance to see what has been pasted, before explicitly executing it. This behaviour is probably commonplace among other terminal emulators, as well.

3 3

Linux Kernel Signature Verification Code Adds FIPS Compliance
by Peter Reutemann 26 Jun '22

26 Jun '22

'Phoronix reports a new change was merged into the soon-to-be-released Linux 5.19 on Tuesday, making the kernel's signature verification code compliant with the Federal Information Processing Standards known as FIPS: FIPS are public standards via the National Institute of Standards and Technology used by U.S. government agencies and contractors in the areas of computer security and interoperability... Known-answer self-tests are required for FIPS compliance at startup/reboot, but the Linux kernel's signature verification code has been lacking such tests. The signature checking code is used for module signing, Kexec, and other functionality. With Linux 5.19 there will now be some basic self-tests at start. The tests will make their debut in Linux 5.19-rc4.' -- source: https://linux.slashdot.org/story/22/06/25/0118254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy Birthday X
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

X Windows† turns 38 years old this week <https://www.theregister.com/2022/06/22/the_x_window_system_just/>. It originated from a previous GUI system called “W” (for “Window”, I guess) which ran on the “V” microkernel-based research OS. Nobody seems able to find any source code for these earlier projects. The first version of X (X1?) only ran on the DEC VAXstation 100. By about the version called X10, it was getting more portable to other workstation hardware. And of course X11 remains (with various revisions) with us to this day. However, it’s clear much of the development momentum has left the project, and gone to candidates for an all-new redesigned-from-the-ground-up successor, like Wayland. †Or the “X Window System”, if you prefer

1 0

The World Is Not Ready For Such Power ...
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

... says Microsoft. Recognizing the potential <https://www.theregister.com/2022/06/21/microsoft_api_ai_algorithms/> for misuse of technologies that can glean information from publicly-available images, audio etc that the subjects of those online media might not expect (including the ability to forge their likenesses), the company has pledged to come up with restrictions on how developers outside the company can use these technologies. As for developers _inside_ the company? (...crickets...)

1 0

Most Top Websites Are Not Following Best Practices In Their Password Policies
by Lawrence D'Oliveiro 23 Jun '22

23 Jun '22

Report on a survey <https://freedom-to-tinker.com/2022/06/22/most-top-websites-are-not-followin…> on the sorts of password policies in force on various popular websites. Too many of them still have unnecessary restrictions like the characters you are allowed to use, or even imposing a maximum permitted length. There is a linked blog post from one of the developers at Discourse, which argues that rules of any kind should be avoided. Or nearly any kind: there is a case for a minimum-length requirement (but be careful how you count it -- are you just going by Unicode “code points”? Or worse still, are you requiring passwords to be ASCII-only?), and checks against leaked password lists, plus some kind of entropy test to rule out trivial things like “aaaaaaaaaa”. Beyond that, let the user enter what they like. Showing the user a password-strength meter next to their entry as they choose a password is considered part of best practice nowadays. But in their article, they show that Facebook’s password-strength meter, for example, seems to prefer certain weak passwords (with a wider character set) over more random, stronger ones (from a smaller character set). Maybe there are circumstances out of the hands of the sysadmins, and the blame lies elsewhere: the article closes with One idea for future research: directly engage with system administrators, in order to understand their mindset on password security. Perhaps password policy is meant to be security theater--giving users a sense of safety without actually improving security. Or maybe websites have shifted their attention to adopting other authentication technologies, like SMS-based multi-factor authentication (which also suffers from severe weaknesses, as we discovered in previous research on SIM swaps and number recycling). Perhaps websites have to deal with security audits from firms like Deloitte recommending outdated practices. Or maybe websites face other practical constraints that the information security community doesn’t know about.

1 0

Mega says it can’t decrypt your files. New POC exploit shows otherwise
by Peter Reutemann 22 Jun '22

22 Jun '22

'In the decade since larger-than-life character Kim Dotcom founded Mega, the cloud storage service has amassed 250 million registered users and stores a whopping 120 billion files that take up more than 1,000 petabytes of storage. A key selling point that has helped fuel the growth is an extraordinary promise that no top-tier Mega competitors make: Not even Mega can decrypt the data it stores. On the company's homepage, for instance, Mega displays an image that compares its offerings to Dropbox and Google Drive. In addition to noting Mega's lower prices, the comparison emphasizes that Mega offers end-to-end encryption, whereas the other two do not. Over the years, the company has repeatedly reminded the world of this supposed distinction, which is perhaps best summarized in this blog post. In it, the company claims, "As long as you ensure that your password is sufficiently strong and unique, no one will ever be able to access your data on MEGA. Even in the exceptionally improbable event MEGA's entire infrastructure is seized!" (emphasis added). Third-party reviewers have been all too happy to agree and to cite the Mega claim when recommending the service. Research published on Tuesday shows there's no truth to the claim that Mega, or an entity with control over Mega's infrastructure, is unable to access data stored on the service. The authors say that the architecture Mega uses to encrypt files is riddled with fundamental cryptography flaws that make it trivial for anyone with control of the platform to perform a full key recovery attack on users once they have logged in a sufficient number of times. With that, the malicious party can decipher stored files or even upload incriminating or otherwise malicious files to an account; these files look indistinguishable from genuinely uploaded data.' -- source: https://arstechnica.com/information-technology/2022/06/mega-says-it-cant-de… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RISC OS: 35-Year-Old Original ARM OS Is Alive and Well
by Peter Reutemann 22 Jun '22

22 Jun '22

'RISC OS, the operating system of the original Arm computer, the Acorn Archimedes, is still very much alive -- and doing relatively well for its age. The Register reports: In June 1987, Acorn launched the Archimedes A305 and A310, starting at $982 and running a new operating system called Arthur. At the time, it was a radical and very fast computer. In his review (PDF) for Personal Computer World, Dick Pountain memorably said: "It loads huge programs with a faint burping noise, in the time it takes to blink an eye." Arthur was loosely related to Acorn's earlier MOS, the BBC Micro operating system but looked very different thanks to a prototype graphical desktop, implemented in BBC BASIC, that could charitably be called "technicolor." Renamed RISC OS, version 2 followed in 1989 -- the same year that Sun started selling its new SPARCstation 1 (a snip at $9,200) and DEC launched the MIPS R2000-chipset-based DECstation 3100 (for $10,800). RISC OS has had a rather convoluted history, partly due to Acorn spinning out Arm, eventually pulling out of the computer market, rebranding as Element 14 and being acquired by Broadcom, where Arm co-designer Sophie Wilson still works today. And partly due to drama over the ownership of the OS post-Acorn at one point. One fork of RISC OS still supports Acorn-era Arm's odd 26-bit mode, meaning that today it mostly runs on the commercial Virtual Acorn emulator. The other branch, designed for the 32-bit mode of more recent Arm chips, is now owned by RISC OS Developments, which made it fully open source back in 2018. Development and maintenance is done by the team at RISC OS Open Ltd -- ROOL for short -- which offers downloads for a variety of current Arm hardware, such as the Titanium desktops. [...] RISC OS Developments are still working on new functionality for the OS. Notably, it recently released a new TCP/IP stack, derived from OpenBSD. Right now, the main benefit is IPv6 support. A feature more significant to most users is still in development: Wi-Fi support. Also still under development, but available to paid backers, is a new RISC OS web browser, Iris. RISC OS does come with a choice of browsers -- NetSurf and Otter -- but the plan is that the new Iris browser will be a native app, with the RISC OS look and feel, but using the WebKit engine for better compatibility with the modern web. The main remaining limitation is SMP. As an OS from the 1980s, long before the 21st-century technology of mainstream multicore processors, RISC OS practically only supports a single CPU core. Various experimental efforts are under way to address this. One has got NetBSD running on another core, and another has the experimental Genode OS running alongside RISC OS. Another effort is working on adding SMP support into the RISC OS kernel itself.' -- source: https://tech.slashdot.org/story/22/06/21/2036227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.25 Released
by Peter Reutemann 20 Jun '22

20 Jun '22

'Long-time Slashdot reader jrepin describes Plasma as "a popular desktop environment, which is also powering the desktop mode on the Steam Deck portable gaming console." And this week the KDE Community announced the release of KDE Plasma 5.25: This new version brings many improvements... - The accent colour can now be set based on the prominent colour from the current desktop background image (it updates if you use slide-show wallpapers) and it applies to more graphical elements. - Floating Panels add a margin all around the panel to make it float while no window is maximised. - Touch-screen mode can now be activated by detaching the screen, rotating it 360, or enabling it manually. - The Global Theme settings page lets you pick and choose which parts to apply. - The Application page for Discover has been redesigned and gives you links to the application's documentation and website, and shows what system resources it has access to. - Panels can now be navigated with the keyboard, and you can assign custom shortcuts to focus individual panels. Lilputing.com adds that "There's a new Overview effect that zooms out to display previews of all currently-running apps and virtual desktops. You can access this view with a four-finger pinch on a touchscreen or touchpad, and from this view, you can also search for apps, documents, or browser tabs or add, remove, or rename virtual desktops."' -- source: https://tech.slashdot.org/story/22/06/18/045234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WLUG meeting next Monday
by Peter Reutemann 20 Jun '22

20 Jun '22

Hi everyone We have a (hybrid) meeting next Monday with the following line up: 'Tom Butz will talk about his experience of installing Linux Mint 20 on his laptop and Ian Stewart of getting Ubuntu 22.04 dual-booting Linux/Windows on a UEFI-enabled device.' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776671/ Link for virtual meeting: https://bbb2.nzoss.nz/b/pet-pgj-enn-fbi Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Linux Botnet That Spreads Using Stolen SSH Keys
by Peter Reutemann 20 Jun '22

20 Jun '22

'ZDNet is warning that Linux users need to watch out for "a new peer-to-peer (P2P) botnet that spreads between networks using stolen SSH keys and runs its crypto-mining malware in a device's memory." The Panchan P2P botnet was discovered by researchers at Akamai in March and the company is now warning it could be taking advantage of collaboration between academic institutions to spread by causing previously stolen SSH authentication keys to be shared across networks. But rather than stealing intellectual property from these educational institutions, the Panchan botnet is using their Linux servers to mine cryptocurrency, according to Akamai... "Instead of just using brute force or dictionary attacks on randomized IP addresses like most botnets do, the malware also reads the id_rsa and known_hosts files to harvest existing credentials and use them to move laterally across the network...." Akamai found 209 peers, but only 40 of them are currently active and they were mostly located in Asia. And why is the education sector more impacted by Panchan? Akamai guesses this could be because of poor password hygiene, or that the malware moves across the network with stolen SSH keys. Akamai writes that the malware "catches Linux termination signals (specifically SIGTERM — 0xF and SIGINT — 0x2) that are sent to it, and ignores them. "This makes it harder to terminate the malware, but not impossible, since SIGKILL isn't handled (because it isn't possible, according to the POSIX standard, page 313)."' -- source: https://linux.slashdot.org/story/22/06/18/2046253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Patch Trouble
by Lawrence D'Oliveiro 17 Jun '22

17 Jun '22

This article <https://arstechnica.com/information-technology/2022/06/botched-and-silent-p…> relates Microsoft’s ongoing troubles coming up with proper patches for security-related issues in its systems. For example, there was a vulnerability in Azure that took over three months and three different patches before the problem could be considered fixed. (The article describes the time interval as “five months”, but to be fair, the final patch came out just over three months after the initial notification.) Then there is the “Follina” vulnerability, which lets an attacker execute code via Microsoft Office, even if you have macro autoexecution disabled. This was finally patched earlier this week -- over seven weeks after it had been seen being actively exploited in the wild. Microsoft’s response has a sentence beginning “We are deeply committed...”. I think this PR usage of the word “committed” should be on a bingo card for content-free buzzwords.

1 0

Ubuntu Core 22 Brings Real-Time Linux Options To IoT
by Peter Reutemann 17 Jun '22

17 Jun '22

'Embedded and internet of things (IoT) devices are a growing category of computing, and with that growth has come expanded needs for security and manageability. One way to help secure embedded and IoT deployments is with a secured operating system, such as Canonical's Ubuntu Core. The Ubuntu Core provides an optimized version of the open-source Ubuntu Linux operating system for smaller device footprints, using an approach that puts applications into containers. On June 15, Ubuntu Core 22 became generally available, providing users with new capabilities to help accelerate performance and lock down security. Ubuntu Core 22 is based on the Ubuntu 22.04 Linux operating system, which is Canonical's flagship Linux distribution that's made available for cloud, server and desktop users. Rather than being a general purpose OS, Ubuntu Core makes use of the open-source Snap container technology that was originally developed by Canonical to run applications. With Snaps, an organization can configure which applications should run in a specific IoT or embedded device and lock down the applications for security. Snaps provide a cryptographically authenticated approach for application updates.' -- source: https://news.slashdot.org/story/22/06/15/1729255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A New Vulnerability in Intel and AMD CPUs Lets Hackers Steal Encryption Keys
by Peter Reutemann 17 Jun '22

17 Jun '22

'Microprocessors from Intel, AMD, and other companies contain a newly discovered weakness that remote attackers can exploit to obtain cryptographic keys and other secret data traveling through the hardware, researchers said on Tuesday. From a report: Hardware manufacturers have long known that hackers can extract secret cryptographic data from a chip by measuring the power it consumes while processing those values. Fortunately, the means for exploiting power-analysis attacks against microprocessors is limited because the threat actor has few viable ways to remotely measure power consumption while processing the secret material. Now, a team of researchers has figured out how to turn power-analysis attacks into a different class of side-channel exploit that's considerably less demanding. The team discovered that dynamic voltage and frequency scaling (DVFS) -- a power and thermal management feature added to every modern CPU -- allows attackers to deduce the changes in power consumption by monitoring the time it takes for a server to respond to specific carefully made queries. The discovery greatly reduces what's required. With an understanding of how the DVFS feature works, power side-channel attacks become much simpler timing attacks that can be done remotely. The researchers have dubbed their attack Hertzbleed because it uses the insights into DVFS to expose -- or bleed out -- data that's expected to remain private. The vulnerability is tracked as CVE-2022-24436 for Intel chips and CVE-2022-23823 for AMD CPUs. The researchers have already shown how the exploit technique they developed can be used to extract an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel.' -- source: https://it.slashdot.org/story/22/06/15/1715226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tsunami of junk traffic that broke DDoS records delivered by tiniest of botnets
by Peter Reutemann 16 Jun '22

16 Jun '22

'A massive flood of malicious traffic that recently set a new distributed denial-of-service record came from an unlikely source. A botnet of just 5,000 devices was responsible as extortionists and vandals continue to develop ever more powerful attacks to knock sites offline, security researchers said. The DDoS delivered 26 million HTTPS requests per second, breaking the previous record of 15.3 million requests for that protocol set only seven weeks ago, Cloudflare Product Manager Omer Yoachimik reported. Unlike more common DDoS payloads such as HTTP, SYN, or SYN-ACK packets, malicious HTTPS requests require considerably more computing resources for the attacker to deliver and for the defender or victim to absorb. ' -- source: https://arstechnica.com/information-technology/2022/06/tsunami-of-junk-traf… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft finds Linux desktop flaw that gives root to untrusted users
by Peter Reutemann 14 Jun '22

14 Jun '22

'Vulnerabilities recently discovered by Microsoft make it easy for people with a toehold on many Linux desktop systems to quickly gain root system rights— the latest elevation of privileges flaw to come to light in the open source OS. As operating systems have been hardened to withstand compromises in recent years, elevation of privilege (EoP) vulnerabilities have become a crucial ingredient for most successful hacks. They can be exploited in concert with other vulnerabilities that on their own are often considered less severe, with the latter giving what’s called local access and the former escalating the root access. From there, adversaries with physical access or limited system rights can deploy backdoors or execute code of their choice. Nimbuspwn, as Microsoft has named the EoP threat, is two vulnerabilities that reside in the networkd-dispatcher, a component in many Linux distributions that dispatch network status changes and can run various scripts to respond to a new status. When a machine boots, networkd-dispatcher runs as root. The flaws, tracked as CVE-2022-29799 and CVE-2022-29800, combine threats including directory traversal, symlink race, and time-of-check time-of-use (TOCTOU) race condition.' -- source: https://arstechnica.com/information-technology/2022/04/microsoft-finds-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Credentials for thousands of open source projects free for the taking—again!
by Peter Reutemann 14 Jun '22

14 Jun '22

'A service that helps open source developers write and test software is leaking thousands of authentication tokens and other security-sensitive secrets. Many of these leaks allow hackers to access the private accounts of developers on Github, Docker, AWS, and other code repositories, security experts said in a new report. The availability of the third-party developer credentials from Travis CI has been an ongoing problem since at least 2015. At that time, security vulnerability service HackerOne reported that a Github account it used had been compromised when the service exposed an access token for one of the HackerOne developers. A similar leak presented itself again in 2019 and again last year. The tokens give anyone with access to them the ability to read or modify the code stored in repositories that distribute an untold number of ongoing software applications and code libraries. The ability to gain unauthorized access to such projects opens the possibility of supply chain attacks, in which threat actors tamper with malware before it's distributed to users. The attackers can leverage their ability to tamper with the app to target huge numbers of projects that rely on the app in production servers. Despite this being a known security concern, the leaks have continued, researchers in the Nautilus team at the Aqua Security firm are reporting. A series of two batches of data the researchers accessed using the Travis CI programming interface yielded 4.28 million and 770 million logs from 2013 through May 2022. After sampling a small percentage of the data, the researchers found what they believe are 73,000 tokens, secrets, and various credentials.' -- source: https://arstechnica.com/information-technology/2022/06/credentials-for-thou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email client K-9 Mail will become Thunderbird for Android
by Peter Reutemann 14 Jun '22

14 Jun '22

'The open source Thunderbird email client has a long and storied history, but until now, that history has been limited to the desktop. That's about to change, according to a post on the Thunderbird blog. Thunderbird will be coming to Android through the popular open source mobile email client K-9 Mail. According to Thunderbird's Jason Evangelho, the Thunderbird team has acquired the source code and naming rights to K-9 Mail. K-9 Mail project maintainer Christian Ketterer (who goes by "cketti" in the OSS community) will join the Thunderbird team, and over time, K-9 Mail will become Thunderbird for Android.' -- source: https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Working To Provide Good Support For The VisionFive Low-Cost RISC-V Board
by Peter Reutemann 13 Jun '22

13 Jun '22

'"Ubuntu developers have been working on bringing up and improving support for the Starfive VisionFive," writes Phoronix, calling the $179 device "one of the most promising 'low-cost' RISC-V single board computers to date... intended to run full-blown RISC-V Linux distributions." The board comes in two varieties with 4GB or 8GB of system memory, powered by a dual-core SiFive U74 RV64 SoC @ 1.0GHz, an NVDLA deep learning accelerator engine, a Tensilica-VP6 Vision DSP, and a neural network engine.... Considering the performance of the much more capable HiFive Unmatched development board (that is also multiple times more expensive) and even that sometimes being outpaced by the Raspberry Pi, don't get too excited for the dual-core 1.0GHz RISC-V 64-bit SoC for general purpose workloads. But this VisionFive board may be interesting for some machine learning and other use-cases thanks to its additional accelerators. It's also one of the few RISC-V boards capable of running a full Linux distribution in the sub-$200 space. Since the upstream Linux 5.17 kernel there has been mainline support for the VisionFive v1 board. Ubuntu developers are working on enabling the StarFive VisionFive board for their RISC-V kernel build. ' -- source: https://linux.slashdot.org/story/22/06/12/1524230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0