- wlug - list.wlug.org.nz

Nvidia Transitioning To Official, Open-Source Linux GPU Kernel Driver
by Peter Reutemann 12 May '22

12 May '22

'Nvidia is publishing their Linux GPU kernel modules as open-source and will be maintaining it moving forward. Phoronix's Michael Larabel reports: To much excitement and a sign of the times, the embargo has just expired on this super-exciting milestone that many of us have been hoping to see for many years. Over the past two decades NVIDIA has offered great Linux driver support with their proprietary driver stack, but with the success of AMD's open-source driver effort going on for more than a decade, many have been calling for NVIDIA to open up their drivers. Their user-space software is remaining closed-source but as of today they have formally opened up their Linux GPU kernel modules and will be maintaining it moving forward. [...] This isn't limited to just Tegra or so but spans not only their desktop graphics but is already production-ready for data center GPU usage. ' -- source: https://linux.slashdot.org/story/22/05/11/2051237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux On Mars: NASA’s Ingenuity Helicopter Flies
by Lawrence D'Oliveiro 10 May '22

10 May '22

The first powered aircraft on Mars <https://www.theregister.com/2021/04/19/perseverance_computing_feature/> has proved its concept, taken flight for a few seconds, and made a controlled landing again. The control system is running Linux on a Qualcomm Snapdragon 801 chip, not because NASA considered it the best tool for the job, but because it was the easiest solution available. The hardware “is tuned for use on Earth, not Mars”, so it is only planned to make brief flights of no more than 90 seconds at a time, always landing back at the same spot, and it is not expected to endure beyond the initial 30 days of the Perseverance mission.

1 3

Hackers Are Now Hiding Malware In Windows Event Logs
by Peter Reutemann 10 May '22

10 May '22

'Security researchers have noticed a malicious campaign that used Windows event logs to store malware, a technique that has not been previously documented publicly for attacks in the wild. BleepingComputer reports: The method enabled the threat actor behind the attack to plant fileless malware in the file system in an attack filled with techniques and modules designed to keep the activity as stealthy as possible. [...] The dropper copies the legitimate OS error handling file [...] and then drops an encrypted binary resource to the 'wer.dll' (Windows Error Reporting) in the same location, for DLL search order hijacking to load malicious code. DLL hijacking is a hacking technique that exploits legitimate programs with insufficient checks to load into memory a malicious Dynamic Link Library (DLL) from an arbitrary path. [Denis Legezo, lead security researcher at Kaspersky] says that the dropper's purpose is to loader on the disk for the side-loading process and to look for particular records in the event logs (category 0x4142 - 'AB' in ASCII. If no such record is found, it writes 8KB chunks of encrypted shellcode, which are later combined to form the code for the next stager. "The dropped wer.dll is a loader and wouldn't do any harm without the shellcode hidden in Windows event logs," says Legezo. The new technique analyzed by Kaspersky is likely on its way to becoming more popular as Soumyadeep Basu, currently an intern for Mandiant's red team, has created and published on GitHub source code for injecting payloads into Windows event logs. ' -- source: https://tech.slashdot.org/story/22/05/09/2155240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are actively exploiting BIG-IP vulnerability with a 9.8 severity rating
by Peter Reutemann 10 May '22

10 May '22

'Researchers are marveling at the scope and magnitude of a vulnerability that hackers are actively exploiting to take full control of network devices that run on some of the world's biggest and most sensitive networks. The vulnerability, which carries a 9.8 severity rating out of a possible 10, affects F5’s BIG-IP, a line of appliances that organizations use as load balancers, firewalls, and for inspection and encryption of data passing into and out of networks. There are more than 16,000 instances of the gear discoverable online, and F5 says it’s used by 48 of the Fortune 50. Given BIG-IP's proximity to network edges and their functions as devices that manage traffic for web servers, they often are in a position to see decrypted contents of HTTPS-protected traffic. Last week, F5 disclosed and patched a BIG-IP vulnerability that hackers can exploit to execute commands that run with root system privileges. The threat stems from a faulty authentication implementation of the iControl REST, a set of web-based programming interfaces for configuring and managing BIG-IP devices. “This issue allows attackers with access to the management interface to basically pretend to be an administrator due to a flaw in how the authentication is implemented,” Aaron Portnoy, the director of research and development at security firm Randori, said in a direct message. “Once you are an admin, you can interact with all the endpoints the application provides, including execute code.”' -- source: https://arstechnica.com/information-technology/2022/05/hackers-are-actively… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME Patent Troll Gets Stripped of Patent Rights
by Peter Reutemann 09 May '22

09 May '22

'An anonymous Slashdot reader writes: Remember that patent lawsuit filed against GNOME's Shotwell in 2019? An enterprising open source lawyer has challenged it within the patent office and gotten the whole thing canceled! OpenSource.org argues that decision by the U.S. patent office "may well give patent trolls cause to steer clear of open source projects — even more than the fierce resistance the community impressively funded and mounted in the GNOME case." Of the many methods developed over the past 20 years to eliminate patent threats against FOSS, none is as powerful as challenging the nefarious patents directly. That's what McCoy Smith, founder of OSI sponsor LexPan Law, did.... Smith pointed out in a re-examination request to the U.S. Patent & Trademark Office that the patent was not for any new invention. They agreed. As a result, all of these "claims" in the Rothschild '086 Patent — the part of a patent describing what the patent rights cover — have consequently been canceled. The Rothschild '086 patent can no longer be used against any victim, including open source projects. Of course, that's little comfort to the 20+ victims attacked after GNOME with the now-proven-worthless Rothschild '086 patent, or the 50+ companies targeted with related patents that haven't yet been re-examined.... Still, it's good to know there are open source champions of all sizes defending the development of open software.' -- source: https://yro.slashdot.org/story/22/05/08/0052226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

(Mostly) Open Source SteamOS Forked into Homegrown ISO For Other Machines
by Peter Reutemann 09 May '22

09 May '22

'"While Valve has yet to actually release a proper ISO for SteamOS 3 used on the Steam Deck, others have been taking it into their own hands to provide," reports GamingOnLinux, "like with the new HoloISO. "This is possible, since 99% of what SteamOS uses is open source (not the Steam client though)..." So people can easily hack away at it to do whatever they want. [HoloISO] is not exactly the same as SteamOS 3 but it's probably the closest I've seen yet, with the main packages coming direct from Valve with "zero possible edits" the developer says. It's described as a "first beta release." Neowin supplies some context: Back in early March, Valve released the Steam Deck recovery image for Deck users who need to get back to a factory state. When it was released, many of us over at the Steam OS subreddit did the first thing any reasonable enthusiast would do and tried installing it on a standard PC. The results of this approach were mixed, and only partial successes were achieved. Then HoloISO happened.... The first release, called 'Ground Zero', was released today and allows users to install Steam OS on any machine. But there are some things you need to know before installing this for yourself.... There's a bunch of caveats, but the article still concludes that "If you're team red and you want to give this a shot, head over to the project's Github page to read more and download."' -- source: https://games.slashdot.org/story/22/05/08/0844220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Silicon Exclusively Hit With World-First 'Augury' DMP Vulnerability
by Peter Reutemann 07 May '22

07 May '22

'Tom's Hardware: A team of researchers with the University of Illinois Urbana-Champaign, Tel Aviv University, and the University of Washington have demonstrated a world-first Data Memory-Dependent Prefetcher (DMP) vulnerability, dubbed "Augury," that's exclusive to Apple Silicon. If exploited, the vulnerability could allow attackers to siphon off "at rest" data, meaning the data doesn't even need to be accessed by the processing cores to be exposed. Augury takes advantage of Apple Silicon's DMP feature. This prefetcher aims to improve system performance by being aware of the entire memory content, which allows it to improve system performance by pre-fetching data before it's needed. Usually, memory access is limited and compartmentalized in order to increase system security, but Apple's DMP prefetch can overshoot the set of memory pointers, allowing it to access and attempt a prefetch of unrelated memory addresses up to its prefetch depth. If you feel your mind grasping at a certain familiarity with this, it's likely because the infamous Spectre/Meltdown vulnerabilities also try and speculate what data will be required by the system before it's even requested (hence the term speculative execution). But while side-channel vulnerabilities such as Spectre and Meltdown are only capable of leaking in-use data, Apple's DMP can potentially leak the entire memory content even if it's not being actively accessed. The nature of Apple's DMP also renders void some of the already-engineered fixes for speculative execution vulnerabilities -- those that rely on controlling what is visible to the processing cores. The researchers said that Apple is fully aware of their discoveries, but there are no plans for whether or not the company will deploy mitigations.' -- source: https://apple.slashdot.org/story/22/05/06/2226251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Celebrates the Release of Firefox 100
by Peter Reutemann 05 May '22

05 May '22

'vm shares the blogpost of Mozilla releasing Firefox 100, and outlines some of thoughts: Out of the ashes of Netscape/AOL, Firebird rose as a promising new browser. A significant name change and a hundred releases later, Firefox 100 is still the underdog that keeps on fighting. With my mounting annoyance at all the Google services underpinning Chrome, I've since discovered and used Ungoogled Chromium, Waterfox, LibreWolf, and a handful of other lesser known spins on Chrome or Firefox. On mobile, Brave really does the best job at ad blocking whether you're on iOS or Android but the Mozilla Foundations is probably still the largest dev group fighting the good fight when it comes to both privacy and security enhancements.That's not to say that the Chromium team isn't security savvy -- I only wish they were just a little less Google. Anyhow, tell us about your favorite browser in the comments and have a look at Mozilla's latest release while you're at it.' -- source: https://news.slashdot.org/story/22/05/03/1720240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome's Latest Update: 30 Security Fixes and Bug Details Kept 'Restricted'
by Peter Reutemann 02 May '22

02 May '22

'Hot Hardware warns that on Tuesday, the Stable Channel for Chrome's desktop edition "had an update on April 26, 2022. That update includes 30 security fixes, some of them so bad that Google is urging all users to update immediately." The release notes for Google's Chrome v101.0.4951.41 for Windows, Mac, and Linux has a long list of bug fixes; you can view it here. However, there's also a key statement in that page. "Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed...." Effectively the the non-developer translation of the quote above is that something so significant was found, the details are being kept hidden.' -- source: https://it.slashdot.org/story/22/05/02/0034206 That sounds pretty bad... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora's Lead Speaks on the Popularity of Linux and the Importance of Open Source
by Peter Reutemann 02 May '22

02 May '22

'Fedora project leader Matthew Miller spoke to TechRepublic's Jack Wallen this week, sharing some thoughts on the future of Linux — and on open source in general: Matthew Miller: I think it's a lost cause to try to "sell" our quirky technology interest to people who don't see it already. We need to take a different approach.... I think our message, at its root, has to be around open source.... [W]ith Linux, when you install an open-source distro, you're not just part of a fan community. You're part of a colossal, global effort that makes software more available to everyone, makes that software better and better, and makes the whole world better through sharing... Just by using it you're sharing in this amazing undertaking, part of a move away from scarcity to an economy based on abundance.... Jack Wallen: What's the biggest difference in Linux today vs. Linux of 10 years ago? Matthew Miller: I think first we have to start with just the amazing ubiquity of it. Ten years ago, it was cute to find a TV that ran Linux. Now, not only is it definitely powering your TV, you've probably got Linux running on your lightbulbs! It's everywhere. And while Linux had pushed proprietary Unix from the server room, ten years ago Windows-based servers were pushing back. The cloud changed that — now, the cloud is Linux, almost completely. (Anything that isn't is a legacy app that it was too much trouble to port!) From tiny devices to the most powerful mainframes and supercomputers: Linux, Linux, Linux.... Jack Wallen: If Linux has an Achilles' heel, what is it? Matthew Miller: Linux and the whole free and open-source software movement grew up with the rise of the internet as an open communication platform. We absolutely need that to continue in order to realize our vision, and I don't think we can take it for granted. That's more general than an Achilles' heel, though, so right now let me highlight one thing that I think is troubling: Chrome becoming the dominant browser to the point where it's often the only way to make sites work. Chromium (the associated upstream project) is open source, but isn't really run as a community project, and, pointedly, very very few people run Chromium itself. I'd love to see that change, but I'd also like to see Firefox regain a meaningful presence. Miller also said Fedora's next release is focused on simplicity. ("When the OS gets in the way, it drops from the conversation I want to have about big ideas to ... well, the boring technical details that people never want to deal with") And he also shared his thoughts on what Linux needs most. "What I'd really like to see more of are more non-technical contributors. I mean, yes, we can always benefit from more packagers and coders and engineers, but I think what we really need desperately are writers, designers, artists, videographers, communicators, organizers and planners. I don't think big companies are likely to provide those things, at least, not for the parts of the Linux world which aren't their products." "We need people who think the whole grand project I've been talking about is important, and who have the skills and interests to help make it real."' -- source: https://linux.slashdot.org/story/22/05/01/014252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

30,000 New Users Signed Up For Mastodon After Elon Musk Bought Twitter
by Peter Reutemann 29 Apr '22

29 Apr '22

'Motherboard: Social media platform Mastodon, often seen as an alternative to Twitter, gained nearly 30,000 new users on the day that Elon Musk bought Twitter. On Tuesday a Mastodon domain became unresponsive. Eugen Rochko, Mastodon's CEO, later told Motherboard in an email that there were performance issues. "I'm sorry I couldn't have responded sooner," he wrote. "I was working all day on fixing performance issues on the Mastodon servers I operate due to the influx of new and returning users following Twitter's acquisition by Elon Musk." Rochko added that Mastodon has seen an increase of 41,287 active users, including both returning users and new users. When breaking that figure down by just new users, 28,391 new people have joined Mastodon in the past day, Rochko said. Mastodon is a piece of open-source software that people can use as a base to create their own social networks. Although its appearance is similar to Twitter, it also differs from Twitter in the sense that Twitter is a single social network people sign up for. When it comes to the social network side of things, Mastodon holds more similarities with Discord, in that users have to find specific Mastodon instances to join. Those looking to create their own Mastodon instance also have to host it themselves, a step that may alienate many non-technical users. Donald Trump's social media site, Truth Social, is based on Mastodon and was recently called out by the company for failing to provide the source code for the site built on top of it. Two weeks later, the social media site quietly acknowledged Mastodon in a dedicated section labeled "open source." In regard to the matter, Mastodon founder Eugen Rochko said: "Compliance with our AGPLv3 license is very important to me as that is the sole basis upon which I and other developers are willing to give away years of work for free." Twitter did confirm some fluctuations in follower counts after Musk's deal was made official, although they said they were organic in nature.' -- source: https://news.slashdot.org/story/22/04/27/2141231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

One of the most powerful DDoSes ever targets cryptocurrency platform
by Peter Reutemann 29 Apr '22

29 Apr '22

'A cryptocurrency platform was recently on the receiving end of one of the biggest distributed denial-of-service attacks ever after threat actors bombarded it with 15.3 million requests, content delivery network Cloudflare said. DDoS attacks can be measured in several ways, including by the volume of data, the number of packets, or the number of requests sent each second. The current records are 3.4 terabits per second for volumetric DDoSes—which attempt to consume all bandwidth available to the target—and 809 million packets per second, and 17.2 million requests per second. The latter two records measure the power of application-layer attacks, which attempt to exhaust the computing resources of a target’s infrastructure. Cloudflare's recent DDoS mitigation peaked at 15.3 million requests per second. While still smaller than the record, its power was more considerable because the attack was delivered through HTTPS requests rather than HTTP requests used in the record. Because HTTPS requests are much more compute-intensive than HTTP requests, the latest attack had the potential to put much more strain on the target.' -- source: https://arstechnica.com/information-technology/2022/04/one-of-the-most-powe… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: New Zealand Cyber Security Challenge 2022
by Peter Reutemann 29 Apr '22

29 Apr '22

Considering our cyber security theme from this week, some of you might want to participate in the (free) challenge outlined below. Cheers, Peter ---------- Forwarded message --------- From: Buddhika Subasinghe <buddhika.subasinghe(a)waikato.ac.nz> Date: Fri, Apr 29, 2022 at 10:28 AM Subject: New Zealand Cyber Security Challenge 2022 To: Computing Staff: CS & SE <computing-staff(a)waikato.ac.nz>, Mathematics Staff <maths-staff(a)waikato.ac.nz>, Design staff: NZ <design-nz(a)waikato.ac.nz > Hi all FYI Please see the message below from Harpreet re the NZ Cyber Security Challenge 2022. Please contact Vimal vimal.kumar(a)waikato.ac.nz ro Harpreet harpreet.kaur(a)waikato.ac.nz if you need any further information about this event. Many thanks! Buddhika On Fri, Apr 29, 2022 at 9:26 AM Harpreet Kaur <harpreet.kaur(a)waikato.ac.nz> wrote: > Dear Buddhika, > > This is the email we want to regulate in the cs list. Much appreciated > your help! > > > *Hi All,* > *Cyber Security Researchers of Waikato (CROW) team is organising the NZ > Cyber Security Challenge again this year. Could you please distribute this > email invitation to your students?* > > ------------------------------------------------------------------------------------------ > *New Zealand Cyber Security Challenge 2022* > > The NZ Cyber Security Challenge is back for its 9th edition. Participation > is free and as always there are a number of prizes to be won. > > We invite anyone interested in cybersecurity to join and take part in the > challenge. The challenge will start with an online CTF round (Round 0). We > will then invite the top 150 participants to the University of Waikato > campus for the main competition involving Rounds 1,2, a networking lunch, > cybersecurity talks and a side challenge. > > The schedule of the NZCSC’22 is as follows: > > - > > 04 June - 22 June: > - > > Online Round 0: open for everyone > > > - > > 15 June - 22 June: > - > > Online Waikato x Cardiff Challenge (special round for Waikato and > Cardiff University Students) > - > > 22-23 July : > - > > Round 1 - Incident Response round > - > > Round 2 - Capture the Flag > - > > Side Challenge > - > > Networking lunch and talks from the industry > > Feel free to contact me (vimal.kumar(a)waikato.ac.nz) or Harpreet Kaur ( > harpreet.kaur(a)waikato.ac.nz) if you have any questions. More information > and the Registration of Interest link can be found on the event website. > > https://cybersecuritychallenge.org.nz/ > > > We look forward to hosting you at the event! > > > > -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PFSense - additional info
by Roger Hardy 27 Apr '22

27 Apr '22

Hi all. These are the manuals for the small boards we use to run remote installs. https://pcengines.ch/pdf/apu4.pdf Better details here https://www.pcengines.ch/apu4c4.htm You can even download the schematics there. Price lists here https://www.pcengines.ch/order.htm As I said, these are cheaper than the netgate ones, that can be seen at https://www.netgate.com/appliances The "manual" for PFSense is here https://docs.netgate.com/pfsense/en/latest/ And just for giggles, I checked their (netgate) support prices. Not too bad for a business. https://www.netgate.com/support And they have a pretty interesting service called "Zero to Ping" where "they will help get your Netgate appliance connected to the Internet and one client on the same network online." Feel free to ask any questions, about either PFSense or the APU devices. Roger

1 0

Concerns Raised Over The 'New' NTFS Linux Driver That Merged Last Year
by Peter Reutemann 27 Apr '22

27 Apr '22

'In 2020, Paragon Software announced they wanted to upstream their previously proprietary NTFS driver into Linux. After a year of review, the NTFS3 driver was added to the Linux 5.15 kernel. While Paragon pledged to maintain their driver, there have been no major updates to the driver despite a growing list of patches that have submitted. Developer Kari Argillander has raised his concerns on the mailing list that the driver is orphaned, and that the Paragon maintainer has not responded to any messages about fixes. An offer to co-maintain the driver has also been met with "radio silence".' -- source: https://linux.slashdot.org/story/22/04/26/1749239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New OpenSSH Version On Debian Unstable
by Lawrence D'Oliveiro 24 Apr '22

24 Apr '22

Did my periodic OS upgrade today, and one change that has had an (easy to fix) impact on my backup system is that OpenSSH 9.0 is phasing out the special protocol that was used to implement the scp command, in favour of using the same one as for sftp. One difference this makes is with file specs that contain shell-special characters (e.g. spaces). Previously, when specifying such to the scp command in the shell, you had to do two levels of escaping, one to get them past the local shell, and another to work with the remote shell. But now, the second level of escaping for the remote end is no longer needed. The release notes describe this second level of quoting as “finicky and brittle”, so all in all things are simpler without it.

1 1

Major cryptography blunder in Java enables “psychic paper” forgeries
by Peter Reutemann 22 Apr '22

22 Apr '22

'Organizations using newer versions of Oracle’s Java framework woke up on Wednesday to a disquieting advisory: A critical vulnerability can make it easy for adversaries to forge TLS certificates and signatures, two-factor authentication messages, and authorization credentials generated by a range of widely used open standards. The vulnerability, which Oracle patched on Tuesday, affects the company’s implementation of the Elliptic Curve Digital Signature Algorithm in Java versions 15 and above. ECDSA is an algorithm that uses the principles of elliptic curve cryptography to authenticate messages digitally. A key advantage of ECDSA is the smaller size of the keys it generates, compared to RSA or other crypto algorithms, making it ideal for use in standards including FIDO-based 2FA, the Security Assertion Markup Language, OpenID, and JSON.' -- source: https://arstechnica.com/information-technology/2022/04/major-crypto-blunder… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical bug could have let hackers commandeer millions of Android devices
by Peter Reutemann 22 Apr '22

22 Apr '22

'Security researchers said they uncovered a vulnerability that could have allowed hackers to commandeer millions of Android devices equipped with mobile chipsets made by Qualcomm and MediaTek. The vulnerability resided in ALAC—short for Apple Lossless Audio Codec and also known as Apple Lossless—which is an audio format introduced by Apple in 2004 to deliver lossless audio over the Internet. While Apple has updated its proprietary version of the decoder to fix security vulnerabilities over the years, an open-source version used by Qualcomm and MediaTek had not been updated since 2011. Together, Qualcomm and MediaTek supply mobile chipsets for an estimated 95 percent of US Android devices.' The buggy ALAC code contained an out-of-bounds vulnerability, meaning it retrieved data from outside the limits of allocated memory. Hackers could exploit this mistake to force the decoder to execute malicious code that otherwise would be off-limits. “The ALAC issues our researchers found could be used by an attacker for remote code execution attack (RCE) on a mobile device through a malformed audio file,” security firm Check Point said on Thursday. “RCE attacks allow an attacker to remotely execute malicious code on a computer. The impact of an RCE vulnerability can range from malware execution to an attacker gaining control over a user’s multimedia data, including streaming from a compromised machine’s camera.” -- source: https://arstechnica.com/information-technology/2022/04/critical-bug-could-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Now Hopes To IPO in 2023
by Peter Reutemann 22 Apr '22

22 Apr '22

'The saga of Ubuntu-maker Canonical's IPO efforts now stretches back quite a few years. I think the first time I talked to the company's founder Mark Shuttleworth about going public was in 2018, though there had already been some chatter about it in previous years. But the timing never quite worked out for Canonical. In a press briefing ahead of today's launch of Ubuntu 22.04 LTS, Shuttleworth noted he now expects it to go public next year. "We are on track to float the business. And now I'm pretty confident that we will do that in 2023," said Shuttleworth, who was calling in from an undisclosed island off the coast of West Africa. "And so we're taking active steps at the board level and in our finance operation -- various other parts of the business -- to be prepared for that. We're now effectively on a very clear program to a flotation of the business next year." He stressed that Canonical is not in a situation where it has to raise outside money and that going public for him is not about fundraising. He noted that Canonical's revenue last year was $175 million and that the company's biggest challenge right now is that demand is bigger that the company's ability to service it, in large part because there isn't enough talent on the market for the company to hire.' -- source: https://news.slashdot.org/story/22/04/21/1333228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Volla Phone 22 Runs Ubuntu Touch Or a Privacy-Focused Android Fork Or Both
by Peter Reutemann 20 Apr '22

20 Apr '22

'The Volla Phone 22, a new smartphone available for preorder via a Kickstarter campaign, is unlike any other smartphone on the market today in that it ships with a choice of the Android-based Volla OS or the Ubuntu Touch mobile Linux distribution. "It also supports multi-boot functionality, allowing you to install more than one operating system and choose which to run at startup," writes Liliputing's Brad Linder. Some of the hardware specs include a 6.3-inch FHD+ display, a MediaTek Helio G85 processor, 4GB of RAM, 128GB storage, 3.5mm audio jack and a microSD card reader. There's also a 48-megapixel main camera sensor and replaceable 4,500mAh battery. From the report: While Volla works with the folks at UBPorts to ensure its phones are compatible with Ubuntu Touch, the company develops the Android-based Volla OS in-house. It's based on Google's Android Open Source Project code, but includes a custom launcher, user interface, and set of apps with an emphasis on privacy. The Google Play Store is not included, as this is a phone aimed at folks who want to minimize tracking from big tech companies. Other Google apps and services like the Chrome web browser, Google Maps, Google Drive, and Gmail are also omitted. The upshot is that no user data is collected or stored by Volla, Google, or other companies unless you decide to install apps that track your data. Of course, that could make using the phone a little less convenient if you've come to rely on those apps, so the Volla Phone might not be the best choice for everyone. Volla OS also has a built-in user-customizable firewall, an App Locker feature for disabling and hiding apps, and optional support for using the Hide.me VPN for anonymous internet usage. The source code for Volla OS is also available for anyone that wants to inspect the code. The operating system also has a custom user interface including a Springboard that allows you to quickly launch frequently-used apps by pressing a red dot for a list, or by starting to type in a search box for automatic suggestions such as placing a phone call, sending a text message, or opening a web page. You can also create notes or calendar events from the Springboard or send an encrypted message with Signal. The phone is expected to ship in June at an early bird price of about $408.' -- source: https://news.slashdot.org/story/22/04/19/2131242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers can infect >100 Lenovo models with unremovable malware. Are you patched?
by Peter Reutemann 20 Apr '22

20 Apr '22

'Lenovo has released security updates for more than 100 laptop models to fix critical vulnerabilities that make it possible for advanced hackers to surreptitiously install malicious firmware that can be next to impossible to remove or, in some cases, to detect. Three vulnerabilities affecting more than 1 million laptops can give hackers the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, the UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the initial link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and even harder to remove. Two of the vulnerabilities—tracked as CVE-2021-3971 and CVE-2021-3972—reside in UEFI firmware drivers intended for use only during the manufacturing process of Lenovo consumer notebooks. Lenovo engineers inadvertently included the drivers in the production BIOS images without being properly deactivated. Hackers can exploit these buggy drivers to disable protections, including UEFI secure boot, BIOS control register bits, and protected range register, which are baked into the serial peripheral interface (SPI) and designed to prevent unauthorized changes to the firmware it runs.' -- source: https://arstechnica.com/information-technology/2022/04/bugs-in-100-lenovo-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Tuesday (!)
by Peter Reutemann 20 Apr '22

20 Apr '22

Hi everyone We have a meeting next week on Tuesday, due to ANZAC day on Monday. Since we are back under Orange traffic light, we will attempt a hybrid meeting. Whilst the physical meeting will take place in MS4, everything will be transmitted via BigBlueButton. That way you won't miss out n case you can't or don't want to attend in person. Our topic: With increasing cyber security threats, it is high time that we look at how you can bolster the security of your Linux system and how you connect to the outside world. For this purpose, we will have short show and tells lined up: Roger will demo the pfSense firewall and router system based on FreeBSD, complete with a web-based user interface. A far simpler firewall, ufw (uncomplicated firewall), will be introduced by Peter (command-line and GUI). Angus will demo Wireguard, the VPN solutation that made it into the Linux kernel (starting with 5.6). Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776633/ If you want to demo something as well, then please contact me. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Details How China-Linked Crew’s Malware Hides Scheduled Windows Tasks
by Lawrence D'Oliveiro 18 Apr '22

18 Apr '22

Seems every week there is something new to learn about the (in)security of Microsoft Windows. In this description <https://www.theregister.com/2022/04/14/microsoft-tarrask-malware-in-windows/> of a malware attack, the software infection creates a scheduled task to automatically reinstall itself if it has been removed. So far, no big deal: on *nix we have cron, and systemd timers, that do much the same thing. But on Windows, these scheduled tasks have “security descriptors” -- basically, ACLs, as far as I have been able to determine, that control who can manage these tasks or even see them. So if a program creates a task and deletes all its security descriptors, the task effectively becomes invisible to the normal Windows admin tools. Except, it can still be seen and managed through its Registry entries. So, having write access to the Registry lets you bypass the entire security-descriptor mechanism, yet it still does not let you see these tasks in any other way? Like the “security” those higher-level tools think they are enforcing is a complete mirage, and end up making the system, not more, but less, secure.

1 0

Git For Windows Issues Update To Fix Running-Someone-Else's-Code Vulnerability
by Peter Reutemann 14 Apr '22

14 Apr '22

'The Git team has issued an update to fix a bug in Git for Windows that "affects multi-user hardware where untrusted parties have write access to the same hard disk," reports The Register. Specifically, the update is concerned with CVE-2022-24765. From the report: Arguably, if an "untrusted party" has write access to a hard disk, then all bets are off when it comes to the nooks and crannies of a PC anyway. In this case, the miscreants would only need to create the folder c:\.git, "which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory," according to NIST. The result is that Git would use the config in the directory. NIST went on to list potentially vulnerable products, which included Visual Studio. "Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash." The Git team was little blunter about the vulnerability, and warned that "Merely having a Git-aware prompt that runs 'git status' (or 'git diff') and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user." [...] To deal with the issue, the Git team recommends an update. Alternatively, a user could create that .git folder themselves and remove read/write access as workaround or "define or extend 'GIT_CEILING_DIRECTORIES' to cover the parent directory of the user profile," according to NIST. ' -- source: https://it.slashdot.org/story/22/04/13/2140258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tim Cook Invokes Eisenhower
by Lawrence D'Oliveiro 13 Apr '22

13 Apr '22

Apple’s CEO gave a speech at a gathering of the International Association of Privacy Professionals <https://arstechnica.com/gadgets/2022/04/tim-cook-delivers-speech-railing-ag…>, where he claimed that Apple has “a commitment to protecting people from a data industrial complex built on a foundation of surveillance”. He particularly hates regulatory proposals to force Apple and other platform owners to allow sideloading of apps, claiming That means data-hungry companies would be able to avoid our privacy rules, and once again track our users against their will. In other words, we should trust companies like his to keep their word, and not fall back on Big Bad Government Regulation. If it weren’t for Governments, the world would end up run by corporations. Which would you prefer?

1 0