- wlug - list.wlug.org.nz

Trend says hackers have weaponized SpringShell to install Mirai malware
by Peter Reutemann 12 Apr '22

12 Apr '22

'Researchers on Friday said that hackers are exploiting the recently discovered SpringShell vulnerability to successfully infect vulnerable Internet of Things devices with Mirai, an open source piece of malware that wrangles routers and other network-connected devices into sprawling botnets. The Internet’s biggest players are all affected by critical Log4Shell 0-day When SpringShell (also known as Spring4Shell) came to light last Sunday, some reports compared it to Log4Shell, the critical zero-day vulnerability in the popular logging utility Log4J that affected a sizable portion of apps on the Internet. That comparison proved to be exaggerated because the configurations required for SpringShell to work were by no means common. To date, there are no real-world apps known to be vulnerable. Researchers at Trend Micro now say that hackers have developed a weaponized exploit that successfully installs Mirai. A blog post they published didn’t identify the type of device or the CPU used in the infected devices. The post did, however, say a malware file server they found stored multiple variants of the malware for different CPU architectures.' -- source: https://arstechnica.com/information-technology/2022/04/trend-says-hackers-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox downloads PDF files to home directory when viewing
by Peter Reutemann 12 Apr '22

12 Apr '22

Hi everyone One annoying new feature that showed up in Firefox recently is that it downloads PDF files to my home directory rather then /tmp when I'm only viewing them. The following thread discusses this: https://support.mozilla.org/en-US/questions/1370409 All you have to do is go to the configuration ("about:config" in URL bar) and change the following option to "false: browser.download.improvements_to_download_panel Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The End Of Byte Magazine
by Lawrence D'Oliveiro 12 Apr '22

12 Apr '22

I’ve been browsing through a few more of those old issues of Byte magazine, up to its shutdown in 1998. In the final, July, issue, among the items promised as “coming up in August”, was a “software lab report” on “free Unixes”: “We test Linux and FreeBSD to see how they measure up against their commercial cousins as servers and development platforms”. Presumably as per the typical magazine publishing pipeline, that report had already been done and written up by that point; I wonder if it ever got published anywhere ... Linux had been getting a few small mentions in the prior issues, along with other free software such as Perl for website development. Though the writers kept referring to these as “freeware” ... Also in that issue was a mention of an unusual new PC design, called the “Rock City”, from a company called the Panda Project. It was the shape of a cube, balanced on one corner (where the stand was attached). Hunting around, I found a short item, with one small, intriguing-looking picture, here <https://www.fatsofa.com/rockcity.html>. The actual company website is of course long gone; I tried looking for copies at archive.org, but while the text of the website back to 1998 is there, the pictures are not.

2 1

Raspberry Pi OS Ditches Longtime User Account For Security Reasons
by Peter Reutemann 09 Apr '22

09 Apr '22

'Ars Technica: Since its launch, the Raspberry Pi OS (and most operating systems based on it) has shipped with a default "pi" user account, making it simpler to boot up a Pi and start working without needing to hook up the device to a monitor or go through a multi-step setup process. But as of today, that's changing -- new installs of the Raspberry Pi OS are shedding that default user account for both security and regulatory reasons. Raspberry Pi Foundation software engineer Simon Long explains the thinking in this blog post. "[The "pi" user account] could potentially make a brute-force attack slightly easier, and in response to this, some countries are now introducing legislation to forbid any Internet-connected device from having default login credentials," he writes. This move will improve the Pi operating system's security. Before, even if you assigned a good password to the "pi" account, attackers could still assume with a reasonable degree of certainty that most Raspberry Pi boards were using the "pi" username. Many Pi OS-based operating systems also ship with the default "pi" user account enabled and are completely passwordless, requiring extra steps to assign the account a password in the first place. The flip side is that the change could break some software and scripts, particularly those that are hard-coded to use the "pi" user account and home folder. "[T]he Raspberry Pi OS now boots into a dedicated setup mode the first time you start it up instead of running the setup wizard as an app in the normal desktop environment," adds Ars. "And that setup wizard now prompts you to create a username and password rather than simply assigning a password to the default 'pi' user account. To aid with setup, the wizard can now pair Bluetooth keyboards and mice without requiring you to plug in a USB accessory first." The new version of the Pi OS also includes experimental support for the Wayland display server protocol, but Long says most people should ignore it for now since it's explicitly labeled as "experimental."' -- source: https://hardware.slashdot.org/story/22/04/08/2032252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Plans To Drop Support For Legacy BIOS Systems
by Peter Reutemann 08 Apr '22

08 Apr '22

'The Fedora 37 development team is considering dropping support for non-UEFI BIOS. Linuxiac reports: The Unified Extensible Firmware Interface, or UEFI, is a modern method of handling the boot process. UEFI is similar to Legacy; however, the boot data is stored in a .efi file rather than the firmware. In the case of Fedora, while the change may take some time, the new Fedora x86_64 installations will no longer work on non-UEFI platforms. On x86_64 architectures, Fedora 37 will mark legacy BIOS installation as deprecated in favor of UEFI. While systems already using Legacy BIOS to boot will continue to be supported, new Legacy BIOS installations on these architectures will be impossible. ' -- source: https://linux.slashdot.org/story/22/04/07/2049257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese Hackers Abuse VLC Media Player To Launch Malware Loader
by Peter Reutemann 08 Apr '22

08 Apr '22

'Security researchers have uncovered a long-running malicious campaign from hackers associated with the Chinese government who are using VLC Media Player to launch a custom malware loader. BleepingComputer reports: The campaign appears to serve espionage purposes and has targeted various entities involved in government, legal, and religious activities, as well as non-governmental organizations (NGOs) on at least three continents. This activity has been attributed to a threat actor tracked as Cicada (a.k.a. menuPass, Stone Panda, Potassium, APT10, Red Apollo) that has been active for more than 15 years, since at least 2006. Brigid O Gorman of Symantec Threat Hunter Team told BleepingComputer that the attacker uses a clean version of VLC with a malicious DLL file in the same path as the media player's export functions. The technique is known as DLL side-loading and it is widely used by threat actors to load malware into legitimate processes to hide the malicious activity. Apart from the custom loader, which O Gorman said Symantec does not have a name but has been seen in previous attacks attributed to Cicada/APT10, the adversary also deployed a WinVNC server to gain remote control over victim systems. The attacker also executed the Sodamaster backdoor on compromised networks, a tool believed to be used exclusively by the Cicada threat group since at least 2020. Sodamaster runs in the system memory (fileless) and is equipped to evade detection by looking in the registry for clues of a sandbox environment or by delaying its execution. The malware can also collect details about the system, search for running processes, and download and execute various payloads from the command and control server. [...] The attackers' dwell time on the networks of some of the discovered victims lasted for as long as nine months, the researchers note in a report today. ' -- source: https://it.slashdot.org/story/22/04/06/2144218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

disable "Pocket" in Firefox
by Peter Reutemann 08 Apr '22

08 Apr '22

Hi everyone If you find that "Pocket" in Firefox is getting in your way or you simply don't want to use it, just do the following to disable it: - in the URL bar, type about:config (and click on "show all") - and toggle "extensions.pocket.enabled" to "false" >From here: https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zyxel patches critical vulnerability that can allow Firewall and VPN hijacks
by Peter Reutemann 05 Apr '22

05 Apr '22

'Hardware manufacturer Zyxel has issued patches for a highly critical security flaw that gives malicious hackers the ability to take control of a wide range of firewalls and VPN products the company sells to businesses. The flaw is an authentication bypass vulnerability that stems from a lack of a proper access-control mechanism in the CGI (common gateway interface) of affected devices, the company said. Access control refers to a set of policies that rely on passwords and other forms of authentication to ensure resources or data are available only to authorized people. The vulnerability is tracked as CVE-2022-0342. “The flaw could allow an attacker to bypass the authentication and obtain administrative access of the device,” Zyxel said in an advisory. The severity rating is 9.8 out of a possible 10.' -- source: https://arstechnica.com/information-technology/2022/04/zyxel-patches-critic… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Infinite Mac' Project Lets You Boot Up Mac OS In Your Browser
by Peter Reutemann 03 Apr '22

03 Apr '22

'Ars Technica: What makes the ["Infinite Mac"] project unique isn't necessarily the fact that it's browser-based; it has been possible to run old DOS, Windows, and Mac OS versions in browser windows for quite a while now. Instead, it's the creative solutions that developer Mihai Parparita has come up with to enable persistent storage, fast download speeds, reduced processor usage, and file transfers between the classic Mac and whatever host system you're running it on. Parparita details some of his work in this blog post. Beginning with a late 2017 browser-based port of the Basilisk II emulator, Parparita wanted to install old apps to more faithfully re-create the experience of using an old Mac, but he wanted to do it without requiring huge downloads or running as a separate program as the Macintosh.js project does. To solve the download problem, Parparita compressed the disk image and broke it up into 256K chunks that are downloaded on demand rather than up front. "Along with some old fashioned web optimizations, this makes the emulator show the Mac's boot screen in a second and be fully booted in 3 seconds, even with a cold HTTP cache," Parparita wrote. CPU usage was another issue. Old operating systems and processors didn't really distinguish between active and idle processor states -- your computer was either on or off. So when you emulate these old systems, they'll ramp one of your CPU cores to 100% whether you're actually using the emulator or not. Parparita used existing Basilisk II features to reduce CPU usage, only requiring full performance when "there was user input or a screen refresh was required." Infinite Mac won't run later releases of classic Mac OS (including 8.5, 8.6, and 9) because those releases ran exclusively on PowerPC Macs, dropping support for the old Motorola 68000-based processors. Emulators like QEMU are capable of emulating PowerPC Macs, but (at least as far as I am aware) there are no easy browser-based implementations that exist. Not yet, anyway.' -- source: https://apple.slashdot.org/story/22/04/01/2032251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

StarFive VisionFive RISC-V Single Board Computer
by Lawrence D'Oliveiro 29 Mar '22

29 Mar '22

A few videos have appeared on YouTube in the last few days about this VisionFive board. Instead of an ARM chip, it uses a RISC-V CPU, but of course it runs Linux. It’s quite clearly gunning for the Raspberry π market, both in its configuration and pricewise, though I don’t think it’s as powerful as a π 4. StarFive Technology have a few quite technical-looking videos on their channel, seemingly going into details like how the OS boots. I’ll see if I can find a decent hands-on review.

1 0

Mozilla To Offer MDN Premium Tier
by Lawrence D'Oliveiro 28 Mar '22

28 Mar '22

The Mozilla Developer Network <https://developer.mozilla.org/en-US/docs/Web> is a really good resource if you’re doing any kind of web development. I’ve found all kinds of well-explained technical detail there that is simply missing from other sources (*cough* w3schools *cough*). Now Mozilla is trying to get some money from it. They’re not taking anything away from existing access, they are merely offering extra personalization features on a paid basis <https://www.theregister.com/2022/03/24/mozillas_mdn_subscription/>.

1 0

'Rolling Rhino' Tool Converts Ubuntu Into a Rolling Release
by Peter Reutemann 28 Mar '22

28 Mar '22

'"Rolling Rhino is a tool long ago created by Martin Wimpress, who until recently was part of the Canonical team," one Linux blog pointed out recently. "What it does is basically change the repositories of the DailyLive developers...." Neowin sees it as a competitive advantage. After more than 17 years, there's a way to get a Ubuntu distro offering the same "rolling" release cycles that helped popularize Arch Linux: While there are many positive qualities that would draw a user into the world of Arch, its headlining feature would be the one that remains the most relevant in today's world of continuous integration and delivery and that's its rolling release strategy. While I don't think Judd Vinet could have predicted the proliferation of DevOps or the massive shift to cloud computing, it must be interesting to see that the entire industry is following the Arch strategy in all sorts of different places. One could even argue that Microsoft Windows has become a rolling release. While many of Arch's contemporaries have joined the fray, one notable open-source giant has yet to make the leap. Rolling Rhino looks to change that by converting Ubuntu into a rolling release.' -- source: https://news.slashdot.org/story/22/03/27/0035232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE's New Swipe Gesture Makes Windows 11 Look Bad
by Peter Reutemann 28 Mar '22

28 Mar '22

'"Microsoft has been struggling to reach a state of convergence between tablet and desktop ever since Windows 8 and the original Surface," argues Neowin, adding "If we're using Windows 11 as a barometer of their progress, they'll likely never get there...." But meanwhile, writes Slashdot reader segaboy81, "KDE's new swipe gesture is awesome. It's about 1000% smoother than the overview in Windows 11 and the swiping mechanism is easier, too. Is KDE getting better for tablets?" >From Neowin's report: Starting in KDE Plasma 5.25, users with touch screen devices will be able to enter their tasks and virtual desktops overview by simply swiping down from the top edge, but with a special twist. The scale of the windows directly follows the path of your finger. The result is every bit as fluid as you might imagine. While you can achieve the same result in Windows 11 with a simple three-finger swipe up, this implementation looks great and performs great too.' -- source: https://tech.slashdot.org/story/22/03/27/201245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Is Reverse-Engineering Support For Apple Silicon, Including M1 Ultra
by Peter Reutemann 27 Mar '22

27 Mar '22

'Ars Technica: For months, a small group of volunteers has worked to get this Arch Linux-based distribution up and running on Apple Silicon Macs, adapting existing drivers and (in the case of the GPU) painstakingly writing their own. And that work is paying off -- last week, the team released its first alpha installer to the general public, and as of yesterday, the software supports the new M1 Ultra in the Mac Studio. In the current alpha, an impressive list of hardware already works, including Wi-Fi, USB 2.0 over the Thunderbolt ports (USB 3.0 only works on Macs with USB-A ports, but USB 3.0 over Thunderbolt is "coming soon"), and the built-in display. But there are still big features missing, including DisplayPort and Thunderbolt, the webcam, Bluetooth, sleep mode, and GPU acceleration. That said, regarding GPU acceleration, the developers say that the M1 is fast enough that a software-rendered Linux desktop feels faster on the M1 than a GPU-accelerated desktop feels on many other ARM chips. Asahi's developers don't think the software will be "done," with all basic M1-series hardware and functionality supported and working out of the box, "for another year, maybe two." By then, Apple will probably have introduced another generation or two of M-series chips. But the developers are optimistic that much of the work they're doing now will continue to work on future generations of Apple hardware with relatively minimal effort. [...] If you want to try Asahi Linux on an M1 Mac, the current installer is run from the command line and requires "at least 53GB of free space" for an install with a KDE Plasma desktop. Asahi only needs about 15GB, but the installer requires you to leave at least 38GB of free space to the macOS install so that macOS system updates don't break. From there, dual-booting should work similarly to the process on Intel Macs, with the alternate OS visible from within Startup Disk or the boot picker you can launch when your start your Mac. Future updates should be installable from within your new Asahi Linux installation and shouldn't require you to reinstall from scratch.' -- source: https://linux.slashdot.org/story/22/03/25/2333245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ted Nelson Quote From 1995
by Lawrence D'Oliveiro 26 Mar '22

26 Mar '22

I was prompted to browse through old scanned issues of “Byte” magazine (available from vintageapple.org) after watching a YouTube video by a guy who has collected a complete set of actual paper issues <https://www.youtube.com/watch?v=0lU537upx3c>. In the November 1995 issue, there was a back-page column by Ted Nelson (originator of the terms “hypertext” and “hypermedia”) called “Things To Come”, where he casually threw out a bunch of prognostications on how he thought computing would develop. I was struck by this quote, under the title “Tomorrow’s killer applications”: My hope is that there will be no more applications, because future software will be set up to be tied together, piped together, scripted together. I would say that has partially come true. We have a lot of software components now that can be reused via scriptable APIs, or even just shell scripts. However, nobody considered that such usage is the anithesis of how GUIs work. Most of the predictions in the rest of the column were, shall we say, a bit wide of the mark. For example, the next sentence after the above was “The real killer applications will be nanotech bugs that escape”, which is perhaps best left to just lie there quietly ...

1 0

topic for next wlug meeting?
by Peter Reutemann 25 Mar '22

25 Mar '22

Hi everyone At this stage, we don't have a speaker lined up for this month's virtual meeting (we're still at the Red traffic light). With the current world situation and increasing cyber security threats, I was wondering whether we should have a meeting where we discuss together (and showcase) various tools that we can run or use to make our online life safer. A non-exhaustive list: firewalls, virus scanners, rootkit detectors, VPNs. Thoughts? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Two Years After Chrome and Edge, Firefox is Getting AV1 Hardware Acceleration
by Peter Reutemann 24 Mar '22

24 Mar '22

'Firefox is finally gaining proper AV1 support. Neowin reports: According to an update made to a post on Bugzilla, the Mozilla Foundation is finally ready to add hardware acceleration for the AV1 video format. Developers plan to implement improved AV1 support in the upcoming release of Firefox 100, scheduled to arrive on May 3, 2022. Hardware acceleration for AV1 video brings several noticeable benefits to customers. The standard developed by Alliance for Open Media and initially released in March 2018 offers better video compression than H.264 (about 50%) and VP9 (about 20%). Shifting AV1 video processing from software to hardware improves efficiency and reduces energy consumption, resulting in better battery life on tablets and laptops. Google and Microsoft announced hardware-accelerated AV1 video in Chrome and Edge in late 2020. Mozilla, on the other hand, did not rush to introduce improved AV1 support in Firefox. While it is easy to dunk on Firefox, there is a reason why developers took their time. Hardware-accelerated AV1 video is not something you can add to any computer with Windows 10, and it requires a PC with the most recent and powerful hardware.' -- source: https://news.slashdot.org/story/22/03/23/1359219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's Messages, Dialer Apps Quietly Sent Text, Call Info To Google
by Peter Reutemann 23 Mar '22

23 Mar '22

'Google's Messages and Dialer apps for Android devices have been collecting and sending data to Google without specific notice and consent, and without offering the opportunity to opt-out, potentially in violation of Europe's data protection law. From a report: According to a research paper, "What Data Do The Google Dialer and Messages Apps On Android Send to Google?" [PDF], by Trinity College Dublin computer science professor Douglas Leith, Google Messages (for text messaging) and Google Dialer (for phone calls) have been sending data about user communications to the Google Play Services Clearcut logger service and to Google's Firebase Analytics service. "The data sent by Google Messages includes a hash of the message text, allowing linking of sender and receiver in a message exchange," the paper says. "The data sent by Google Dialer includes the call time and duration, again allowing linking of the two handsets engaged in a phone call. Phone numbers are also sent to Google." The timing and duration of other user interactions with these apps has also been transmitted to Google. And Google offers no way to opt-out of this data collection. [...] Both pre-installed versions of these apps, the paper observes, lack app-specific privacy policies that explain what data gets collected -- something Google requires from third-party developers. And when a request was made through Google Takeout for the Google Account data associated with the apps used for testing, the data Google provided did not include the telemetry data observed.' -- source: https://yro.slashdot.org/story/22/03/22/2146234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Random Number Generator Sees Major Improvements
by Peter Reutemann 22 Mar '22

22 Mar '22

'An anonymous Slashdot reader summarizes some important news from the web page of Jason Donenfeld (creator of the open-source VPN protocol WireGuard): The Linux kernel's random number generator has seen its first set of major improvements in over a decade, improving everything from the cryptography to the interface used. Not only does it finally retire SHA-1 in favor of BLAKE2s [in Linux kernel 5.17], but it also at long last unites '/dev/random' and '/dev/urandom' [in the upcoming Linux kernel 5.18], finally ending years of Slashdot banter and debate: The most significant outward-facing change is that /dev/random and /dev/urandom are now exactly the same thing, with no differences between them at all, thanks to their unification in random: block in /dev/urandom. This removes a significant age-old crypto footgun, already accomplished by other operating systems eons ago. [...] The upshot is that every Internet message board disagreement on /dev/random versus /dev/urandom has now been resolved by making everybody simultaneously right! Now, for the first time, these are both the right choice to make, in addition to getrandom(0); they all return the same bytes with the same semantics. There are only right choices. Phoronix adds: One exciting change to also note is the getrandom() system call may be a hell of a lot faster with the new kernel. The getrandom() call for obtaining random bytes is yielding much faster performance with the latest code in development. Intel's kernel test robot is seeing an 8450% improvement with the stress-ng getrandom() benchmark. Yes, an 8450% improvement.' -- source: https://linux.slashdot.org/story/22/03/19/1821254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

KDE Konsole Shows Colours!
by Lawrence D'Oliveiro 22 Mar '22

22 Mar '22

I noticed this happening in my Konsole terminal windows very occasionally over the last couple of months: a little coloured square with a black border would momentarily appear, then disappear when I moved the mouse. I never quite figured out what was going on, thought it was a window manager glitch or something ... until today. It appears Konsole has this (undocumented?) feature where, if you hover over the name of a colour in a terminal session, it will helpfully pop up this square showing what the colour looks like. The colour names come from the traditional X11 set in /usr/share/X11/rgb.txt, with limits: it only looks at single-word names, and does not match names with numeric suffixes. Thus, “darkmagenta” will work (case-insensitive match against “DarkMagenta”), while “dark magenta” only matches the “magenta” part, and “magenta1” is not recognized at all. It will also recognize a sequence of 3 or 6 hex digits preceded by “#” -- “#rgb” or “#rrggbb”, as commonly used in HTML. Just tried 8 hex digits -- “#rrggbbaa” with alpha transparency -- and that works too. This feature might be new in Konsole 21.08 or something.

1 0

Browser-in-the-Browser Attack Can Trick Even Savvy Users
by Peter Reutemann 22 Mar '22

22 Mar '22

'Ars Technica: Hundreds of thousands of sites use the OAuth protocol to let visitors login using their existing accounts with companies like Google, Facebook, or Apple. Instead of having to create an account on the new site, visitors can use an account that they already have -- and the magic of OAuth does the rest. The Browser-in-the-Browser (BitB) technique capitalizes on this scheme. Instead of opening a genuine second browser window that's connected to the site facilitating the login or payment, BitB uses a series of HTML and cascading style sheets (CSS) tricks to convincingly spoof the second window. The URL that appears there can show a valid address, complete with a padlock and HTTPS prefix. The layout and behavior of the window appear identical to the real thing. While the method is convincing, it has a few weaknesses that should give savvy visitors a foolproof way to detect that something is amiss. Genuine OAuth or payment windows are in fact separate browser instances that are distinct from the primary page. That means a user can resize them and move them anywhere on the monitor, including outside the primary window. BitB windows, by contrast, aren't a separate browser instance at all. Instead, they're images rendered by custom HTML and CSS and contained in the primary window. That means the fake pages can't be resized, fully maximized or dragged outside the primary window. All users should protect their accounts with two-factor authentication. One other thing more experienced users can do is right click on the popup page and choose "inspect." If the window is a BitB spawn, its URL will be hardcoded into the HTML. ' -- source: https://it.slashdot.org/story/22/03/21/236242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A big bet to kill the password for good
by Peter Reutemann 21 Mar '22

21 Mar '22

'After years of tantalizing hints that a passwordless future is just around the corner, you're probably still not feeling any closer to that digital unshackling. Ten years into working on the issue, though, the FIDO Alliance, an industry association that specifically works on secure authentication, thinks it has finally identified the missing piece of the puzzle. On Thursday, the organization published a white paper that lays out FIDO's vision for solving the usability issues that have dogged passwordless features and, seemingly, kept them from achieving broad adoption. FIDO's members collaborated to produce the paper, and they span chipmakers like Intel and Qualcomm, prominent platform developers like Amazon and Meta, financial institutions like American Express and Bank of America, and the developers of all major operating systems—Google, Microsoft, and Apple. The paper is conceptual, not technical, but after years of investment to integrate what are known as the FIDO2 and WebAuthn passwordless standards into Windows, Android, iOS, and more, everything is now riding on the success of this next step.' -- source: https://arstechnica.com/information-technology/2022/03/a-big-bet-to-kill-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trickbot is using MikroTik routers to ply its trade. Now we know why
by Peter Reutemann 18 Mar '22

18 Mar '22

'For years, malicious hackers have been hacking large fleets of MikroTik routers and conscripting them into Trickbot, one of the Internet’s most destructive botnets. Now, Microsoft has finally figured out why and how the routers are being put to use. Trickbot came to light in 2016 as a trojan for stealing account passwords for use in bank fraud. Since then, Trickbot has mushroomed into one of the Internet's most aggressive threat platforms, thanks to its highly modular, multistage malware framework that provides a full suite of tools that are used to install ransomware and other forms of malware from other hacking groups. The malware driving Trickbot is notable for its advanced capabilities. It excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks, and performing reconnaissance that identifies infected computers belonging to high-value targets. The malware often uses readily available software like Mimikatz or exploits like EternalBlue, which was stolen from the National Security Agency.' -- source: https://arstechnica.com/information-technology/2022/03/trickbot-is-using-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher uses Dirty Pipe exploit to fully root a Pixel 6 Pro and Samsung S22
by Peter Reutemann 17 Mar '22

17 Mar '22

'A researcher has successfully used the critical Dirty Pipe vulnerability in Linux to fully root two models of Android phones—a Pixel 6 Pro and Samsung S22—in a hack that demonstrates the power of exploiting the newly discovered OS flaw. The researcher chose those two handset models for a good reason: they are two of the few—if not the only—devices known to run Android version 5.10.43, the only release of Google's mobile OS that's vulnerable to Dirty Pipe. Because the LPE, or local privilege escalation, vulnerability wasn't introduced until the recently released version 5.8 of the Linux kernel, the universe of exploitable devices—whether mobile, Internet of Things, or servers and desktops—is relatively small.' -- source: https://arstechnica.com/information-technology/2022/03/researcher-uses-dirt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nasty Linux Netfilter Firewall Security Hole Found
by Peter Reutemann 16 Mar '22

16 Mar '22

'Sophos threat researcher Nick Gregory discovered a hole in Linux's netfilter firewall program that's "exploitable to achieve kernel code execution (via ROP [return-oriented programming]), giving full local privilege escalation, container escape, whatever you want." ZDNet reports: Behind almost all Linux firewalls tools such as iptables; its newer version, nftables; firewalld; and ufw, is netfilter, which controls access to and from Linux's network stack. It's an essential Linux security program, so when a security hole is found in it, it's a big deal. [...] This problem exists because netfilter doesn't handle its hardware offload feature correctly. A local, unprivileged attacker can use this to cause a denial-of-service (DoS), execute arbitrary code, and cause general mayhem. Adding insult to injury, this works even if the hardware being attacked doesn't have offload functionality! That's because, as Gregory wrote to a security list, "Despite being in code dealing with hardware offload, this is reachable when targeting network devices that don't have offload functionality (e.g. lo) as the bug is triggered before the rule creation fails." This vulnerability is present in the Linux kernel versions 5.4 through 5.6.10. It's listed as Common Vulnerabilities and Exposures (CVE-2022-25636), and with a Common Vulnerability Scoring System (CVSS) score of 7.8), this is a real badie. How bad? In its advisory, Red Hat said, "This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a privilege escalation threat." So, yes, this is bad. Worse still, it affects recent major distribution releases such as Red Hat Enterprise Linux (RHEL) 8.x; Debian Bullseye; Ubuntu Linux, and SUSE Linux Enterprise 15.3. While the Linux kernel netfilter patch has been made, the patch isn't available yet in all distribution releases. ' -- source: https://linux.slashdot.org/story/22/03/15/221258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0