- wlug - list.wlug.org.nz

Should Intel Stop Making Chips?
by Lawrence D'Oliveiro 01 Jan '21

01 Jan '21

Intel has suffered more than one misstep in its recent attempts to move to more advanced chip-fabrication technologies. Performance-wise, AMD has been eating its breakfast. RISC-based alternative architectures like ARM and RISC-V are eating into the x86 market. Now an investor fund <https://arstechnica.com/gadgets/2020/12/activist-hedge-fund-advises-intel-t…> is suggesting that Intel outsource its chip-making facilities altogether (like AMD did years ago). This part was news to me: “Intel has lost some $60 billion in market value over the past year...”. According to Yahoo Finance <https://finance.yahoo.com/quote/INTC/>, its current market cap is just a bit over $200 billion. So that $60 billion represents a huge drop in its share price.

1 0

Mastodon Versus Gab
by Lawrence D'Oliveiro 29 Dec '20

29 Dec '20

(OK, this is an old article, but I just noticed it.) Mastodon is not a social network, but a “federation” of social networks. It is built on open-source protocols and software, which you can use to set up your own social-network node. You can then become part of the “fediverse” by associating with other Mastodon nodes, allowing users of one to interact with users of another. What is allowed on a node is entirely up the policies of the node admins. The Fediverse is intentionally decentralized, and admins of one node do not have the power to control what users do on another node. Contrast this with traditional social-networking sites like Facebook and Twitter, each of which is controlled by a single company. Naturally, such autonomy is a double-edged sword. So what do you do when the neo-Nazis move in? Gab, home of those who have promoted violence against various groups based on ethnicity, sexuality etc, is now a Mastodon node. How is the rest of the Fediverse dealing with them? The answer seems to be: you can’t stop them operating, but you can shun them. <https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-n…>

1 0

Linux Kernel Ported to the Nintendo 64
by Peter Reutemann 29 Dec '20

29 Dec '20

'Phoronix reports: It's been a turbulent year and 2020 is certainly ending interesting in the Linux/open-source space... If it wasn't odd enough seeing Sony providing a new official Linux driver for their PlayStation 5 DualSense controller for ending out the year, there is also a new Linux port to the Nintendo 64 game console... Yes, a brand new port to the game console that launched more than two decades ago. Open-source developer Lauri Kasanen who has contributed to Mesa and the Linux graphics stack took to developing a new Nintendo 64 port and announced it this Christmas day. This isn't the first time Linux has been ported to the N64 but prior attempts weren't aimed at potentially upstreaming it into the mainline Linux kernel... This fresh port to the N64 was pursued in part to help port emulators and frame-buffer or console games. And also, the announcement adds, "Most importantly, because I can."' -- source: https://linux.slashdot.org/story/20/12/28/0024241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Let’s Encrypt comes up with workaround for abandonware Android devices
by Peter Reutemann 29 Dec '20

29 Dec '20

'Things were touch-and-go for a while, but it looks like Let's Encrypt's transition to a standalone certificate authority (CA) isn't going to break a ton of old Android phones. This was a serious concern earlier due to an expiring root certificate, but Let's Encrypt has come up with a workaround. Let's Encrypt is a fairly new certificate authority, but it's also one of the world's leading. The service was a major player in the push to make the entire Web run over HTTPS, and as a free, open issuing authority, it went from zero certs to one billion certs in just four years. For regular users, the list of trusted CAs is usually issued by your operating system or browser vendor, so any new CA has a long rollout that involves getting added to the list of trusted CAs by every OS and browser on Earth as well as getting updates to every user. To get up and running quickly, Let's Encrypt got a cross-signature from an established CA, IdenTrust, so any browser or OS that trusted IdenTrust could now trust Let's Encrypt, and the service could start issuing useful certs. When it launched in 2016, Let's Encrypt also issued its own root certificate ("ISRG Root X1") and applied for it to be trusted by the major software platforms, most of which accepted it sometime that year. Now, several years later, with IdenTrust's "DST Root X3" certificate set to expire in September 2021, the time has come for Let's Encrypt to stand on its own and rely on its own root certificate. Since this was submitted four years ago, surely every Web-capable OS currently in use has gotten an update with Let's Encrypt's cert, right? That's true of every mainstream OS except for one. Sitting in the corner of the room, wearing a dunce cap, is Android, the world's only major consumer operating system that can't be centrally updated by its creator. Believe it or not, there are still quite a lot of people running a version of Android that hasn't been updated in four years. Let's Encrypt says it was added to Android's CA store in version 7.1.1 (released December 2016) and, according to Google's official stats, 33.8 percent of active Android users are on a version older than that. Given Android's 2.5 billion strong monthly active user base, that's 845 million people who have a root store frozen in 2016. Oh no.' -- source: https://arstechnica.com/gadgets/2020/12/lets-encrypt-comes-up-with-workarou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Websites That Won’t Let Go
by Lawrence D'Oliveiro 26 Dec '20

26 Dec '20

A friend asked me for help, saying some kind of “gambling app” had managed to attach itself to his Android phone, and kept popping up all the time. I figured he had been tricked into installing something, and we would probably have to track down the app, which likely had some innocuous name to obscure its purpose. Or possibly even worse, it had managed to take advantage of some vulnerability in his OS version to hide itself. Turned out it was a bit simpler than that. It was a website he had visited in Chrome (most likely following a link from an ad or something), which had an interesting technique to prevent him from getting away: it kept pestering him to allow it to access his location data. The trick was, it had maybe a hundred (maybe more) different site names of the form “«nn».example.com”, so when you blocked one, it would simply ask again, the request coming from a different number for «nn». The expectation obviously was that the user would eventually give up and allow one of these sites access. I was able to close the offending tab, but on quitting and restarting Chrome, it would come back. I figured out that his Chrome setting was to restore the last-visited page(s) when Chrome was restarted, which was why this page kept coming up. So I just turned off that setting. I thought maybe there was some deeper malware that would just bring the problem back when that setting was restored, and that he should consult somebody expert on more recent versions of Android to see about a permanent fix. But he suggested re-enabling that setting, just to confirm the problem was still there. And I did. And it wasn’t! So there was no obvious sign of any malware installation, it was just the website itself, exploiting a quirk of browser behaviour, to gain a lock on the user and blackmail them into giving up their location data.

1 0

Redox OS 0.6 Released With Many Fixes, Rewritten Kernel Memory Manager
by Peter Reutemann 26 Dec '20

26 Dec '20

'Redox OS, the micro-kernel based Rust-written operating system, is out with a new Christmas release. From a report: Redox OS 0.6 was released on Christmas Eve with many bug fixes and new features. Redox OS 0.6 features a complete rewrite of its RMM kernel memory manager, improvements to its Relibc C library implementation, Pkgar as a new package format, and Rust code compatibility updates. It's been the better part of two years since Redox 0.5 was released but moving forward they hope to start releasing new updates more often.' -- source: https://tech.slashdot.org/story/20/12/25/1349219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Citrix Devices Are Being Abused as DDoS Attack Vectors
by Peter Reutemann 26 Dec '20

26 Dec '20

'Threat actors have discovered a way to bounce and amplify junk web traffic against Citrix ADC networking equipment to launch DDoS attacks. From a report: While details about the attackers are still unknown, victims of these Citrix-based DDoS attacks have mostly included online gaming services, such as Steam and Xbox, sources have told ZDNet earlier today. The first of these attacks have been detected last week and documented by German IT systems administrator Marco Hofmann. Hofmann tracked the issue to the DTLS interface on Citrix ADC devices. DTLS, or Datagram Transport Layer Security, is a more version of the TLS protocol implemented on the stream-friendly UDP transfer protocol, rather than the more reliable TCP. Just like all UDP-based protocols, DTLS is spoofable and can be used as a DDoS amplification vector. ' -- source: https://tech.slashdot.org/story/20/12/25/1337207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Up To 3 Million Devices Infected By Malware-Laced Chrome and Edge Add-Ons
by Peter Reutemann 17 Dec '20

17 Dec '20

'As many as 3 million people have been infected by Chrome and Edge browser extensions that steal personal data and redirect users to ad or phishing sites, a security firm said on Wednesday. Ars Technica reports: In all, researchers from Prague-based Avast said they found 28 extensions for the Google Chrome and Microsoft Edge browsers that contained malware. The add-ons billed themselves as a way to download pictures, videos, or other content from sites including Facebook, Instagram, Vimeo, and Spotify. At the time this post went live, some, but not all, of the malicious extensions remained available for download from Google and Microsoft. Avast researchers found malicious code in the JavaScript-based extensions that allows them to download malware onto an infected computer. In a post, the researchers wrote: "Users have also reported that these extensions are manipulating their internet experience and redirecting them to other websites. Anytime a user clicks on a link, the extensions send information about the click to the attacker's control server, which can optionally send a command to redirect the victim from the real link target to a new hijacked URL before later redirecting them to the actual website they wanted to visit. User's privacy is compromised by this procedure since a log of all clicks is being sent to these third party intermediary websites. The actors also exfiltrate and collect the user's birth dates, email addresses, and device information, including first sign in time, last login time, name of the device, operating system, used browser and its version, even IP addresses (which could be used to find the approximate geographical location history of the user)." The researchers don't yet know if the extensions came with the malicious code preinstalled or if the developers waited for the extensions to gain a critical mass of users and only then pushed a malicious update. It's also possible that legitimate developers created the add-ons and then unknowingly sold them to someone who intended to use them maliciously. [...] The list Avast provides in its blog post includes links to download locations for both Chrome and Edge. Anyone who has downloaded one of these add-ons should remove it immediately and run a virus scan. ' -- source: https://it.slashdot.org/story/20/12/16/2138210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Officially Support Running Chrome OS On Old PCs
by Peter Reutemann 17 Dec '20

17 Dec '20

'This week, Google acquired a company called Neverware that allows users to turn their old PCs and Macs into a Chromebook with its CloudReady software. Now, Google is planning to make CloudReady into an official Chrome OS release. Engadget reports: When that happens, Neverware says its existing users will be able to seamlessly upgrade to the updated software. Moreover, once that transition is complete, Google will support CloudReady in the same way that it currently does Chrome OS. In the immediate future, Neverware says it's business as usual. The Home Edition of CloudReady isn't changing, and the company says it's committed to supporting its existing education and enterprise customers. Moreover, there's no plan to change pricing at the moment, and Google will honor any current multi-year licenses. Not only does this acquisition make a lot of sense from Google's perspective, but it's hard to see a downside for CloudReady users. The fact the operating system wasn't officially supported by Google was one of the few downsides to the software. It meant you couldn't install Android apps on CloudReady devices, even though it's based on Chromium OS. With this acquisition, support for Android apps becomes much more likely. Direct support from Google will also make the software more appealing to schools and businesses since they can get help directly from the company if they have any technical issues.' -- source: https://tech.slashdot.org/story/20/12/16/219202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Australia Sues Facebook Over Its Use of Onavo To Snoop
by Peter Reutemann 17 Dec '20

17 Dec '20

'Australia's Competition and Consumer Commission (ACCC) is suing Facebook over its use, in 2016 and 2017, of the Onavo VPN app to spy on users for commercial purposes. From a report: The ACCC's case accuses Facebook of false, misleading or deceptive conduct toward thousands of Australian consumers, after it had promoted the Onavo Protect app -- saying it would keep users personal activity data private, protected and secret and not use it for any other purpose, when it was being used to gather data to help Facebook's business. "Through Onavo Protect, Facebook was collecting and using the very detailed and valuable personal activity data of thousands of Australian consumers for its own commercial purposes, which we believe is completely contrary to the promise of protection, secrecy and privacy that was central to Facebook's promotion of this app," said ACCC chair Rod Sims in a statement. "Consumers often use VPN services because they care about their online privacy, and that is what this Facebook product claimed to offer. In fact, Onavo Protect channelled significant volumes of their personal activity data straight back to Facebook."' -- source: https://yro.slashdot.org/story/20/12/16/1652247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gmail Is Broken Right Now, One Day After a Massive Outage
by Peter Reutemann 16 Dec '20

16 Dec '20

'TechCrunch: While it doesn't appear to be completely down like it was yesterday morning, we're hearing many reports from Gmail users that the email service is having major issues right now. Some users are reporting that Gmail is particularly slow, while others are reporting constant error messages. One TechCrunch writer, meanwhile, noticed that emails he was sending to Gmail accounts appeared to immediately bounce, with Gmail's server responding with an error reading "550-5.1.1 The email account that you tried to reach does not exist." Google confirms the issues on its services dashboard, writing at 1:30 PM Pacific that they're impacting a "significant" number of users: "We're aware of a problem with Gmail affecting a significant subset of users. The affected users are able to access Gmail, but are seeing error messages, high latency, and/or other unexpected behavior." In a second update at 2:30 PM, Google says its teams are "continuing to investigate this issue"; as of 3:30 PM, the company says it expects the issues to be fixed by 4:00 PM while noting that time may change. Google says the problems have been resolved, although encrypted email service ProtonMail tweets that the email bouncing issue is widespread, with many emails sent to Gmail users bouncing permanently.' -- source: https://tech.slashdot.org/story/20/12/16/0231237 Yeah, I'm one of those affected by this outage. Haven't been receiving a bunch of emails (but really random, some come through whilst others don't)... In Gmail's defence, I haven't had many problems over all these years! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Bitcon $19,372.83”
by Lawrence D'Oliveiro 16 Dec '20

16 Dec '20

Been getting a minor barrage of emails with subject lines of this form, complete with that misspelling. Truth in spam, for once?

2 1

Microsoft and Industry Partners Seize Key Domain Used In SolarWinds Hack
by Peter Reutemann 16 Dec '20

16 Dec '20

'ZDNet: Microsoft and a coalition of tech companies have intervened today to seize and sinkhole a domain that played a central role in the SolarWinds hack, ZDNet has learned from sources familiar with the matter. The domain in question is avsvmcloud[.]com, which served as command and control (C&C) server for malware delivered to around 18,000 SolarWinds customers via a trojanized update for the company's Orion app. SolarWinds Orion updates versions 2019.4 through 2020.2.1, released between March 2020 and June 2020, contained a strain of malware named SUNBURST (also known as Solorigate). Once installed on a computer, the malware would sit dormant for 12 to 14 days and then ping a subdomain of avsvmcloud[.]com. According to analysis from security firm FireEye, the C&C domain would reply with a DNS response that contained a CNAME field with information on another domain from where the SUNBURST malware would obtain further instructions and additional payloads to execute on an infected company's network. Earlier today, a coalition of tech companies seized and sinkholed avsvmcloud[.]com, transferring the domain into Microsoft's possession. Sources familiar with today's actions described the takedown as "protective work" done to prevent the threat actor behind the SolarWinds hack from delivering new orders to infected computers.' -- source: https://it.slashdot.org/story/20/12/15/2117255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CloudLinux To Invest More Than a Million Dollars a Year Into CentOS Clone
by Peter Reutemann 16 Dec '20

16 Dec '20

'ZDNet: When Red Hat, CentOS's Linux parent company, announced it was "shifting focus from CentOS Linux, the rebuild of Red Hat Enterprise Linux (RHEL), to CentOS Stream, which tracks just ahead of a current RHEL release," it lost a lot of friends. CentOS co-founder, Gregory Kurtzer, immediately announced he'd create his own RHEL clone and CentOS replacement: Rocky Linux. He wasn't the only one. CloudLinux also proclaimed it would create a new CentOS clone Lenix. And, CloudLinux will be putting over a million dollars a year behind it. Why? Igor Seletskiy, CloudLinux CEO and founder, explained, "Red Hat's announcement has left users looking for an alternative with all that CentOS provides and without the disruption of having to move to alternative distributions. We promise to dedicate the resources required to Project Lenix that will ensure impartiality and a not-for-profit community initiative. CloudLinux already has the assets, infrastructure, and experience to carry out the mission, and we promise to be open about the process of developing Project Lenix." [...] Project Lenix will be a free, open-source, community-driven, 1:1 binary compatible fork of RHEL 8 (and future releases). For CentOS users, the company promises Lenix will provide an uninterrupted way to convert existing CentOS servers with absolutely zero downtime or need to reinstall anything. The company even claims you'll be able to port entire CentOS server fleets with a single command with no reinstallation or reboots required. That's a bold claim. But CloudLinux already does that trick with its commercial Linux distribution. If the company says it can do it, I think it can. Lenix is only a placeholder name, notes ZDNet. "[A] yet to be formed governing board will decide on a permanent name for the distribution. If all goes well, the first software release will appear in the first quarter of 2021."' -- source: https://linux.slashdot.org/story/20/12/15/0218245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Group that hacked SolarWinds can bypass MFA account protections
by Peter Reutemann 15 Dec '20

15 Dec '20

'The hackers behind the supply chain attack that compromised public and private organizations have devised a clever way to bypass multi-factor-authentication systems protecting the networks they target. Researchers from security firm Volexity said on Monday that it had encountered the same attackers in late 2019 and early 2020 as they penetrated deep inside of a think tank organization no fewer than three times. During one of the intrusions, Volexity researchers noticed the hackers using a novel technique to bypass MFA protections provided by Duo. After having gained administrator privileges on the infected network, the hackers used those unfettered rights to steal a Duo secret known as an akey from a server running Outlook Web App, which enterprises use to provide account authentication for various network services.' -- source: https://arstechnica.com/information-technology/2020/12/solarwinds-hackers-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Israeli Spy Tech Firm Says It Can Break Into Signal App
by Peter Reutemann 15 Dec '20

15 Dec '20

'Last Thursday, Israeli phone-hacking firm Cellebrite said in a blog post that it can now break into Signal, an encrypted app considered safe from external snooping. Haaretz reports: Cellebrite's flagship product is the UFED (Universal Forensic Extraction Device), a system that allows authorities to unlock and access the data of any phone in their possession. Another product it offers is the Physical Analyzer, which helps organize and process data lifted from the phone. Last Thursday, the company announced that the analyzer has now been updated with a new capability, developed by the firm, that allows clients to decode information and data from Signal. Signal, owned by the Signal Technology Foundation, uses a special open source encryption system called Signal Protocol, which was thought to make it nigh-on impossible for a third party to break into a conversation or access data being shared on the platform. It does so by employing what's called "end-to-end encryption." According to Cellebrite's announcement last week, "Law enforcement agencies are seeing a rapid rise in the adoption of highly encrypted apps like Signal, which incorporate capabilities like image blurring to stop police from reviewing data. "Criminals are using this application to communicate, send attachments, and making [sic] illegal deals that they want to keep discrete [sic] and out of sight from law enforcement," the blog post added. Despite support for the app's encryption capabilities, Cellebrite noted that "Signal is an encrypted communication application designed to keep sent messages and attachments as safe as possible from 3rd-party programs. "Cellebrite Physical Analyzer now allows lawful access to Signal app data. At Cellebrite, we work tirelessly to empower investigators in the public and private sector to find new ways to accelerate justice, protect communities, and save lives." In an earlier, now deleted, version of the blog post, the company went as far as to say: "Decrypting Signal messages and attachments was not an easy task. It required extensive research on many different fronts to create new capabilities from scratch. At Cellebrite, however, finding new ways to help those who make our world a safer place is what we're dedicated to doing every day." The initial post, which was stored on the Internet Archive, also included a detailed explanation of how Cellebrite "cracked the code" by reviewing Signal's own open source protocol and using it against it. The company noted in the deleted blog post that "because [Signal] encrypts virtually all its metadata to protect its users, efforts have been put forward by legal authorities to require developers of encrypted software to enable a 'backdoor' that makes it possible for them to access people's data. Until such agreements are reached, Cellebrite continues to work diligently with law enforcement to enable agencies to decrypt and decode data from the Signal app."' -- source: https://it.slashdot.org/story/20/12/14/2241230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

~18,000 organizations downloaded backdoor planted by Cozy Bear hackers
by Peter Reutemann 15 Dec '20

15 Dec '20

'About 18,000 organizations around the world downloaded network management tools that contained a backdoor that spies believed to be backed by the Russian government could use to install additional malware that stole sensitive data, the tools provider, SolarWinds, said on Monday. The disclosure from Austin, Texas-based software maker SolarWinds, came a day after the US government revealed a major security breach hitting federal agencies and private companies. The US Departments of Treasury, Commerce, and Homeland Security departments were among the federal agencies on the receiving end of attacks that gave access to email and other sensitive resources. Federal agencies using the software were instructed on Sunday to disconnect systems that run the software and perform a forensic analysis of their networks. Premiere security firm FireEye says it was breached by nation-state hackers Security firm FireEye, which last week disclosed a serious breach of its own network, said that hackers backed by a nation state compromised a SolarWinds software update mechanism and then used it to infect selected customers who installed a backdoored version of the company’s Orion network management tool. The backdoor infected customers who installed an update from March to June of this year, SolarWinds said in a document filed on Monday with the Securities and Exchange Commission. SolarWinds, which said SolarWinds has about 300,000 Orion customers, put the number of affected customers at about 18,000.' -- source: https://arstechnica.com/information-technology/2020/12/18000-organizations-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wormable code-execution flaw in Cisco Jabber has a severity rating of 9.9 out of 10
by Peter Reutemann 14 Dec '20

14 Dec '20

'Cisco has patched its Jabber conferencing and messaging application against a critical vulnerability that made it possible for attackers to execute malicious code that would spread from computer to computer with no user interaction required. Again. A single text is all it took to unleash code-execution worm in Cisco Jabber The vulnerability, which was first disclosed in September, was the result of several flaws discovered by researchers at security firm Watchcom Security. First, the app failed to properly filter potentially malicious elements contained in user-sent messages. The filter was based on an incomplete blocklist that could be bypassed using a programming attribute known as onanimationstart. Messages that contained the attribute passed directly to DOM of an embedded browser. Because the browser was based on the Chromium Embedded Framework, it would execute any scripts that made it through the filter. With the filter bypassed, the researchers still had to find a way to break out of a security sandbox that’s designed to keep user input from reaching sensitive parts of the operating system. The researchers eventually settled on a function called CallCppFunction, which among other things Cisco Jabber uses to open files one user receives from another. [...] The researchers recommended that the updates be installed as soon as possible. Until all employees are patched, organizations should consider disabling all external communications. The vulnerabilities affect all currently supported versions of the Cisco Jabber client (12.1 through 12.9).' -- source: https://arstechnica.com/information-technology/2020/12/wormable-zero-click-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Selling More Than 85,000 MySQL Databases On a Dark Web Portal
by Peter Reutemann 14 Dec '20

14 Dec '20

'For the past year, hackers have been breaking into MySQL databases, downloading tables, deleting the originals, and leaving ransom notes behind, telling server owners to contact the attackers to get their data back. If database owners don't respond and ransom their data back in nine days, the databases are then put up on auction on a dark web portal. "More than 85,000 MySQL databases are currently on sale on a dark web portal for a price of only $550/database," reports ZDNet: This suggests that both the DB intrusions and the ransom/auction web pages are automated and that attackers don't analyze the hacked databases for data that could contain a higher concentration of personal or financial information. Signs of these ransom attacks have been piling up over the course of 2020, with the number of complaints from server owners finding the ransom note inside their databases popping up on Reddit, the MySQL forums, tech support forums, Medium posts, and private blogs.' -- source: https://developers.slashdot.org/story/20/12/12/1943216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Developers Say Securing Their Code Is 'Insufferably Boring' and 'Soul-Withering'
by Peter Reutemann 14 Dec '20

14 Dec '20

'"A new survey of the free and open-source software (FOSS) community conducted by the Linux Foundation suggests that contributors spend less than 3% of their time on security issues and have little desire to increase this," reports TechRepublic: Moreover, responses indicated that many respondents had little interest in increasing time and effort on security. One respondent commented that they "find the enterprise of security a soul-withering chore and a subject best left for the lawyers and process freaks," while another said: "I find security an insufferably boring procedural hindrance." The researchers concluded that a new approach to the security and auditing of FOSS would be needed to improve security practices, while limiting the burden on contributors. Some of the most requested tools from contributors were bug and security fixes, free security audits, and simplified ways to add security-related tools to their continuous integration (CI) pipelines. "There is a clear need to dedicate more effort to the security of FOSS, but the burden should not fall solely on contributors," read the report. "Developers generally do not want to become security auditors; they want to receive the results of audits..." The researchers continued: "One way to improve a rewrite's security is to switch from memory-unsafe languages (such as C or C++ ) into memory-safe languages (such as nearly all other languages)," researchers said. "This would eliminate entire classes of vulnerabilities such as buffer overflows and double-frees." Also interesting: money "scored very low in developers' motivations for contributing to open-source projects, as did a desire for recognition amongst peers," according to TechRepublic. "Instead, developers said they were purely interested in finding features, fixes and solutions to the open-source projects they were working on. Other top motivations included were enjoyment and a desire to contribute back to the FOSS projects that they used."' -- source: https://news.slashdot.org/story/20/12/12/205206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Here Comes the Google Chrome Change that Worries Ad-Blocker Creators
by Peter Reutemann 14 Dec '20

14 Dec '20

'CNET reports: With the next version of Chrome, Google is moving ahead with a plan to improve privacy and security by reining in some abilities of extensions used to customize the browser. The move had angered some developers who expected earlier it would cripple ad blockers. Manifest v3, the programming interface behind Google's security plans, will arrive with Chrome 88 in mid-January, Google said Wednesday at the Chrome Dev Summit. Extensions using the earlier Manifest v2 will still work for at least a year... Among other things, Manifest v3 limits the number of "rules" that extensions may apply to a web page as it loads. Rules are used, for example, to check if a website element comes from an advertiser's server and should therefore be blocked. Google announced the changes two years ago. Reducing the number of rules allowed angered creators of extensions like the uBlock Origin ad blocker and the Ghostery tracking blocker. They said the rules limits will stop their extensions from running their full lists of actions to screen ads or block tracking. That could let websites bypass extensions — and the preferences of people who installed them... The shift brought on by Manifest V3 will spread to all browsers, to the detriment of ad blocking software, predicted Andrey Meshkov, co-founder and chief technology officer of AdGuard, an ad-blocking extension... Ghostery is working to update its extension for Manifest V3 but would rather spend its time on "real privacy innovations," President Jeremy Tillman said in a statement Wednesday. "We still have real misgivings that these changes have more to do with Google protecting its bottom line than it does with improving security for Chrome users...." The importance of the Chrome team's choices are magnified by the fact that other browsers, including Microsoft Edge, Vivaldi , Opera and Brave, are built on its Chromium open-source foundation. Microsoft said it will embrace Manifest v3, too. "Another Manifest v3 change is that extensions no longer may update their abilities by downloading code from third-party sites. "The entire extension now must be distributed through the Chrome Web Store, a measure Google says improves security screens and speeds reviews."' -- source: https://tech.slashdot.org/story/20/12/13/0012217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Accessing Judicial Records Online
by Lawrence D'Oliveiro 13 Dec '20

13 Dec '20

This article <https://arstechnica.com/tech-policy/2020/12/us-house-passes-bill-to-tear-do…> about the ongoing can of worms that is the PACER online judicial records system in the US prompted me to take a look at our own. I found this page <https://www.courtsofnz.govt.nz/judgments/>, which links conveniently to separate areas for the Supreme Court, Court of Appeal and High Courts at the Ministry of Justice <https://forms.justice.govt.nz/jdo/Introduction.jsp>, District Courts <https://www.districtcourts.govt.nz/> and the Legal Information Institute <http://www.nzlii.org/>. In terms of copyright and redistribution, there is this note on the MoJ page: No copyright exists in respect of judgments or decisions of any New Zealand Court or Tribunal. See Copyright Act 1994 s27(g). Also, I like this note on the help page for the nzlii.org site: Emulated Search Languages If you have used one of the popular online legal database systems (or even if you haven't) you probably do not need to learn anything new. Most Lexis, Status, Info-One, (and for the non-lawyers, even C and agrep) style searches are recognised.

1 0

CentOS 8 Ending Next Year To Focus Shift On CentOS Stream
by Peter Reutemann 13 Dec '20

13 Dec '20

'Well here is a surprise for those that have long used CentOS as the community-supported rebuild of Red Hat Enterprise Linux... CentOS 8 will end in 2021 and moving forward CentOS 7 will remain supported until the end of its lifecycle but CentOS Stream will be the focus as the future upstream of RHEL. From a report: For those relying on CentOS 8 to enjoy the reliability and features of Red Hat Enterprise Linux 8 but without the licensing costs, etc, that will end in 2021. At the end of 2021, CentOS 8 will no longer be maintained but CentOS 7 will stick around in a supported maintenance state until 2024. The CentOS Project will be focused moving forward just on CentOS Stream as the upstream/development branch of Red Hat Enterprise Linux. CentOS 8 users are encouraged to begin transitioning to CentOS Stream 8. The CentOS Project announced this shift in focus today via the CentOS Blog. Red Hat's announcement meanwhile is promoting the change as beneficial to CentOS Stream.' -- source: https://linux.slashdot.org/story/20/12/08/2010236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Random Firefox Tweaks
by Lawrence D'Oliveiro 12 Dec '20

12 Dec '20

Been looking at various settings changes you can make in the “about:config” page in Firefox. Here are a couple I have found useful: * keyword.enabled -- set to false to stop Firefox trying to do a search on the contents of the address box if it doesn’t match a URL. This is why I have a search box separate from the address box. * browser.fixup.alternate.enabled -- set to false to stop it helpfully tacking on “www.” and “.com” if the original URL you type doesn’t work. I have occasionally been confused by it complaining about not finding a URL, but showing a different one from the one I typed. By the way, when you first try to view this page, Firefox shows you a warning to ensure you understand the consequences of messing about with settings at this level. It remembers it has shown you this warning by adding the following line to the prefs.js file in your profile: user_pref("browser.aboutConfig.showWarning", false); Firefox seems to overwrite this file when it quits, and reloads it when it is launched again.

2 2

Google Says It is Expanding Fuchsia's Open Source Model
by Peter Reutemann 11 Dec '20

11 Dec '20

'Fuchsia is a long-term project to create a general-purpose, open source operating system, and today we are expanding Fuchsia's open source model to welcome contributions from the public. Fuchsia is designed to prioritize security, updatability, and performance, and is currently under active development by the Fuchsia team. We have been developing Fuchsia in the open, in our git repository for the last four years. You can browse the repository history at fuchsia.googlesource.com to see how Fuchsia has evolved over time. We are laying this foundation from the kernel up to make it easier to create long-lasting, secure products and experiences. Starting today, we are expanding Fuchsia's open source model to make it easier for the public to engage with the project. We have created new public mailing lists for project discussions, added a governance model to clarify how strategic decisions are made, and opened up the issue tracker for public contributors to see what's being worked on. As an open source effort, we welcome high-quality, well-tested contributions from all. There is now a process to become a member to submit patches, or a committer with full write access. In addition, we are also publishing a technical roadmap for Fuchsia to provide better insights for project direction and priorities. Some of the highlights of the roadmap are working on a driver framework for updating the kernel independently of the drivers, improving file systems for performance, and expanding the input pipeline for accessibility.' -- source: https://news.slashdot.org/story/20/12/08/2048257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2