- wlug - list.wlug.org.nz

South Korea Finally Gets Rid Of ActiveX
by Lawrence D'Oliveiro 11 Dec '20

11 Dec '20

Being just about the first country in the world to introduce secure online banking (in 1999!) came at a cost to the Republic of Korea: because SSL/TLS wasn’t widespread at the time, they had to cobble together a solution based on Microsoft’s ActiveX technology. This made it specific to Windows. It worked OK for a while, but as computing platforms have continued to evolve, this dependency on a “legacy” technology has become increasingly annoying to just about everybody. Then in 2017, it actually became an election campaign promise to get rid of this. And finally, now, the promise is being fulfilled. <https://www.theregister.com/2020/12/10/south_korea_activex_certs_dead/>

1 0

Brave Browser-Maker Launches Privacy-Friendly News Reader
by Peter Reutemann 11 Dec '20

11 Dec '20

'Ars Technica: Brave Software, maker of the Brave Web browser, is introducing a news reader that's designed to protect user privacy by preventing parties -- both internal and third party -- from tracking the sites, articles, and story topics people view. Brave Today, as the service is called, is using technology that the company says sets it apart from news services offered by Google and Facebook. It's designed to deliver personalized news feeds in a way that leaves no trail for Brave, ISPs, and third parties to track. The new service is part of Brave's strategy of differentiating its browser as more privacy-friendly than its competitors'. Key to Brave Today is a new content delivery network the company is unveiling. Typically, news services use a single CDN to cache content and then serve it to users. This allows the CDN or the service using it to see both the IP address and news feed of each user, and over time, that data can help services build detailed profiles of a person's interests. The Brave Today CDN takes a different approach. It's designed in a way that separates a user's IP address from the content they request. One entity offers a load-balancing service that receives TLS-encrypted traffic from the user. The load balancer then passes the traffic on to the CDN that processes the request. The load balancer knows the user's IP address but, because the request is encrypted, has no visibility into the content the user is seeking. The CDN, meanwhile, sees only the request but has no way of knowing the IP address that's making it. Responses are delivered in reverse order. To prevent the data from being combined, Brave says that it will use one provider for load balancing and a different one for content delivery. To prevent the load-balancing provider from using the size of the requests and responses to infer the contents of the encrypted data, the service will also use a technique called padding, which adds characters to the plaintext before it's encrypted. The CDN uses several other techniques to preserve the anonymity of users. Among them: stripping out various headers that could be used to identify the person making the request. Furthermore, Brave is also taking steps to shield user information from its own employees. "... [T]he company has configured its account with the load-balancing provider to restrict access to its logging resources," reports Ars. "The load-balancing provider also doesn't provide the ability for customers to use the proxy protocol to inject the requester's IP address into outgoing requests. In case that changes, however, Brave has also entered into a contract with the load balancer that restricts access to logs or use of the protocol, even if Brave asks."' -- source: https://yro.slashdot.org/story/20/12/10/2151244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Exposes Adrozek, Malware That Hijacks Chrome, Edge, and Firefox
by Peter Reutemann 11 Dec '20

11 Dec '20

'Microsoft has raised the alarm today about a new malware strain that infects users' devices and then proceeds to modify browsers and their settings in order to inject ads into search results pages. From a report: Named Adrozek, the malware has been active since at least May 2020 and reached its absolute peak in August this year when it controlled more than 30,000 browsers each day. But in a report today, the Microsoft 365 Defender Research Team believes the number of infected users is much, much higher. Microsoft researchers said that between May and September 2020, they observed "hundreds of thousands" of Adrozek detections all over the globe. Based on internal telemetry, the highest concentration of victims appears to be located in Europe, followed by South and Southeast Asia. Microsoft says that, currently, the malware is distributed via classic drive-by download schemes. Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software. The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with the help of a registry key.' -- source: https://news.slashdot.org/story/20/12/10/1857222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

arch - low disk space on root partition
by Peter Reutemann 10 Dec '20

10 Dec '20

Hi everyone My experience with EndeavourOS has been really positive so far. However, this morning, after a big upgrade, I received the notification that I was running low on disk space on my root partition (only 1.9GB out of 37GB remaining!). After a bit of looking around the web, I settled on clearing my pacman cache: sudo pacman -Sc And I'm back to having 19GB free disk space. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

The Origins Of T he C Programming Language
by Lawrence D'Oliveiro 10 Dec '20

10 Dec '20

This article <https://arstechnica.com/features/2020/12/a-damn-stupid-thing-to-do-the-orig…> goes a bit more in-depth into the precursors of the C programming language. The story begins with a computer scientist from a well-connected family named Christopher Strachey (I remember the name of his uncle Lytton as the author of a volume of short biographies in my parents’ library called “Eminent Victorians”), who led a group to create a language called “CPL”. CPL proved a bit too ambitious to implement at the time. And it didn’t help that its designers insisted on certain syntactical niceties that might be considered more literary than practical. (Reflecting a certain British public-school background, I suppose ...) But a cut-down subset of this was implemented, with the aim of using it as a “bootstrap” language for writing the compiler for the full language. This was BCPL, and it turned out to be useful for a range of programming projects. The group at AT&T Bell Labs got hold of this after the Labs pulled out of the MULTICS project, and implemented an even more cut-down version called “B”, which could run on the limited memory of the PDP-7 which was all they had at the time. Then a later enhancement of this was called “New B” or “NB”. Several attempts were made to rewrite the fledgling Unix operating system in NB, which didn’t work. After each attempt, the language was revised to add more features. Finally, after the addition of structured types, the result was a language sufficiently useful to write an OS, and sufficiently different to warrant a new name. So it was dubbed “C”.

1 0

Bye-Bye DB2, Bye-Bye Oracle, Hello Postgres
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

A report on how a couple of companies -- German IT outfit BG Phoenics and Indian one TransUnion CIBIL -- migrated their entire mass of internal company database deployments off proprietary DBMSes -- IBM DB2 in one case, Oracle in the other -- to Postgres EDB: <https://www.theregister.com/2020/12/08/leaving_ibm_db2_for_postgres/>. In both cases, a big factor was the licensing conditions, which made it very complicated to do any changes to database usage. The improvement in agility was major: Since going live, the user found the deployment of new instances in Postgres much faster than it had been in Db2, down from around 20 hours spread over two weeks to 40 to 60 minutes. Of course an Oracle advocate has to say “[Postgres] is not as scalable as a proprietary database like Oracle or SQL Server”. But I would suggest they think twice about such a pronouncement. Remember that Facebook runs its entire multi-billion-user operation on MySQL, and I’m sure Postgres can scale to that level as well. Where is there an Oracle or DB2 deployment of that size and throughput requirement? I don’t think such a thing exists.

1 0

Amazon, Amex To Fund Software Developers in New GitHub Program
by Peter Reutemann 09 Dec '20

09 Dec '20

'Amazon.com, American Express, Daimler AG and Stripe are among those joining a new GitHub program that will let companies directly fund open-source projects and software developers that are key to their businesses. From a report: It's an expansion of GitHub's Sponsors program, which previously let individuals support software projects and the millions of developers who use the digital platform to collaborate on, share and store code. GitHub, whose parent company Microsoft will also participate in the new service announced Tuesday, expects the change to dramatically increase the number of contributions. The year-old sponsors service has already generated enough money for some developers to rely on it as full-time work, said Devon Zuegel, GitHub's director of product for the communities department.' -- source: https://developers.slashdot.org/story/20/12/08/1821203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GE Puts Default Password In Radiology Devices, Leaving Healthcare Networks Exposed
by Peter Reutemann 09 Dec '20

09 Dec '20

'Ars Technica: Dozens of radiology products from GE Healthcare contain a critical vulnerability that threatens the networks of hospitals and other health providers that use the devices, officials from the US government and a private security firm said on Tuesday. The devices -- used for CT scans, MRIs, X-Rays, mammograms, ultrasounds, and positron emission tomography -- use a default password to receive regular maintenance. The passwords are available to anyone who knows where on the Internet to look. A lack of proper access restrictions allows the devices to connect to malicious servers rather than only those designated by GE Healthcare. Attackers can exploit these shortcomings by abusing the maintenance protocols to access the devices. From there, the attackers can execute malicious code or view or modify patient data stored on the device or the hospital or healthcare provider servers. Aggravating matters, customers can't fix the vulnerability themselves. Instead, they must request that the GE Healthcare support team change the credentials. Customers who don't make such a request will continue to rely on the default password. Eventually, the device manufacturer will provide patches and additional information. The flaw has a CVSS severity rating of 9.8 out of 10 because of the impact of the vulnerability combined with the ease of exploiting it. Security firm CyberMDX discovered the vulnerability and privately reported it to the manufacturer in May. The US Cyber Security and Infrastructure Security Agency is advising affected healthcare providers to take mitigation steps as soon as possible. In a statement, GE Healthcare officials wrote: "We are not aware of any unauthorized access to data or incident where this potential vulnerability has been exploited in a clinical situation. We have conducted a full risk assessment and concluded that there is no patient safety concern. Maintaining the safety, quality, and security of our devices is our highest priority. We are providing on-site assistance to ensure credentials are changed properly and confirm proper configuration of the product firewall. Additionally, we are advising the facilities where these devices are located to follow network management and security best practices." ' -- source: https://it.slashdot.org/story/20/12/08/2034217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye, a Top Cybersecurity Firm, Says It Was Hacked By a Nation-State
by Peter Reutemann 09 Dec '20

09 Dec '20

'The New York Times : For years, the cybersecurity firm FireEye has been the first call for government agencies and companies around the world who have been hacked by the most sophisticated attackers, or fear they might be. Now it looks like the hackers -- in this case, evidence points to Russia's intelligence agencies -- may be exacting their revenge. FireEye revealed on Tuesday that its own systems were pierced by what it called "a nation with top-tier offensive capabilities." The company said hackers used "novel techniques" to make off with its own tool kit, which could be useful in mounting new attacks around the world. It was a stunning theft, akin to bank robbers who, having cleaned out local vaults, then turned around and stole the F.B.I.'s investigative tools. In fact, FireEye said on Tuesday, moments after the stock market closed, that it had called in the F.B.I. The $3.5 billion company, which partly makes a living by identifying the culprits in some of the world's boldest breaches -- its clients have included Sony and Equifax -- declined to say explicitly who was responsible. But its description, and the fact that the F.B.I. has turned the case over to its Russia specialists, left little doubt who the lead suspects were and that they were after what the company calls "Red Team tools." These are essentially digital tools that replicate the most sophisticated hacking tools in the world. FireEye uses the tools — with the permission of a client company or government agency -- to look for vulnerabilities in their systems. Most of the tools are based in a digital vault that FireEye closely guards. The hack raises the possibility that Russian intelligence agencies saw an advantage in mounting the attack while American attention -- including FireEye's -- was focused on securing the presidential election system. At a moment that the nation's public and private intelligence systems were seeking out breaches of voter registration systems or voting machines, it may have a been a good time for those Russian agencies, which were involved in the 2016 election breaches, to turn their sights on other targets. The hack was the biggest known theft of cybersecurity tools since those of the National Security Agency were purloined in 2016 by a still-unidentified group that calls itself theShadowBrokers. [...] The N.S.A.'s tools were most likely more useful than FireEye's since the U.S. government builds purpose-made digital weapons. FireEye's Red Team tools are essentially built from malware that the company has seen used in a wide range of attacks. Still, the advantage of using stolen weapons is that nation-states can hide their own tracks when they launch attacks.' -- source: https://it.slashdot.org/story/20/12/08/2247219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Next Step In DNS Privacy
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

We already have mechanisms called “DNS-over-HTTPS” (DoH) and “DNS-over-TLS” (DoT) to encrypt your DNS queries so intermediaries cannot eavesdrop on them. However, the DNS server you are querying still knows what you are asking for, and can tie that to the IP address that you are querying from. So the next step is called “Oblivious DNS” (“over HTTPS”?) or “ODoH” <https://arstechnica.com/information-technology/2020/12/cloudflare-apple-and…>. This one interposes a proxy to relay the encrypted query and response between the client machine and DNS server. The proxy cannot decrypt the communications, and its presence hides the client’s IP address from the server, further increasing your privacy. To recap: the DNS server knows what you are asking for, but not who is asking. The proxy knows who is asking, but not what they are asking for. Given the controversy from some parties over the existing mechanisms (remember when the British Internet Service Providers’ Association dubbed Mozilla a “villain” for implementing DoH <https://www.theregister.com/2019/07/10/ispa_clears_mozilla/>?), I wonder what kind of hoo-hah this further development will trigger...

1 0

Will Businesses Make 2021 The Year of the Linux Desktop?
by Peter Reutemann 08 Dec '20

08 Dec '20

'Writing for TechRepublic, open source advocate Jack Wallen predicts 2021 will be a year where open source technology dominates the world of big data even more than 2021 (with a big role predicted for SUSE). But he also sees businesses cutting costs by switching to open source solutions — including a big move to Linux on enterprise desktops, thanks to enterprise-ready options now available from System76, Lenovo, and Dell: This will have the added benefit of even more companies jumping into the mix and offering more and more desktops and laptops, all powered by Linux and open source technology. One added bonus for this movement is that System76 will finally gain the recognition they've deserved for so many years. Linux on the desktop would not be where it is today, had it not been for their stalwart support for open source technology. Year after year, System76 has proved that high-quality, business-class systems, powered by Linux, can be produced at a level befitting the enterprise. That success within the realm of business will start trickling down to consumers. As more and more people start using Linux at their place of business, they'll begin seeing the benefits of the open source operating system and desire to adopt it for their home computers. I suspect that by the end of 2021, we'll see Linux desktop market share to finally break the 10% bubble. It may not sound like much, but given how Linux has hovered around 2% and maxed out at 5%, that 10% figure is like a dream come true. That's only the tip of the iceberg. Although Linux will max out at around 10% by the end of the year, it will lead to continued growth over the coming years.' -- source: https://linux.slashdot.org/story/20/12/07/0332259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Qualcomm Feel Threatened By Apple's M1 Macs?
by Peter Reutemann 07 Dec '20

07 Dec '20

'PCMag.com's lead mobile analyst calls Qualcomm "a little too unbothered by Apple's M1 Macs" Qualcomm executives brushed off a question about Apple's new M1-based Macs during a question-and-answer session at the company's Snapdragon Summit today, where Qualcomm announced a new flagship smartphone chipset but no upgrades to its year-old chips for PCs... In general, reviews of Qualcomm-powered laptops such as the Microsoft Surface Pro X have celebrated the devices' long battery life, but lamented problems with third-party apps that were originally coded for Intel processors. That stands in stark contrast to Apple's new M1-based Macs, which don't seem to be slowed down as badly by older software... "It's a great validation of what we've been doing for the past few years and [Qualcomm's product line] is just going to get stronger and stronger as we broaden our scope," said Alex Katouzian, Qualcomm SVP for mobile. Katouzian made sure to subtly call out ways in which Qualcomm's always-connected PCs are superior to Apple's newest Macs. The Macs lack 4G connectivity and still have poor-quality, 720p front-facing cameras... Katouzian also pointed out that (presumably unlike Apple) Qualcomm addresses "many tiers...and many price points" with its 7c, 8c, and 8cx laptop chipsets, letting Windows laptop makers drive prices well below the MacBook Air's $999 list price. The core problem with Qualcomm's always-connected PC strategy is one that Qualcomm itself can't fix. While Qualcomm could, and probably will, soon announce a laptop chip that's based on the new Snapdragon 888 and has a level of raw power closer to Apple's M1, it's really down to Microsoft, as well as peripheral and app makers to solve the platform incompatibilities that have frustrated PC reviewers. Hot Hardware cites Microsoft's promises of changes come in future updates to Windows 10, arguing that "with the arrival of x64 emulation and a growing library of native Arm64 apps, Windows 10 on Arm is going to be an even more powerful platform." >From a performance perspective, while running Windows 10 on Arm, these [Snapdragon 8cx] chips may currently be at a disadvantage to the Apple M1, but some day in the not so distant future that might not be the case. We have no doubt that Qualcomm is likely working on a new Windows PC-centric SoC that is based on Snapdragon 888 or similar architecture. Qualcomm has promised a 25 percent uplift in CPU and a 35% lift in GPU performance over the Snapdragon 865, with the Snapdragon 888, which already offers a big boost over the previous gen Snapdragon 855/8cx. So, Qualcomm has the potential to put up a strong showing against the Apple M1, whenever its next-generation Snapdragon PC chip launches. That may be, but John Gruber at Daring Fireball argues that currently "M1 Macs embarrass all other PCs — all Intel-based Macs, including automobile-priced Mac Pros, and every single machine running Windows or Linux." Those machines are just standing around in their underwear now because the M1 stole all their pants. Well, that just doesn't happen, your instincts tell you. One company, even a company like Apple, doesn't just embarrass the entire rest of a highly-competitive longstanding industry. But just because something hasn't happened — or hasn't happened in a very long while — doesn't mean it can't happen. And in this case, it just happened... M1 Macs completely upend what we can and should expect from PCs. It's a breakthrough along the lines of the iPhone itself in 2007.' -- source: https://hardware.slashdot.org/story/20/12/06/060238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Richard Stallman Answers Questions at EmacsConf 2020
by Peter Reutemann 07 Dec '20

07 Dec '20

'All the videos have now appeared online for the talks at this year's virtual EmacsConf 2020, "the conference about the joy of Emacs, Emacs Lisp, and memorizing key sequences." And among them are an appearance by 67-year-old Richard Stallman, reminding the audience he'd created the first Emacs editor in 1976 "with some help from Guy Steele," then created GNU Emacs in 1984. Stallman was there to tell the history of the GNU Emacs Lisp Package Archive (and the licensing issues involved) — and how it's ultimately led to the creation of the NonGNU ELPA. "The fundamental plan of NonGNU ELPA is that we won't ask for copyright assignments for those packages, so we won't be able to put them into core Emacs, at least not easily — but we will have some control over how we distribute them. We can put any package into NonGNU ELPA as long as its free software. "If we like it, we can set up that way for users to get it. We can put the package in exactly as it is, if there's no problem at all with it. We can make an arrangement with the package's developers to work on it with us and maintain it directly for distribution by NonGNU ELPA. But if they are not interested, we can put it in ourselves, and if we need to make any changes we can do so. So NonGNU ELPA is not meant to be just a way that others can distribute their packages. Its meant at least in a minimal, technical sense to work with GNU Emacs, and we will make changes if necessary so that it works smoothly with GNU Emacs... "The idea is to have a single Git repository where you can download various packages, but they won't be maintained there. Each of those packages will be copied automatically from some other place, probably some other people have the right access to work on it. This way we can avoid giving a gigantic number of people access to it. "So far NonGNU ELPA is just a plan. We need people to implement the plan, so if you'd like to help, please write to me. I think this is a very important step for progress, and it's got to be implemented. Thanks, and happy hacking." Stallman provided a status update on NonGNU ELPA as part of the 46-minute Q&A that followed. ' -- source: https://news.slashdot.org/story/20/12/06/1957219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenZFS 2.0 release unifies Linux, BSD and adds tons of new features
by Peter Reutemann 04 Dec '20

04 Dec '20

'This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between "ZFS on Linux" and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.' -- source: https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

One of the Internet’s most aggressive threats could take UEFI malware mainstream
by Peter Reutemann 04 Dec '20

04 Dec '20

'One of the Internet’s most aggressive threats has just gotten meaner, with the ability to infect one of the most critical parts of any modern-day computer. Trickbot is a piece of malware that’s notable for its advanced capabilities. Its modular framework excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks and performing reconnaissance that identifies infected computers belonging to high-value targets. It often uses readily available software like Mimikatz or exploits like EternalBlue stolen from the National Security Agency. Once a simple banking fraud trojan, Trickbot over the years has evolved into a full-featured malware-as-a-service platform. Trickbot operators sell access to their vast number of infected machines to other criminals, who use the botnet to spread bank trojans, ransomware, and a host of other malicious software. Rather than having to go through the hassle of ensnaring victims themselves, customers have a ready-made group of computers that will run their crimeware. Now, Trickbot has acquired a new power: the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove.' -- source: https://arstechnica.com/information-technology/2020/12/dangerous-uefi-malwa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FBI Warns of Email Forwarding Rules Being Abused in Recent Hacks
by Peter Reutemann 03 Dec '20

03 Dec '20

'The US Federal Bureau of Investigation says that cyber-criminals are increasingly relying on email forwarding rules in order to disguise their presence inside hacked email accounts. From a report: In a PIN (Private Industry Notification) alert sent last week and made public today, the FBI says the technique has been seen and abused in recent BEC (Business Email Compromise) attacks reported over the summer. The hackers' technique relies on a feature found in some email services called "auto-forwarding email rules." As its name implies, the feature allows the owner of an email address to set up "rules" that forward (redirect) an incoming email to another address if a certain criteria is met. Threat actors absolutely love email auto-forwarding rules as they allow them to receive copies of all incoming emails without having to log into an account each day -- and be at risk of triggering a security warning for a suspicious login.' -- source: https://it.slashdot.org/story/20/12/02/1944205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malicious npm Packages Caught Installing Remote Access Trojans
by Peter Reutemann 03 Dec '20

03 Dec '20

'The security team behind the "npm" repository for JavaScript libraries removed two npm packages this Monday for containing malicious code that installed a remote access trojan (RAT) on the computers of developers working on JavaScript projects. From a report: The name of the two packages was jdb.js and db-json.js., and both were created by the same author and described themselves as tools to help developers work with JSON files typically generated by database applications. Both packages were uploaded on the npm package registry last week and were downloaded more than 100 times before their malicious behavior was detected by Sonatype, a company that scans package repositories on a regular basis. According to Sonatype's Ax Sharma, the two packages contained a malicious script that executed after web developers imported and installed any of the two malicious libraries. The post-install script performed basic reconnaissance of the infected host and then attempted to download and run a file named patch.exe that later installed njRAT, also known as Bladabindi, a very popular remote access trojan that has been used in espionage and data theft operations since 2015.' -- source: https://tech.slashdot.org/story/20/12/02/1939247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Zero-Click Wi-Fi Exploit is One of the Most Breathtaking Hacks Ever
by Peter Reutemann 03 Dec '20

03 Dec '20

'Dan Goodin, writing for ArsTechnica: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device -- over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable -- meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed. This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly. Almost immediately, fellow security researchers took notice. "This is a fantastic piece of work," Chris Evans, a semi-retired security researcher and executive and the founder of Project Zero, said in an interview. "It really is pretty serious. The fact you don't have to really interact with your phone for this to be set off on you is really quite scary. This attack is just you're walking along, the phone is in your pocket, and over Wi-Fi someone just worms in with some dodgy Wi-Fi packets." Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel -- one of the most privileged parts of any operating system -- the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.' -- source: https://apple.slashdot.org/story/20/12/02/1933245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: 'Don't Make Users Mad'
by Peter Reutemann 01 Dec '20

01 Dec '20

'Greg Kroah-Hartman, the Linux Foundation fellow currently responsible for stable Linux kernel releases, shared the lessons he's learned as a kernel developer that are applicable to other developers at this year's Linux App Summit. He started by showing how he could succinctly distill the essence of the talk into a single five-word slide: "Don't make your users mad...." Kroah-Hartman explains that one of Linus Torvalds' most deeply-held convictions: don't break userspace. "Other operating systems have this rule as well — it's a very solid rule — because we always want you to upgrade. And we want you to upgrade without worrying about it. We don't want you to feel scared. If you see a new release, and we say, 'Hey, this fixes a bunch of problems,' we don't want you to feel worried about taking that. That's really really important — especially with security...." If you do make a change, make sure there truly is a compelling reason. "You have to provide enough reason and enough goodness to force somebody to take the time to learn to do something else. That's very rare." His example of this was systemd, which unified a variety of service configurations and initialization processes. "They did it right. They provided all the functionality, they solved a real problem that was there. They unified all these existing tools and problems in such a way that it was just so much better to use, and it provided enough impetus that everybody was willing to do the work to modify their own stuff and move to the new model. It worked. People still complain about it, but it worked. Everybody switched... It works well. It solves a real problem. "That was an example of how you can provide a compelling reason to move on — and make the change."' -- source: https://linux.slashdot.org/story/20/11/28/0714229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Used To Hack Tesla Model X SUV Key Fob
by Peter Reutemann 29 Nov '20

29 Nov '20

'According to this Tom's Hardware story, a Belgian PhD student managed to wrest full control of a Tesla Model X SUV, by way of hijacking the Bluetooth keyfob and reprogramming it, using a Raspberry Pi. Tesla has since issued a software update to protect against that kind of attack Since the attack is done via Bluetooth, control could be gained wirelessly from 5 meters away. According to the article this is the third time the same student "has managed to exploit the key fob and gain access to the car. Previously he was able to clone the fob..." Computer Weekly also got an interesting quote from a senior security consultant at the electronic design automation company Synopsys, who argues that the research "demonstrates the impacts of security requirements and security features not having proper validation."' -- source: https://tech.slashdot.org/story/20/11/28/2325210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PHP 8.0 Brings Major (And Breaking) Changes to a 25-Year-Old Language
by Peter Reutemann 29 Nov '20

29 Nov '20

'"PHP version 8.0 has arrived, bringing with it a major update to the 25-year-old programming language..." writes Tech Republic. New language features include the nullsafe operator and attributes (commonly known as annotations in other languages) to add metadata to classes — and more: The JIT compiler is designed to bring performance improvements to web applications by turning code into instructions for the CPU at runtime. Meanwhile, union types is a feature that allows data of more than one type to be held by a variable. Named arguments allow developers to assign values to a function by specifying the value name, allowing optional parameters to be ignored. Alongside these, version 8.0 of PHP brings optimizations and enhancements to the language's type system, syntax, error handling and consistency.... Commenting on PHP 8.0, PHP programmer and stitcher.io developer, Brent Roose, noted that the latest version of the language may require developers to review code for any breaking changes.' -- source: https://developers.slashdot.org/story/20/11/28/1030246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Successfully Virtualizes Windows for Arm on M1 Mac
by Peter Reutemann 29 Nov '20

29 Nov '20

'Developer Alexander Graf has successfully virtualized the Arm version of Windows on an M1 Mac, proving that the M1 chip is capable of running Microsoft's operating system. From a report: Currently, Macs with the M1 chip do not support Windows and there is no Boot Camp feature as there is on Intel Macs, but support for Windows is a feature that many users would like to see. Using the open-source QEMU virtualizer, Graf was able to virtualize the Arm version of Windows on Apple's M1 chip, with no emulation. Since the M1 chip is a custom Arm SoC, it is no longer possible to install the x86 version of Windows or x86 Windows apps using Boot Camp, as was the case with previous Intel-based Macs. However, he said in a Tweet that when virtualized on an M1 Mac, "Windows ARM64 can run x86 applications really well. It's not as fast as Rosetta 2, but close."' -- source: https://apple.slashdot.org/story/20/11/27/2343223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM in January
by Peter Reutemann 28 Nov '20

28 Nov '20

Hi everyone Since we had our last meeting for the year, I just want to announce our upcoming AGM on January 25th. Agenda (preliminary) • President's Report • Treasurer's Report • Election of 2021 Committee • General business • Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ Don't worry, there will be another announcement closer to the date. ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's 'Project Latte' Aims To Bring Android Apps To Windows 10
by Peter Reutemann 28 Nov '20

28 Nov '20

'Windows Central reports: Microsoft is working on a software solution that would allow app developers to bring their Android apps to Windows 10 with little to no code changes by packaging them as an MSIX and allowing developers to submit them to the Microsoft Store. According to sources familiar with the matter, the project is codenamed 'Latte' and I'm told it could show up as soon as next year. The company has toyed with the idea of bringing Android apps to Windows 10 before via a project codenamed Astoria that never saw the light of day. Project Latte aims to deliver a similar product, and is likely powered by the Windows Subsystem for Linux (WSL.) Microsoft will need to provide its own Android subsystem for Android apps to actually run, however. Microsoft has announced that WSL will soon get support for GUI Linux applications, as well as GPU acceleration which should aid the performance of apps running through WSL. It's unlikely that Project Latte will include support for Play Services, as Google doesn't allow Play Services to be installed on anything other than native Android devices and Chrome OS. This means that apps which require Play Services APIs will need to be updated to remove those dependencies before they can be submitted on Windows 10.' -- source: https://tech.slashdot.org/story/20/11/27/2027234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

2FA Bypass Discovered In Web Hosting Software cPanel
by Peter Reutemann 26 Nov '20

26 Nov '20

'ZDNet: Security researchers have discovered a major security flaw in cPanel, a popular software suite used by web hosting companies to manage websites for their customers. The bug, discovered by security researchers from Digital Defense, allows attackers to bypass two-factor authentication (2FA) for cPanel accounts. These accounts are used by website owners to access and manage their websites and underlying server settings. Access to these accounts is critical, as once compromised, they grant threat actors full control over a victim's site. On its website, cPanel boasts that its software is currently used by hundreds of web hosting companies to manage more than 70 million domains across the world. But in a press release today, Digital Defense says that the 2FA implementation on older cPanel & WebHost Manager (WHM) software was vulnerable to brute-force attacks that allowed threat actors to guess URL parameters and bypass 2FA -- if 2FA was enabled for an account. While brute-forcing attacks, in general, usually take hours or days to execute, in this particular case, the attack required only a few minutes, Digital Defense said today. Exploiting this bug also requires that attackers have valid credentials for a targeted account, but these can be obtained from phishing the website owner. The good news is that Digital Defense has privately reported the bug, tracked as SEC-575, to the cPanel team, which has already released patches last week.' -- source: https://it.slashdot.org/story/20/11/25/2227200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0