- wlug - list.wlug.org.nz

Cisco Discloses Security Breach That Impacted VIRL-PE Infrastructure
by Peter Reutemann 01 Jun '20

01 Jun '20

'Thursday Cisco disclosed a security breach that impacted a small part of its backend infrastructure and two of its commercial products also bundling the SaltStack software package as part of their firmware. ZDNet reports: Cisco said that hackers used a vulnerability in the SaltStack software package, which Cisco bundles with some products, to gain access to six servers... The six servers provide the backend infrastructure for VIRL-PE (Internet Routing Lab Personal Edition), a Cisco service that lets users model and create virtual network architectures to test network setups before deploying equipment in real situations. "Cisco identified that the Cisco maintained salt-master servers that are servicing Cisco VIRL-PE releases 1.2 and 1.3 were compromised," the company said Thursday. Cisco said it patched and remediated all hacked VIRL-PE servers on May 7, when it deployed updates for the SaltStack software. However, the issue isn't localized to Cisco's backend infrastructure alone. Cisco says that two of its commercial products also bundle the SaltStack software package as part of their firmware. These are the aforementioned Cisco VIRL-PE, and Cisco Modeling Labs Corporate Edition (CML), another network modeling tool. Both VIRL-PE and CML can be used in Cisco-hosted and on-premise scenarios. In case companies use the two products on location, Cisco says CML and VIRL-PE need to be patched.' -- source: https://tech.slashdot.org/story/20/05/30/055201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

An advanced and unconventional hack is targeting industrial firms
by Peter Reutemann 01 Jun '20

01 Jun '20

'Attackers are putting considerable skill and effort into penetrating industrial companies in multiple countries, with hacks that use multiple evasion mechanisms, an innovative encryption scheme, and exploits that are customized for each target with pinpoint accuracy. The attacks begin with emails that are customized for each target, a researcher at security firm Kaspersky Lab reported this week. For the exploit to trigger, the language in the email must match the localization of the target’s operating system. For example, in the case of an attack on a Japanese company, the text of the email and an attached Microsoft Office document containing a malicious macro had to be written in Japanese. Also required: an encrypted malware module could be decrypted only when the OS had a Japanese localization as well. Recipients who click on a request to urgently enable the document’s active content will see no indication anything is amiss. Behind the scenes, however, a macro executes a Powershell script. The reason it stays hidden: the command parameters: - ExecutionPolicy ByPass—to override organization policies - WindowStyle Hidden. This hides the PowerShell window - NoProfile, which executes the script with no end-user configuration.' -- source: https://arstechnica.com/information-technology/2020/05/an-advanced-and-unco… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Warns Java Developers of New Malware Poisoning NetBeans Projects
by Peter Reutemann 01 Jun '20

01 Jun '20

'GitHub issued a security alert Thursday warning about new malware spreading on its site via boobytrapped Java projects, ZDNet reports: The malware, which GitHub's security team has named Octopus Scanner, has been found in projects managed using the Apache NetBeans IDE (integrated development environment), a tool used to write and compile Java applications. GitHub said it found 26 repositories uploaded on its site that contained the Octopus Scanner malware, following a tip it received from a security researcher on March 9. But the article adds GitHub "believes that many more projects have been infected during the past two years." GitHub says that when other users would download any of the 26 projects, the malware would behave like a self-spreading virus and infect their local computers. It would scan the victim's workstation for a local NetBeans IDE installation, and proceed to burrow into the developer's other Java projects. The malware, which can run on Windows, macOS, and Linux, would then download a remote access trojan (RAT) as the final step of its infection, allowing the Octopus Scanner operator to rummage through an infected victim's computer, looking for sensitive information. GitHub says the Octopus Scanner campaign has been going on for years, with the oldest sample of the malware being uploaded on the VirusTotal web scanner in August 2018, time during which the malware operated unimpeded.' -- source: https://news.slashdot.org/story/20/05/30/2031219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom's New, Stronger Encryption May Only Protect Paying Clients
by Peter Reutemann 01 Jun '20

01 Jun '20

'"Zoom plans to strengthen the encryption of its service for paying customers," reports Newsweek, "but the upgrade will not be available to users of its free service." Zoom security consultant Alex Stamos later confirmed the details of the reported move in an interview with Reuters, which first reported the changes on Friday. But he also told the news outlet that Zoom's plans could still change. "The CEO is looking at different arguments," Stamos said. "The current plan is paid customers plus enterprise accounts where the company knows who they are." In the wake of privacy concerns, he added that Zoom was making significant efforts to upgrade safety and trust on its platform. In an emailed statement to Newsweek, a Zoom spokesperson said: "Zoom's approach to end-to-end encryption is very much a work in progress — everything from our draft cryptographic design, which was just published last week, to our continued discussions around which customers it would apply to." The tech company's plans to boost the encryption of video calls on its platform have been revealed a month after it was reported that half a million Zoom account credentials were being sold on the Dark Web. Zoom's increased usage during lockdowns brought increase scrutiny, reports CNET, which "revealed several Zoom security problems and the fact that an earlier Zoom boast of end-to-end encryption was baseless."' -- source: https://it.slashdot.org/story/20/05/30/2311256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Maintainers of Open Source Projects Be Paid?
by Peter Reutemann 01 Jun '20

01 Jun '20

'Matt Asay, a former COO of Canonical now working at AWS, writes "Over the last few weeks I've interviewed a range of open source project maintainers, most of which don't directly get paid for supporting their projects... Is this a bad thing?" It's not completely clear. Linux Foundation executive Chris Aniszczyk has been an outspoken opponent of open source "tip jars" that seek to sustain projects with donations. "These [open source developers] should be encouraged to start businesses or your business should hire them directly," he argues. But many such developers don't want a 9-to-5 corporate job, preferring the independence of contract work. Open source sustainability, in other words, is messy. Most open source project maintainers with whom I've spoken got started because it was a "fun" way to spend their free time. They had a variety of personal "itches" they needed to scratch. Exactly none started coding because they were hoping to get paid for that work. In fact, in some cases, it was specifically to create space from their employer that they started the project. For Datasette founder Simon Willison, for example, he "wanted a creative outlet." That is, a project that he got to have complete control over. In some ways, he said, it was perhaps "a way of blowing off steam," but really it was a place where he could express his creativity without a corporate overlord steering that creativity. See the problem...? Aniszczyk reasonably suggests that the most sustainable source of funding is a paycheck, but that's precisely what many of these developers don't want. Or, at least, they don't want a paycheck that comes with restrictions on their ability to code freely... [O]pen source sustainability will never have one, meta answer for all of open source. It's always a project-by-project analysis and, really, a founder-by-founder (or community-by-community) decision. ' -- source: https://news.slashdot.org/story/20/05/31/0138252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ardour 6.0 Is Out
by Lawrence D'Oliveiro 29 May '20

29 May '20

Most of us are happy with Audacity for our audio-editing needs, but if you need full on pro-quality audio production, Ardour is it <https://www.theregister.co.uk/2020/05/28/ardour_6_release/>. I did try running it briefly once, but like Blender, you really need an introductory tutorial or two to make at least some initial sense of it all--you cannot just dive in blindly and expect to figure it out by messing around.

2 1

Microsoft Announces The Official “Windows Package Manager”
by Lawrence D'Oliveiro 29 May '20

29 May '20

<https://www.theregister.co.uk/2020/05/20/microsoft_announces_official_windo…>: Among the best features of Linux is the availability of package managers, such as Debian's Apt, that can install, remove and manage dependencies for applications from the command line. It is not perfect – dependency version issues or broken configuration files can be a problem – but most of the time it makes it easy to get what you want, and is scriptable. Many users would like Windows to be equally convenient to use. Only it’s not quite there yet: More seriously, the current preview is limited to installation; it does not even have a remove option for packages. It does not auto-update packages or even have any mechanism to update them, and there is no specific dependency management. On the to-do list are features including uninstall, update, and Store app support. Hence the filing of a bug report pointing out that “All it does is downloading installers (which are not packages) and executing them (which is not management)”.

1 1

A $350 “anti-5G” device is just a 128MB USB stick, teardown finds
by Peter Reutemann 29 May '20

29 May '20

'Believers of 5G conspiracy theories have apparently been buying a $350 anti-5G USB key that—not surprisingly—appears to just be a regular USB stick with only 128MB of storage. As noted by the BBC today, the "5GBioShield" USB stick "was recommended by a member of Glastonbury Town Council's 5G Advisory Committee, which has called for an inquiry into 5G." The company that sells 5GBioShield claims it "is the result of the most advanced technology currently available for balancing and prevention of the devastating effects caused by non-natural electric waves, particularly (but not limited to) 5G, for all biological life forms." The product's website charges £283 for a single 5GBioShield, which converts to nearly $350. That's what it costs to get "protection for your home and family, thanks to the wearable holographic nano-layer catalyser, which can be worn or placed near to a smartphone or any other electrical, radiation or EMF emitting device." "The 5GBioShield makes it possible, thanks to a uniquely applied process of quantum nano-layer technology, to balance the imbalanced electric oscillations arising from all electric fog induced by all devices such as: laptops, cordless phones, wlan, tablets, etc.," the company says, adding that the USB stick "brings balance into the field at the atomic and cellular level restoring balanced effects to all harmful (ionized and non-ionized) radiation." The USB stick apparently doesn't need to be plugged in to anything to work its magic. "It is always ON and working—that's why we used quantum nano-layer technology," the company says in an FAQ. But the device allegedly produces a wider field of protection when it is plugged in. To answer the question of whether the stick needs to be "charged regularly," the FAQ says, "No—the input charge only expands the field effect from 4m radius to 20m + radius when plugged into an USB wall charger or a computer." Fortunately, you can use 5GBioShield without disabling your Wi-Fi. The USB key doesn't block Wi-Fi signals, the company says. Instead, the product "transmutes" the signals and "harmonizes all harmful frequencies into life affirming frequencies."' -- source: https://arstechnica.com/tech-policy/2020/05/5g-conspiracy-theorists-sell-35… Oh dear... Techno-babble to scam the uneducated always seems to work... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Using Curl to make REST API requests
by Peter Reutemann 29 May '20

29 May '20

'An application program interface (API) is a set of definitions and protocols that allows software programs to communicate with each other. The term REST stands for representational state transfer. It is an architectural style that consists of a set of constraints to be used when creating web services. RESTful API is an API that follows the REST architecture. Typically REST APIs use the HTTP protocol for sending and retrieving data and JSON formatted responses. You can use the standard HTTP methods to create, view, update, or delete resources through the API. To test and interact with the RESTful APIs, you can use any library or tool that can make HTTP requests. API requests are made up of four different parts: - The endpoint. This is the URL that the client uses to communicate with the server. - The HTTP method. It tells the server what action the client wants to perform. The most common methods are GET POST PUT DELETE and PATCH - The headers. Used to pass additional information between the server and the client, such as authorization. - The body. The data sent to the server. In this article, we’re going to discuss how to use curl to interact with RESTful APIs. curl is a command-line utility for transferring data from or to a remote server. It is installed by default on macOS and most Linux distributions.' -- source: https://linuxize.com/post/curl-rest-api/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Raspberry Pi 4 model comes with a ton of RAM: 8GB
by Peter Reutemann 29 May '20

29 May '20

'Hot off the launch of an interchangeable camera system earlier this month, Raspberry Pi is introducing a new configuration of the Pi4: a model with a whopping 8GB of RAM. The new, highest-end config for the Pi 4 will run you $75. The 8GB version of the Raspberry Pi 4 has been long rumored, thanks to Raspberry Pi itself leaking the existence of an 8GB model. The blog post reveals that an 8GB model was always a possibility and says, "We were so enthusiastic about the idea that the non-existent product made its way into both the Beginner’s Guide and the compliance leaflet." The Raspberry Pi 4 launched last year with a faster SoC, more RAM, dual micro-HDMI, USB 3.0 support, and a USB-C charging port. In addition to the usual server and hobbyist uses, Raspberry Pi promoted performance on par with an "entry-level x86 PC" and dual-monitor desktop uses.' -- source: https://arstechnica.com/gadgets/2020/05/new-raspberry-pi-4-model-comes-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian hackers are exploiting bug that gives control of US servers
by Peter Reutemann 29 May '20

29 May '20

'A Russian hacking group tied to power-grid attacks in Ukraine, the world’s most destructive data wiper worm, and other nefarious Kremlin operations is exploiting a vulnerability that allows it to take control of computers operated by the US government and its partners. In an advisory published on Thursday, the US National Security Agency said that the Sandworm group was actively exploiting a vulnerability in Exim, an open source mail transfer agent, or MTA, for Unix-based operating systems. Tracked as CVE-2019-10149, the critical bug makes it possible for an unauthenticated remote attacker to send specially crafted emails that execute commands with root privileges. With that, the attacker can install programs of their choosing, modify data, and create new accounts.' -- source: https://arstechnica.com/information-technology/2020/05/russian-hackers-are-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Digital Signage Moving To Linux?
by Lawrence D'Oliveiro 28 May '20

28 May '20

The Register regularly collects reports of computer-controlled public signage malfunctioning in an amusing way. In this latest instalment <https://www.theregister.co.uk/2020/05/27/bork/>, there is an interesting mention: The company went on to tell us that the units run Windows 10, but "we're about to upgrade all of our production machines to a custom Linux build to improve their stability and generally operate with more efficiency." One of the reader comments mentions a company called “Screenly”, which offers a product in both open-source and proprietary-paid forms.

1 0

meeting next month
by Peter Reutemann 28 May '20

28 May '20

Hi everyone Just got contacted by the timetabling people that look after the room bookings for WLUG (and also Python). No evening bookings are allowed till the campus fully operational again. At least the June meetings will be virtual ones again. Having said that, would you like to present something during June? Then please contact me (can be off-list). :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Choosing 2FA authenticator apps can be hard. Ars did it so you don’t have to
by Peter Reutemann 28 May '20

28 May '20

'Last year, Sergio Caltagirone found himself in a tough spot. While traveling, his phone broke and stopped working completely. With no access to his Google and Microsoft authenticator apps, he lost access to two-factor authentication when he needed it most—when he was logging in from IP addresses not recognized by the 30 to 40 sites he had enrolled. “I had a whole bunch of sites [that] I had to go through a massively long account restoration process because I lost my 2FA,” said Caltagirone, who is senior VP of threat intelligence at security firm Dragos. “Every time, I had to contact customer service. I had different levels of requirements I had to go through for them to effectively disable 2FA on my account. Some required address verification. [For others,] I had to send a last bill. The number of those I went through was just insane.” The experience shows the double-edged sword of multi-factor authentication. Requiring users to enter a password that’s pseudorandomly generated every 30 seconds makes account takeovers significantly harder, even when an attacker has phished or otherwise obtained the password. But in the event that second factor (in this case, the “something you have,” that is, the phone) isn’t available, that same protection can block legitimate users from logging in for unacceptably long periods of time. When Caltagirone relayed his experience last September, a quick survey of the available consumer and small-business authenticators left much to be desired. Only a few of them made it possible to back up the unique cryptographic seeds that each phone uses to generate a time-based one-time password, or TOTP. Websites—including Google, Github, Facebook, and hundreds of others that implement the Time-Based One-Time Password Algorithm standard—require the temporary password to log in users who opt in to 2FA. The result? When your device was stolen, lost, or stopped working, you had to go through the same painful and time-consuming account recoveries Caltagirone did. The lack of a backup and recovery mechanism meant the only viable way to hedge against a device loss or malfunction was to print, scan, or photograph each QR code or the underlying Web link (for instance, http://USERNAME(a)salesforce.com/?secret=LZZIKRWX736EH2IQ&issuer=Slack) it represented. That was time consuming. Even worse, it was cumbersome and insecure to store them, particularly when traveling.' -- source: https://arstechnica.com/information-technology/2020/05/choosing-2fa-authent… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

OpenSSH To Deprecate SHA-1 Logins Due To Security Risk
by Peter Reutemann 28 May '20

28 May '20

'OpenSSH, the most popular utility for connecting to and managing remote servers, has announced today plans to drop support for its SHA-1 authentication scheme. From a report: The OpenSSH team cited security concerns with the SHA-1 hashing algorithm, currently considered insecure. The algorithm was broken in a practical, real-world attack in February 2017, when Google cryptographers disclosed SHAttered, a technique that could make two different files appear as they had the same SHA-1 file signature. At the time, creating an SHA-1 collision was considered computationally expensive, and Google experts thought SHA-1 could still be used in practice for at least half a decade until the cost would go down. However, subsequent research released in May 2019 and in January 2020, detailed an updated methodology to cut down the cost of an SHA-1 chosen-prefix collision attack to under $110,000 and under $50,000, respectively. ' -- source: https://it.slashdot.org/story/20/05/27/1830211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Tech’s Volkswagen Moment”
by Lawrence D'Oliveiro 27 May '20

27 May '20

Love the use of the phrase “Volkwagen moment”. A researcher investigating Trend Micro’s antimalware software <https://www.theregister.co.uk/2020/05/20/trend_accused_microsoft_cheating/> has discovered a routine in it which appears to be able to tell when the software is running within Microsoft’s WHQL test suite, so the code can behave one way during testing and certification, and a different way while running on ordinary punters’ PCs. Trend Micro’s response seems to be trying to have it both ways, on the one hand denying it is doing such a thing, on the other trying to cast aspersions on the researcher for going public without contacting them first. But as a reader comment <https://forums.theregister.co.uk/forum/all/2020/05/20/trend_accused_microso…> points out, such a “responsible-disclosure” process is supposed to apply to security bugs. However, this appears to be a deliberate feature.

1 1

India Open Sources Its Contact-Tracing App
by Peter Reutemann 27 May '20

27 May '20

'India has released the source code of its contact-tracing app, Aarogya Setu, to the relief of privacy and security experts who have been advocating for this ever since the app launched in early April. >From a report: Ministry of Electronics and Information Technology Secretary Ajay Prakash Sawhney made the announcement on Tuesday, dubbing the move "opening the heart" of the Aarogya Setu app to allow engineers to inspect and tinker with the code. The app has amassed over 114 million users in less than two months -- an unprecedented scale globally. The source code of Aarogya Setu's Android app is live on GitHub with code of iOS and KaiOS apps slated to release in a "few weeks." Nearly 98% of the app's users are on the Android platform. Sawhney said the government will also offer cash prizes of up to $1,325 to security experts for identifying and reporting bugs and vulnerabilities. "Open-sourcing Aarogya Setu is a unique feat for India. No other government product anywhere in the world has been open-sourced at this scale," said Amitabh Kant, chief executive of government-run think-tank NITI Aayog, in a press conference today.' -- source: https://news.slashdot.org/story/20/05/26/1954212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Android Vulnerability Strandhogg 2.0 Exploits User Trust
by Peter Reutemann 27 May '20

27 May '20

'A Norwegian infosec firm discovered a new Android vulnerability, which they've dubbed Strandhogg 2.0. Security firm Promon says "Strandhogg" is an old Norse strategy for coastline raids and abductions, and today's vulnerability is the "evil twin" of a similar one discovered in 2019. The original Strandhogg used an Android feature called taskAffinity to hijack applications -- by setting the taskAffinity of one of its activities to match the packageName of any other app, then setting allowTaskReparenting="true" in its own manifest, the Strandhogg app would be launched in place of the target app. Strandhogg's 1.0 major weakness was the need to declare taskAffinity in the Android Manifest. The Manifest is a plain XML file and must be included in the package hosted at the Play Store itself -- it can't simply be downloaded later, after the app is installed. This made it relatively simple to scan the Play store for apps with sketchy-looking taskAffinity declarations. Strandhogg 2.0 doesn't require any special settings in a package's Android Manifest -- meaning the attacking code doesn't need to be present on the Play Store to be scanned at all. Instead, the attacker can download the attack code later, once the trojan app or game is already installed on a user's device. In addition to the obvious credential-stealing attacks, Strandhogg can be used to trick users into escalating its privileges based on the trust they have for the apps it hijacks. For example, a user tapping Camera is asked if they want to grant it permission to access the camera and microphone -- if the user taps Yes, they've actually given those privileges to the malware app, not the Camera app it covered up on the screen. Strandhogg 2.0 affects all versions of Android prior to 10 -- which translates to roughly 90 percent of the Android userbase. Google rolled out a patch to close the Strandhogg 2.0 vulnerability, CVE-2020-0096, in May's Android Security Update. This is good news for Pixel users -- but as always, carriers and OEMs may delay those upgrades significantly.' -- source: https://it.slashdot.org/story/20/05/26/211241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Dumps Intel For 32-core AMD Ryzen On His Personal PC
by Peter Reutemann 26 May '20

26 May '20

'Linus Torvalds released Linux 5.7 rc7 today, saying it "looks very normal... none of the fixes look like there's anything particularly scary going on." But then he added something else: [T]he biggest excitement this week for me was just that I upgraded my main machine, and for the first time in about 15 years, my desktop isn't Intel-based. No, I didn't switch to ARM yet, but I'm now rocking an AMD Threadripper 3970x. My 'allmodconfig' test builds are now three times faster than they used to be, which doesn't matter so much right now during the calming down period, but I will most definitely notice the upgrade during the next merge window. The Register writes: Torvalds didn't divulge any further details about his new rig, but the 3970x is quite the beast, boasting 32 cores and 64 threads at 3.7GHz with the ability to burst up to 4.5GHz, all built on TSMC's 7nm FinFET process... Torvalds has probably acquired a whole new PC, as the Threadripper range requires a sTRX4 socket and those debuted on motherboards from late 2019. Whatever he's running, it has more cores than Intel currently offers in a CPU designed for PCs. Even Chipzilla's high-end CoreX range tops out at 18 cores. AMD will be over the moon that such a high profile IT pro has adopted their kit and pointed to its performance. Or, as long-time Slashdot reader williamyf puts it, "Good endorsement for AMD, a PR blow for Intel."' -- source: https://linux.slashdot.org/story/20/05/25/020240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Thousands of Enterprise Systems Infected by New Blue Mockingbird Malware Gang
by Peter Reutemann 26 May '20

26 May '20

'Thousands of enterprise systems are believed to have been infected with a cryptocurrency-mining malware operated by a group tracked under the codename of Blue Mockingbird. From a report: Discovered earlier this month by malware analysts from cloud security firm Red Canary, the Blue Mockingbird group is believed to have been active since December 2019. Researchers say Blue Mockingbird attacks public-facing servers running ASP.NET apps that use the Telerik framework for their user interface (UI) component. Hackers exploit the CVE-2019-18935 vulnerability to plant a web shell on the attacked server. They then use a version of the Juicy Potato technique to gain admin-level access and modify server settings to obtain (re)boot persistence. Once they gain full access to a system, they download and install a version of XMRRig, a popular cryptocurrency mining app for the Monero (XMR) cryptocurrency.' -- source: https://tech.slashdot.org/story/20/05/25/1913201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

eBay Port Scans Visitors' Computers For Remote Access Programs
by Peter Reutemann 26 May '20

26 May '20

'When visiting the eBay.com site, a script will run that performs a local port scan of your computer to detect remote support and remote access applications. Many of these ports are related to remote access/remote support tools such as the Windows Remote Desktop, VNC, TeamViewer, Ammy Admin, and more. After learning about this, BleepingComputer conducted a test and can confirm that eBay.com is indeed performing a local port scan of 14 different ports when visiting the site.' -- source: https://it.slashdot.org/story/20/05/25/161246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Security Report Finds Library-Induced Flaws in 70% of Applications
by Peter Reutemann 25 May '20

25 May '20

' The State of Software Security (SOSS): Open Source Edition "analyzed the component open source libraries across the Veracode platform database of 85,000 applications which includes 351,000 unique external libraries," reports TechRepublic. "Chris Eng, chief research officer at Veracode, said open source software has a surprising variety of flaws." "An application's attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies," he said. The study found that 70% of applications have a security flaw in an open source library on an initial scan. Other findings from the report: - The most commonly included libraries are present in over 75% of applications for each language. - 47% of those flawed libraries in applications are transitive. - More than 61% of flawed libraries in JavaScript contain vulnerabilities without corresponding common vulnerabilities and exposures (CVEs). - Fixing most library-introduced flaws can be done with a minor version upgrade. - Using any given PHP library has a greater than 50% chance of bringing a security flaw along with' -- source: https://developers.slashdot.org/story/20/05/23/2330244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromium Project Finds 70% of Its Serious Security Bugs Are Memory Safety Problems
by Peter Reutemann 25 May '20

25 May '20

'"Around 70% of our serious security bugs are memory safety problems," the Chromium project announced this week. "Our next major project is to prevent such bugs at source." ZDNet reports: The percentage was compiled after Google engineers analyzed 912 security bugs fixed in the Chrome stable branch since 2015, bugs that had a "high" or "critical" severity rating. The number is identical to stats shared by Microsoft. Speaking at a security conference in February 2019, Microsoft engineers said that for the past 12 years, around 70% of all security updates for Microsoft products addressed memory safety vulnerabilities. Both companies are basically dealing with the same problem, namely that C and C++, the two predominant programming languages in their codebases, are "unsafe" languages.... Google says that since March 2019, 125 of the 130 Chrome vulnerabilities with a "critical" severity rating were memory corruption-related issues, showing that despite advances in fixing other bug classes, memory management is still a problem... Half of the 70% are use-after-free vulnerabilities, a type of security issue that arises from incorrect management of memory pointers (addresses), leaving doors open for attackers to attack Chrome's inner components... While software companies have tried before to fix C and C++'s memory management problems, Mozilla has been the one who made a breakthrough by sponsoring, promoting and heavily adopting the Rust programming language in Firefox... Microsoft is also heavily investing in exploring C and C++ alternativesâ¦ But this week, Google also announced similar plans as well... Going forward, Google says it plans to look into developing custom C++ libraries to use with Chrome's codebase, libraries that have better protections against memory-related bugs. The browser maker is also exploring the MiraclePtr project, which aims to turn "exploitable use-after-free bugs into non-security crashes with acceptable performance, memory, binary size and minimal stability impact." And last, but not least, Google also said it plans to explore using "safe" languages, where possible. Candidates include Rust, Swift, JavaScript, Kotlin, and Java.' -- source: https://developers.slashdot.org/story/20/05/24/1349204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'FOSS Responders' Want to Help Open-Source Groups Survive
by Peter Reutemann 25 May '20

25 May '20

'"Thanks to the coronavirus, technology events have been canceled left and right," writes ZDNet. "This, in turn, is damaging the finances of companies and groups that depend on these events." Some open-source groups, such as The Linux Foundation, can deal with it. Others aren't so fortunate. Some, such as Drupal Foundation, the Open Source Initiative (OSI), Open Source Matters (Joomla), and Ajv JSON Schema validator, are in real trouble. FOSS Responders is trying to help these and other groups and individuals... Nuritzi Sanchez, a FOSS Responder co-founder and GitLab senior open-source program manager, said: We "started out around mid-March as a response to COVID-19 event cancellations. It's a group of open source leaders from companies like Indeed, Facebook, Google, Red Hat, GitHub, GitLab, etc." They've set up a process to help both open-source individuals and organizations facing financial trouble. So far, Sanchez said, "organizations are the ones that have been reaching out most so far." They're also consolidating information on how to plan and execute virtual events and provide a place where people can look for and offer help. FOSS Responders has already had some success in raising donations. Alyssa Wright, Open Collective's director of social engineering, reports that it's raised funds from Indeed, Open Source Collective, Linux Fund, GitHub, Google, Sentry, Ethereum Foundation, and the Sloan Foundation. As a result "FOSS Responders is contributing over $100K to open-source organizations that are experiencing financial strain because of the COVID-19 pandemic." "The main focus of philanthropic efforts will be elsewhere, as they should be," noted LWN.net back in March, "but it is nice to see our community finding ways to help itself out internally."' -- source: https://news.slashdot.org/story/20/05/23/2351224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Patent Troll Sent Packing
by Lawrence D'Oliveiro 22 May '20

22 May '20

<https://www.theregister.co.uk/2020/05/21/gnome_foundation_settles_patent_tr…>: In an article comment on this story, [CEO Neil] McGovern said: "For those asking about payment, I can confirm we paid RPI and Leigh Rothschild a grand total of $0.00 for the settlement."

1 0