- wlug - list.wlug.org.nz

The Internet is Now Rife With Places Where You Can Organize Zoom-bombing Raids
by Peter Reutemann 03 Apr '20

03 Apr '20

'The internet is rife with online communities where users can go and share Zoom conference codes and request that pranksters connect and hurl insults, play pornographic material, or make death threats against other participants -- in a practice called Zoom-bombing or a Zoom raid. From a report: ZDNet began tracking the tactic since mid-March when the term was first coined following a TechCrunch article. Ever since then, Zoom-bombing incidents have increased, as articles in major news outlets like the New York Times and the BBC have made the practice a favorite pastime for all the teenagers stuck in their homes during the current coronavirus (COVID-19) quarantines. From a niche prank that started on a derelict Discord channel, Zoom-bombing has now spread to enormous proportions -- being so rampant these days that the FBI sent a nationwide alert last week, urging companies, schools, and universities to take steps to secure their Zoom channels. But as Zoom-bombing became more popular, more pranksters wanted to join on the fun, and more users wanted their friends' Zoom meetings disrupted. And as the old saying goes; where there's a demand, there's always a supply. Over the course of the past week, the number of places on the public internet where you can request a zoom raid from a gang of bored teenagers has exploded.' -- source: https://yro.slashdot.org/story/20/04/02/1937229 How to secure Zoom: https://www.netsafe.org.nz/get-into-zoom/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

National Tells PM To Stop Using Zoom At Cabinet Meetings
by Lawrence D'Oliveiro 02 Apr '20

02 Apr '20

Security concerns are being raised about the Zoom videoconferencing service, which Jacinda Ardern and her cabinet have been using in their online meetings <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12321784>.

2 1

Linux Mint 20 is 64-bit Only, Based on Ubuntu 20.04, and Named 'Ulyana'
by Peter Reutemann 01 Apr '20

01 Apr '20

'Today, we learn some new details about the upcoming Linux Mint 20. While most of the newly revealed information is positive, there is one thing that is sure to upset many Linux Mint users. First things first, Linux Mint 20 will be based on the upcoming Ubuntu 20.04. This shouldn't come as a surprise, as Mint only uses Long Term Support versions of Ubuntu, and 20.04 will be an LTS. We also now know the name of Linux Mint 20. The Mint team always uses female names, and this time they chose "Ulyana." This is apparently a Russian name meaning "youthful." So far, all of the news is positive, so what exactly will upset some users? The Linux Mint developers are finally dropping 32-bit support and will only produce 64-bit ISOs.' -- source: https://linux.slashdot.org/story/20/03/31/1842216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

OpenWRT code-execution bug puts millions of devices at risk
by Peter Reutemann 01 Apr '20

01 Apr '20

'For almost three years, OpenWRT—the open source operating system that powers home routers and other types of embedded systems—has been vulnerable to remote code-execution attacks because updates were delivered over an unencrypted channel and digital signature verifications are easy to bypass, a researcher said. OpenWRT has a loyal base of users who use the freely available package as an alternative to the firmware that comes installed on their devices. Besides routers, OpenWRT runs on smartphones, pocket computers and even laptops and desktop PCs. Users generally find OpenWRT to be a more secure choice because it offers advanced functions and its source code is easy to audit. Security researcher Guido Vranken, however, recently found that updates and installation files were delivered over unencrypted HTTPs connections, which are open to attacks that allow adversaries to completely replace legitimate updates with malicious ones. The researcher also found that it was trivial for attackers with moderate experience to bypass digital-signature checks that verify a downloaded update as the legitimate one offered by OpenWTR maintainers. The combination of those two lapses makes it possible to send a malicious update that vulnerable devices will automatically install.' -- source: https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerabl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How The ESA Has Kept The Mars Express Probe Doing Useful Science For 16 Years
by Lawrence D'Oliveiro 01 Apr '20

01 Apr '20

Originally designed for a mission lasting one Martian year (about two Earth years), MEX <https://www.theregister.co.uk/2020/03/31/mars_express/> continues to operate even today, and looks likely to manage to stay in action for a few more years. Working around a wiring error that meant it only had 70% of the designed operating power, then dealing with unreliabilities cropping up in the Solid-State Mass Memory system, figuring out how to prolong the life of the maneouvring reaction wheels, actually having to write and upload new software written in Ada-83, where the original contractor was helpful, rather than obstructive for a change: While support had officially ended, ESA did set up a small contract with Airbus (who had acquired the original spacecraft manufacturer) in a role reversal that saw Airbus review the MEX team's work rather than the other way around. As it transpired, Airbus turned out to be hugely helpful, blowing dust off some testing tools, making suggestions and, effectively, "putting the band back together" as those who originally designed and built MEX (and had not yet shuffled off into retirement) were hauled back to offer assistance. All in all, the team operating MEX has done some amazing work so far. Bear in mind that launching probes into space is still a dicey business, prone to embarrassing failures. This is why they have to be over-engineered, then backed up with alternate recovery plans on top of alternate recovery plans.

1 0

Zoom Meetings Aren't End-to-End Encrypted, Despite Misleading Marketing
by Peter Reutemann 01 Apr '20

01 Apr '20

'Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. With millions of people around the world working from home in order to slow the spread of the coronavirus, business is booming for Zoom, bringing more attention on the company and its privacy practices, including a policy, later updated, that seemed to give the company permission to mine messages and files shared during meetings for the purpose of ad targeting. Still, Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using "computer audio" instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom's website, its security white paper, and the user interface within the app. But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption.' -- source: https://it.slashdot.org/story/20/03/31/1526250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom is Leaking Peoples' Email Addresses and Photos To Strangers
by Peter Reutemann 01 Apr '20

01 Apr '20

'Popular video-conferencing Zoom is leaking personal information of at least thousands of users, including their email address and photo, and giving strangers the ability to attempt to start a video call with them through Zoom. From a report: The issue lies in Zoom's "Company Directory" setting, which automatically adds other people to a user's lists of contacts if they signed up with an email address that shares the same domain. This can make it easier to find a specific colleague to call when the domain belongs to an individual company. But multiple Zoom users say they signed up with personal email addresses, and Zoom pooled them together with thousands of other people as if they all worked for the same company, exposing their personal information to one another.' -- source: https://yro.slashdot.org/story/20/03/31/201237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPE, Intel and Linux Foundation Team Up For Open Source Software for 5G Core
by Peter Reutemann 01 Apr '20

01 Apr '20

'HPE announced on Tuesday it's working with Intel and the Linux Foundation on a new open source software project to help automate the roll out of 5G across multiple sites. From a report: The new partnership, which will be under the Linux Foundation umbrella, is called the Open Distributed Infrastructure Management Framework. The partnership represents HPE's move into the 5G core network space as it branches out from its enterprise roots. Other partners for the open source project include AMI, Apstra, IBM's Red Hat, Tech Mahindra and World Wide Technology. HPE will also introduce an enterprise offering, the HPE Open Distributed Infrastructure Management Resource Aggregator.' -- source: https://news.slashdot.org/story/20/03/31/1947203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Keyring Concept in Ubuntu: What is It and How to Use it?
by Peter Reutemann 31 Mar '20

31 Mar '20

'f you use automatic login in Ubuntu or other Linux distributions, you might have come across a pop-up message of this sort: Enter password to unlock your login keyring The login keyring did not get unlocked when you logged into your computer. It keeps on popping up several times before disappearing if you keep on clicking cancel. You may wonder why do you keep seeing this keyring message all the time? Let me tell you something. It’s not an error. It’s a security feature. Surprised? Let me explain the keyring concept in Linux.' -- source: https://itsfoss.com/ubuntu-keyring/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Internet Pioneer Vint Cerf Tests Positive For Covid-19
by Peter Reutemann 31 Mar '20

31 Mar '20

'Tech pioneer Vint Cerf, one of the co-creators of the modern internet, has tested positive for covid-19, according to a tweet Cerf sent out Monday morning. The 76-year-old tweeted out a clip from HBO's Last Week Tonight with John Oliver about the U.S. response to the global pandemic. "I tested positive for COVID-19 and am recovering," Cerf tweeted. "Listen to what John Oliver has to say about our national response so far." Cerf helped create the modern internet in the 1970s while working at UCLA with other pioneers like Bob Kahn and Leonard Kleinrock. Cerf worked on packet switching for the APRANET under Kleinrock and TCP/IP protocols with ARPA (now DARPA), the plumbing that makes the internet function. DARPA tweeted its support of Cerf, telling him to get well soon.' -- source: https://science.slashdot.org/story/20/03/30/214250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

WireGuard VPN makes it to 1.0.0—and into the next Linux kernel
by Peter Reutemann 31 Mar '20

31 Mar '20

'We've been anticipating WireGuard's inclusion into the mainline Linux kernel for quite some time—but as of Sunday afternoon, it's official. Linus Torvalds released the Linux 5.6 kernel, which includes (among other things) an in-tree WireGuard. Phoronix has a great short list of the most interesting new features in the 5.6 kernel, as well as a longer "everything list" for those who want to make sure they don't miss anything. If this is the first time you're hearing about WireGuard, the TL;DR is that it's a relatively new VPN (Virtual Private Network) application that offers a leaner codebase, easier configuration, faster connect times, and the latest and most thoroughly peer-reviewed and approved encryption algorithms. You can find a more detailed introduction in our initial August 2018 coverage.' -- source: https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

#IsTheInternetDown
by Lawrence D'Oliveiro 28 Mar '20

28 Mar '20

Parts of it, anyway. Currently having trouble accessing github.com and anz.co.nz. Well, what else is there to do? ;)

3 4

Public Crash Screens: Linux For A Change
by Lawrence D'Oliveiro 27 Mar '20

27 Mar '20

The Register runs a regular series of reports on public signage showing crash messages instead of the ones they are supposed to show. Usually these are Microsoft Windows messages, often for hilariously out-of-date versions of Windows. This one, for a change <https://www.theregister.co.uk/2020/03/24/bork_walmart/>, shows a Linux boot failure. But it is still a hilariously out-of-date version of Linux.

2 2

Moving To Life Online ... With A Vengeance
by Lawrence D'Oliveiro 26 Mar '20

26 Mar '20

ISPs are having a few hiccups adjusting to the massive increase in Internet usage, particularly in the daytime <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123201…>. Even phone calls, it seems, are overloading the landline network: Meanwhile, Spark says the indu[s]try-wide congestion problems that stopped many voice calls getting through on Monday and Tuesday are slowly starting to ease - but the telco is still encouraging people to use internet apps like Apple Facetime, WhatsApp or Skype for calls to help ease the pressure. Yeah, push even more load onto the Internet ...

2 2

Singapore Government To Make Its Contact-Tracing App Freely Available To Developers Worldwide
by Peter Reutemann 26 Mar '20

26 Mar '20

'In a move to help the international community combat the coronavirus pandemic, the Singapore government will be making the software for its contact-tracing application TraceTogether, which has already been installed by more than 620,000 people, freely available to developers around the world. From a report: In a post on Monday, Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan said that the app, developed by the Government Technology Agency (GovTech) and the Ministry of Health, will be open-sourced. This means that the software's source code will be made freely available and may be redistributed and modified. "We believe that making our code available to the world will enhance trust and collaboration in dealing with a global threat that does not respect boundaries, political systems or economies," said Dr Balakrishnan, who is also Foreign Minister. "Together, we can make our world safer for everyone."' -- source: https://yro.slashdot.org/story/20/03/25/1651232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The exFAT Filesystem Is Coming To Linux -- Paragon Software's Not Happy About It
by Peter Reutemann 26 Mar '20

26 Mar '20

'When software and operating system giant Microsoft announced its support for inclusion of the exFAT filesystem directly into the Linux kernel back in August, it didn't get a ton of press coverage. But filesystem vendor Paragon Software clearly noticed this month's merge of the Microsoft-approved, largely Samsung-authored version of exFAT into the VFS for-next repository, which will in turn merge into Linux 5.7 -- and Paragon doesn't seem happy about it. Yesterday, Paragon issued a press release about European gateway-modem vendor Sagemcom adopting its version of exFAT into an upcoming series of Linux-based routers. Unfortunately, it chose to preface the announcement with a stream of FUD (Fear, Uncertainty, and Doubt) that wouldn't have looked out of place on Steve Ballmer's letterhead in the 1990s.' -- source: https://linux.slashdot.org/story/20/03/25/2136223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play’s malicious app problem infects 1.7 million more devices
by Peter Reutemann 25 Mar '20

25 Mar '20

'Google Play, the company’s official repository for Android apps, has once again been caught hosting fraudulent and potentially malicious apps, with the discovery of more than 56 apps—many of them for children—that were installed on almost 1.7 million devices. Tekya is a family of malware that generates fraudulent clicks on ads and banners delivered by agencies including Google’s AdMob, AppLovin’, Facebook, and Unity. To give the clicks the air of authenticity, the well-obfuscated code causes infected devices to use Android’s “MotionEvent” mechanism to imitate legitimate user actions. At the time researchers from security firm Check Point discovered them, the apps went undetected by VirusTotal and Google Play Protect. Twenty-four of the apps that contained Tekya were marketed to children. Google removed all 56 of the apps after Check Point reported them. The discovery “highlights once again that the Google Play Store can still host malicious apps,” Check Point researchers Israel Wernik, Danil Golubenko, and Aviran Hazum wrote in a post published on Tuesday. “There are nearly 3 million apps available from the store, with hundreds of new apps being uploaded daily–making it difficult to check that every single app is safe. Thus, users cannot rely on Google Play’s security measures alone to ensure their devices are protected.”' -- source: https://arstechnica.com/information-technology/2020/03/found-malicious-goog… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches New Initiative With Scroll To Fund Publishers
by Peter Reutemann 25 Mar '20

25 Mar '20

'Firefox, the global web browser from Mozilla, is launching a new subscription product Tuesday called the "Firefox Better Web initiative," and it will feature former Chartbeat CEO Tony Haile's new product Scroll as a launch partner. From a report: It's uncommon for a web browser to launch a product that's explicitly tied to paying out publishers. Scroll's business is all about paying publishers for their content while giving users a better ad experience. The test pilot for the product, which is a subscription to a privacy-first Firefox extension, will only be available in the U.S. The money from a membership ($4.99 monthly, $2,99 for first six months) goes directly to fund publishers and writers.' -- source: https://news.slashdot.org/story/20/03/24/145235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meet the Chinese OS That's Trying To Shift the Country Off Windows
by Peter Reutemann 25 Mar '20

25 Mar '20

'China's homegrown operating systems haven't made much of a dent on the global stage. Now there's a Linux-based system that's aimed at weaning the country off Windows. From a report: UOS, or Unified Operating System, hit a new milestone after its first stable release in January: Union Tech's OS can now boot in 30 seconds on China-made chips. It's an important step as Chinese tech companies look to reduce their dependence on US-made software and hardware. The struggles of ZTE and Huawei illustrate this clearly: The former was reliant on chips made in the US to produce smartphones, while the latter has the difficult task of selling Android handsets outside China without Google apps or services. The "current international climate" has made it imperative for China to have its own foundational software to avoid being cut off by the US, said the general manager of Union Tech, Liu Wenhan. While Chinese operating systems currently account for less than 1% of the market, Liu said he expects them to grow to 20% to 30% in the future. Integrating homegrown Chinese chips could be the biggest accomplishment of UOS if it pans out. Although Chinese computer chips still don't approach the sophistication of those created by US-based companies, Union Tech said that it is actively working with Chinese chipmakers like Loongson and Sunway to facilitate the gradual replacement of American technology in the Chinese government and pillar industries. In December, Beijing ordered all government offices and public institutions to remove foreign computer equipment and software within three years.' -- source: https://tech.slashdot.org/story/20/03/24/1918223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Says Hackers Are Attacking Windows Users With a New Unpatched Bug
by Peter Reutemann 24 Mar '20

24 Mar '20

'Microsoft says attackers are exploiting a previously undisclosed security vulnerability found in all supported versions of Windows, including Windows 10. From a report: But the software giant said there is currently no patch for the vulnerability. The security flaw, which Microsoft deems "critical" -- its highest severity rating -- is found in how Windows handles and renders fonts, according to the advisory posted Monday. The bug can be exploited by tricking a victim into opening a malicious document. Once the document is opened -- or viewed in Windows Preview -- an attacker can remotely run malware, such as ransomware, on a vulnerable device. The advisory said that Microsoft was aware of hackers launching "limited, targeted attacks," but did not say who was launching the attacks or at what scale.' -- source: https://tech.slashdot.org/story/20/03/23/1846216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WLUG meeting (virtual)
by Peter Reutemann 23 Mar '20

23 Mar '20

Hi everyone Thanks to Aarons tireless efforts, we can have our WLUG meeting despite COVID-19, though in virtual form via Youtube and Google Hangouts (see links below). As a refresher for the topic: The voice interface represents another big shift in user interfaces, and could be as big a shift as the shift from switches to terminals, the switch from terminals to windowed GUIs, or the switch from full computers to small touchscreen devices. Unfortunately, right now most of these devices are little more than a telephone for talking to a server in the cloud. That is a big problem for privacy, and presents the user with a false choice between access and privacy. Today's computers are capable of handling a verbal interface without requiring a cloud service to handle all of your requests. Aaron Chantrill is one of the developers on the Naomi Project, a free and open source voice assistant (https://projectnaomi.com) It is a plugin based system based on Jasper (http://jasperproject.github.io/) and depending on how the user chooses to configure it, can run totally offline. In this presentation, Aaron would like to introduce people to the Naomi Project, talk about the benefits of a verbal interface, talk about the current architectures of virtual assistants, and ways in which that architecture can be altered to provide better privacy, and also do a comparison of offline speech to text and text to speech solutions, including Pocketsphinx, Mozilla Deepspeech, Kaldi, and Julius. Finally, He will invite people to participate in building and improving Naomi. There is a lot to do and much of it is both engaging and cutting-edge. Aaron recorded a video of his presentation that you can watch here before the virtual meeting: https://youtu.be/8383A_t7iKQ The slides are available as well: https://github.com/aaronchantrill/NaomiPresentation/raw/master/Presentation… The Google Hangouts link for the Question & Answer session: https://hangouts.google.com/hangouts/_/calendar/ZHJhc2t5QGdtYWlsLmNvbQ.3j6l… Meetup link: https://www.meetup.com/WaikatoLinuxUsersGroup/events/269578787/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

[OT] The Doctor Who Helped Defeat Smallpox Explains What’s Coming
by Lawrence D'Oliveiro 23 Mar '20

23 Mar '20

I realize this isn’t part of the topic of this group, but this article <https://arstechnica.com/science/2020/03/the-doctor-who-helped-defeat-smallp…> seems to me important enough that everyone should read it. It’s an interview with epidemiologist Larry Brilliant, who was part of the group that helped eradicate smallpox, and who gave a TED talk 14 years ago about what the next epidemic would look like, that is proving rather prescient right now. He gives an overview of where we are at in the knowledge of the SARS-Cov-2† virus that is causing the current COVID-19‡ pandemic. In short, as new as this virus is, it’s going to follow a lot of the same sort of behaviour as every past infectious viral disease. On facemasks: The N95 mask itself is extremely wonderful. The pores in the mask are three microns wide. The virus is one micron wide. So you get people who say, well, it's not going to work. But you try having three big, huge football players who are rushing for lunch through a door at lunchtime—they're not going to get through. In the latest data I saw, the mask provided 5x protection. That's really good. But we have to keep the hospitals going and we have to keep the health professionals able to come to work and be safe. So masks should go where they’re needed the most: in taking care of patients. †Official name of the virus ‡Official name of the disease caused by the virus

1 0

Critical bugs in dozens of Zyxel and Lilin IoT models under active exploit
by Peter Reutemann 22 Mar '20

22 Mar '20

'Criminals are exploiting critical flaws to corral Internet-of-things devices from two different manufacturers into botnets that wage distributed denial-of-service attacks, researchers said this week. Both DVRs from Lilin and storage devices from Zyxel are affected, and users should install updates as soon as possible. Multiple attack groups are exploiting the Lilin DVR vulnerability to conscript them into DDoS botnets known as FBot, Chalubo, and Moobot, researchers from security firm Qihoo 360 said on Friday. The latter two botnets are spinoffs of Mirai, the botnet that used hundreds of thousand of IoT devices to bombard sites with record-setting amounts of junk traffic. The DVR vulnerability stems from three flaws that allow attackers to remotely inject malicious commands into the device. The bugs are: (1) hard-coded login credentials present in the device, (2) command-injection flaws, and (3) arbitrary file reading weaknesses. The injected parameters affect the device capabilities for file transfer protocol, network time protocol, and the update mechanism for network time protocol.' -- source: https://arstechnica.com/information-technology/2020/03/lilin-dvrs-and-zyxel… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using Employer’s Proprietary Software From Home? It’ll Cost You
by Lawrence D'Oliveiro 21 Mar '20

21 Mar '20

Never mind the security pitfalls of employees working from home, now there are additional licensing headaches to worry about as well, with proprietary software <https://www.theregister.co.uk/2020/03/20/surge_in_home_working/>: ... some vendors have curious rules about remote access to their applications that incur additional fees. Rich Gibbons, a licensing trainer at IT Asset Management (ITAM), noted that Citrix and/or Remote Desktop Services are "the easiest way to quickly become non-compliant with a LOT of vendors." ... Security is one thing, but in the midst of a global pandemic, does anyone care about licensing? "You're not going to get audited right now," Gibbons told The Reg. "But in six months or whenever this is over, you need to know what you've done."

1 0

Open-Source Project Spins Up 3D-Printed Ventilator Validation Prototype In Just One Week
by Peter Reutemann 20 Mar '20

20 Mar '20

'In a great example of what can happen when smart, technically-oriented people come together in a time of need, an open-source hardware project started by a group including Irish entrepreneur Colin Keogh and Breeze Automation CEO and co-founder Gui Calavanti has produced a prototype ventilator using 3D-printed parts and readily available, inexpensive material. The ventilator prototype was designed and produced in just seven days, after the project spun up on Facebook and attracted participation from over 300 engineers, medical professionals and researchers. The prototype will now enter into a validation process by the Irish Health Services Executive (HSE), the country's health regulatory body. This will technically only validate it for use in Ireland, which ironically looks relatively well-stocked for ventilator hardware, but it will be a key stamp of approval that could pave the way for its deployment across countries where there are shortages, including low-income nations. The group behind the ventilator also recently changed the focus of their Facebook community, renaming the group from the Open Source Ventilator Project to the Open Source COVID19 Medical Supplies community. They're looking at expanding their focus to finding ways to cheaply and effectively build and validate other needed equipment, including protective gear like masks, sanitizer and protective face guards for front-line healthcare workers.' -- source: https://science.slashdot.org/story/20/03/19/2047232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0