- wlug - list.wlug.org.nz

SSH Password-Guessing Attacks
by Lawrence D'Oliveiro 16 May '19

16 May '19

I suppose you know that if you put a machine on the Internet with an SSH server listening on port 22, you are going to get bombarded with password-guessing login attempts. Previously, I thought that moving the SSH server to a nonstandard port was sufficient to block these. But now I am seeing these attacks happening on my Rimu VPS anyway. Should I bother to change the port again?

5 4

Why Linux On Desktop 'Failed': A Discussion With Mark Shuttleworth
by Peter Reutemann 15 May '19

15 May '19

'Mark Shuttleworth, founder and CEO of Canonical, summed it in a few words: "I think the bigger challenge has been that we haven't invented anything in the Linux that was like deeply, powerfully ahead of its time." He also said that "if in the free software community we only allow ourselves to talk about things that look like something that already exists, then we're sort of defining ourselves as a series of forks and fragmentations." He added that it seems the desktop Linux people want to be angry at something. We wanted to do amazing things with Unity but the community won't let us do it, so here we are. He also commended Google folks for what they have built for Chrome OS.' -- source: https://linux.slashdot.org/story/19/05/15/1523252 Hmm... Multiple virtual desktops, natively supported Windows, finally available with Windows 10 (though terrible to use!). Even fvwm2 in 1998 or 1999 was better than Windows' current implementation... Talking about something amazing... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Recalls Its Bluetooth Titan Security Keys Because of a Security Bug
by Peter Reutemann 15 May '19

15 May '19

'Google today disclosed a security bug in its Bluetooth Titan Security Key that could allow an attacker in close physical proximity to circumvent the security the key is supposed to provide. From a report: The company says that the bug is due to a "misconfiguration in the Titan Security Keys' Bluetooth pairing protocols" and that even the faulty keys still protect against phishing attacks. Still, the company is providing a free replacement key to all existing users. The bug affects all Titan Bluetooth keys, which sell for $50 in a package that also includes a standard USB/NFC key, that have a "T1" or "T2" on the back.' -- source: https://it.slashdot.org/story/19/05/15/1728202 Rather than "Titan", they should have called it "Achilles"... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So Long Dual-Booting Windows on a Chromebook: Project Campfire is deprecated
by Peter Reutemann 15 May '19

15 May '19

'Project Campfire turned up in the Chromium world this past August. The intent was to let a Chromebook boot not just into Chrome OS but directly into another operating system such as Linux or Windows. I thought the latter was a positive outcome since it would allow Chromebooks to natively run Windows desktop apps on a Chromebook, and add value to devices. Unfortunately, the project is shutting down. Spotted in code, there are comments and code removals that make it clear Project Campfire is being deprecated.' -- source: https://linux.slashdot.org/story/19/05/15/1752208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is About To Have a Lot More Ads On Phones
by Peter Reutemann 14 May '19

14 May '19

'The Verge reports on the new ad types Google announced today that will start showing up throughout its mobile products, including some that interrupt the core Google search and discovery experiences. From the report: Google searches on mobile will soon include "gallery" ads that allow advertisers to display multiple images for users to swipe through. You'll also begin to see ads in Google's discover feed -- the feed of news stories that you find built into many Android home screens, inside the Google app, and on Google's mobile homepage -- though they'll only appear in select locations for now. The new ad formats are meant to make ads a lot more noticeable. In a blog post, Google ad chief Prabhakar Raghavan says that, in tests, gallery ads resulted in "up to 25 percent more interactions" than traditional search ads. Gallery ads will only be launching on mobile, not the desktop. Discover ads will appear in Google's mobile app, as well as on the discover feed on Android phones. Google tells us those ads won't appear in the discover feed that's built into the google.com mobile homepage. [...] The discover feed -- a personalized feed of recommended news stories that Google displays on mobile -- will also be getting ads for the first time. They'll appear just like any other story, with an image on top, a headline, and a subject field with more information. But they'll have a small badge that says "ad" to let users know it's sponsored. Those ads will extend to YouTube as well, where they'll slot in alongside recommended videos. Discover ads will also roll out later this year. ' -- source: https://search.slashdot.org/story/19/05/14/2014207 Time to switch your Google Apps to FOSS ones: https://f-droid.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Patches 'Wormable' Flaw in Windows XP, 7 and Windows 2003
by Peter Reutemann 14 May '19

14 May '19

'Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003, citing the discovery of a "wormable" flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017. From a report: The vulnerability (CVE-2019-0708) resides in the "remote desktop services" component built into supported versions of Windows, including Windows 7, Windows Server 2008 R2, and Windows Server 2008. It also is present in computers powered by Windows XP and Windows 2003, operating systems for which Microsoft long ago stopped shipping security updates. Microsoft said the company has not yet observed any evidence of attacks against the dangerous security flaw, but that it is trying to head off a serious and imminent threat.' -- source: https://tech.slashdot.org/story/19/05/14/1943243 A bit like "what is dead may never die"... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Hard-To-Fix' Cisco Flaw Puts Work Email At Risk
by Peter Reutemann 14 May '19

14 May '19

'Security researchers have discovered serious vulnerabilities affecting dozens of Cisco devices. The flaws allow hackers to deceive the part of the product hardware that checks whether software updates come from legitimate sources. Experts believe this could put emails sent within an organization at risk as they may use compromised routers. Messages sent externally constitute less of a risk, however, as they tend to be encrypted. The California-based firm said it is working on "software fixes" for all affected hardware. "We've shown that we can quietly and persistently disable the Trust Anchor," Red Balloon chief executive Ang Cui, told Wired magazine. "That means we can make arbitrary changes to a Cisco router, and the Trust Anchor will still report that the device is trustworthy. Which is scary and bad, because this is in every important Cisco product. Everything." Security experts believe that the vulnerability could cause a major headache for Cisco, which has listed dozens of its products as vulnerable on its website. "We don't know how many devices could have been affected and it's unlikely Cisco can tell either," said Prof Alan Woodward, a computer security expert based at Surrey University. "It could cost Cisco a lot of money."' -- source: https://it.slashdot.org/story/19/05/14/1945212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Says It is Willing To Sign 'No-Spy' Agreements With Governments
by Peter Reutemann 14 May '19

14 May '19

'Huawei is willing to sign no-spy agreements with governments, including Britain, the Chinese telecommunications company's chairman said on Tuesday as the United States pressures European countries to shun the firm over spying concerns. From a report: Washington has told allies not to use Huawei's technology to build new 5G telecommunications networks because of worries it could be a vehicle for Chinese spying, an accusation the firm has denied.' -- source: https://tech.slashdot.org/story/19/05/14/1531257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs Released in Last 8 Years Impacted by New Zombieload Side-Channel Attack
by Peter Reutemann 14 May '19

14 May '19

'Academics have discovered a new class of vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. From a report: The leading attack in this new vulnerability class is a security flaw named Zombieload, which is another side-channel attack in the same category as Meltdown, Spectre, and Foreshadow. Just like the first three, Zombieload is exploited by taking advantage of the speculative execution process, which is an optimization technique that Intel added to its CPUs to improve data processing speeds and performance. For more than a year, academics have been poking holes in various components of the speculative execution process, revealing ways to leak data from various CPU buffer zones and data processing operations. Meltdown, Spectre, and Foreshadow have shown how various CPU components leak data during the speculative execution process. Today, an international team of academics -- including some of the people involved in the original Meltdown and Spectre research -- along with security researchers from Bitdefender have disclosed a new attack impacting the speculative execution process. This one is what researchers have named a Microarchitectural Data Sampling (MDS) attack, and targets a CPU's microarchitectural data structures, such as the load, store, and line fill buffers, which the CPU uses for fast reads/writes of data being processed inside the CPU. [...] In a research paper published today, academics say that all Intel CPUs released since 2011 are most likely vulnerable. Processors for desktops, laptops, and (cloud) servers are all impacted, researchers said on a special website they've set up with information about the Zombieload flaws.' -- source: https://tech.slashdot.org/story/19/05/14/1721242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Academics Improve SHA-1 Collision Attack, Make It Actually Dangerous
by Peter Reutemann 14 May '19

14 May '19

'"Attacks on the SHA-1 hashing algorithm just got a lot more dangerous last week with the discovery of the first-ever 'chosen-prefix collision attack,' a more practical version of the SHA-1 collision attack first carried out by Google two years ago," reports ZDNet. Google's original research allowed attackers to force duplicates for specific files, but this process was often at random. A new SHA-1 collision attack variation (a chosen-prefix attack) detailed last week allows attackers to choose what SHA-1-signed files or data streams they want to forge on demand, making SHA-1 an attack that is now practical in the real world, albeit at a price tag of $100,000 per collision.' -- source: https://it.slashdot.org/story/19/05/13/2255229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1