- wlug - list.wlug.org.nz

News articles on privacy...
by Peter Reutemann 03 Mar '19

03 Mar '19

"Leaked Documents Reveal Facebook's Global War On Data Privacy Laws" -- source: https://tech.slashdot.org/story/19/03/03/1623229 "Massive Database Leak Exposes China's 'Digital Surveillance State'" -- source: https://developers.slashdot.org/story/19/03/03/053253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Break Digital Signatures For Most Desktop PDF Viewers
by Peter Reutemann 26 Feb '19

26 Feb '19

'A team of academics from the Ruhr-University Bochum in Germany say they've managed to break the digital signing system and create fake signatures on 21 of 22 desktop PDF viewer apps and five out of seven online PDF digital signing services. This includes apps such as Adobe Acrobat Reader, Foxit Reader, and LibreOffice, and online services like DocuSign and Evotrust --just to name the most recognizable names. The five-person research team has been working since early October 2018 together with experts from Germany's Computer Emergency Response Team (BSI-CERT) to notify impacted services. The team went public with their findings over the weekend after all affected app makers and commercial companies finished patching their products. In research published today, the Ruhr-University Bochum team described three vulnerabilities that they found in the digital signing process used by several desktop and web-based PDF signing services. Summarized, they are: 1. Universal Signature Forgery (USF) -- vulnerability lets attackers trick the signature verification process into showing users a fake panel/message that the signature is valid. 2. Incremental Saving Attack (ISA) -- vulnerability lets attackers add extra content to an already signed PDF document via the "incremental saving (incremental update)" mechanism, but without breaking the already-existing signature. 3. Signature Wrapping (SWA) -- vulnerability is similar to ISA, but the malicious code also contains extra logic to fool the signature validation process into "wrapping" around the attacker's extra content, effectively digitally signing the incremental update.' -- source: https://it.slashdot.org/story/19/02/25/2126208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Netflix Is Killing Piracy In NZ”
by Lawrence D'Oliveiro 25 Feb '19

25 Feb '19

<https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122073…>: Independent research commissioned by Vocus indicates "piracy is dying a natural death," ... ... Peer-to-peer services, usually associated with piracy, used to be "the dominant source of traffic on our network." Today, about 80 per cent of Vocus' peak-time traffic is for legal streaming sites like Netflix and YouTube. Ah, don’t you just love that simplistic conflation: P2P ≡ piracy, YouTube ≡ legit. I wonder when they will discover youtube-dl...

1 0

Android Is Helping Kill Passwords on a Billion Devices
by Peter Reutemann 25 Feb '19

25 Feb '19

'The FIDO Alliance -- a consortium that develops open source authentication standards -- has been pushing to expand its secure login protocols to make seamless logins a reality for several years. Today, it has hit the jackpot: Google. From a report: On Monday, Google and the FIDO Alliance announced that Android has added certified support for the FIDO2 standard, meaning that the vast majority of devices running Android 7 or later will now be able to handle password-less logins in mobile browsers like Chrome. Android already offered secure FIDO login options for mobile apps, where you authenticate using a phone's fingerprint scanner or with a hardware dongle like a YubiKey. But FIDO2 support will make it possible to use these easy authentication steps for web services in a mobile browser instead of laboriously typing in your password every time you want to log in. Web developers can now design their sites to interact with Android's FIDO2 management infrastructure.' -- source: https://tech.slashdot.org/story/19/02/25/1440241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Australian Email Service FastMail Says It is Losing Customers and Facing Calls To Move Operations Outside of the Country Over Local Anti-Encryption Laws
by Peter Reutemann 25 Feb '19

25 Feb '19

'Email provider FastMail says it has lost customers and faces "regular" requests to shift its operations outside Australia following the passage of anti-encryption laws. The Victorian company, which offers ad-free email services to users in 150 countries, told a senate committee that the now-passed laws were starting to bite. "The way in which [the laws] were introduced, debated, and ultimately passed ... creates a perception that Australia has changed - that we are no longer a country which respects the right to privacy," FastMail CEO Bron Gondwana said. "We have already seen an impact on our business caused by this perception. Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." "Still, we have seen existing customers leave, and potential customers go elsewhere, citing this bill as the reason for their choice. We are [also] regularly being asked by customers if we plan to move.' -- source: https://tech.slashdot.org/story/19/02/25/1329204 That's what the tech community had to say earlier about this bill: https://alp.fail/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla and Scroll Partner To Test Alternative Funding Models for the Web
by Peter Reutemann 25 Feb '19

25 Feb '19

'News subscription service Scroll, which is yet to launch to consumers but has received the backing of several top publishers, courted another major player today: Mozilla. The browser maker says it will work with Scroll to better understand how consumers react to ad-free experiences on the web and subscription-based funding models. As part of the deal, Mozilla said it would test features and product ideas provided by Scroll, which itself has been conducting internal tests with a number of outlets. Small groups of Firefox users will be invited at random to share feedback and also respond to surveys, Mozilla said.' -- source: https://news.slashdot.org/story/19/02/25/1819244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drupal 7 Will Reach End-of-Life in November of 2021
by Peter Reutemann 25 Feb '19

25 Feb '19

'Drupal 7, which was first released in January 2011, will reach end of life (EOL) in November of 2021, the Drupal Association said today. What this means for your Drupal 7 sites is, as of November 2021: 1. Drupal 7 will no longer be supported by the community at large. The community at large will no longer create new projects, fix bugs in existing projects, write documentation, etc. around Drupal 7. 2. There will be no more core commits to Drupal 7. 3. The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core or contributed modules, themes, or other projects. Reports about Drupal 7 vulnerabilities might become public creating 0 day exploits. 4. All Drupal 7 releases on all project pages will be flagged as not supported. Maintainers can change that flag if they desire to. 5. On Drupal 7 sites with the update status module, Drupal Core will show up as unsupported. 6. After November 2021, using Drupal 7 may be flagged as insecure in 3rd party scans as it no longer gets support. 7. Best practice is to not use unsupported software, it would not be advisable to continue to build new Drupal 7 sites. 8. Now is the time to start planning your migration to Drupal' -- source: https://developers.slashdot.org/story/19/02/25/1953224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

holding packages
by Peter Reutemann 25 Feb '19

25 Feb '19

Hi everyone If you want to keep a certain package at a fixed version, you can "hold" that package on a debian system like this: https://help.ubuntu.com/community/PinningHowto#Introduction_to_Holding_Pack… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experts Find Serious Problems With Switzerland's Online Voting System
by Peter Reutemann 22 Feb '19

22 Feb '19

'Switzerland made headlines this month for the transparency of its internet voting system when it launched a public penetration test and bug bounty program to test the resiliency of the system to attack. But after source code for the software and technical documentation describing its architecture were leaked online last week, critics are already expressing concern about the system's design and about the transparency around the public test. Cryptography experts who spent just a few hours examining the leaked code say the system is a poorly constructed and convoluted maze that makes it difficult to follow what's going on and effectively evaluate whether the cryptography and other security measures deployed in the system are done properly. "Most of the system is split across hundreds of different files, each configured at various levels," Sarah Jamie Lewis, a former security engineer for Amazon as well as a former computer scientist for England's GCHQ intelligence agency, told Motherboard. "I'm used to dealing with Java code that runs across different packages and different teams, and this code somewhat defeats even my understanding." She said the system uses cryptographic solutions that are fairly new to the field and that have to be implemented in very specific ways to make the system auditable, but the design the programmers chose thwarts this. "It is simply not the standard we would expect," she told Motherboard. [...] It isn't just outside attackers that are a concern; the system raises the possibility for an insider to intentionally misconfigure the system to make it easier to manipulate, while maintaining plausible deniability that the misconfiguration was unintentional. "Someone could wire the thing in the wrong place and suddenly the system is compromised," said Lewis, who is currently executive director of the Open Privacy Research Society, a Canadian nonprofit that develops secure and privacy-enhancing software for marginalized communities. "And when you're talking about code that is supposed to be protecting a national election, that is not a statement someone should be able to make." "You expect secure code to be defensively written that would prevent the implementers of the code from wiring it up incorrectly," Lewis told Motherboard. But instead of building a system that doesn't allow for this, the programmers simply added a comment to their source code telling anyone who compiles and implements it to take care to configure it properly, she said. The online voting system was developed by Swiss Post, the country's national postal service, and the Barcelona-based company Scytl. "Scytl claims the system uses end-to-end encryption that only the Swiss Electoral Board would be able to decrypt," reports Motherboard. "But there are reasons to be concerned about such claims."' -- source: https://developers.slashdot.org/story/19/02/21/2227234 At least they had a public test to figure that out, rather than an actual election... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of websites threatened by highly critical code-execution bug in Drupal
by Peter Reutemann 22 Feb '19

22 Feb '19

'Millions of sites that run the Drupal content management system run the risk of being hijacked until they're patched against a vulnerability that allows hackers to remotely execute malicious code, managers of the open source project warned Wednesday. CVE-2019-6340, as the flaw is tracked, stems from a failure to sufficiently validate user input, managers said in an advisory. Hackers who exploited the vulnerability could, in some cases, run code of their choice on vulnerable websites. The flaw is rated highly critical. "Some field types do not properly sanitize data from non-form sources," the advisory stated. "This can lead to arbitrary PHP code execution in some cases."' -- source: https://arstechnica.com/information-technology/2019/02/millions-of-websites… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0