- wlug - list.wlug.org.nz

Analysis of Linux Backdoor Used In Freenode Hack
by Peter Reutemann 14 Oct '14

14 Oct '14

For those that use IRC... "A detailed analysis has been done of the Linux backdoor used in the freenode hack. It employed port knocking and encryption to provide security against others using it. This seems a little more sophisticated than your average black-hat hacker." -- source: http://linux.slashdot.org/story/14/10/14/2142214 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

VeraCrypt Is the New TrueCrypt -- and It's Better
by Peter Reutemann 13 Oct '14

13 Oct '14

'If you're looking for an alternative to TrueCrypt, you could do worse than VeraCrypt, which adds iterations and corrects weaknesses in TrueCrypt's API, drivers and parameter checking. According to the article, "In technical terms, when a system partition is encrypted, TrueCrypt uses PBKDF2-RIPEMD160 with 1,000 iterations. For standard containers and other (i.e. non system) partitions, TrueCrypt uses at most 2,000 iterations. What Idrassi did was beef up the transformation process. VeraCrypt uses 327,661 iterations of the PBKDF2-RIPEMD160 algorithm for system partitions, and for standard containers and other partitions it uses 655,331 iterations of RIPEMD160 and 500,000 iterations of SHA-2 and Whirlpool, he said. While this makes VeraCrypt slightly slower at opening encrypted partitions, it makes the software a minimum of 10 and a maximum of about 300 times harder to brute force."' -- source: http://it.slashdot.org/story/14/10/13/2234251 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Lunar Linux 1.7.0
by Peter Reutemann 13 Oct '14

13 Oct '14

'Stefan Wold has announced the release of Lunar Linux 1.7.0, a source-based distribution with a complete application management system: "You better believe it, the day you all have been waiting for has finally arrived. The Lunar team proudly announces the final release of Lunar Linux 1.7.0, code name 'Sinus Successus'. Like the phoenix rising from the ashes Lunar Linux is back with a vengeance; a lot of overhauling has been done all over the core tools, packages, installer and the ISO builder. Even though our journey to reach this milestone has been a long one we hope that the changes and quality improvements we've made was worth the wait. So what are you waiting for? Go grab a copy of Lunar Linux while it is hot! New features in 1.7.0: out with sysvinit and in with systemd; Linux kernel 3.16.3, GCC 4.9.1 and glibc 2.19; added support for the Btrfs file system; GRUB 2 or LILO, pick your poison; improved installer; now with initrd support; a bunch of updated modules."' -- source: http://distrowatch.com/?newsid=08641 If you like compiling stuff, this should be an interesting distro. I wonder, how it compares to Gentoo? Anybody feel like giving it a spin and maybe share some insights at the next meeting? Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

AGM: Monday 24th November 2014
by Peter Reutemann 13 Oct '14

13 Oct '14

Hi everyone The year is coming to an end and it is once again time for an AGM. This year's AGM will take place on November 24th, usual place at uni, MS4.G.02. Agenda: - Possible nomination of additional secretary by committee - President's Report - Treasurer's Report - Election of 2015 Committee - Consumption of pizza Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 1

Linux Foundation Launches Open Source Dronecode Project
by Peter Reutemann 13 Oct '14

13 Oct '14

"The Linux Foundation, the nonprofit organization dedicated to accelerating the growth of Linux and collaborative development, today announced the founding of the Dronecode Project. The Project will bring together existing open source drone projects and assets under a nonprofit structure governed by The Linux Foundation. The result will be a common, shared open source platform for Unmanned Aerial Vehicles (UAVs). Founding members include 3D Robotics, Baidu, Box, DroneDeploy, Intel, jDrones, Laser Navigation, Qualcomm, SkyWard, Squadrone System, Walkera and Yuneec. Dronecode includes the APM UAV software platform and associated code, which until now has been hosted by 3D Robotics, a world leader in advanced UAV autopilot and autonomous vehicle control. The company was co-founded by Chris Anderson, formerly editor-in-chief of Wired" -- source: http://news.slashdot.org/story/14/10/13/1152208 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Netflix Now Works On Ubuntu, No Hacks Required
by Peter Reutemann 12 Oct '14

12 Oct '14

"The company has, quietly, and without fanfare, flipped the switch required to allow Google Chrome users on Ubuntu (and other modern Linux distributions) to watch movies and TV shows in the browser. If you’ve been following this long, protracted saga — which has been about as enjoyable as a binge-watch of the US Inbetweeners remake — then this news won’t be too out of the blue. Last month Netflix engineer Paul Adolph pledged to remove the user-agent filter, the final hurdle in preventing Ubuntu users from streaming content, once a newer version of the security library (nss3) was rolled out to users. That roll out took place in late September. " -- source: http://goo.gl/ekPj73 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Spotify is Powered by Linux and Open Source
by Peter Reutemann 12 Oct '14

12 Oct '14

'Spotify can aptly be called the "Netflix for music." The company started off in 2008 and by 2014 it boasts more than 40 million users with 10 million paid subscribers. The Swedish company is yet another example of how Linux and open source enable businesses to serve millions of customers using state-of-the-art, shared technologies.' -- source: http://www.linux.com/news/enterprise/case-studies/790458 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

ChromeOS Will No Longer Support Ext2/3/4 On External Drives/SD Cards
by Peter Reutemann 12 Oct '14

12 Oct '14

"Chrome OS is based on the Linux kernel and designed by Google to work with web applications and installed applications. Chromebook is one of the best selling laptops on Amazon. However, devs decided to drop support for ext2/3/4 on external drivers and SD card. It seems that ChromiumOS developers can't implement a script or feature to relabel EXT volumes in the left nav that is insertable and has RW privileges using Files.app. Given that this is the main filesystem in Linux, and is thereby automatically well supported by anything that leverages Linux, this choice makes absolutely no sense. Google may want to drop support for external storage and push the cloud storage on everyone. Overall Linux users and community members are not happy at all." -- source: http://hardware.slashdot.org/story/14/10/12/1321207 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fwd: [NZOSS-Openchat] [Crosspost] LCA2015 Earlybird registrations are now open!
by Peter Reutemann 08 Oct '14

08 Oct '14

FYI ---------- Forwarded message ---------- From: Mark Foster Date: Wed, Oct 8, 2014 at 9:57 PM Subject: [NZOSS-Openchat] [Crosspost] LCA2015 Earlybird registrations are now open! (With apologies for the crosspost - but this is big news! :-)) PRESS RELEASE FOR IMMEDIATE RELEASE LCA2015 Earlybird registrations are now open! The moment that you have been waiting for has finally arrived! It is with many hugs of sincere gratitude to the team that we can announce that Earlybird Registration for LCA2015 is now open. Now is the time to chose - are you a Professional, a Hobbyist or a Student attending LCA2015? Will you be one of our fantastic army of volunteers? Go to lca2015.linux.org.au <http://lca2015.org.au> to register and buy your Earlybird ticket. You can also register as a volunteer right now, and begin to get involved with our wonderful conference. All of the information that you need is there - what you receive for your ticket price, accommodation options, THE Penguin Dinner, as well as Partners Program and creche options for those of you who are bringing your family with you. There have been months of anticipation, and several sleepless nights, but we are now at a truly exciting stage of the conference organising process - registration! We look forward to seeing you all in January 2015 in Auckland. The LCA2015 team END -- Mark Foster For the LCA2015 Org Team _______________________________________________ Openchat mailing list Openchat(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/openchat -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

next meeting
by Peter Reutemann 08 Oct '14

08 Oct '14

Hi everyone So far, we haven't got anything lined up for our next meeting in October. Anyone feeling like presenting something? For instance Ubuntu 14.10 has its release 23/10 - just before our meeting. Maybe giving the release candidate a spin and share your experience? Or cool Raspberry Pi projects? Thanks! Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

3 6

Google Deliberately Weakens Open Source Android As It Hopes To Dominate With Android One
by Peter Reutemann 05 Oct '14

05 Oct '14

"When you are the underdog in the smartphone world, you look for every advantage possible to get market share. That was the case when Google was looking to establish Android as an alternative to Symbian OS and Windows Mobile. It’s free, here’s the code, knock yourself out, was the implication from Mountain View. Now that market share is clearly with Google (IDC estimates it at 85% for Q2 2014) the question is no longer how to get the OS established as the mass market mobile platform of choice, but about maximizing the revenue generating possibilities for Google. So how does Google deal with the legacy of the first ‘free as in speech’ strategy, namely the Android Open Source Project? Its answer is Android One, and it hopes that the new for 2014 off-the-shelf package will stem the flow of handset manufacturers in China and India rolling their own flavors of Android from the Android Open Source Project (AOSP)." -- source: http://onforb.es/1nOiR0k Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Assorted Fun Linux Command Line Hacks
by Peter Reutemann 05 Oct '14

05 Oct '14

"Today's fun command line festivities are inspired by Command Line Magic (https://twitter.com/climagic) who hangs out on Twitter sharing excellent Linux command line incantations for all occasions. Today's assortment includes shell rainbows, Is the Internet on Fire?, Star Wars Traceroute, and creating annoying sounds from the console." -- source: http://www.linux.com/learn/tutorials/790121 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Other Projects Participating In This Winter's Women Outreach Program
by Peter Reutemann 02 Oct '14

02 Oct '14

"The other projects participating in this December to March cycle are Debian, Evergreen, FFmpeg, Foreman, GNOME, the Linux kernel, Mesos / Aurora / Pants, the Open-Source Robotics Foundation, OpenStack, OpenStreetMap, oVirt, Perl, Wikimedia, and the Xen Project. The contributions don't need to be necessarily code related but could be those wishing to help with marketing, documentation, or other tasks needed to keep a healthy open-source project. Participating women are paid $5,500 USD for their three months of work. " -- source: http://www.phoronix.com/scan.php?page=news_item&px=MTgwMjg Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Shellshock Vulnerability Spreads to NAS Devices
by Peter Reutemann 02 Oct '14

02 Oct '14

"Shellshock, the vulnerability in the Bourne Again Shell (Bash), is taking a new twist and is now being actively exploited in network-attached storage (NAS) devices, according to a new report from FireEye." - source: http://bit.ly/1pJCII3 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Hacking USB Firmware
by Peter Reutemann 02 Oct '14

02 Oct '14

'Now the NSA isn't the only one who can hack your USB firmware: "In a talk at the Derbycon hacker conference in Louisville, Kentucky last week, researchers Adam Caudill and Brandon Wilson showed that they've reverse engineered the same USB firmware as Nohl's SR Labs, reproducing some of Nohl's BadUSB tricks. And unlike Nohl, the hacker pair has also published the code for those attacks on Github, raising the stakes for USB makers to either fix the problem or leave hundreds of millions of users vulnerable." Personally, I always thought it was insane that USB drives don't come with physical write-protect switches to keep them from being infected by malware.' -- source: http://hardware.slashdot.org/story/14/10/02/2154204 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Arducorder, Next Open Source Science Tricorder-like Device, Nears Completion
by Peter Reutemann 02 Oct '14

02 Oct '14

"The Arducorder Mini, an Arduino-compatible pocket-sized handheld sensing tool and the next in line of open source science tricorder-like devices designed by Dr. Peter Jansen, is nearing completion. Where the previous models have included about a dozen sensors spanning atmospheric, electromagnetic, and spatial readings, an exciting video of the new prototype shows this model includes sensors for spectroscopy, low-resolution thermal imaging, and radiation sensing. The development is open with the project build logs and most recent source schematics, board layouts, and firmware available on github. This project is an entry in the Hack a Day Prize for a trip to space." -- source: http://build.slashdot.org/story/14/09/30/2227221 Packs an amazing amount of sensors in such a small form factor! Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Security bug in Xen may have exposed Amazon, other cloud services
by Peter Reutemann 01 Oct '14

01 Oct '14

"The Xen Project has published a security advisory that could affect millions of virtualized servers running in Amazon’s cloud and other public hosting services. A flaw in the Xen hypervisor could allow a malicious fully virtualized server to read data about other virtualized systems running on the same physical hardware or the hypervisor hosting the virtual machine. The malicious system could also potentially crash the server hosting the virtual machines. A patch, which was privately disclosed last week under embargo, has been issued to correct the issue." -- source: http://bit.ly/1sNg89a Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Secure Your Linux Desktop and SSH Login Using Two Factor Google Authenticator
by Peter Reutemann 01 Oct '14

01 Oct '14

"Two factor authentication is increasingly becoming a strongly recommended way of protecting user accounts in web applications from attackers by requiring a second method of authentication in addition to the standard username and password pair. Although two factor authentication can encompass a wide range of techniques like biometrics or smart cards, the most commonly deployed technique in web applications is the one time password. If you have used applications like Gmail, you are probably familiar with the one time password generated by the Google Authenticator app that's available on iOS or Android devices. The algorithm used for the one time password in the Google Authenticator app is known as the Time-based One-Time Password (TOTP) algorithm. The TOTP algorithm is a standard algorithm approved by the IETF in (RFC 6238) totp-rfc. It is a little known fact that you can use the TOTP algorithm to secure your user accounts in Linux systems. This article will walk you through the steps necessary. While the exact commands will be for Fedora 20, the TOTP algorithm can be deployed to any Linux distro with a little modification." -- source: http://bit.ly/10lMmvM Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linux Foundation Announces Major Network Functions Virtualization Project
by Peter Reutemann 30 Sep '14

30 Sep '14

"The Linux Foundation this morning announced the latest addition to its family of major hosted open source initiatives: the Open Platform for NFV Project (OPNFV). Its mission is to develop and maintain a carrier-grade, integrated, open source reference platform for the telecom industry. Importantly, the thirty-eight founding members include not only cloud and service infrastructure vendors, but telecom service providers, developers and end users as well. The announcement of OPNFV highlights three of the most significant trends in IT: virtualization (the NFV part of the name refers to network function virtualization), moving software and services to the cloud, and collaboratively developing complex open source platforms in order to accelerate deployment of new business models while enabling interoperability across a wide range of products and services. The project is also significant for reflecting a growing recognition that open source projects need to incorporate open standards planning into their work programs from the beginning, rather than as an afterthought." -- source: http://linux.slashdot.org/story/14/09/30/1820245 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Adobe Photoshop Is Coming To Linux, Through Chromebooks
by Peter Reutemann 30 Sep '14

30 Sep '14

"Adobe is bringing the king of all photo editing software, Photoshop, to Linux-based Chrome OS. Chrome OS-powered devices, such as Chromebooks and Chromeboxes, already have a decent line-up of 'applications' that can work offline and eliminate the need of a traditional desktop computer. So far it sounds like great news. The bad news is that the offering is in its beta stage and is available only to the customers of the Creative Cloud Education program residing in the U.S. I have a full subscription of Creative Cloud for Photographers, and LightRoom, but even I can't join the program at the moment." -- source: http://linux.slashdot.org/story/14/09/30/1430240 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

LibreSSL: More Than 30 Days Later
by Peter Reutemann 30 Sep '14

30 Sep '14

"Ted Unangst has posted an update on LibreSSL development. "Joel and I have been working on a replacement API for OpenSSL, appropriately entitled ressl. Reimagined SSL is how I think of it. Our goals are consistency and simplicity. In particular, we answer the question 'What would the user like to do?' and not 'What does the TLS protocol allow the user to do?'. You can make a secure connection to a server. You can host a secure server. You can read and write some data over that connection." -- source: http://www.linux.com/news/software/applications/789692 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Improved Patch Tackles New Shellshock Bash Bug Attack Vectors
by Peter Reutemann 30 Sep '14

30 Sep '14

"System administrators who spent last week making sure their computers are patched against Shellshock, a critical vulnerability in the Bash Unix command-line interpreter, will have to install a new patch that addresses additional attack vectors." -- source: http://www.linux.com/news/enterprise/systems-management/789720 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Ubuntu Phones to Arrive By Year's End
by Peter Reutemann 29 Sep '14

29 Sep '14

"Ubuntu Touch for phones is now at manufacturing status, a major milestone for many people who wondered if Ubuntu phones would ever become market realities. Several months ago, rumors swirled that the first Ubuntu phones were delayed and wouldn’t appear until 2015, if at all, but this week news broke that we're likely to see phones by year's end." -- source: http://ostatic.com/blog/ubuntu-phones-to-arrive-by-years-end Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Hijacking Open Source
by Peter Reutemann 29 Sep '14

29 Sep '14

'Somewhere along the line, we’ve lost the spirit of what open source is supposed to be. Cloud computing, the rise of social networks, and data mining personal information on a massive scale has led to an explosion of interest in server side open source, but personal open source still languishes in comparison. Linux.com is running a story entitled Back to the Source: Why FOSS is More Important Than Ever questioning if freedom is still at the heart of open source, and wondering if this is what winning actually looks like. “Open Source” is more popular than ever, but it’s not because we live in an enlightened age of freedom, it’s because the term has been hijacked. ' -- source: http://ostatic.com/blog/hijacking-open-source Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fwd: [NZLUG] ALERT: Remote code-exec in bash (CVE-2014-6271)
by Peter Reutemann 26 Sep '14

26 Sep '14

Typo... ---------- Forwarded message ---------- From: Volker Kuhlmann <hidden(a)paradise.net.nz> Date: Thu, Sep 25, 2014 at 10:23 AM Subject: Re: [NZLUG] ALERT: Remote code-exec in bash (CVE-2014-6271) To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> On Thu 25 Sep 2014 08:33:37 NZST +1200, Clark Mills wrote: > [ from /. thread ] > > This is the test to see if you are vulnerable: > > env x='() {:;}; echo vulnerable' bash -c "echo this is a test" Thanks for that. http://beta.slashdot.org/comments.pl?sid=5750159&cid=47985625 However, your code here seems to have a serious copy/paste/etc error in it: > bash > env x='() {:;}; echo vulnerable' bash -c "echo this is a test" bash: x: line 0: syntax error near unexpected token `{:' bash: x: line 0: `x () {:;}; echo vulnerable' bash: error importing function definition for `x' this is a test > env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test GNU bash, version 4.2.42(1)-release (x86_64-suse-linux-gnu) Volker -- Volker Kuhlmann is list0570 with the domain in header. http://volker.top.geek.nz/ Please do not CC list postings to me. _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

4 5

First Shellshock Botnet Attacking Akamai, US DoD Networks
by Peter Reutemann 26 Sep '14

26 Sep '14

'The Bash "Shellshock" bug is being used to spread malware to create a botnet, that's active and attacking Akamai and Department of Defense networks. "The 'wopbot' botnet is active and scanning the internet for vulnerable systems, including at the United States Department of Defence, chief executive of Italian security consultancy Tiger Security, Emanuele Gentili, told iTnews. 'We have found a botnet that runs on Linux servers, named “wopbot", that uses the Bash Shellshock bug to auto-infect other servers,' Gentili said."' -- source: http://it.slashdot.org/story/14/09/25/236256 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

GNOME 3.14 Released
by Peter Reutemann 25 Sep '14

25 Sep '14

"GNOME 3.14 was released today and it includes some interesting changes such as re-worked default theme, multi-touch gestures for both the system and applications, and new animations. Information including details on all the new features, can be found here." -- source: http://tech.slashdot.org/story/14/09/24/2155241 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Kali NetHunter turns Android device into hacker Swiss Army knife
by Peter Reutemann 25 Sep '14

25 Sep '14

"One of the tools we've leaned on heavily in some of our lab testing of software privacy and security is Kali Linux. The Debian-based operating system comes packaged with a collection of penetration testing and network monitoring tools curated and developed by the security training company Offensive Security. Today, the Kali developer team and Offensive Security released a new Kali project that runs on a Google Nexus device. Called NetHunter, the distribution provides much of the power of Kali with the addition of a browser-driven set of tools that can be used to launch attacks on wireless networks or on unattended computers via a USB connection." -- source: http://bit.ly/1veUgAz Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fwd: [NZLUG] ALERT: Remote code-exec in bash (CVE-2014-6271)
by Peter Reutemann 24 Sep '14

24 Sep '14

FYI ---------- Forwarded message ---------- From: Clark Mills <c.mills(a)auckland.ac.nz> Date: Thu, Sep 25, 2014 at 8:33 AM Subject: Re: [NZLUG] ALERT: Remote code-exec in bash (CVE-2014-6271) To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> [ from /. thread ] This is the test to see if you are vulnerable: env x='() {:;}; echo vulnerable' bash -c "echo this is a test" On 25/09/14 08:16, Jaco wrote: > > bash is borked. > > http://www.csoonline.com/article/2687265/application-security/remote-exploi… > > This bad. > This is very, VERY bad. > > Please go patch! _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

4 4

Linux Saturday Workshop
by Bruce Kingsbury 24 Sep '14

24 Sep '14

I'll be running another Saturday Linux Workshop this weekend; Saturday September 27th, 2014 10:00 am – 2:00 pm *Te Whare O Te Ata* 60a Sare Cres Hamilton, 3214 07 2820577 This is a GNU/Linux-focused workshop where people can bring their PCs, Laptops, Pi's, Android devices etc for trouble-shooting and to learn or try out new skills. All visitors welcome - light lunch provided - gold coin donation appreciated

2 1

Debian Switching Back To GNOME As the Default Desktop
by Peter Reutemann 24 Sep '14

24 Sep '14

"Debian will switch back to using GNOME as the default desktop environment for the upcoming Debian 8.0 Jessie release, due out in 2015. The decision is based on accessibility and systemd integration, along with a host of other reasons. Debian switched away from GNOME back in 2012." -- source: http://linux.slashdot.org/story/14/09/23/2312251 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

DuckDuckGo Now Blocked In China
by Peter Reutemann 23 Sep '14

23 Sep '14

"Privacy-oriented search engine DuckDuckGo is now blocked in China. On Sunday DuckDuckGo founder and CEO Gabriel Weinberg confirmed to Tech in Asia that the team has noticed the blockage in China on Twitter. DuckDuckGo had been working fine in mainland China since its inception, aside from the occasional 'connection reset' experienced when accessing many overseas websites from within the country. But now the search engine is totally blocked in China. ... [T]he GreatFire index of blocked sites suggest that DuckDuckGo got whacked on September 4. DuckDuckGo joins Google in being censored and blocked in the nation. Google, after years of being throttled by China's Great Firewall since the web giant turned off its mainland China servers in 2010, was finallyblocked totally in June this year." -- source: http://search.slashdot.org/story/14/09/23/0052206 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Outlining Thin Linux
by Peter Reutemann 23 Sep '14

23 Sep '14

'Deep End's Paul Venezia follows up his call for splitting Linux distros in two by arguing that the new shape of the Linux server is thin, light, and fine-tuned to a single purpose. "Those of us who build and maintain large-scale Linux infrastructures would be happy to see a highly specific, highly stable mainstream distro that had no desktop package or dependency support whatsoever, so was not beholden to architectural changes made due to desktop package requirements. When you're rolling out a few hundred Linux VMs locally, in the cloud, or both, you won't manually log into them, much less need any type of graphical support. Frankly, you could lose the framebuffer too; it wouldn't matter unless you were running certain tests," Venezia writes. "It's only a matter of time before a Linux distribution that caters solely to these considerations becomes mainstream and is offered alongside more traditional distributions."' -- source: http://linux.slashdot.org/story/14/09/22/2245217 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fork of Systemd Leads To Lightweight Uselessd
by Peter Reutemann 21 Sep '14

21 Sep '14

"A boycott of systemd and other backlash around systemd's feature-creep has led to the creation of Uselessd, a new init daemon. Uselessd is a fork of systemd 208 that strips away functionality considered irrelevant to an init system like the systemd journal and udev. Uselessd also adds in functionality not accepted in upstream systemd like support for alternative C libraries (namely uClibc and musl) and it's even being ported to BSD." -- source: http://linux.slashdot.org/story/14/09/21/1427240 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

KDE's UI To Bend Toward Simplicity
by Peter Reutemann 20 Sep '14

20 Sep '14

"KDE Software is often criticized for being too complicated for an average user to use. Try setting up Kmail and you would know what I mean. The KDE developers are aware of it and now they are working on making KDE UI simpler. KDE usability team lead Thomas Pfeiffer Thomas prefers a layered feature exposure so that users can enjoy certain advanced features at a later stage after they get accustomed to the basic functionality of the application. He quotes the earlier (pre-Plasma era) vision of KDE 4 – "Anything that makes Linux interesting for technical users (shells, compilation, drivers, minute user settings) will be available; not as the default way of doing things, but at the user's discretion." -- source: http://tech.slashdot.org/story/14/09/20/0725232 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Android Apps Now Unofficially Able To Run On Any Major Desktop OS
by Peter Reutemann 20 Sep '14

20 Sep '14

'A developer who goes by the handle Vladikoff has tweaked Google's App Runtime for Chrome (ARC) to allow any Android app to run on any major desktop operating system, not just the handful announced last week which were also limited to Chrome OS. His tweaked version of ARC is re-packaged as ARChon. The install isn't very straightforward, and you have to be in developer mode on Chrome. But there's a support forum on reddit. The extension will work on any OS running the desktop version of Chrome 37 and up as long as the user also installs chromeos-apk, which converts raw Android app packages (APKs) to a Chrome extension. Ars Technica reports that apps run this way are buggy, fast, and crash often but expresses optimism for when Google officially "opens the floodgates on the Play Store, putting 1.3 million Android apps onto nearly every platform."' -- source: http://mobile.slashdot.org/story/14/09/20/0250209 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Native Netflix Support Is Coming To Linux
by Peter Reutemann 20 Sep '14

20 Sep '14

'Native support for Netflix is coming to Linux, thanks to their move from Silverlight to HTML5, Mozilla and Google Chrome. Paul Adolph from Netflix proposed a solution to Ubuntu developers: "Netflix will play with Chrome stable in 14.02 if NSS version 3.16.2 or greater is installed. If this version is generally installed across 14.02, Netflix would be able to make a change so users would no longer have to hack their User-Agent to play." The newer version of NSS is set to go out with the next security update.' -- source: http://linux.slashdot.org/story/14/09/19/1350202 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

TrueCrypt Gets a New Life, New Name
by Peter Reutemann 20 Sep '14

20 Sep '14

"Amid ongoing security concerns, the popular open source encryption program TrueCrypt may have found new life under a new name. Under the terms of the TrueCrypt license — which was a homemade open source license written by the authors themselves rather than a standard one — a forking of the code is allowed if references to TrueCrypt are removed from the code and the resulting application is not called TrueCrypt. Thus, CipherShed will be released under a standard open source license, with long-term ambitions to become a completely new product." -- source: http://it.slashdot.org/story/14/09/19/1620240 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Digia Spins Off Qt As Subsidiary
by Peter Reutemann 16 Sep '14

16 Sep '14

"Following through on an announcement from August, Digia has spun off a subsidiary called The Qt Company to unify Qt's commercial and open source efforts, and debuted a low-cost plan for mobile developers. The Linux-oriented Qt cross-platform development framework has had a tumultuous career, having been passed around Scandinavia over the years from Trolltech to Nokia and then from Nokia to Digia. Yet, Qt keeps rolling along in both commercial and open source community versions, continually adding support for new platforms and technologies, and gaining extensive support from mobile developers. Now Qt is its own company, or at least a wholly owned subsidiary under Digia. Finland-based Digia has largely been involved with the commercial versions of Qt since it acquired the platform from Nokia in 2012, but it has also sponsored the community Qt Project as a relatively separate project. Now, both efforts are being unified under one roof at The Qt Company and the new QT.io website, says Digia. Meanwhile, Digia will focus on its larger enterprise software business." -- source: http://linux.slashdot.org/story/14/09/16/2146243 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Industry-Based ToDo Alliance Wants To Guide FOSS Development
by Peter Reutemann 16 Sep '14

16 Sep '14

'The New York Times broke a story [Monday] (paywalled if you look at more than 10 stories a month) about ToDo, "an open group of companies who run open source programs" who are seeking to "committed to working together in order to overcome" the challenges of using FOSS, "including ensuring high-quality and frequent releases, engaging with developer communities, and using and contributing back to other projects effectively." The more militant among us will read that as "It's not enough getting a free ride off of developers building great software, we want to shove our roadmap down their throats and get them to work harder for us — without having to pay for it, of course." That might be a bit harsh, but none of the companies on the page are exactly well known for cooperating with the projects they use, with Google being one of the worst offenders by forking both Linux and WebKit.' -- source: http://developers.slashdot.org/story/14/09/16/1244207 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

New Release of MINIX 3 For x86 and ARM Is NetBSD Compatible
by Peter Reutemann 16 Sep '14

16 Sep '14

"MINIX 3 is a small POSIX-compliant operating system aimed at high reliability (embedded) applications. A major new version of MINIX 3 (3.3.0) is now available for download at www.minix3.org. In addition to the x86, the ARM Cortex A8 is now supported, with ports to the BeagleBoard and BeagleBones available. Finally, the entire userland has been redone in 3.3.0 to make it NetBSD compatible, with thousands of NetBSD packages available out of the box. MINIX 3 is based on a tiny (13 KLoC) microkernel with the operating system running as a set of protected user-mode processes. Each device driver is also a separate process. If a driver fails, it is automatically and transparently restarted without rebooting and without applications even noticing, making the system self-healing." -- source: http://developers.slashdot.org/story/14/09/16/1348208 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

SparkFun Works to Build the Edison Ecosystem
by Peter Reutemann 15 Sep '14

15 Sep '14

'Edison is an Intel creation aimed squarely at the maker and prototype markets. It's smaller than an Arduino, has built-in wi-fi, and is designed to be used in embedded applications. SparkFun is "an online retail store that sells the bits and pieces to make your electronics projects possible." They're partnering with Intel to sell the Edison and all kinds of add-ons for it. Open source? Sure. Right down to the schematics. David Stillman, star of today's video, works for SparkFun. He talks about "a gajillion" things you can do with an Edison, up to and including the creation of an image-recognition system for your next homemade drone.' -- source: http://hardware.slashdot.org/story/14/09/15/209206 Running Linux on Edison: http://hackaday.com/2014/09/10/hands-on-with-the-intel-edison/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fate of Bodhi Linux in Balance as Founder Quits
by Peter Reutemann 15 Sep '14

15 Sep '14

"Jeff Hoogland, founder and lead developer of Bodhi Linux, today blogged that he will no longer be continuing with the project. Bodhi began four years ago and reach impressive heights of popularity being recommended by some of the biggest names in Linux. However, version 3.0 is way overdue and Hoogland says he just doesn't have the bandwidth to finish it or continue the project. The code is GitHub and Hoogland is hoping someone will volunteer to take over for him. For those currently using Bodhi, repositories will remain available until April 2015." -- source: http://ostatic.com/blog/fate-of-bodhi-linux-in-balance-as-founder-quits Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Turning the tables on “Windows Support” scammers by compromising their PCs
by Peter Reutemann 15 Sep '14

15 Sep '14

"Matt Weeks is one of the developers who contributes code to the open source Metasploit Project, a sprawling and continually updated security framework that functions as a repository for software vulnerabilities and is frequently used as a Swiss Army Knife for penetration testing. Weeks has published a long report on his site detailing how he was able to reverse-engineer the encrypted communications protocol used by Ammyy Admin, one of the most popular remote control apps used by tech support scammers, and then use that knowledge to ferret out a vulnerability in the Ammyy Admin application. Because Ammyy Admin uses the same binary on both the remote computer being controlled and the source computer doing the controlling, an exploit with the application has the potential to affect not just the target but also the source. Weeks figured that if he could sniff out a vulnerability in the application’s communications stack, he could use that vulnerability to execute code on the remote computer—in other words, to gain the same level of access on the scammer’s PC that the scammer tries to gain on the victim’s." -- source: http://bit.ly/X4faGL Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

KDevelop 4.7.0 Released
by Peter Reutemann 14 Sep '14

14 Sep '14

"KDevelop team is proud to announce the final release of KDevelop 4.7.0. This release is special, as it marks the end of the KDE4 era for us. As such, KDevelop 4.7.0 comes with a long-term stability guarantee. The CMake support was improved and extended to ensure that all idioms needed for KF5 development are available. The unit test support UI was polished and several bugs fixed. In the same direction, some noteworthy issues with the QtHelp integration were addressed. KDevelop's PHP language support now handles namespaces better and can understand traits aliases. Furthermore, some first fruits of the Google summer of code projects are included in this release. These changes pave the path toward better support for cross compile toolchains. Feature-wise, KDevelop now officially supports the Bazaar (bzr) version control system. On the performance front, it was possible to greatly reduce the memory footprint when loading large projects with several thousand files in KDevelop. Additionally, the startup should now be much faster." -- source: http://tech.slashdot.org/story/14/09/14/1347203 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

OCRmyPDF
by Peter Reutemann 13 Sep '14

13 Sep '14

Just came across this (haven't tried, but seemed worth sharing). OCRmyPDF combines several Linux tools to generate PDF/A files (PDF format intended for long term archiving) from PDF files that contain just bitmaps with text, e.g., of scanned document pages. The generated PDF/A files are then searchable. Original article in German describing the tool: http://www.heise.de/open/artikel/Toolbox-Texterkennung-mit-OCRmyPDF-2356670… Google translation: http://www.google.com/translate?hl=en&ie=UTF8&sl=auto&tl=en&u=http%3A%2F%2F… Project homepage on github: https://github.com/fritz-hh/OCRmyPDF Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Chrome OS Can Now Run Android Apps With No Porting Required
by Peter Reutemann 12 Sep '14

12 Sep '14

'On Thursday, Google launched "App Runtime for Chrome (Beta)" which allows Android apps to run on Chrome OS without the need for porting. At the moment, only Duolingo, Evernote, Sight Words, and Vine are available on the platform with the rest of the Play Store's offerings to come later. Google "built an entire Android stack into Chrome OS using Native Client" in order to achieve this.' -- source: http://tech.slashdot.org/story/14/09/12/0050206 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

The State of ZFS On Linux
by Peter Reutemann 11 Sep '14

11 Sep '14

'Richard Yao, one of the most prolific contributors to the ZFSOnLinux project, has put up a post explaining why he thinks the filesystem is definitely production-ready. He says, "ZFS provides strong guarantees for the integrity of [data] from the moment that fsync() returns on a file, an operation on a synchronous file handle is returned or dirty writeback occurs (by default every 5 seconds). These guarantees are enabled by ZFS' disk format, which places all data into a Merkle tree that stores 256-bit checksums and is changed atomically via a two-stage transaction commit.. ... Sharing a common code base with other Open ZFS platforms has given ZFS on Linux the opportunity to rapidly implement features available on other Open ZFS platforms. At present, Illumos is the reference platform in the Open ZFS community and despite its ZFS driver having hundreds of features, ZoL is only behind on about 18 of them."' -- source: http://linux.slashdot.org/story/14/09/11/1421201 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Learning About Enea's Real Time Linux Embedded OS (Video)
by Peter Reutemann 10 Sep '14

10 Sep '14

'Jon Aldama is the Product Marketing Manager for Enea A.B., but he prides himself on being a developer first and a marketer second -- a point he stresses early in today's video. Enea is behind Operating System Embedded, whose Wikipedia page, some say, "appears to be written like an advertisement," which an unkind person could also say about the Enea A.B. Wikipedia page. In any case, Enea works with the Linux Foundation's Yocto Project workgroup, whose main webpage says, "It's not an embedded Linux distribution – it creates a custom one for you." This is all open source, which Jon says is a big corporate principle at Enea -- and he should know, since his previous job was as an Open Source Compliance Officer and Software Analyst at Ericsson.' -- source: http://linux.slashdot.org/story/14/09/10/1638243 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Running Your Business on Linux (No, You Don't Need Windows)
by Peter Reutemann 08 Sep '14

08 Sep '14

"Believe it or not, my dear Linux friends, a lot of IT pros still believe they need Windows servers. They have this goofy idea that Active Directory, SharePoint, Exchange, Windows Server, SQL Server, and all the other members of the lardy malware vector family are the only proper business backends. They have this funny notion that Microsoft servers are easier to run. I must refute this odd notion with reality: they are not. They are expensive, troublesome, less-capable, and pointy-clicky does not equal easier to use, nor does it negate having to possess actual skills and knowledge." -- source: http://www.linux.com/learn/tutorials/786721 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0