- wlug - list.wlug.org.nz

Quotes From RSA
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Among the plethora of pithy apothegms from the panel of crypto experts at the RSA Conference <https://www.theregister.co.uk/2020/02/26/rsa_2020_panel_discussion/>: “I give fusion power a higher chance of succeeding than quantum computing.” -- Ron Rivest “Blockchain is the wrong security technology for voting. I like to think of it as bringing a combination lock to a kitchen fire.” -- Ron Rivest “Intelligence is not about playing fair, it is about succeeding.” -- Whitfield Diffie, on the Crypto AG backdooring saga “I would like to understand how right to be forgotten could be for anything except to keep the little people in line. It is not the right to be forgotten by the secret police.” -- Whitfield Diffie Of course, there were some dissenting opinions to that last one ...

1 0

Smithsonian Releases 2.8 Million Images And 3D Models Into The Public Domain
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Just came across this news report <https://www.techdirt.com/articles/20200225/14150743985/smithsonian-releases…> about the Smithsonian Institution making a whole bunch of stuff available for free download and reuse under a Creative Commons CC0 licence. More info on their home page <https://www.si.edu/OpenAccess>. I had a quick look at one or two 3D models from <https://3d.si.edu/cc0>, and I see OBJ, glTF (OpenGL Transfer Format) and GLB (binary version of glTF) options available. These are all open formats, well-supported in non-proprietary software.

2 1

Ars takes the new Opera R2020 browser for a spin
by Peter Reutemann 27 Feb '20

27 Feb '20

'Conclusion We've been briefly excited by lesser-known browsers many times in the last 20 years, only to eventually gravitate back to the most comfortable of the big, common options. But the tide may be turning for lesser-known options like Opera. Using the same Chromium open source browser upstream as Google Chrome and Microsoft Edge do, there aren't likely to be many compatibility surprises—at least for Windows and Mac users. The Good - Opera feels both fast and familiar (enough) for anyone accustomed to Google Chrome, Microsoft Edge, or Firefox - First-rate Linux installation and update experience - The stand-out features feel immediately useful—Snapshot, VPN, Workspaces, pinned Messengers, and My Flow all fit very neatly and obviously into our existing workflows - Chromium upstream base means sites render familiarly and accurately to Chrome or Edge users - Battery saver feature makes bloated sites feel less bloated and wasteful, even on a desktop The Bad - Unit and currency conversion is still a little wonky and limited - DRM is completely non-functional on Linux The Ugly - Many Linux users won't care about broken DRM for philosophical reasons—but they won't use a non-Libre browser, for the same philosophical reasons' -- source: https://arstechnica.com/gadgets/2020/02/browser-review-opera-r2020-and-oper… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw in Billions of Wi-Fi Devices Left Communications Open To Eavesdropping
by Peter Reutemann 27 Feb '20

27 Feb '20

'Billions of devices -- many of them already patched -- are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference. From a report: The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, Raspberry Pi 3's, and Wi-Fi routers from Asus and Huawei. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cyperess' and Broadcom's FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126. Manufacturers have made patches available for most or all of the affected devices, but it's not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely. "This results in scenarios where client devices that are unaffected (either patched or using different Wi-Fi chips not vulnerable to Kr00k) can be connected to an access point (often times beyond an individual's control) that is vulnerable," Eset researchers wrote in a research paper published on Wednesday. "The attack surface is greatly increased, since an adversary can decrypt data that was transmitted by a vulnerable access point to a specific client (which may or may not be vulnerable itself)."' -- source: https://mobile.slashdot.org/story/20/02/26/165207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox for Mac and Linux To Get a New Security Sandbox System
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will add a new security sandbox system to Firefox on Linux and Firefox on Mac. The new technology, named RLBox, works by separating third-party libraries from an app's native code. From a report: This process is called "sandboxing," and is a widely used technique that can prevent malicious code from escaping from within an app and executing at the OS level. RLBox is an innovative project because it takes sandboxing to the next level. Instead of isolating the app from the underlying operating system, RLBox separates an app's internal components -- namely its third-party libraries -- from the app's core engine. This technique prevents bugs and exploits found inside a third-party library from impacting another project that uses the same library.' -- source: https://news.slashdot.org/story/20/02/25/2028214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Enable DNS-over-HTTPS by Default To US Users
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will bring its new DNS-over-HTTPS security feature to all Firefox users in the U.S. by default in the coming weeks, the browser maker has confirmed. From a report: It follows a year-long effort to test the new security feature, which aims to make browsing the web more secure and private. Whenever you visit a website -- even if it's HTTPS enabled -- the DNS query that converts the web address into an IP address that computers can read is usually unencrypted. DNS-over-HTTPS, or DoH, encrypts the request so that it can't be intercepted or hijacked in order to send a user to a malicious site. These unencrypted DNS queries can also be used to snoop on which websites a user visits. DoH works at the app-level, and is baked into Firefox. The feature relies on sending DNS queries to third-party providers -- such as Cloudflare and NextDNS -- both of which will have their DoH offering baked into Firefox and will process DoH queries.' -- source: https://it.slashdot.org/story/20/02/25/1210223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PayPal Accounts Are Getting Abused En-masse For Unauthorized Payments
by Peter Reutemann 26 Feb '20

26 Feb '20

'Hackers have found a bug in PayPal's Google Pay integration and are now using it to carry out unauthorized transactions via PayPal accounts. From a report: Since last Friday, users have reported seeing mysterious transactions pop up in their PayPal history as originating from their Google Pay account. Issues have been reported on numerous platforms, such as PayPal's forums, Reddit, Twitter, and Google Pay's Russian and German support forums. Victims reported that hackers abused Google Pay accounts to buy products using linked PayPal accounts. According to screenshots and various testimonies, most of the illegal transactions are taking place at US stores, and especially at Target stores across New York. Most of the victims appear to be German users.' -- source: https://it.slashdot.org/story/20/02/25/1213209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Licences: What, Which & Why
by Lawrence D'Oliveiro 25 Feb '20

25 Feb '20

A good overview <https://arstechnica.com/gadgets/2020/02/how-to-choose-an-open-source-licens…> for anybody having anything to do with Open Source, not just those trying to decide what licence to choose for their own projects. Basic recommendation: stick to something approved by the Open Source Initiative, and above all avoid making up a licence of your own.

2 1

EU Commission To Staff: Switch To Signal Messaging App
by Peter Reutemann 25 Feb '20

25 Feb '20

'The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications. From a report: The instruction appeared on internal messaging boards in early February, notifying employees that "Signal has been selected as the recommended application for public instant messaging." The app is favored by privacy activists because of its end-to-end encryption and open-source technology. "It's like Facebook's WhatsApp and Apple's iMessage but it's based on an encryption protocol that's very innovative," said Bart Preneel, cryptography expert at the University of Leuven. "Because it's open-source, you can check what's happening under the hood," he added. Signal was developed in 2013 by privacy activists. It is supported by a nonprofit foundation that has the backing of WhatsApp founder Brian Acton, who had left the company in 2017 after clashing with Facebook's leadership.' -- source: https://tech.slashdot.org/story/20/02/24/1430211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple To Release First ARM Mac Without Intel Processor in Next 18 Months, Predicts Kuo
by Peter Reutemann 25 Feb '20

25 Feb '20

Since we were talking about ARM chips at last night's meeting, this seems an interesting bit of news: 'Ming-Chi Kuo is out with a new analyst note today and the most interesting part of his forecast is that Apple will release its first Mac with an ARM processor in the first half of 2021. From a report: Kuo is predicting that one of Apple's new products to be released within the next 12-18 months will be a Mac with an in-house processor, instead of using an Intel CPU. There have been growing reports over the last couple of years about Apple making the switch to a custom-designed ARM processor for its Macs and today's report gives a concrete timeframe for when to expect that launch, which has actually held true since Kuo's prediction back in 2018. Since the coronavirus outbreak, Kuo highlights that Apple has been "more aggressive" with its funding for research, development, and production of 5nm process chips that are expected to show up in the first Macs with ARM CPUs. That's because 5nm chips will be integral to iPhone, iPad later this year, as well as Macs come 2021.' -- source: https://apple.slashdot.org/story/20/02/24/184242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tablet converted from Win10 to Linux
by Ian Stewart 25 Feb '20

25 Feb '20

Hi Guys, A correction to my story at last nights meeting about converting a tablet from running Win10 to running Debian LXDE. In looking back at the notes I made during this installation, the tablet was an ACER Switch 10 - Model SW5-012. It's CPU is an Intel Atom Processor Z3735F, 4x core, 64-bit, 1.33GHz. Last night I thought its CPU was an ARM chip. However it seems that this CPU has a similarity to ARM in that it needs to initially boot images written in 32-bit code in order to start booting the 64 bit Linux. Although I didn't succeed, in theory I could have installed a 64-bit Ubuntu LXDE 19.10 version, and got it to boot by putting 32 bit images into the /boot partition. That is according to this<https://www.instructables.com/id/Linux-Kiosk-Tablet-From-Acer-Aspire-Switch…> document. Instead I used the debian-live-10.2.0-i386-lxde.iso image and booted it from a USB stick to do an installation to the tablets MMC drive. At the moment the Debian Live team only produce i386 and AMD64 iso's. They do not produce an ARM iso. So the installation approach I took with this tablet, wouldn't work with Mike's PINEBook Pro (ARM) laptop. cheers, Ian.

1 0

Gopher's Rise and Fall Shows How Much We Lost When Monopolists Stole the Net
by Peter Reutemann 23 Feb '20

23 Feb '20

'Science-fiction writer, journalist and longtime Slashdot reader, Cory Doctorow, a.k.a. mouthbeef, writes: The Electronic Frontier Foundation (EFF) just published the latest installment in my case histories of "adversarial interoperability" -- once the main force that kept tech competitive. Today, I tell the story of Gopher, the web's immediate predecessor, which burrowed under the mainframe systems' guardians and created a menu-driven interface to campus resources, then the whole internet. Gopher ruled until browser vendors swallowed Gopherspace whole, incorporating it by turning gopher:// into a way to access anything on any Gopher server. Gopher served as the booster rocket that helped the web attain a stable orbit. But the tools that Gopher used to crack open the silos, and the moves that the web pulled to crack open Gopher, are radioactively illegal today. If you wanted do to Facebook what Gopher did to the mainframes, you would be pulverized by the relentless grinding of software patents, terms of service, anticircumvention law, bullshit theories about APIs being copyrightable. Big Tech blames "network effects" for its monopolies -- but that's a counsel of despair. If impersonal forces (and not anticompetitive bullying) are what keeps tech big then there's no point in trying to make it small. Big Tech's critics swallow this line, demanding that Big Tech be given state-like duties to police user conduct -- duties that require billions and total control to perform, guaranteeing tech monopolists perpetual dominance. But the lesson of Gopher is that adversarial interoperability is judo for network effects.' -- source: https://tech.slashdot.org/story/20/02/21/2240222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dongle!!
by john 21 Feb '20

21 Feb '20

Hi All, Anyone care to help me with this issue please?? I just bought a USB Bluetooth adapter the icon on the desktop states ' standard: Detected Distance:255;Current State:gone; Status:No bluetooth device configured... Simulation mode (locking disabled)' Output from terminal. lsusb. Bus 003 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode) Output from "dmesg" 15.616762] Bluetooth: Core ver 2.22 [ 15.616785] NET: Registered protocol family 31 [ 15.616786] Bluetooth: HCI device and connection manager initialized [ 15.616790] Bluetooth: HCI socket layer initialized [ 15.616793] Bluetooth: L2CAP socket layer initialized [ 15.616800] Bluetooth: SCO socket layer initialized [ 18.714533] Bluetooth: BNEP (Ethernet Emulation) ver 1.3stan [ 18.714536] Bluetooth: BNEP filters: protocol multicast [ 18.714542] Bluetooth: BNEP socket layer initialized [ 20.153867] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.246093] r8169 0000:01:00.0 enp1s0: link down [ 20.246348] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.258191] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.289093] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.548998] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 21.932491] wlx0019e08c5078: authenticate with 18:f1:45:96:63:4b [ 21.937373] wlx0019e08c5078: send auth to 18:f1:45:96:63:4b (try 1/3) [ 21.939214] wlx0019e08c5078: authenticated [ 21.939962] wlx0019e08c5078: associate with 18:f1:45:96:63:4b (try 1/3) [ 21.942561] wlx0019e08c5078: RX AssocResp from 18:f1:45:96:63:4b (capab=0x431 status=0 aid=1) [ 21.943456] wlx0019e08c5078: associated [ 21.981876] IPv6: ADDRCONF(NETDEV_CHANGE): wlx0019e08c5078: link becomes ready [ 26.871648] Bluetooth: RFCOMM TTY layer initialized [ 26.871656] Bluetooth: RFCOMM socket layer initialized [ 26.871663] Bluetooth: RFCOMM ver 1.11

2 1

Google launches the Android 11 Developer Preview today
by Peter Reutemann 21 Feb '20

21 Feb '20

'It's a bit earlier than the usual March release, but today Google is launching the first Android 11 Developer Preview. This first OS preview is coming to the Pixel 2, 3, 3a, and 4, along with generic system images for Project Treble devices. It also has a new name. Typically these releases have been denoted by a letter—Android 10 was the "Android Q Preview"—and while Android 11 is still called "Android R" internally, publicly this is the "Android 11 Developer Preview" to all us non-Googlers. True to form, Google has already started with the Spinal Tap references and starts the blog post with a dial that goes to 11. For now we're just working off a giant blog post with lots of bullet points, and nearly zero screenshots, so we're not sure what the scope of this release is really like. We'll have a hands-on later, but for now, here are some highlights. Android 10—The Ars Technica Review One of the most-used features of Android 11 will probably be a new "one-time permission" option for apps that want to access location, microphone, and camera data. In Android 10, Google added the ability to grant a permission to an app only when it was running in the foreground, and now users will be able to grant access to a permission a single time. This is already in iOS, and it makes a lot of sense for certain apps.' -- source: https://arstechnica.com/gadgets/2020/02/google-launches-the-android-11-deve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

The Linux Foundation Identifies Most Important Open-Source Software Components and Their Problems
by Peter Reutemann 21 Feb '20

21 Feb '20

'The Linux Foundation's Core Infrastructure Initiative (CII) and the Laboratory for Innovation Science at Harvard (LISH) have revealed -- in "Vulnerabilities in the Core, a preliminary report and Census II of open-source software" -- the most frequently used components and the vulnerabilities they share. From a report: This Census II analysis and report is the first major study of its kind but isn't a final analysis. It takes important first steps and lays out a methodology for understanding and addressing open-source software structural and security complexities. Specifically, it also identifies the most commonly used free and open-source software (FOSS) components in production applications and examines them for potential vulnerabilities. To create this work, CII and LISH partnered with Software Composition Analysis (SCAs) and application security companies such as Snyk and Synopsys Cybersecurity Research Center. They combined private usage data with publicly available datasets for identifying over 200 of the most used open-source software projects. These are not the programs -- Apache, MySQL, Linux -- that probably spring to your mind. For all their foundational importance, it's the small building block programs that are most widely used. They may be small, sometimes less than a hundred lines of code (LoC), but they're vital. As Frank Nagle, a professor at Harvard Business School and co-director of the Census II project, said: "FOSS was long seen as the domain of hobbyists and tinkerers. However, it has now become an integral component of the modern economy and is a fundamental building block of everyday technologies like smart phones, cars, the Internet of Things, and numerous pieces of critical infrastructure. Understanding which components are most widely used and most vulnerable will allow us to help ensure the continued health of the ecosystem and the digital economy."' -- source: https://news.slashdot.org/story/20/02/20/1349241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Bring Its Defender Antivirus Software To iOS and Android
by Peter Reutemann 21 Feb '20

21 Feb '20

'Microsoft said today it plans to bring its antivirus software, Defender Advanced Threat Protection, to phones and other devices running Apple's iOS and Google's Android. From a report: The software, also called Defender ATP, is already available on Windows and MacOS. It offers features like preventive protection, post-breach detection and automated investigation and response, according to Microsoft. When it comes to mobile devices, Microsoft's Rob Lefferts said that the Defender software could help companies protect employees from things like malware and phishing attacks. Apple's and Google's app stores are "pretty safe," Lefferts said, but "malware does happen on those platforms."' -- source: https://it.slashdot.org/story/20/02/20/1928225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPN
by john 20 Feb '20

20 Feb '20

Are any of the Mozilla add-ons listed in the attachment a good thing to add to Firefox? Cheers John...

2 1

Mozilla's Standalone Firefox VPN is Now Available in Beta
by Peter Reutemann 20 Feb '20

20 Feb '20

'Mozilla has a new virtual private network service and if you have a Chromebook, a Windows 10 computer or an Android device in the US, you can start using a beta version now. From a report: Called Firefox Private Network, the new service is designed to function as a full-device VPN and give better protection when surfing the web or when using public Wi-Fi networks. The company offers two options: a free browser-extension version, which it launched in beta last year, that provides 12 one-hour VPN passes when using the Firefox browser and a Firefox account; and a second, $4.99-a-month option that provides a more complete VPN service across your whole device. The new paid option, which runs off of servers provided by Swedish open-source VPN company Mullvad, can protect up to five devices with one account. It allows for faster browsing and streaming, and gives you the ability to tap into servers located in "30-plus countries" for masking your location data.' -- source: https://news.slashdot.org/story/20/02/19/1910233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why fixing security vulnerabilities in medical devices, IoT is so hard
by Peter Reutemann 20 Feb '20

20 Feb '20

'When your family opened up that brand-new computer when you were a kid, you didn’t think of all of the third-party work that made typing in that first BASIC program possible. There once was a time when we didn't have to worry about which companies produced all the bits of licensed software or hardware that underpinned our computing experience. But recent malware attacks and other security events have shown just how much we need to care about the supply chain behind the technology we use every day. The URGENT/11 vulnerability, the subject of a Cybersecurity and Infrastructure Security Agency advisory issued last July, is one of those events. It forces us to care because it affects multiple medical devices. And it serves as a demonstration of how the software component supply chain and availability of support can affect the ability of organizations to update devices to fix security bugs—especially in the embedded computing space. URGENT/11 is a vulnerability in the Interpeak Networks TCP/IP stack (IPNet), which was licensed out to multiple vendors of embedded operating systems. IPNet also became the main networking stack in Wind River VxWorks, until Wind River acquired Interpeak in 2006 and stopped supporting IPNet. (Wind River itself was acquired by Intel in 2009 and spun off in 2018.) But the end of support didn’t stop several other manufacturers from continuing to use IPNet. When critical bugs were discovered in IPNet, it set off a scare among the numerous medical device manufacturers that run it as part of their product build.' -- source: https://arstechnica.com/information-technology/2020/02/medical-device-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Attack Dog
by Lawrence D'Oliveiro 19 Feb '20

19 Feb '20

Did my roughly-monthly update of Debian Unstable yesterday, and got yet another new version of Firefox. Quite sobering to see the extra protections being triggered now, on sites that I regularly visit. I got a warning earlier today about fingerprinters on aljazeera.com, though on revisiting the site a minute ago these no longer show up. Still an amazing number of cross-site tracking cookies, also present on arstechnica.com. The report for the latter shows a couple of fingerprinters currently being blocked, even though I got no explicit warning about that. It also says that “cryptominers” are blocked by default, but when I visited a certain well-known torrent-search site which has a policy of mining bitcoins on users’ machines, it didn’t show any present on that site, even though I could still hear my machine’s fans cranking up from the increased CPU load (which went away when I closed that tab).

1 0

Google Confirms It Again Removed Alleged Spying Tool ToTok From Google Play
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google has confirmed that the popular messaging app ToTok, which is actually a spying tool used by the United Arab Emirates to track the activities of those who download it, has again been removed from the Play Store. But this time they declined to comment as to why. TechCrunch reports: Reached for comment, Google confirmed to TechCrunch that it removed the app from Google Play. In addition, Google noted the enforcement was not done in response to any external direction or request. That means the U.S. government did not get involved here, rather that Google chose to remove the app itself -- likely for a policy violation. According to The NYT's original report, ToTok had been downloaded millions of times from both Apple and Google's app stores by customers across the Middle East, Europe, Asia, Africa and North America in the few months since its launch. Citing unnamed U.S. intelligence sources, the report claimed the app had been used to track its users' "every conversation, movement, relationship, appointment, sound, and image." At the time of the app's removal, Google said the app had violated unspecified Google Play policies. The app had over 10 million installs by then, app intelligence firm Sensor Tower says. In January, ToTok's website announced the app was again available for download. The updated version submitted to Google Play included a new dialog that requested authorization to access and sync users' contact list, Vice reported. Oddly, this updated version of ToTok never ranked on Google Play's charts again.' -- source: https://yro.slashdot.org/story/20/02/17/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug In WordPress Plugin Can Let Hackers Wipe Up To 200,000 Sites
by Peter Reutemann 18 Feb '20

18 Feb '20

'WordPress site owners who use commercial themes provided by ThemeGrill are advised to update one of the plugins that come installed with these themes in order to patch a critical bug that can let attackers wipe their sites. The vulnerability resides in ThemeGrill Demo Importer, a plugin that ships with themes sold by ThemeGrill, a web development company that sells commercial WordPress themes. The plugin, which is installed on more than 200,000 sites, allows site owners to import demo content inside their ThemeGrill themes so they'll have examples and a starting point on which they can build their own sites. However, in a report published yesterday, WordPress security firm WebARX says that older versions of the ThemeGrill Demo Importer are vulnerable to remote attacks from unauthenticated attackers. Remote hackers can send a specially crafted payload to vulnerable sites and trigger a function inside the plugin. The vulnerable function resets the site's content to zero, effectively wiping the content of all WordPress sites where a ThemeGrill theme is active, and the vulnerable plugin is installed. Furthermore, if the site's database contains a user named "admin," then the attacker is granted access to that user with full administrator rights over the site.' -- source: https://it.slashdot.org/story/20/02/17/2111235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux distro review: Intel’s own Clear Linux OS
by Peter Reutemann 18 Feb '20

18 Feb '20

'Intel's Clear Linux distribution has been getting a lot of attention lately, due to its incongruously high benchmark performance. Although the distribution was created and is managed by Intel, even AMD recommends running benchmarks of its new CPUs under Clear Linux in order to get the highest scores. Recently at Phoronix, Michael Larabel tested a Threadripper 3990X system using nine different Linux distros, one of which was Clear Linux—and Intel's distribution got three times as many first-place results as any other distro tested. When attempting to conglomerate all test results into a single geometric mean, Larabel found that the distribution's results were, on average, 14% faster than the slowest distributions tested (CentOS 8 and Ubuntu 18.04.3). There's not much question that Clear Linux is your best bet if you want to turn in the best possible benchmark numbers. The question not addressed here is, what's it like to run Clear Linux as a daily driver? We were curious, so we took it for a spin.' -- source: https://arstechnica.com/gadgets/2020/02/linux-distro-review-intels-own-clea… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung's Changes To Android Are Making Its Phones Less Secure, Says Google
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google scolded Samsung this week for an issue discovered on the Korean phone maker's Galaxy A50. From a report: Google says Samsung made "unnecessary changes to Android's core kernel," adding the changes Samsung made threaten rather than strengthen the phone's security. The tech giant has a vested interest in making sure Android is secure for OEMs and end users alike. Earlier this week Google announced it has made measurable efforts to limit malicious apps on its Google Play Store and it's clamping down on the permissions apps can request, resulting in a 98% reduction in requests for access to user's call history and text messages. It's also been tackling more worrying bugs, like self-reinstalling ones. But in this instance, it's a hardware partner that's causing the problems. In a detailed blog post from Google's Project Zero Team, researcher Jann Honn outlines the exact issue with Samsung's changes to the Android kernel on the A50. Samsung's changes included a security feature to restrict an attacker from reading or modifying user data, but Honn says the move is "futile" and rather than bolstering security, it introduces vulnerabilities that could increase an attacker's ability to arbitrarily execute code.' -- source: https://tech.slashdot.org/story/20/02/17/1656204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 17 Feb '20

17 Feb '20

Hi everyone We have a WLUG meeting next Monday: "Michael Cree will demo his Pinebook Pro and talk about his experiences with it, as well as challenges that he has (or still has to) overcome." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791995/ https://gettogether.community/events/3275/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Alternative Browser 'Waterfox' Acquired By System1
by Peter Reutemann 17 Feb '20

17 Feb '20

'Waterfox is an open-source web browser for x64, ARM64, and PPC64LE systems, "intended to be speedy and ethical, and maintain support for legacy extensions dropped by Firefox, from which it is forked," according to Wikipedia. (Its tabs also still have angled sides with rounded corners.) Friday Waterfox's original creator, 24-year-old Alexandros Kontos, announced that the browser "now has funding and a development team, so Waterfox can finally start to grow!" after its acquisition by a company called System1. I started Waterfox when I was 16. It was a way for me to understand how large software projects worked and the Mozilla documentation was a great introduction... I've touted Waterfox as an ethical and privacy friendly browser... I never wanted Waterfox to be a part of the hyper-privacy community. It would just feel like standards that would be impossible to uphold, especially for something such as a web browser on the internet. Throughout the years people have always asked about Waterfox and privacy, and if they've ever wanted more than it can afford, I've always pushed them to use Tor. Waterfox was here for customisations and speed, with a good level of privacy... I wasn't doing anything with Waterfox except developing it and making some money via search. Why I kept going throughout the years, I'll never know... System1 has been to Waterfox a search syndication partner. Essentially a way to have a search engine partnership (such as Bing) is through them, because companies such as Microsoft are too big and too busy to talk to small players such as Waterfox... It's probably the one easy way a browser can make money without doing anything dodgy, and it's a way I've been happy to do it without having to compromise Waterfox (and will be the same way System1 makes money from Waterfox -- nothing else). People also don't seem to understand what System1 does... "Now I can finally focus on making Waterfox into a viable alternative to the big browsers," Kontos concludes. Long-time Slashdot reader Freshly Exhumed contextualized the news with this brief history of the alternate browser ecosystem: As the usage share of web browsers continues to show a lopsideded dominance by Google Chrome, many previously-independent browsers have fallen by the wayside or have been reinvented as Chrome variants (i.e. Opera, Edge, Brave). Apple forges on with its Safari browser while other, smaller projects tend to be quite limited for multi-platform users, such as Dolphin and Bromite. Mozilla continues independently with Firefox for almost every platform, while variants such as Pale Moon and Sea Monkey have attempted to provide products that avoid drastic and/or controversial changes made by Mozilla but sometimes do not match the multi-platform support of Firefox. Let us not forget Tor, the Firefox-based anonymity-focused browser. Alex Kontos is a developer who attempted to provide continuity with dropped Firefox capabilities in his multi-platform Waterfox browser, proudly declaring that Firefox's user data sharing and telemetry collection was not included. For that privacy focus a certain popularity of Waterfox occurred. Now Kontos has revealed that his Waterfox project has been sold to System1, a company describing itself as "a consumer internet and applications company with the most powerful audience expansion platform in the industry." ' -- source: https://tech.slashdot.org/story/20/02/16/2146256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome Will Soon Start Blocking Insecure Downloads
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Google has revealed plans to initially warn Chrome users about 'insecure' downloads and eventually block them outright," reports The Verge. The warnings will begin in April: "Today we're announcing that Chrome will gradually ensure that secure (HTTPS) pages only download secure files," Joe DeBlasio of the Chrome security team wrote in a blog post. "Insecurely-downloaded files are a risk to users' security and privacy. For instance, insecurely-downloaded programs can be swapped out for malware by attackers, and eavesdroppers can read users' insecurely-downloaded bank statements." Beginning with Chrome 82, due for release in April, Chrome will warn users if they're about to download mixed content executables from a secure website. Then, when version 83 is released, those executable downloads will be blocked and the warning will be applied to archive files. PDFs and .doc files will get the warning in Chrome 84, with audio, images, text, and video files displaying it by version 85. Finally, all mixed content downloads — a non-secure file coming from a secure site — will be blocked as of the release of Chrome 86. Right now, Google is estimating an October release for that build of the popular web browsing.' -- source: https://tech.slashdot.org/story/20/02/16/1926231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do We Need To Talk About 'Cloud Neutrality'?
by Peter Reutemann 17 Feb '20

17 Feb '20

'"A multibillion-dollar, privately-owned infrastructure is now essential to the modern internet economy," writes Wired. And if you care about net neutrality, "That should freak you out." [T]here's an even bigger issue brewing, and it's time to start talking about it: cloud neutrality. "While its name sounds soft and fluffy," Microsoft president and general counsel Brad Smith and coauthor Carol Ann Browne write in their recent book, Tools and Weapons: The Promise and the Peril of the Digital Age, "in truth the cloud is a fortress...." Each data center costs hundreds of millions of dollars to build and many millions more to maintain; and you pretty much can't build a successful new company without them. So, thank goodness for Microsoft, right? The book means to portray this might and power as both a source of wonder and an enabling feature of the modern economy. To me, it reads like a threat. The cloud economy exists at the pleasure, and continued profit, of a handful of companies. The internet is no longer the essential enabler of the tech economy. That title now belongs to the cloud. But the infrastructure of the internet, at least, was publicly financed and subsidized. The government can set rules about how companies have to interact with their customers. Whether and how it sets and enforces those rules isn't the point, for now. It can. That's not the case with the cloud. This infrastructure is solely owned by a handful of companies with hardly any oversight. [Besides Microsoft, the article also notes Google and Amazon.] The potential for abuse is huge, whether it's through trade-secret snooping or the outright blocking, slowing, or hampering of transmission. No one seems to be thinking about what could happen if these behemoths decide it's against their interests to have all these barnacles on their flanks. They should be. Cloud companies "are essentially incubating and hosting their competition..." the article points out. "The problem is that few have the resources to replicate the cloud infrastructure, should the landlords suddenly turn on their tenants."' -- source: https://tech.slashdot.org/story/20/02/16/1847204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenPower Foundation Releases a Friendly EULA For IBM's Power ISA RISC
by Peter Reutemann 17 Feb '20

17 Feb '20

'Michael Larabel, of Phoronix, writes that the OpenPower Foundation has released a license agreement for Hardware Vendors to implement the Power ISA RISC instruction set in their processors. Hugh Blemings, the Director of OpenPower, was responsible for ensuring that the EULA is favourable and friendly towards Libre and Open Hardware projects and businesses. Of particular interest is that IBM's massive patent portfolio is automatically granted, royalty-free as long as two conditions apply: firstly, the hardware must be fully and properly Power ISA compliant, and secondly, the implementor must not "try it on" as a patent troll. Innovation in the RISC space just got a little more interesting. "Amidst the fully free and open RISC-V ISA making headway into the computing market, and ARM feeling pressured to loosen up its licensing, it seems they figured that it's best to join the party early," argues Hackaday.' -- source: https://news.slashdot.org/story/20/02/16/1743222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox, Wordpress Move to Support Lazy Loading of Images and iFrames
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Lazy Loading" would augment HTML's <img> tag (and <iframe> tag) with two new attributes -- "eager" (to load immediately) and "lazy" (to load only when it becomes relevant in the viewport). Felix Arntz, a developer programs engineer at Google (and a WordPress core committer) notes the updates in the HTML specification for the lazy loading attributes, adding that it's "already supported by several browsers, including Chrome and Edge" and also the Android browser and Opera. And lazy loading can now also be toggled on for Firefox 75 Nightly users, reports Neowin, though it's disabled by default: It's not clear if it will be enabled by the time Firefox 75 reaches the stable branch but according to comments on the Bugzilla thread, it's in high demand. Previously, websites could employ lazy loading by using JavaScript but now lazy loading syntax is supported directly in the web browser. The implementation in Firefox comes after Google added the feature to its browser. Google's Arntz has also written a post describing a proposal to begin lazy-loading images by default in Wordpress. The proposed solution is available as a feature plugin WP Lazy Loading in the plugin repository. The plugin is being developed on GitHub. Your testing and feedback will be much appreciated.' -- source: https://news.slashdot.org/story/20/02/16/0229240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Sends Microsoft A Blank Hard Drive For Sending Back The Windows 7 Source Code
by Peter Reutemann 16 Feb '20

16 Feb '20

'The Free Software Foundation sent Microsoft a hard drive for Valentine's Day -- along with a petition calling for the release of the source code for Windows 7 (which is no longer supported by Microsoft): It's as easy as copying the source code, giving it a license notice, and mailing it back to us. As the author of the most popular free software license in the world, we're ready to give them all of the help we can. All they have to do is ask. We want them to show exactly how much love they have for the "open source" software they mention in their advertising. If they really do love free software -- and we're willing to give them the benefit of the doubt -- they have the opportunity to show it to the world. We hope they're not just capitalizing on the free software development model in the most superficial and exploitative way possible: by using it as a marketing tool to fool us into thinking that they care about our freedom. Together, we've stood up for our principles. They can reject us, or ignore us, but what they cannot do is stop us. We'll go on campaigning, until all of us are free.' -- source: https://tech.slashdot.org/story/20/02/15/0213242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux is Ready for the End of Time
by Peter Reutemann 16 Feb '20

16 Feb '20

'January 19, 2038 is for Linux what Y2K was for mainframe and PC computers in 2000, reports ZDNet. It's the day that the value for time "runs out of numbers" and, in the case of 32-bit Unix-based operating systems like Linux and older versions of macOS, "starts counting time with negative numbers..." "But the fixes are underway to make sure all goes well when that fatal time rolls around." nickwinlund77 shared their report: Linux developers have seen this coming for decades. So, Linux kernel developer Arnd Bergmann and others have been working on a repair. These corrections are now in the forthcoming Linux 5.6 kernel. Bergmann explained, "Linux-5.6, or my backport of the patches to 5.4, should be the first release that can serve as a base for a 32-bit system designed to run beyond year 2038." There are some caveats: - All user space must be compiled with a 64-bit time_t, which will be supported in the coming musl-1.2 and glibc-2.32 releases, along with installed kernel headers from Linux-5.6 or higher. - Applications that use the system call interfaces directly need to be ported to use the time64 syscalls added in Linux-5.1 in place of the existing system calls. - Applications that use a private copy of kernel uapi header files or their contents may need to update to the Linux-5.6 version. - A few remaining interfaces cannot be changed to pass a 64-bit time_t in a compatible way, so they must be configured to use CLOCK_MONOTONIC times... After we fix this, we won't have to worry about 64-bit Linux running out of seconds until 15:30:08 GMT Sunday, December 4, 29,227,702,659. Personally, I'm not going to worry about that one.' -- source: https://linux.slashdot.org/story/20/02/15/0247201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Signal Is Finally Bringing Its Secure Messaging To the Masses
by Peter Reutemann 15 Feb '20

15 Feb '20

'[Cryptographer and coder known as Moxie Marlinspike] has always talked about making encrypted communications easy enough for anyone to use. The difference, today, is that Signal is finally reaching that mass audience it was always been intended for -- not just the privacy diehards, activists, and cybersecurity nerds that formed its core user base for years -- thanks in part to a concerted effort to make the app more accessible and appealing to the mainstream. That new phase in Signal's evolution began two years ago this month. That's when WhatsApp cofounder Brian Acton, a few months removed from leaving the app he built amid post-acquisition clashes with Facebook management, injected $50 million into Marlinspike's end-to-end encrypted messaging project. Acton also joined the newly created Signal Foundation as executive chairman. The pairing up made sense; WhatsApp had used Signal's open source protocol to encrypt all WhatsApp communications end-to-end by default, and Acton had grown disaffected with what he saw as Facebook's attempts to erode WhatsApp's privacy. Since then, Marlinspike's nonprofit has put Acton's millions -- and his experience building an app with billions of users -- to work. After years of scraping by with just three overworked full-time staffers, the Signal Foundation now has 20 employees. For years a bare-bones texting and calling app, Signal has increasingly become a fully featured, mainstream communications platform. With its new coding muscle, it has rolled out features at a breakneck speed: In just the last three months, Signal has added support for iPad, ephemeral images and video designed to disappear after a single viewing, downloadable customizable "stickers," and emoji reactions. More significantly, it announced plans to roll out a new system for group messaging, and an experimental method for storing encrypted contacts in the cloud. Many of those features might sound trivial. They certainly aren't the sort that appealed to Signal's earliest core users. Instead, they're what Acton calls "enrichment features." They're designed to attract normal people who want a messaging app as multifunctional as WhatsApp, iMessage, or Facebook Messenger but still value Signal's widely trusted security and the fact that it collects virtually no user data. Wired explains how adding simple-sounding enhancements can require significant feats of security engineering to fit within Signal's privacy constraints. Adding downloadable customizable stickers, for example, "required designing a system where every sticker 'pack' is encrypted with a 'pack key,'" reports Wired. "That key is itself encrypted and shared from one user to another when someone wants to install new stickers on their phone, so that Signal's server can never see decrypted stickers or even identify the Signal user who created or sent them." For Signal's new group messaging, Signal partnered with Microsoft Research to invent a novel form of "anonymous credentials" that let a server gatekeep who belongs in a group, but without ever learning the members' identities.' -- source: https://it.slashdot.org/story/20/02/14/2216214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UK West Midlands Police Warn Against Evils Of Kali Linux
by Lawrence D'Oliveiro 15 Feb '20

15 Feb '20

A poster was recently issued <https://www.theregister.co.uk/2020/02/14/silly_police_infosec_parental_advi…> by the West Midlands Regional Organised Crime Unit, also bearing the logo of the National Crime Agency, warning parents to watch out for certain signs of delinquency on their children’s computer, such as use of virtual machines, Kali Linux, Discord and various other things. The NCA have disavowed any knowledge of the poster.

1 0

An Old Android Virus is Reinstalling Itself Even After Factory Resets
by Peter Reutemann 14 Feb '20

14 Feb '20

'A particularly persistent malware infection has been spreading amongst Android phones -- and removing it only seems to bring it back with a vengeance. From a report: The Trojan xHelper, which Malwarebytes first wrote about last year, is reportedly re-spawning on devices where it's already been removed. If virus-removal software doesn't take care of a nasty infection, a hard reset will usually do the trick. But users report that even a full factory reset of an infected device doesn't wipe xHelper out completely. Within an hour the malware is usually back and ready to wreak havoc.' -- source: https://it.slashdot.org/story/20/02/13/1745252 The above news article has a link on how to remove it. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

500 Chrome Extensions Secretly Uploaded Private Data From Millions of Users
by Peter Reutemann 14 Feb '20

14 Feb '20

'More than 500 browser extensions downloaded millions of times from Google's Chrome Web Store surreptitiously uploaded private browsing data to attacker-controlled servers, researchers said on Thursday. Ars Technica reports: The extensions were part of a long-running malvertising and ad-fraud scheme that was discovered by independent researcher Jamila Kaya. She and researchers from Cisco-owned Duo Security eventually identified 71 Chrome Web Store extensions that had more than 1.7 million installations. After the researchers privately reported their findings to Google, the company identified more than 430 additional extensions. Google has since removed all known extensions. "In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users," Kaya and Duo Security Jacob Rickerd wrote in a report. "This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users' knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store's fraud detection mechanisms." The extensions were mostly presented as tools that provided various promotion- and advertising-as-a service utilities. In fact, they engaged in ad fraud and malvertising by shuffling infected browsers through a maze of sketchy domains. Each plugin first connected to a domain that used the same name as the plugin (e.g.: Mapstrek[.]com or ArcadeYum[.]com) to check for instructions on whether to uninstall themselves. The plugins then redirected browsers to one of a handful of hard-coded control servers to receive additional instructions, locations to upload data, advertisement feed lists, and domains for future redirects. Infected browsers then uploaded user data, updated plugin configurations, and flowed through a stream of site redirections. The researchers say the campaign dates back to at least January 2019, but it's possible that the operators were active "as early as 2017."' -- source: https://yro.slashdot.org/story/20/02/13/2355237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces Windows 10X
by Lawrence D'Oliveiro 13 Feb '20

13 Feb '20

A report <https://www.theregister.co.uk/2020/02/12/microsoft_previews_windows_10x/> on major new changes coming to the architecture of Microsoft Windows. This includes locking up all Win32 apps, that is to say the majority of Windows apps (now considered “legacy”), in a sandbox where they are strictly limited in what they can do to your OS, and even your documents. Access by the user to these apps is constrained through a channel very similar to RDP, which is normally only used for remote access. Interesting to see that, in 2020, Microsoft is still battling “OS rot”, which computer humourist Verity Stob was making fun of nearly two decades ago.

1 0

KDE Plasma 5.18 Released
by Peter Reutemann 12 Feb '20

12 Feb '20

'The KDE community today announced the release of Plasma 5.18. This version of the popular desktop environment is the latest long-term supported release and brings an emoji selector, user feedback capabilities, a global edit mode, and improvements to System Settings, the Discover software manager, widgets, GTK integration and much more.' -- source: https://news.slashdot.org/story/20/02/11/224207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Arrives With Default Zoom Level and Readability Backplate
by Peter Reutemann 12 Feb '20

12 Feb '20

'Mozilla today released Firefox 73 for Windows, Mac, Linux, and Android. Firefox 73 includes a default zoom level setting, a readability backplate option, and a handful of developer features.' -- source: https://news.slashdot.org/story/20/02/11/1953208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

One of the most destructive botnets can now spread to nearby Wi-Fi networks
by Peter Reutemann 12 Feb '20

12 Feb '20

'Over the past half decade, the Emotet malware has emerged as a top Internet threat that pillages people’s bank accounts and installs other types of malware. The sophistication of its code base and its regularly evolving methods for tricking targets into clicking on malicious links—in September, for instance, it began a spam run that addresses recipients by name and quotes past emails they sent or received—has allowed it to spread widely. Now, Emotet is adopting yet another way to spread: using already compromised devices to infect devices connected to nearby Wi-Fi networks. World’s most destructive botnet returns with stolen passwords and email in tow Last month, Emotet operators were caught using an updated version that uses infected devices to enumerate all nearby Wi-Fi networks. It uses a programming interface called wlanAPI to profile the SSID, signal strength, and use of WPA or other encryption methods for password-protecting access. Then, the malware uses one of two password lists to guess commonly used default username and password combinations. After successfully gaining access to a new Wi-Fi network, the infected device enumerates all non-hidden devices that are connected to it. Using a second password list, the malware then tries to guess credentials for each user connected to the drive. In the event no connected users are infected, the malware tries to guess the password for the administrator of the shared resource.' -- source: https://arstechnica.com/information-technology/2020/02/one-of-the-most-dest… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Insulter
by Lawrence D'Oliveiro 12 Feb '20

12 Feb '20

How would you like your shell (Bash or Zsh) to insult you every time you typed a wrong command? You need wait no longer, just install this <https://gitlab.com/dwt1/bash-insulter>. Of course, the insults list is customizable. The guy who wrote it also runs the DistroTube channel on YouTube <https://www.youtube.com/channel/UCVls1GmFKf6WlTraIb_IaJg/videos>.

2 1

South Korea's Government Explores Move From Windows To Linux Desktop
by Peter Reutemann 11 Feb '20

11 Feb '20

'In May 2019, South Korea's Interior Ministry announced plans to look into switching to the Linux desktop from Windows. It must have liked what it saw. According to the Korean news site Newsis, the South Korean Ministry of Strategy and Planning has announced the government is exploring moving most of its approximately 3.3 million Windows computers to Linux. The reason for this is simple. It's to reduce software licensing costs and the government's reliance on Windows. As Choi Jang-hyuk, the head of the Ministry of Strategy and Finance, said, "We will resolve our dependency on a single company while reducing the budget by introducing an open-source operating system." How much? South Korean officials said it would cost 780 billion won (about $655 million) to move government PCs from Windows 7 to Windows 10. [...] Windows will still have a role to play for now on South Korean government computers. As the Aju Business Daily, a South Korean business news site, explained: Government officials currently use two physical, air-gapped PCs. One is external for internet use, and the other is internal for intranet tasks. Only the external one will use a Linux-based distro. Eventually, by 2026, most civil servants will use a single Windows-powered laptop. On that system, Windows will continue to be used for internal work, while Linux will be used as a virtual desktop via a Linux-powered cloud server. This looks to eventually end up as a Desktop-as-a-Service (DaaS) model. The report notes that the Ministry of National Defense and National Police Agency are already using the Ubuntu Linux 18.04 LTS-based Harmonica OS 3.0. "Meanwhile, the Korean Postal Service division is moving to TMaxOS," reports ZDNet. "The Debian Linux-based South Korean Gooroom Cloud OS is also being used by Defense and the Ministry of Public Administration and Security."' -- source: https://linux.slashdot.org/story/20/02/10/2133246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Companies That Buy Data Derived From Scraping the Contents of Your Email Inbox
by Peter Reutemann 11 Feb '20

11 Feb '20

'The popular Edison email app, which is in the top 100 productivity apps on the Apple app store, scrapes users' email inboxes and sells products based off that information to clients in the finance, travel, and e-Commerce sectors. The contents of Edison users' inboxes are of particular interest to companies who can buy the data to make better investment decisions, according to a J.P. Morgan document obtained by Motherboard. On its website Edison says that it does "process" users' emails, but some users did not know that when using the Edison app the company scrapes their inbox for profit. Motherboard has also obtained documentation that provides more specifics about how two other popular apps -- Cleanfox and Slice -- sell products based on users' emails to corporate clients. Some of the companies listed in the J.P. Morgan document sell data sourced from "personal inboxes," the document adds. A spokesperson for J.P. Morgan Research, the part of the company that created the document, told Motherboard that the research "is intended for institutional clients." That document describes Edison as providing "consumer purchase metrics including brand loyalty, wallet share, purchase preferences, etc." The document adds that the "source" of the data is the "Edison Email App." On the product section of its website, Edison offers "Edison Trends" and "Trends Direct." The company says it can provide "Detailed behavior patterns to improve your customers' experience and business results." Edison is just one of several companies that offer free email apps which then sell anonymized or pseudonymized data derived from users' inboxes. Another company that mines inboxes called Foxintelligence has data that comes from users of the Cleanfox app, which tidies up users' inboxes. Some of the "examples of clients" mentioned in a confidential Foxintelligence presentation include PayPal, consulting giants Bain & Company, and McKinsey & Company. "A spreadsheet containing data from Rakuten's Slice, an app that scrapes a user's inbox so they can better track packages or get their money back once a product goes down in price, contains the item that an app user bought from a specific brand, what they paid, and an unique identification code for each buyer," adds Motherboard. "An email obtained by Motherboard appeared to show the price for access to Rakuten data for one product category as over $100,000."' -- source: https://yro.slashdot.org/story/20/02/10/2158242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Windows 10 Start Menu Now Harasses Firefox Users
by Peter Reutemann 11 Feb '20

11 Feb '20

'The "Suggested" section on the Windows 10 Start Menu used to just promote its own apps, reports MSPowerUser. But for some users (who haven't disable Microsoft's "Suggestions"), that menu is now showing a new kind of ad listing: The listing displays "Still using Firefox? Microsoft Edge is here", to all users of the former -- even with the latter already installed. The ad provides a link to download the chromium-based browser. Undoubtedly, the suggestions won't end here. Microsoft is reportedly planning to sprawl similar ads out to Wordpad, to encourage users to download official Office apps. The Windows Latest blog points out that Microsoft's "Suggestions" can be "permanently disabled with a few tweaks unlike the Chrome ads in Google search results."' -- source: https://news.slashdot.org/story/20/02/10/0014245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Suspicion and Anger Towards Microsoft Rises After Windows 10 Search Failure
by Peter Reutemann 10 Feb '20

10 Feb '20

'Earlier this week, searching in Windows 10 was broken, "with a black bar showing where search results should be, even for those who tried to perform a local search of their files." Microsoft issued a fix and blamed the issue on a "third-party networking fiber provider". But unfortunately, Microsoft's fix isn't working for everyone -- and that's just the beginning. Long-time Slashdot reader Futurepower(R) shares Forbes' report: Second, and more worryingly, Microsoft's explanation doesn't add up and it has prompted serious questions to be asked about how the operating system works and what personal data it is sharing. Popular Microsoft pundit Woody Leonard led the charge, writing: "If you believe that yesterday's worldwide crash of Windows 10 Search was caused by a bad third-party fiber provider, I have a bridge to sell you." In an open letter to new Windows head Panos Panay, Susan 'Patch Lady' Bradley was similarly sceptical, noting that today "we all found out that our local search boxes are somehow dependent on some service working at Microsoft." She attacked the company for a lack of transparency and gave it a maximum 'Pinocchio score' for a lack of trust... Similarly, Engadget writer Richard Lawler revealed that users were now trying to hack the Windows 10 registry to disconnect their local file searches from Microsoft servers "and I can't say I blame them after this episode. Microsoft owes users a better explanation than this and should make sure it's impossible for offline features to get taken out when the cloud is having an issue." In fact, Forbes writes that "the aforementioned Windows 10 registry hack appears to be the only 100% fix for this issue and it also disconnects Bing and Cortana online services from Windows 10 search." And then on Saturday the Windows Latest blog also noticed that Microsoft's release notes for Windows 10 20H1 Build 19035 reveal that Microsoft is apparently now delaying the roll-out of a widely-anticipated "Optional Updates" option. "It appears that the new Optional updates experience will come out in October/November 2020, not this spring as previously planned."' -- source: https://tech.slashdot.org/story/20/02/09/2241212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's 'Clear Linux' Distro Beats Ubuntu and Windows 10 -- on an AMD Laptop
by Peter Reutemann 10 Feb '20

10 Feb '20

'Intel's Clear Linux distribution looks like it could be the best operating system to run on cheap AMD hardware, with benchmarks showing it outperforms Windows 10 and Ubuntu on a $199 laptop with a budget AMD Ryzen 3200U processor. The Phoronix website ran a series of benchmarks on a super-cheap AMD laptop from Walmart, and found that Intel Clear Linux beat popular Linux distros Fedora and Ubuntu for 78% of the tests. Not only is it remarkable that a relatively unknown Linux distro is so easily outperforming established operating systems, the fact that Intel is the company behind the distro is particularly ironic. As you can imagine, Clear Linux is optimized for Intel processors, but it seems like it works brilliantly on AMD hardware as well.' -- source: https://linux.slashdot.org/story/20/02/08/1849207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost Every Website You Visit Records Exactly How Your Mouse Moves
by Peter Reutemann 09 Feb '20

09 Feb '20

'Medium's technology blog OneZero reports that many websites today use a service that collects all of your mouse movements, enabling "replays" of every move. "What surprised me was that the software even recorded when I shook my mouse around while deciding what to click on. It felt like observing digital body language." Session replay services have been around for over a decade and are widely used. One service, called FullStory, lists popular sites like Zillow, TeeSpring, and Jane as clients on its website. Another, called LogRocket, boasts Airbnb, Reddit, and CarFax, and a third called Inspectlet lists Shopify, ABC, and eBay among its users. They bill themselves as tools for designing sites that are easy to use and increase desired user behavior, such as buying an item. If many users add items to their cart, but then abandon the purchase at a certain rough part of the checkout process, for instance, the service helps site owners figure out how to change the site's design to nudge users over the checkout line... FullStory even has a feature that tracks what it calls "rage clicks." This is when a user gets frustrated with a site and starts angrily clicking over and over. In a semi-related story, a reporter for The Markup also recently discovered Amazon had apparently collected 90,000 rows of timestamped data about every tap they'd made on their Kindle.' -- source: https://yro.slashdot.org/story/20/02/08/002242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Elementary OS Wants to Crowdfund a Better Distro-Independent 'AppCenter for Everyone'
by Peter Reutemann 09 Feb '20

09 Feb '20

'In 2017 Elementary OS built a pay-what-you-want app store -- funded with $10,000 raised on IndieGogo. Now they're trying to raise another $10,000 for a one-week, in-person sprint in Denver, Colorado, Forbes reports, to upgrade the store while bringing an even grander concept to reality: That concept comprises 4 main goals: - Enable open source developers to monetize their apps on every other Linux distribution - Empower developers to ship apps with cutting-edge technologies - Improve privacy, security, and stability - Streamline the payments process On the technical side of things, the team plans to rebuild AppCenter's backend from the ground up to enable newer technologies developers are asking for, and they're rallying behind the Flatpak packaging format to get it done. They've already been collaborating with the FlatHub team, and plan to bring in developers from Endless and GNOME to ensure that "our solution can be reused and improved by other Flatpak stores and the greater open source desktop ecosystem." For a donation of $10, "you'll have your name immortalized in the AppCenter code on GitHub," explains a promotional video. (There's already 70 backers who have claimed this perk.) In fact, "Less than 8 hours ago we launched #AppCenterForEveryone, and we're 50% funded," announced an update Friday on Twitter. The campaign's web page shared this note of appreciation. "With your support, we'll be able to accelerate the timeline on adopting cutting edge technology and making an even more competitive Open Source operating system and a compelling foundation for all Flatpak stores."' -- source: https://linux.slashdot.org/story/20/02/08/1813251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security In 2020: Revisited
by Lawrence D'Oliveiro 08 Feb '20

08 Feb '20

Security guru Bruce Schneier revisits <https://www.schneier.com/blog/archives/2020/02/security_in_202_1.html> an essay he wrote 10 years ago, looking ahead in security-related computing trends. If you can stomach the neologisms: Trend over the decade up to 2010: * deperimeterization -- the realization that securing the boundary isn’t enough, you have to have defence in depth. Also known as “submarine warfare”. Trends already becoming apparent in 2010: * consumerization -- the idea that computing needs in workplaces will be following the trends in consumer devices, not leading them * decentralization -- or rather, recentralization in the cloud Trends he forecast in 2010: * deconcentration -- the replacement of general-purpose computers with special-purpose devices. But he also includes special-purpose apps installed on more general-purpose devices like smartphones. * decustomerization -- the idea that we get more of our IT functionality without any business relationship. But beware the maxim: “if you’re not paying for the product, then you are the product”. Also this has been tried with hardware before without success, but he thinks it’s something that will be tried again. * depersonization -- software agents taking decisions on your behalf. Gadgets in your house (and your car) won’t even need you to manage them.

1 0

Google Fixes No-User-Interaction Bug In Android's Bluetooth Component
by Peter Reutemann 08 Feb '20

08 Feb '20

'Google has patched this week a critical security flaw in Android's Bluetooth component. If left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms. Researchers said that exploiting the bug requires no user interaction. All that is required is that the user has Bluetooth enabled on his device. However, while this requirement would have limited the attack surface in past years, it does not today since modern Android OS versions ship with Bluetooth enabled by default and many Android users use Bluetooth-based headphones meaning the Bluetooth service is likely to be enabled on many handsets. The bug can lead to remote code execution and the hijacking of a device. Fixes for the bug are available via the Android February 2020 Security Bulletin, which has been available for download starting this week. Android 9 and earlier are impacted.' -- source: https://tech.slashdot.org/story/20/02/07/0220203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0