- wlug - list.wlug.org.nz

Android Users' Security and Privacy At Risk From Shadowy Ecosystem of Pre-Installed Software, Study Warns
by Peter Reutemann 25 Mar '19

25 Mar '19

'Researchers behind a large-scale independent study of pre-installed Android apps "unearthed a complex ecosystem of players with a primary focus on advertising and 'data-driven services' -- which they argue the average Android user is likely to be unaware of (while also likely lacking the ability to uninstall/evade the baked in software's privileged access to data and resources themselves)," reports TechCrunch. From the report: The study, which was carried out by researchers at the Universidad Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) at Berkeley (USA) and Stony Brook University of New York (US), encompassed more than 82,000 pre-installed Android apps across more than 1,700 devices manufactured by 214 brands, according to the IMDEA institute. "The study shows, on the one hand, that the permission model on the Android operating system and its apps allow a large number of actors to track and obtain personal user information," it writes. "At the same time, it reveals that the end user is not aware of these actors in the Android terminals or of the implications that this practice could have on their privacy. Furthermore, the presence of this privileged software in the system makes it difficult to eliminate it if one is not an expert user." In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."' -- source: https://tech.slashdot.org/story/19/03/25/2058215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Fixes Chrome 'Evil Cursor' Bug Abused by Tech Support Scam Sites
by Peter Reutemann 25 Mar '19

25 Mar '19

'Google has patched a Chrome bug that was being abused in the wild by tech support scammers to create artificial mouse cursors and lock users inside browser pages by preventing them from closing and leaving browser tabs. From a report: The trick was first spotted in September 2018 by Malwarebytes analyst Jerome Segura. Called an "evil cursor," it relied on using a custom image to replace the operating system's standard mouse cursor graphic. A criminal group that Malwarebytes called Partnerstroka operated by switching the standard OS 32-by-32 pixels mouse cursor with one of 128 or 256 pixels in size. A normal cursor would still appear on screen, but in the corner of a bigger transparent bounding box. [...] The "evil cursor" fix is currently live for Google Canary users, and is scheduled to land in the Chrome 75 stable branch, to be released later this spring.' -- source: https://tech.slashdot.org/story/19/03/25/210220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Telegram Adds 'Delete Everywhere' Nuclear Option -- Killing Chat History
by Peter Reutemann 25 Mar '19

25 Mar '19

'Instant messaging service Telegram has added a feature that lets a user delete messages in one-to-one and/or group private chats, after the fact, and not only from their own inbox. From a report: The new 'nuclear option' delete feature allows a user to selectively delete their own messages and/or messages sent by any/all others in the chat. They don't even have to have composed the original message or begun the thread to do so. They can just decide it's time. Let that sink in. All it now takes is a few taps to wipe all trace of a historical communication -- from both your own inbox and the inbox(es) of whoever else you were chatting with (assuming they're running the latest version of Telegram's app).' -- source: https://tech.slashdot.org/story/19/03/25/1641204 Something that WhatsApp could add as well... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Hackers Hijacked ASUS Software Updates To Install Backdoors on Thousands of Computers
by Peter Reutemann 25 Mar '19

25 Mar '19

'ASUS is believed to have pushed malware to hundreds of thousands of customers through its trusted automatic software update tool after attackers compromised the company's server and used it to push the malware to machines. From a report: Researchers at cybersecurity firm Kaspersky Lab say that ASUS, one of the world's largest computer makers, was used to unwittingly to install a malicious backdoor on thousands of its customers' computers last year after attackers compromised a server for the company's live software update tool. The malicious file was signed with legitimate ASUS digital certificates to make it appear to be an authentic software update from the company, Kaspersky Lab says. ASUS, a multi-billion dollar computer hardware company based in Taiwan that manufactures desktop computers, laptops, mobile phones, smart home systems, and other electronics, was pushing the backdoor to customers for at least five months last year before it was discovered, according to new research from the Moscow-based security firm. The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses. Once on a system, if it found one of these targeted addresses, the malware reached out to a command-and-control server the attackers operated, which then installed additional malware on those machines. Kaspersky Lab said it uncovered the attack in January after adding a new supply-chain detection technology to its scanning tool to catch anomalous code fragments hidden in legitimate code or catch code that is hijacking normal operations on a machine. The company plans to release a full technical paper and presentation about the ASUS attack, which it has dubbed ShadowHammer, next month at its Security Analyst Summit in Singapore' -- source: https://yro.slashdot.org/story/19/03/25/144248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

topic for meeting this month?
by Peter Reutemann 24 Mar '19

24 Mar '19

Hi everyone Anyone got a topic that they'd like to present on? Any interesting open-source software that they've come across and would like to demo for a few minutes? Linux distro roundup? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Two serious WordPress plugin vulnerabilities are being exploited in the wild
by Peter Reutemann 24 Mar '19

24 Mar '19

'Attackers have been actively exploiting serious vulnerabilities in two widely used WordPress plugins to compromise websites that run the extensions on top of the content management system. The two affected plugins are Easy WP SMTP with 300,000 active installations and Social Warfare, which has about 70,000 active installations. While developers have released patches for both exploited flaws, download figures indicate many vulnerable websites have yet to install the fixes. Figures for Easy WP SMTP, which was fixed five days ago, show the plugin has just short of 135,000 downloads in the past seven days. Figures for Social Warfare show it has been downloaded fewer than 20,000 times since a patch was published on WordPress on Friday. Sites that use either plugin should disable them immediately and then ensure they have been updated to version 1.3.9.1 of Easy WP SMTP and 3.5.3 of Social Warfare.' -- source: https://arstechnica.com/information-technology/2019/03/two-serious-wordpres… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stallman Suggests Install Fest 'Deals With Devil' Include Actual Man Dressed As Devil
by Peter Reutemann 24 Mar '19

24 Mar '19

'This weekend's annual LibrePlanet conference, hosted by the Free Software Foundation, prompted a new essay about "install fests" from Richard Stallman: Install fests invite users to bring their computers so that experts can install GNU/Linux on them... The problem is that most computers can't run with a completely free GNU/Linux distro. They contain peripherals, or coprocessors, that won't operate unless the installed system contains some nonfree drivers or firmware... This presents the install fest with a dilemma. If it upholds the ideals of freedom, by installing only free software from 100%-free distros, partly-secret machines won't become entirely functional and the users that bring them will go away disappointed. However, if the install fest installs nonfree distros and nonfree software which make machines entirely function, it will fail to teach users to say no for freedom's sake. They may learn to like GNU/Linux, but they won't learn what the free software movement stands for.... In effect, the install fest makes the deal with the devil, on the user's behalf, behind a curtain so the user doesn't recognize that it is one. I propose that the install fest show users exactly what deal they are making. Let them talk with the devil individually, learn the deal's bad implications, then make a deal -- or refuse! As always, I call on the install fest itself to install only free software, taking a strict stance. In this way it can set a clear moral example of rejecting nonfree software. My new idea is that the install fest could allow the devil to hang around, off in a corner of the hall, or the next room. (Actually, a human being wearing a sign saying "The Devil," and maybe a toy mask or horns.) The devil would offer to install nonfree drivers in the user's machine to make more parts of the computer function, explaining to the user that the cost of this is using a nonfree (unjust) program... Those users that get nonfree drivers would see what their moral cost is, and that there are people in the community who refuse to pay that cost. They would have the chance to reflect afterwards on the situation that their flawed computers have put them in, and about how to change that situation, in the small and in the large. Stallman adds that the Free Software Foundation itself would never let a devil near its events. "But given the fact that most install fests quietly play the role of the devil, I think that an explicit devil would be less bad. "It would convert the install-fest dilemma from a debilitating contradiction into a teaching experience."' -- source: https://news.slashdot.org/story/19/03/23/1624242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play Store Mistakenly Removed KDE Connect
by Peter Reutemann 24 Mar '19

24 Mar '19

'Google's Play Store made a bad mistake on Tuesday, long-time Slashdot reader sombragris writes: KDE Connect, a project designed to enable seamless communcation and control between a desktop computer and a mobile phone, was suddenly removed from Android's Google Play store. According to a Twitter thread by Albert Vaca, KDE Connect's maintainer, the removal was allegedly because the app was in breach of Google's new SMS policy. There's an exemption which applies to KDE Connect, but the maintainer was unable to contact anyone at Google to provide support. "There is simply no way to talk to a human being at @Google", he said. Cintora also announced on Twitter that while trying to comply with the Play Store's new policy, he'd initially been stopped again by technical problems. "The @GooglePlay console gives me an internal error, so I can't upload the version without SMS support." But on Thursday Cintora tweeted that KDE Connect "finally got approved, and SMS support is back in version 1.12.4, both on the Play Store and F-Droid!" Cintora credits this resolution partly to his Twitter thread, which got over half a million impressions. Its last tweet now features a picture of a celebrating parrot.' -- source: https://tech.slashdot.org/story/19/03/23/1852220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Share Buybacks
by Lawrence D'Oliveiro 23 Mar '19

23 Mar '19

Seems that Oracle has been buying back its own shares to keep its share price high <https://www.theregister.co.uk/2019/03/22/oracle_buyback_programme/>. On its own, this is not automatically a bad thing. I remember reading about a conversation between Steve Jobs and Warren Buffett some years ago, along the lines of: WB: You think your company shares are undervalued? SJ: Yes. WB: You have plenty of spare cash on hand? SJ: Yes. WB: Then use some of that cash to buy back some of your own shares. If you can spend 80¢ and get a dollar, why wouldn’t you? However, the warning sign in the above article is this: The overall effect is that Oracle is now in a net debt position for the first time since 2008, the Wall Street Journal reported this week. In other words, it seems to be borrowing in order to boost its share price. This might not end well ...

2 1

Tor-Powered Tails 3.13 Anonymous Linux OS Adds Extra Security and Latest Updates
by Peter Reutemann 21 Mar '19

21 Mar '19

'Powered by the Linux 4.19.28 kernel, the Tails 3.13 operating system is now available with latest TOR technologies to help you stay hidden while surfing the Internet, including the Tor Browser 8.0.7 anonymous web browser and Tor 0.3.5.8 client and server for the anonymous Tor network. However, probably the most important addition in the Tails 3.13 release is the updated Intel microcode to version 3.20180807a.2, which adds an extra security measure against more variants of the well-known Spectre, Meltdown, and L1TF (Level 1 Terminal Fault) security vulnerabilities. Furthermore, Tails 3.13 updates the Mozilla Thunderbird email and news client to version 65.1.0, adds support for the Bopomofo input method and improves support for the Pinyin input method for Chinese users, and implements automatic backup of the persistent storage's configuration whenever a change occurs.' -- source: https://news.softpedia.com/news/tor-powered-tails-3-13-ethical-hacking-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

For Years, Hundreds of Millions of Facebook Users Had Their Account Passwords Stored in Plain Text and Searchable By Thousands of Facebook Employees
by Peter Reutemann 21 Mar '19

21 Mar '19

'Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees -- in some cases going back to 2012, KrebsOnSecurity reported Thursday. From the report: Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data. Facebook is probing the causes of a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers. That's according to a senior Facebook employee who is familiar with the investigation and who spoke on condition of anonymity because they were not authorized to speak to the press. The Facebook source said the investigation so far indicates between 200 million and 600 million Facebook users may have had their account passwords stored in plain text and searchable by more than 20,000 Facebook employees. The source said Facebook is still trying to determine how many passwords were exposed and for how long, but so far the inquiry has uncovered archives with plain text user passwords in them dating back to 2012.' -- source: https://yro.slashdot.org/story/19/03/21/1525243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGM next week
by Peter Reutemann 19 Mar '19

19 Mar '19

Hi everyone Just a reminder for our (paying) society members that our SGM is on next Monday at 7pm: https://www.meetup.com/WaikatoLinuxUsersGroup/events/259341905/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a wireless keyboard lets hackers take full control of connected computers
by Peter Reutemann 19 Mar '19

19 Mar '19

'There’s a critical vulnerability in a model of Fujitsu wireless keyboard that makes it easy for hackers to take full control of connected computers, security researchers warned on Friday. Anyone using the keyboard model should strongly consider replacing it immediately. The Fujitsu Wireless Keyboard Set LX901 uses a proprietary 2.4 GHz radio communication protocol called WirelessUSB LP from Cypress Semiconductor. While the keyboard and mouse send input that’s protected with the time-tested Advanced Encryption Standard, the USB dongle that accepts the input accepts unencrypted packets as well, as long as they’re in the proper format. Researchers with the Germany-based penetration-testing firm SySS developed a proof-of-concept attack that exploits the insecure design. Using a small hardware device, they are able to send commands to vulnerable Fujitsu keyboard receiver dongles that are within range. As the video below demonstrates, the researchers were able to send input of their choice that’s automatically funneled to the connected computer.' -- source: https://arstechnica.com/information-technology/2019/03/how-a-wireless-keybo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Large Cloud Providers a Threat To Open Source Vendors?
by Peter Reutemann 18 Mar '19

18 Mar '19

'Stephen O'Grady, co-founder of the industry analyst firm RedMonk, asks whether open source vendors are marching towards an inevitable and damaging war with big cloud providers: In the last twelve to eighteen months...a switch has been flipped. Companies have gone from regarding cloud providers like Amazon, Google or Microsoft as not even worth mentioning as competition to dreadful, existential threat. The fear of these cloud providers has become so overpowering, in fact, that commercial open source vendors have chosen -- against counsel, in many cases -- to walk down strategic paths that violate open source cultural norms, trigger massive and sustained negative PR and jeopardize relationships with developers, partners and customers. Specifically, commercial open source providers have increasingly turned to models that blur the lines between open source and proprietary software in an attempt to access the strengths of both, with the higher probability outcome of ending up with their weaknesses instead. That commercial open source providers took these actions having been advised of these and other risks in advance says everything about how these businesses view their prospects in a world increasingly dominated by massive providers of cloud infrastructure and an expanding array of services that sit on top of that. The strategic decisions inarguably have major, unavoidable negative consequences, but commercial open source providers -- or their investors, at least -- believe that a lack of action would be even more damaging.' -- source: https://news.slashdot.org/story/19/03/16/0118259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Debian Almost Failed to Elect a Project Leader
by Peter Reutemann 17 Mar '19

17 Mar '19

'Five candidates now are running to be Debian's project leader for the coming year. But earlier this week, Slashdot reader Seven Spirals shared LWN's story about what a difficult election it's been: This year, the call for nominations was duly sent out by project secretary Kurt Roeckx on March 3. But, as of March 10, no eligible candidates had put their names forward... There is nobody there to do any campaigning. This being Debian, the constitution naturally describes what is to happen in this situation: the nomination period is extended for another week... Should this deadline also pass without candidates, it will be extended for another week; this loop will repeat indefinitely until somebody gives in and submits their name... In the absence of a project leader, the chair of the technical committee and the project secretary are empowered to make decisions -- as long as they are able to agree on what those decisions should be. Since Debian developers are famously an agreeable and non-argumentative bunch, there should be no problem with that aspect of things... One might well wonder, though, why there seems to be nobody who wants to take the helm of this project for a year. The fact that it is an unpaid position requiring a lot of time and travel might have something to do with it. If that were indeed to prove to be part of the problem, Debian might eventually have to consider doing what a number of similar organizations have done and create a paid position to do this work' -- source: https://linux.slashdot.org/story/19/03/16/2317214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

F5 Acquired NGINX For $670M
by Peter Reutemann 17 Mar '19

17 Mar '19

'F5 Networks on Monday announced that it will acquire NGINX, which provides popular open-source software of the same name, for $670 million. The deal advances F5's aim of capitalizing on the trend toward multi-cloud deployments. F5 plans to enhance NGINX's current offerings with F5 security solutions and will integrate F5 cloud-native technology with NGINX's software load balancing technology. This should accelerate F5's time to market of application services for containerized applications. Meanwhile, NGINX will benefit from F5's global salesforce, channel infrastructure and partner ecosystem. The acquisition adds "the power of NGINX's open source innovation to F5's ADC leadership and enterprise reach," NGINX CEO Gus Robertson said in a statement ' -- source: https://slashdot.org/story/19/03/16/1957241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Two-Thirds of Android Antivirus Apps Are Total BS
by Peter Reutemann 14 Mar '19

14 Mar '19

'Austrian antivirus-testing lab AV-Comparatives tested 250 antivirus apps in Google Play against 2,000 malware samples. They found that only 80 of the apps could stop even a minimal amount of malware. "Less than one in 10 of the apps tested defended against all 2,000 malicious apps, while over two-thirds failed to reach a block rate of even 30 percent," the lab said in a press release. To make sure you're protecting your Android device properly, stick to apps from well-known antivirus companies. Basically, AV-Comparatives said, most Android antivirus apps are phony, and many of them seemed to have been created only to display ads or promote a developer's career. "The main purpose of these apps seems to be generating easy revenue for their developers, rather than actually protecting their users," the AV-Comparatives report said' -- source: https://it.slashdot.org/story/19/03/13/213255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Amazon May Finally Get .amazon Domain
by Lawrence D'Oliveiro 14 Mar '19

14 Mar '19

Amazon has been trying to register the .amazon top-level domain for years, but the governments of Brazil and Peru have been trying to stall this, just ignoring the established procedures for resolving domain disputes, which keep going against them. But it seems ICANN has finally lost patience and is going to stop bending over backwards to placate those governments, and grant the registration <https://www.theregister.co.uk/2019/03/12/amazon_domain_spat/>.

1 0

Google Quietly Adds DuckDuckGo as a Search Engine Option for Chrome Users in About 60 Markets
by Peter Reutemann 13 Mar '19

13 Mar '19

'In an update to the chromium engine, which underpins Google's popular Chrome browser, the search giant has quietly updated the lists of default search engines it offers per market -- expanding the choice of search product users can pick from in markets around the world. Most notably it's expanded search engine lists to include pro-privacy rivals in more than 60 markets globally. The changes, which appear to have been pushed out with the Chromium 73 stable release yesterday, come at a time when Google is facing rising privacy and antitrust scrutiny and accusations of market distorting behavior at home and abroad' -- source: https://tech.slashdot.org/story/19/03/13/1521235 Including NZ! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Launches Android Q Beta 1
by Peter Reutemann 13 Mar '19

13 Mar '19

'Google said today it is rolling out the first beta version of Android Q, the newest version of its mobile operating system. The company will roll out a stable version of Android Q later this year. From a report: The first beta includes a preview SDK for developers with system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, and the official Android Emulator. This is the fourth year running that Google has released the first developer preview of the next Android version in March -- Android N (later named Android Nougat), Android O (Android Oreo), and Android P (Android Pie). For the past two years, Google did not use the Android Beta Program, which lets you get early Android builds via over-their-air updates on select devices. That changes with Android Q -- Google is making the first preview available as a beta, not just as a developer preview. That signals that it is ready for early adopters to try, in addition to developers. As before, this preview version will be referred to as Android Q until Google picks a name starting with that letter.' -- source: https://developers.slashdot.org/story/19/03/13/196215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Send Lets You Share 1GB Files With No Strings Attached
by Peter Reutemann 13 Mar '19

13 Mar '19

'In 2017, Mozilla experimented with a service that let you transfer 1GB files by sharing a web address with the recipient. Firefox Send is now out of testing and boasts a magnified 2.5GB file-size limit if you log into your Firefox account. From a report: Firefox Send is handy for those moments when you need to share video, audio or photo files that can be too big to squeeze into an email attachment. [...] Firefox Send, which will also be available as an Android app, illustrates one of Mozilla's efforts to diversify beyond the Firefox browser. Mozilla touts Firefox Send as focusing on privacy and uses encryption to protect files. Firefox Send files are available for up to seven days and can be password-protected. You can also limit the number of times they're downloaded.' -- source: https://hardware.slashdot.org/story/19/03/12/1439222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia Blocks Encrypted Email Provider ProtonMail
by Peter Reutemann 12 Mar '19

12 Mar '19

'Russia has told internet providers to enforce a block against encrypted email provider ProtonMail, the company's chief has confirmed. The block was ordered by the state Federal Security Service, formerly the KGB, according to a Russian-language blog, which obtained and published the order after the agency accused the company and several other email providers of facilitating bomb threats. Several anonymous bomb threats were sent by email to police in late January, forcing several schools and government buildings to evacuate. In all, 26 internet addresses were blocked by the order, including several servers used to scramble the final connection for users of Tor, an anonymity network popular for circumventing censorship. Internet providers were told to implement the block "immediately," using a technique known as BGP blackholing, a way that tells internet routers to simply throw away internet traffic rather than routing it to its destination. But the company says while the site still loads, users cannot send or receive email. The way the KGB blocked ProtonMail is "particularly sneaky," ProtonMail chief executive Andy Yen said. "ProtonMail is not blocked in the normal way, it's actually a bit more subtle. They are blocking access to ProtonMail mail servers. So Mail.ru -- and most other Russian mail servers -- for example, is no longer able to deliver email to ProtonMail, but a Russian user has no problem getting to their inbox." "That's because the two ProtonMail servers listed by the order are its back-end mail delivery servers, rather than the front-end website that runs on a different system," adds TechCrunch.' -- source: https://yro.slashdot.org/story/19/03/12/0329259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Knoppix 8.5 iso?
by Ian Young 12 Mar '19

12 Mar '19

Anyone have an iso file for Knoppix 8.5, or know of a source for download? This appears to be the latest version, but so far is apparently only available with a copy of Linux Magazine linked with a Linux event in Germany. ~ Ian Y

2 1

Samsung Galaxy S10 Facial Recognition Fooled by a Video of the Phone Owner
by Peter Reutemann 11 Mar '19

11 Mar '19

'Experts have proven once again that facial recognition on modern devices remains hilariously insecure and can be bypassed using simple tricks such as showing an image or a video in front of a device's camera. From a report: The latest device to fall victim to such attacks is Samsung Galaxy S10, Samsung's latest top tier phone and considered one of the world's most advanced smartphones to date. Unfortunately, the Galaxy S10's facial recognition feature remains just as weak as the one supported in its previous versions or on the devices of its competitors, according to Lewis Hilsenteger, a smartphone reviewer better known as Unbox Therapy on YouTube. Hilsenteger showed in a demo video uploaded on his YouTube channel last week how putting up a video of the phone owner in front of the Galaxy S10 front camera would trick the facial recognition system into unlocking the device.' -- source: https://mobile.slashdot.org/story/19/03/11/166239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EU's Plan To Ban Sale of User-Moddable RF Devices Draws Widespread Condemnation
by Peter Reutemann 11 Mar '19

11 Mar '19

'The Register is reporting that the EU is looking to block users from tinkering the firmware/software of their RF devices. This seems to have been very under reported, with a fairly short consultation period that has now expired. It could force manufacturers to lock down phones and routers etc to stop you from installing the likes of Lineage OS or OpenWRT. The way this is written it could stop devices like laptops or Raspberry Pi's having their software changed. >From the report: The controversy centres on Article 3(3)(i) of the EU Radio Equipment Directive, which was passed into law back in 2014. However, an EU working group is now about to define precisely which devices will be subject to the directive -- and academics, researchers, individual "makers" and software companies are worried that their activities and business models will be outlawed. Article 3(3)(i) states that RF gear sold in the EU must support "certain features in order to ensure that software can only be loaded into the radio equipment where the compliance of the combination of the radio equipment and software has been demonstrated." If the law is implemented in its most potentially harmful form, no third-party firmware could be installed onto something like a home router, for example.' -- source: https://tech.slashdot.org/story/19/03/11/1835239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Package Maintainer Steps Down, Complaining About 'Old Infrastructure'
by Peter Reutemann 11 Mar '19

11 Mar '19

'Michael Stapelberg, maintains "a bunch" of Debian packages and services, and says the free software Linux distro "has been in my life for well over 10 years at this point." Today he released a 2,255-word essay explaining why he's "winding down" his involvement in Debian to a minimum, citing numerous complaints including Debian's complicated build stack, waits of up to seven hours before package uploads can be installed, leading to "asynchronous" feedback -- and Debian's lack of tooling for large changes. The closest to "sending out a change for review" is to open a bug report with an attached patch... Culturally, reviews and reactions are slow. There are no deadlines. I literally sometimes get emails notifying me that a patch I sent out a few years ago (!!) is now merged. This turns projects from a small number of weeks into many years, which is a huge demotivator for me. Interestingly enough, you can see artifacts of the slow online activity manifest itself in the offline culture as well: I don't want to be discussing systemd's merits 10 years after I first heard about it. Lastly, changes can easily be slowed down significantly by holdouts who refuse to collaborate. My canonical example for this is rsync, whose maintainer refused my patches to make the package use debhelper purely out of personal preference. Granting so much personal freedom to individual maintainers prevents us as a project from raising the abstraction level for building Debian packages, which in turn makes tooling harder. There's also several complaints about old infrastructure -- for example, "I dread interacting with the Debian bug tracker. debbugs is a piece of software (from 1994) which is only used by Debian and the GNU project these days." Stapelberg also complains that the "painful" experience of developing using Debian "leaves a lot to be desired," and adds that "It baffles me that in 2019, we still don't have a conveniently browsable threaded archive of mailing list discussions." "My frustration level ultimately exceeded the threshold," Stapelberg writes in the essay, adding "I hope this post inspires someone, ideally a group of people, to improve the developer experience within Debian." He'll soon transition packages to be team-maintained "where it makes sense," but also "orphan packages where I am the sole maintainer... For all intents and purposes, please treat me as permanently on vacation..." "I will try to keep up best-effort maintenance of the manpages.debian.org service and the codesearch.debian.net service, but any help would be much appreciated."' -- source: https://linux.slashdot.org/story/19/03/10/2245221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fine And Ancient Art Of Letterlocking
by Lawrence D'Oliveiro 07 Mar '19

07 Mar '19

Came across this linked from computer security expert Bruce Schneier’s blog: how did people in pre-industrial times protect paper letters from prying eyes? There were no mass-produced envelopes in those days, so they resorted to “letterlocking” -- intricate ways of folding and sealing a letter to form its own envelope <https://www.atlasobscura.com/articles/what-did-people-do-before-envelopes-l…>. And yes, there is a whole website devoted to this: <http://letterlocking.org/>.

1 0

Researchers Uncover Ring of GitHub Accounts Promoting 300+ Backdoored Apps
by Peter Reutemann 05 Mar '19

05 Mar '19

'A security researcher has uncovered a ring of malicious GitHub accounts promoting over 300 backdoored Windows, Mac, and Linux applications and software libraries. The malicious apps contained code to gain boot persistence on infected systems and later download other malicious code -- which appeared to be a "sneaker bot," a piece of malware that would add infected systems to a botnet that would later participate in online auctions for limited edition sneakers. All the GitHub accounts that were hosting these files -- backdoored versions of legitimate apps -- have now been taken down. One account, in particular, registered in the name of Andrew Dunkins, hosted 305 backdoored ELF binaries. Another 73 apps were hosted across 88 other accounts. ' -- source: https://developers.slashdot.org/story/19/03/05/1351217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Fears UAE Government's Cybersecurity Company 'DarkMatter' May Be Tied To a Cyber Espionage Program
by Peter Reutemann 05 Mar '19

05 Mar '19

'Firefox browser-maker Mozilla is considering whether to block cybersecurity company DarkMatter from serving as one of its internet security gatekeepers after a Reuters report linked the United Arab Emirates-based firm to a cyber espionage program. Reuters reported in January that DarkMatter provided staff for a secret hacking operation, codenamed Project Raven, on behalf of an Emirati intelligence agency. The unit was largely comprised of former U.S. intelligence officials who conducted offensive cyber operations for the UAE government. Former Raven operatives told Reuters that many DarkMatter executives were unaware of the secretive program, which operated from a converted Abu Dhabi mansion away from DarkMatter's headquarters. Those operations included hacking into the internet accounts of human rights activists, journalists and officials from rival governments, Reuters found. DarkMatter has denied conducting the operations and says it focuses on protecting computer networks. While Mozilla had been considering whether to grant DarkMatter the authority to certify websites as safe, two Mozilla executives said in an interview last week that Reuters' report raised concerns about whether DarkMatter would abuse that authority. Mozilla said the company has not yet come to a decision on whether to deny the authority to DarkMatter, but expects to decide within weeks.' -- source: https://news.slashdot.org/story/19/03/05/0424249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

All Intel Chips Open To New 'Spoiler' Non-Spectre Attack
by Peter Reutemann 05 Mar '19

05 Mar '19

'Spoiler is the newest speculative attack affecting Intel's micro-architecture. From a report: Like the Spectre and Meltdown attacks revealed in January 2018, Spoiler also abuses speculative execution in Intel chips to leak secrets. However, it targets a different area of the processor called the Memory Order Buffer, which is used to manage memory operations and is tightly coupled with the cache. Researchers from Worcester Polytechnic Institute, Massachusetts, and the University of Lubeck in north Germany detail the attack in a new paper, 'Spoiler: Speculative load hazards boost Rowhammer and cache attacks'. The paper [PDF] was released this month and spotted by The Register. The researchers explain that Spoiler is not a Spectre attack, so it is not affected by Intel's mitigations for it, which otherwise can prevent other Spectre-like attacks such as SplitSpectre.' -- source: https://it.slashdot.org/story/19/03/05/1524251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.1 Continues The Years-Long Effort Preparing For Year 2038
by Peter Reutemann 05 Mar '19

05 Mar '19

'Linux 5.1 continues the massive undertaking in preparing the kernel for the Year 2038 problem. Phoronix: The Linux kernel has been seeing "Y2038" work for years and the effort is far from over. Thomas Gleixner (a Linux kernel developer who serves as a member of the technical advisory board at The Linux Foundation) sent in the latest Y2038 work for the Linux 5.1 kernel, which after a lot of ground work in previous kernels has introduced the first set of syscalls that are Year 2038 safe.' -- source: https://linux.slashdot.org/story/19/03/05/1929233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why 'ji32k7au4a83' is a Remarkably Common Password
by Peter Reutemann 05 Mar '19

05 Mar '19

'A seemingly complex set of characters like "ji32k7au4a83" is a very common password among users, it turns out. From a report: This interesting bit of trivia comes from self-described hardware/software engineer Robert Ou, who recently asked his Twitter followers if they could explain why this seemingly random string of numbers has been seen by Have I Been Pwned (HIBP) over a hundred times. Have I Been Pwned is an aggregator that was started by security expert Troy Hunt to help people find out if their email or personal data has shown up in any prominent data breaches. One service it offers is a password search that allows you to check if your password has shown up in any data breaches that are on the radar of the security community. In this case, "ji32k7au4a83" has been seen by HIBP in 141 breaches. Several of Ou's followers quickly figured out the solution to his riddle. The password is coming from the Zhuyin Fuhao system for transliterating Mandarin. The reason it's showing up fairly often in a data breach repository is because "ji32k7au4a83" translates to English as "my password."' -- source: https://it.slashdot.org/story/19/03/05/203253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.0 Released
by Peter Reutemann 04 Mar '19

04 Mar '19

'Linus Torvalds has released Linux 5.0 in kicking off the kernel's 28th year of development. Linux 5.0 features include AMD FreeSync support, open-source NVIDIA Turing GPU support, Intel Icelake graphics, Intel VT-d scalable mode, NXP PowerPC processors are now mitigated for Spectre Variant Two, and countless other additions. eWeek adds: Among the new features that have landed in Linux 5.0 is support for the Adiantum encryption system, developed by Google for low power devices. Google's Android mobile operating system and ChromeOS desktop operating system both rely on the Linux kernel. "Storage encryption protects your data if your phone falls into someone else's hands," Paul Crowley and Eric Biggers, Android Security and Privacy Team at Google wrote in a blog post. "Adiantum is an innovation in cryptography designed to make storage encryption more efficient for devices without cryptographic acceleration, to ensure that all devices can be encrypted. Memory management in Linux also gets a boost in the 5.0 kernel with a series of improvements designed to help prevent memory fragmentation, which can reduce performance.' -- source: https://linux.slashdot.org/story/19/03/04/1329227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

News articles on privacy...
by Peter Reutemann 03 Mar '19

03 Mar '19

"Leaked Documents Reveal Facebook's Global War On Data Privacy Laws" -- source: https://tech.slashdot.org/story/19/03/03/1623229 "Massive Database Leak Exposes China's 'Digital Surveillance State'" -- source: https://developers.slashdot.org/story/19/03/03/053253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Break Digital Signatures For Most Desktop PDF Viewers
by Peter Reutemann 26 Feb '19

26 Feb '19

'A team of academics from the Ruhr-University Bochum in Germany say they've managed to break the digital signing system and create fake signatures on 21 of 22 desktop PDF viewer apps and five out of seven online PDF digital signing services. This includes apps such as Adobe Acrobat Reader, Foxit Reader, and LibreOffice, and online services like DocuSign and Evotrust --just to name the most recognizable names. The five-person research team has been working since early October 2018 together with experts from Germany's Computer Emergency Response Team (BSI-CERT) to notify impacted services. The team went public with their findings over the weekend after all affected app makers and commercial companies finished patching their products. In research published today, the Ruhr-University Bochum team described three vulnerabilities that they found in the digital signing process used by several desktop and web-based PDF signing services. Summarized, they are: 1. Universal Signature Forgery (USF) -- vulnerability lets attackers trick the signature verification process into showing users a fake panel/message that the signature is valid. 2. Incremental Saving Attack (ISA) -- vulnerability lets attackers add extra content to an already signed PDF document via the "incremental saving (incremental update)" mechanism, but without breaking the already-existing signature. 3. Signature Wrapping (SWA) -- vulnerability is similar to ISA, but the malicious code also contains extra logic to fool the signature validation process into "wrapping" around the attacker's extra content, effectively digitally signing the incremental update.' -- source: https://it.slashdot.org/story/19/02/25/2126208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Netflix Is Killing Piracy In NZ”
by Lawrence D'Oliveiro 25 Feb '19

25 Feb '19

<https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122073…>: Independent research commissioned by Vocus indicates "piracy is dying a natural death," ... ... Peer-to-peer services, usually associated with piracy, used to be "the dominant source of traffic on our network." Today, about 80 per cent of Vocus' peak-time traffic is for legal streaming sites like Netflix and YouTube. Ah, don’t you just love that simplistic conflation: P2P ≡ piracy, YouTube ≡ legit. I wonder when they will discover youtube-dl...

1 0

Android Is Helping Kill Passwords on a Billion Devices
by Peter Reutemann 25 Feb '19

25 Feb '19

'The FIDO Alliance -- a consortium that develops open source authentication standards -- has been pushing to expand its secure login protocols to make seamless logins a reality for several years. Today, it has hit the jackpot: Google. From a report: On Monday, Google and the FIDO Alliance announced that Android has added certified support for the FIDO2 standard, meaning that the vast majority of devices running Android 7 or later will now be able to handle password-less logins in mobile browsers like Chrome. Android already offered secure FIDO login options for mobile apps, where you authenticate using a phone's fingerprint scanner or with a hardware dongle like a YubiKey. But FIDO2 support will make it possible to use these easy authentication steps for web services in a mobile browser instead of laboriously typing in your password every time you want to log in. Web developers can now design their sites to interact with Android's FIDO2 management infrastructure.' -- source: https://tech.slashdot.org/story/19/02/25/1440241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Australian Email Service FastMail Says It is Losing Customers and Facing Calls To Move Operations Outside of the Country Over Local Anti-Encryption Laws
by Peter Reutemann 25 Feb '19

25 Feb '19

'Email provider FastMail says it has lost customers and faces "regular" requests to shift its operations outside Australia following the passage of anti-encryption laws. The Victorian company, which offers ad-free email services to users in 150 countries, told a senate committee that the now-passed laws were starting to bite. "The way in which [the laws] were introduced, debated, and ultimately passed ... creates a perception that Australia has changed - that we are no longer a country which respects the right to privacy," FastMail CEO Bron Gondwana said. "We have already seen an impact on our business caused by this perception. Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." "Still, we have seen existing customers leave, and potential customers go elsewhere, citing this bill as the reason for their choice. We are [also] regularly being asked by customers if we plan to move.' -- source: https://tech.slashdot.org/story/19/02/25/1329204 That's what the tech community had to say earlier about this bill: https://alp.fail/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla and Scroll Partner To Test Alternative Funding Models for the Web
by Peter Reutemann 25 Feb '19

25 Feb '19

'News subscription service Scroll, which is yet to launch to consumers but has received the backing of several top publishers, courted another major player today: Mozilla. The browser maker says it will work with Scroll to better understand how consumers react to ad-free experiences on the web and subscription-based funding models. As part of the deal, Mozilla said it would test features and product ideas provided by Scroll, which itself has been conducting internal tests with a number of outlets. Small groups of Firefox users will be invited at random to share feedback and also respond to surveys, Mozilla said.' -- source: https://news.slashdot.org/story/19/02/25/1819244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drupal 7 Will Reach End-of-Life in November of 2021
by Peter Reutemann 25 Feb '19

25 Feb '19

'Drupal 7, which was first released in January 2011, will reach end of life (EOL) in November of 2021, the Drupal Association said today. What this means for your Drupal 7 sites is, as of November 2021: 1. Drupal 7 will no longer be supported by the community at large. The community at large will no longer create new projects, fix bugs in existing projects, write documentation, etc. around Drupal 7. 2. There will be no more core commits to Drupal 7. 3. The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core or contributed modules, themes, or other projects. Reports about Drupal 7 vulnerabilities might become public creating 0 day exploits. 4. All Drupal 7 releases on all project pages will be flagged as not supported. Maintainers can change that flag if they desire to. 5. On Drupal 7 sites with the update status module, Drupal Core will show up as unsupported. 6. After November 2021, using Drupal 7 may be flagged as insecure in 3rd party scans as it no longer gets support. 7. Best practice is to not use unsupported software, it would not be advisable to continue to build new Drupal 7 sites. 8. Now is the time to start planning your migration to Drupal' -- source: https://developers.slashdot.org/story/19/02/25/1953224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

holding packages
by Peter Reutemann 25 Feb '19

25 Feb '19

Hi everyone If you want to keep a certain package at a fixed version, you can "hold" that package on a debian system like this: https://help.ubuntu.com/community/PinningHowto#Introduction_to_Holding_Pack… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experts Find Serious Problems With Switzerland's Online Voting System
by Peter Reutemann 22 Feb '19

22 Feb '19

'Switzerland made headlines this month for the transparency of its internet voting system when it launched a public penetration test and bug bounty program to test the resiliency of the system to attack. But after source code for the software and technical documentation describing its architecture were leaked online last week, critics are already expressing concern about the system's design and about the transparency around the public test. Cryptography experts who spent just a few hours examining the leaked code say the system is a poorly constructed and convoluted maze that makes it difficult to follow what's going on and effectively evaluate whether the cryptography and other security measures deployed in the system are done properly. "Most of the system is split across hundreds of different files, each configured at various levels," Sarah Jamie Lewis, a former security engineer for Amazon as well as a former computer scientist for England's GCHQ intelligence agency, told Motherboard. "I'm used to dealing with Java code that runs across different packages and different teams, and this code somewhat defeats even my understanding." She said the system uses cryptographic solutions that are fairly new to the field and that have to be implemented in very specific ways to make the system auditable, but the design the programmers chose thwarts this. "It is simply not the standard we would expect," she told Motherboard. [...] It isn't just outside attackers that are a concern; the system raises the possibility for an insider to intentionally misconfigure the system to make it easier to manipulate, while maintaining plausible deniability that the misconfiguration was unintentional. "Someone could wire the thing in the wrong place and suddenly the system is compromised," said Lewis, who is currently executive director of the Open Privacy Research Society, a Canadian nonprofit that develops secure and privacy-enhancing software for marginalized communities. "And when you're talking about code that is supposed to be protecting a national election, that is not a statement someone should be able to make." "You expect secure code to be defensively written that would prevent the implementers of the code from wiring it up incorrectly," Lewis told Motherboard. But instead of building a system that doesn't allow for this, the programmers simply added a comment to their source code telling anyone who compiles and implements it to take care to configure it properly, she said. The online voting system was developed by Swiss Post, the country's national postal service, and the Barcelona-based company Scytl. "Scytl claims the system uses end-to-end encryption that only the Swiss Electoral Board would be able to decrypt," reports Motherboard. "But there are reasons to be concerned about such claims."' -- source: https://developers.slashdot.org/story/19/02/21/2227234 At least they had a public test to figure that out, rather than an actual election... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of websites threatened by highly critical code-execution bug in Drupal
by Peter Reutemann 22 Feb '19

22 Feb '19

'Millions of sites that run the Drupal content management system run the risk of being hijacked until they're patched against a vulnerability that allows hackers to remotely execute malicious code, managers of the open source project warned Wednesday. CVE-2019-6340, as the flaw is tracked, stems from a failure to sufficiently validate user input, managers said in an advisory. Hackers who exploited the vulnerability could, in some cases, run code of their choice on vulnerable websites. The flaw is rated highly critical. "Some field types do not properly sanitize data from non-form sources," the advisory stated. "This can lead to arbitrary PHP code execution in some cases."' -- source: https://arstechnica.com/information-technology/2019/02/millions-of-websites… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Netflix..
by John 22 Feb '19

22 Feb '19

Does anyone know how to get Netflix to work in Firefox?? Cheers John..

1 0

Severe Vulnerabilities Uncovered In Popular Password Managers
by Peter Reutemann 21 Feb '19

21 Feb '19

Not sure whether this also applies to the Linux/cross-platform versions... 'Independent Security Evaluators (ISE) published an assessment on Tuesday with the results of testing with several popular password managers, including LastPass and KeePass. The team said that each password management solution "failed to provide the security to safeguard a user's passwords as advertised" and "fundamental flaws" were found that "exposed the data they are designed to protect." The vulnerabilities were found in software operating on Windows 10 systems. In one example, the master password which users need to use to access their cache of credentials was stored in PC RAM in a plaintext, readable format. ISE was able to extract these passwords and other login credentials from memory while the password manager in question was locked. It may be possible that malicious programs downloaded to the same machine by threat actors could do the same. The report has summarized the main findings based on each password management solution. Here's what ISE had to say about LastPass and KeePass -- two of the most popular password managers available: "LastPass obfuscates the master password while users are typing in the entry, and when the password manager enters an unlocked state, database entries are only decrypted into memory when there is user interaction. However, ISE reported that these entries persist in memory after the software enters a locked state. It was also possible for the researchers to extract the master password and interacted-with password entries due to a memory leak." "KeePass scrubs the master password from memory and is not recoverable. However, errors in workflows permitted the researchers from extracting credential entries which have been interacted with. In the case of Windows APIs, sometimes, various memory buffers which contain decrypted entries may not be scrubbed correctly."' -- source: https://it.slashdot.org/story/19/02/21/070204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle Claims a Fighter of Pirated Apps is a Front For Ad Fraud
by Peter Reutemann 21 Feb '19

21 Feb '19

'A company that claims to combat app piracy is a pirate itself, according to a report Oracle released this week. From a report: Oracle claims the company, Tapcore, has been perpetrating a massive ad fraud on Android devices by infecting apps with software that ring up fake ad impressions and drain people's data. Based in The Netherlands, Tapcore works with developers to identify when apps are pirated and then enables developers to make money from those bootleg copies by serving ads. Oracle says that Tapcore's anti-piracy code was a Trojan horse that was generating fake mobile websites to trick ad serving platforms into paying them for non-existent ad inventory. "The code is delivering a steady stream of invisible video ads and spoofing domains," Dan Fichter, VP of software development at Oracle Data Cloud, tells Ad Age. "On all those impressions it looked like the advertiser was running ads on legitimate mobile websites. Not only were they not on a website, they were on an invisible web browser." On its website, Tapcore says it works with more than 3,000 apps, serving 150 million ad impressions a day. The apps whose pirated versions it has worked with include titles like "Perfect 365," "Draw Clash of Clans," "Vertex" and "Solitaire: Season 4," according to Oracle's report.' -- source: https://yro.slashdot.org/story/19/02/21/1238254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Researchers Say Software Alone Can't Mitigate Spectre Chip Flaws
by Peter Reutemann 21 Feb '19

21 Feb '19

'A group of researchers say that it will be difficult to avoid Spectre bugs in the future unless CPUs are dramatically overhauled. From a report: Google researchers say that software alone is not enough to prevent the exploitation of the Spectre flaws present in a variety of CPUs. The team of researchers -- including Ross McIlroy, Jaroslav Sevcik, Tobias Tebbi, Ben L Titzer and Toon Verwaest -- work on Chrome's V8 JavaScript engine. The researchers presented their findings in a paper distributed through ArXiv and came to the conclusion that all processors that perform speculative execution will always remain susceptible to various side-channel attacks, despite mitigations that may be discovered in future. ' -- source: https://hardware.slashdot.org/story/19/02/21/1630210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Launches ELISA, an Open Source Project For Building Safety-Critical Systems
by Peter Reutemann 21 Feb '19

21 Feb '19

'The Linux Foundation today launched Enabling Linux in Safety Applications (ELISA), an open source project comprising tools intended to help companies build and certify Linux-based systems whose failure could result in loss of human life, significant property damage, or environmental damage. From a report: In partnership with British chip designer Arm, BMW, autonomous platforms company Kuka, Linutronix, and Toyota, ELISA will work with certification and standardization bodies in "multiple industries" to establish ways Linux can form the foundation of safety-critical systems across industries.' -- source: https://linux.slashdot.org/story/19/02/21/1559217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Psion Palmtop Successor Has Arrived and It Runs Android and Linux
by Peter Reutemann 21 Feb '19

21 Feb '19

'A lot of people probably remember the 1990s palmtop computers made by Psion fondly. The clamshell-design palmtops were pocketable, black and white, but had a working stylus and a fantastic tactile foldout QWERTY keyboard that you could type pretty substantial documents on or even write code with. A different company -- Planet Computers -- has now produced a spiritual successor to the old Psion palmtops called the Gemini PDA that is much like an old Psion but with the latest Android smartphone hardware in it and a virtually identical tactile keyboard. It can also dual boot to Linux (Debian, Ubuntu, Sailfish) alongside Android. The technical specs are a MediaTek deca-core processor, 4GB RAM, 64GB storage (plus microSD slot), 4G, 802.11c Wi-Fi, GPS, Bluetooth, eSIM support, and 4,220mAh battery. The screen measures in at 5.99-inches with a 2,160 x 1,080 (403ppi) resolution. The only thing missing seems to be the stylus -- but perhaps that would have complicated manufacturing of this niche-device in its first production r' -- source: https://hardware.slashdot.org/story/19/02/20/2241216 Yes, it's back! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Blu-Ray On The Way Out?
by Lawrence D'Oliveiro 20 Feb '19

20 Feb '19

Samsung has given up developing new Blu-Ray players, and is going to stop selling them in the US altogether <https://arstechnica.com/gadgets/2019/02/samsung-says-it-will-stop-making-ne…>. Seems like downloads and streaming are taking over from physical discs, and UHD was never a big part of the latter anyway. One surprising fact is that DVD-Video still accounts for over half of such sales, at least in the US.

1 0