- wlug - list.wlug.org.nz

Internet Explorer Exploit Steals Data From Windows Users-- Even If They Never Use Internet Explorer
by Peter Reutemann 14 Apr '19

14 Apr '19

'Security researcher John Page has revealed a new zero-day exploit that allows remote attackers to exfiltrate Local files using Internet Explorer. "The craziest part: Windows users don't ever even have to open the now-obsolete web browser for malicious actors to use the exploit," reports Mashable. "It just needs to exist on their computer..." [H]ackers are taking advantage of a vulnerability using .MHT files, which is the file format used by Internet Explorer for its web archives. Current web browsers do not use the .MHT format, so when a PC user attempts to access this file Windows opens IE by default. To initiate the exploit, a user simply needs to open an attachment received by email, messenger, or other file transfer service... Most worrisome, according to Page, is that Microsoft told him that it would just "consider" a fix in a future update. The security researcher says he contacted Microsoft in March before now going public with the issue. As ZDNet points out, while Internet Explorer usage makes up less than 10 percent of the web browser market, it doesn't particularly matter in this case as the exploit just requires a user to have the browser on their PC.' -- source: https://it.slashdot.org/story/19/04/14/2232252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does Wi-Fi Security Really Matter?
by Lawrence D'Oliveiro 11 Apr '19

11 Apr '19

Seems the Wi-Fi Alliance is having yet another crack at coming up with a really secure protocol, this time to be called WPA3 <http://www.theregister.co.uk/2018/01/09/wi_fi_wpa3/>. Does anybody care? Remember that on the Internet, security is implemented between the endpoints, the protocols are designed not to care that everything in-between might be pawed through by eavesdroppers, or even active attackers trying to inject fake data.

1 1

Dragonblood Vulnerabilities Disclosed in Wi-Fi WPA3 Standard
by Peter Reutemann 11 Apr '19

11 Apr '19

'Two security researchers disclosed details this week about a group of vulnerabilities collectively referred to as Dragonblood that impact the Wi-Fi Alliance's recently launched WPA3 Wi-Fi security and authentication standard. From a report: If ever exploited, the vulnerabilities would allow an attacker within the range of a victim's network to recover the Wi-Fi password and infiltrate the target's network. In total, five vulnerabilities are part of the Dragonblood ensemble -- a denial of service attack, two downgrade attacks, and two side-channel information leaks. While the denial of service attack is somewhat unimportant as it only leads to crashing WPA3-compatible access points, the other four are the ones that can be used to recover user passwords. Both the two downgrade attacks and two side-channel leaks exploit design flaws in the WPA3 standard's Dragonfly key exchange -- the mechanism through which clients authenticate on a WPA3 router or access point. In a downgrade attack, Wi-Fi WPA3-capable networks can be coerced in using an older and more insecure password exchange systems, which can allow attackers to retrieve the network passwords using older flaws.' -- source: https://mobile.slashdot.org/story/19/04/11/1431219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gmail Becomes First Major Email Provider To Support MTA-STS and TLS Reporting
by Peter Reutemann 11 Apr '19

11 Apr '19

'Google announced this week that Gmail has become the first major email provider to support two new security standards, namely MTA-STS and TLS Reporting. From a report: Both are extensions to the Simple Mail Transfer Protocol (SMTP), the protocol through which all emails are sent today. The purpose of MTA-STS and TLS Reporting is to help email providers establish cryptographically secure connections between each other, with the main goal of twarthing SMTP man-in-the-middle attacks. SMTP man-in-the-middle attacks are a major problem for today's email landscape, where rogue email server operators can intercept, read, and modify the contents of people's emails. The two new standards will prevent this by allowing legitimate email providers to create a secure channel for exchanging emails.' -- source: https://tech.slashdot.org/story/19/04/11/1822228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Workers Are Listening To What You Tell Alexa
by Peter Reutemann 11 Apr '19

11 Apr '19

'Amazon reportedly employs thousands of people around the world to help improve its Alexa digital assistant. "The team listens to voice recordings captured in Echo owners' homes and offices," reports Bloomberg. "The recordings are transcribed, annotated and then fed back into the software as part of an effort to eliminate gaps in Alexa's understanding of human speech and help it better respond to commands." From the report: The team comprises a mix of contractors and full-time Amazon employees who work in outposts from Boston to Costa Rica, India and Romania, according to the people, who signed nondisclosure agreements barring them from speaking publicly about the program. They work nine hours a day, with each reviewer parsing as many as 1,000 audio clips per shift, according to two workers based at Amazon's Bucharest office, which takes up the top three floors of the Globalworth building in the Romanian capital's up-and-coming Pipera district. The modern facility stands out amid the crumbling infrastructure and bears no exterior sign advertising Amazon's presence. The work is mostly mundane. One worker in Boston said he mined accumulated voice data for specific utterances such as "Taylor Swift" and annotated them to indicate the searcher meant the musical artist. Occasionally the listeners pick up things Echo owners likely would rather stay private: a woman singing badly off key in the shower, say, or a child screaming for help. The teams use internal chat rooms to share files when they need help parsing a muddled word -- or come across an amusing recording. Sometimes they hear recordings they find upsetting, or possibly criminal. Two of the workers said they picked up what they believe was a sexual assault. When something like that happens, they may share the experience in the internal chat room as a way of relieving stress. Amazon says it has procedures in place for workers to follow when they hear something distressing, but two Romania-based employees said that, after requesting guidance for such cases, they were told it wasn't Amazon's job to interfere. [...] Amazon, in its marketing and privacy policy materials, doesn't explicitly say humans are listening to recordings of some conversations picked up by Alexa. "We use your requests to Alexa to train our speech recognition and natural language understanding systems," the company says in a list of frequently asked questions. In Alexa's privacy settings, the company gives users the option of disabling the use of their voice recordings for the development of new features. A screenshot reviewed by Bloomberg shows that the recordings sent to the Alexa auditors don't provide a user's full name and address but are associated with an account number, as well as the user's first name and the device's serial number. An Amazon spokesperson said in a statement to Bloomberg: "We take the security and privacy of our customers' personal information seriously. We only annotate an extremely small sample of Alexa voice recordings in order [to] improve the customer experience. For example, this information helps us train our speech recognition and natural language understanding systems, so Alexa can better understand your requests, and ensure the service works well for everyone." They added: "We have strict technical and operational safeguards, and have a zero tolerance policy for the abuse of our system. Employees do not have direct access to information that can identify the person or account as part of this workflow. All information is treated with high confidentiality and we use multi-factor authentication to restrict access, service encryption and audits of our control environment to protect it."' -- source: https://yro.slashdot.org/story/19/04/10/2340251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts
by Peter Reutemann 10 Apr '19

10 Apr '19

'Google said today it will now enable Android users to use their smartphones as a Fast Identity Online (FIDO) security key (for two-step authentication) for their Google accounts, thereby addressing one of the biggest challenges that has slowed the adoption of this security measure: convenience. A report adds: You can thus use your Android phone to protect your personal Google account, and your G Suite, Cloud Identity, and Google Cloud Platform work accounts. (Android tablets aren't supported -- Google specifically limited the functionality since users are more likely to have phones with them.) This means Android phones can move from two-step verification (2SV) to two-factor authentication (2FA). 2SV is a method of confirming a user's identity using something they know (password) and a second thing they know (a code sent via text message). 2FA is a method of confirming a user's identity by using a combination of two different factors: something they know (password), something they have (security key), or something they are (fingerprint). The feature is coming only to Android devices versions 7 and up.' -- source: https://tech.slashdot.org/story/19/04/10/1621253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome Wants To Block Some HTTP File Downloads
by Peter Reutemann 10 Apr '19

10 Apr '19

'Google wants to block some file downloads carried out via HTTP on websites that use HTTPS. The plan is to block EXE, DMG, CRX, ZIP, GZIP, BZIP, TAR, RAR, and 7Z file downloads when the download is initiated via HTTP but the website URL shows HTTPS. Google said it's currently not thinking of blocking all downloads started from HTTP sites, since the browser already warns users about a site's poor security via the "Not Secure" indicator in the URL bar. The idea is to block insecure downloads on sites that appear to be secure (loaded via HTTPS) but where the downloads take place via plain ol' HTTP.' -- source: https://tech.slashdot.org/story/19/04/10/1758206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mysterious safety-tampering malware infects a second critical infrastructure site
by Peter Reutemann 10 Apr '19

10 Apr '19

'Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure. Attackers who may have been working on behalf of a nation caused an operational outage at a critical-infrastructure site after deliberately targeting a system that prevented health- and life-threatening accidents. Game-changing attack on critical infrastructure site causes outage There had been compromises of critical infrastructure sites before. What was unprecedented in this attack—and of considerable concern to some researchers and critical infrastructure operators—was the use of an advanced piece of malware that targeted the unidentified site’s safety processes. Such safety instrumented systems (SIS) are a combination of hardware and software that many critical infrastructure sites use to prevent unsafe conditions from arising. When gas fuel pressures or reactor temperatures rise to potentially unsafe thresholds, for instance, a SIS will automatically close valves or initiate cooling processes to prevent health- or life-threatening accidents. Russia was likely behind dangerous critical infrastructure attack, report says By focusing on the site’s SIS, the malware carried the threat of physical destruction that depending on the site and the type of accident had the potential to be serious if not catastrophic. The malware was alternately named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric. It’s development was ultimately linked to a Russian government-backed research institute.' -- source: https://arstechnica.com/information-technology/2019/04/mysterious-safety-ta… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows XP Dies Final Death As Embedded POSReady 2009 Reaches End of Life
by Peter Reutemann 10 Apr '19

10 Apr '19

'Extended support for Windows Embedded POSReady 2009 -- the last supported version of Windows based on Windows XP -- ended on April 9, 2019, marking the final end of the Windows NT 5.1 product line after 17 years, 7 months, and 16 days. Counting this edition, Windows XP is the longest-lived version of Windows ever -- a record which is unlikely to be beaten. Despite the nominal end of support for Windows XP five years ago, the existence of POSReady 2009 allowed users to receive security updates on Windows XP Home and Professional SP3 through the use of a registry hack. Microsoft dissuaded users from doing this, stating that they "do not fully protect Windows XP customers," though no attempt was apparently made to prevent users from using this hack. With POSReady reaching the end of support, the flow of these security updates will likewise come to an end.' -- source: https://tech.slashdot.org/story/19/04/10/0017208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Most Public Windows Error-Message Screen Ever?
by Lawrence D'Oliveiro 09 Apr '19

09 Apr '19

There has long been a history of Windows error messages popping up in the most embarrassing public places, like on status displays in train stations, shopping malls and the like. Could this example be some kind of record for being the most public? Being wrapped right round the top of one of the tallest buildings in London, after all. <https://www.theregister.co.uk/2019/04/08/bt_tower_broadcasts_error_message_…>

1 0

meeting next Monday
by Peter Reutemann 09 Apr '19

09 Apr '19

Hi everyone Due to Easter falling on our usual WLUG meeting slot on the 22nd and the university no longer allowing rooms to be used on public holidays, this month's meeting will happen next Monday, a week earlier. At this stage, I'm still looking for a speaker. A talk on Wayland was suggested, but I never received a confirmation/blurb, unfortunately. https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884273/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Opera Adds Crypto Wallet To Its Desktop Browser, Launches Anti-Chrome Campaign in Europe
by Peter Reutemann 09 Apr '19

09 Apr '19

'Opera has updated its eponymous web browser for the desktop with a crypto-makeover and a number of additional features. From a report: The Norway-headquartered browser maker has also launched a marketing campaign to cash in on the EU regulatory order that requires Google to give Android users in Europe more options to choose their preferred browser. Dubbed 'Reborn 3,' the latest version of Opera for Windows, macOS, and Linux includes a native cryptocurrency wallet, which follows Opera's Android app getting this feature in December. The wallet keys and transactions are synced between the desktop and mobile browsers with the latter also serving as a way for the user to authenticate their identity, the company said. [...] Additionally, Opera is speeding up the free VPN feature, after adding this feature to its Android app last month.' -- source: https://tech.slashdot.org/story/19/04/09/1356246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Launching Curated Recommended Extensions Program This Summer
by Peter Reutemann 09 Apr '19

09 Apr '19

'However much you love your chosen web browser, you have probably enhanced its capabilities through the use of add-ons. Finding decent, reliable add-ons can be tricky, and this is why Mozilla is launching the Recommended Extensions program. This editor-curated program will surface the very best vetted extensions for Firefox, and it is due to roll out in stages later this summer. Mozilla says that any extensions it recommends through the program will be highlighted across its portfolio of websites and products, including addons.mozilla.org (AMO) and on Firefox's Get Add-Ons page. The company is already identifying extensions it likes the look of, and will soon be reaching out to developers. Changes should be seen on AMO around June.' -- source: https://tech.slashdot.org/story/19/04/09/1444248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Several Major Browsers to Prevent Disabling of Click-Tracking 'Hyperlink Auditing'
by Peter Reutemann 08 Apr '19

08 Apr '19

'A HTML standard called hyperlink auditing that allows sites to track link clicks is enabled by default on Safari, Chrome, Opera, and Microsoft Edge, but will soon have no way to disable it. As it is considered a privacy risk, browsers previously allowed you to disable this feature. Now they are going in the opposite direction. Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on. The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."' -- source: https://news.slashdot.org/story/19/04/07/2338244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Aren't People Abandoning Windows For Linux?
by Peter Reutemann 08 Apr '19

08 Apr '19

'This weekend SlashGear published "Reasons to Abandon Windows For Linux," making their case to "Windows users who are curious about the state of Linux for mainstream computing." It tries to enumerate specific reasons why Linux might be the better choice, arguing among other things that: * Updates on Linux are fast and "rarely call for a restart" -- and are also more complete. "Updates are typically downloaded through a 'Software Updater' application that not only checks for operating system patches, but also includes updates for the programs that you've installed from the repository." * Windows "tries to serve a variety of markets...cramming in a scattered array of features" -- and along those lines, that Microsoft "has gradually implemented monetization schemes and methods for extracting user data." And yet you're still paying for that operating system, while Linux is less bloated and "free forever." * "Because less people use Linux, the platform is less targeted by malware and tends to be more secure than Windows" The article also touches on a few other points (including battery life), and predicts that problems with Windows are "bound to get worse over time and will only present more of a case for making the switch to Linux." Long-time Slashdot reader shanen shared the article, along with some new thoughts on why people really stay with Windows: I think the main "excuse" is the perception of reliability, which is really laughable if you've actually read the EULA. Microsoft certainly doesn't have to help anyone at all. I would argue that Windows support is neither a bug nor a feature, but just a marketing ploy. Their original submission suggests that maybe Linux needs to buttress the perception of its reliability with a better financial model -- possibly through a new kind of crowd funding which could also be extended to all open source software, or even to journalism).' -- source: https://linux.slashdot.org/story/19/04/07/2111218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Provably unbreakable encryption
by Wolf 07 Apr '19

07 Apr '19

Is this something fit for this list? https://www.quantamagazine.org/how-the-evercrypt-library-creates-hacker-pro… Wolf

2 1

Ongoing DNS hijackings target unpatched consumer routers
by Peter Reutemann 05 Apr '19

05 Apr '19

'A wave of DNS hijacking attacks that abuse Google's cloud computing service is causing consumer routers to connect to fraudulent and potentially malicious websites and addresses, a security researcher has warned. By now, most people know that Domain Name System servers translate human-friendly domain names into the numeric IP addresses that computers need to find other computers on the Internet. Over the past four months, a blog post published Thursday said, attackers have been using Google cloud service to scan the Internet for routers that are vulnerable to remote exploits. When they find susceptible routers, the attackers then use the Google platform to send malicious code that configures the routers to use malicious DNS servers.' -- source: https://arstechnica.com/information-technology/2019/04/ongoing-dns-hijackin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The End of the Desktop?
by Peter Reutemann 04 Apr '19

04 Apr '19

'Steven J. Vaughan-Nichols, writing for ComputerWorld : Of course, at one time, to get any work done with a computer, you first had to learn a lot, about computers, operating systems, commands and more. Eventually, "friendly" became the most important adverb in computing circles, and we've reached the point in user-friendliness that people don't even talk about it anymore. Today, Google has shown with its Chrome OS that most of us can pretty much do anything we need to do on a computer with just a web browser. But Google's path is not Microsoft's path. Instead, it's moving us first to Windows as desktop as a service (DaaS) via Microsoft Managed Desktop (MMD). This bundles Windows 10 Enterprise, Office 365 and Enterprise Mobility + Security and cloud-based system management into Microsoft 365 Enterprise. The next step, Windows Virtual Desktop, enables companies to virtualize Windows 7 and 10, Office 365 ProPlus apps and other third-party applications on Azure-based virtual machines. If all goes well, you'll be able to subscribe to Windows Virtual Desktop this fall. Of course, Virtual Desktop is a play for business users -- for now. I expect Virtual Desktop to be offered to consumers in 2020. By 2025, Windows as an actual desktop operating system will be a niche product. Sound crazy? Uh, you do know that Microsoft already really, really wants you to "rent" Office 365 rather than buy Office 2019, don't you? But what about games, you say? We'll always have Windows for games! Will we? Google, with its Google Stadia gaming cloud service, is betting we're ready to move our games to the cloud as well. It's no pipe dream. Valve has been doing pretty well for years now with its Steam variation on this theme. So where is all this taking us? I see a world where the PC desktop disappears for all but a few. Most of us will be writing our documents, filling out our spreadsheets and doing whatever else we now do on our PCs via cloud-based applications on smart terminals running Chrome OS or Windows Lite. If you want a "real" PC, your choices are going to be Linux or macOS.' -- source: https://tech.slashdot.org/story/19/04/04/1724248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft and Canonical Launch Visual Studio Code Snap For Linux
by Peter Reutemann 04 Apr '19

04 Apr '19

'Following the release of Visual Studio 2019 for Windows and Mac platforms, Microsoft today is releasing a snap version of Visual Studio Code. A report adds: No, the source-code editor is not the Windows-maker's first snap -- it also released one for Skype, for instance. "As of today, Visual Studio Code is available for Linux as a snap, providing seamless auto-updates for its users. Visual Studio Code, a free, lightweight code editor, has redefined editors for building modern web and cloud applications, with built-in support for debugging, task running, and version control for a variety of languages and frameworks," says Canonical. Joao Moreno, Software Development Engineer, Microsoft Visual Studio Code offers the following statement: "The automatic update functionality of snaps is a major benefit. It is clear there is a thriving community around snaps and that it is moving forward at great pace. The backing of Canonical ensures our confidence in its ongoing development and long-term future."' -- source: https://linux.slashdot.org/story/19/04/04/1854252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'SPURV' Project Brings Windowed Android Apps To Desktop Linux
by Peter Reutemann 04 Apr '19

04 Apr '19

'A new "experimental containerized Android environment" from a company called Collabora allows Android apps to run in floating windows alongside native applications on desktop Linux. You can read all the technical details at the source link, but put simply, 'SPURV' creates a virtual Android device on your Linux computer, much like Bluestacks and other similar tools. There are various components of SPURV that allow the Android environment to play audio, connect to networks, and display hardware-accelerated graphics through the underlying Linux system. The most interesting part is 'SPURV HWComposer,' which renders Android applications in windows, alongside the windows from native Linux applications. This is what sets SPURV apart from (most) other methods of running Android on a computer. For this to work, the Linux desktop has to be using the Wayland display server (some Linux-based OSes use X11). Pre-built binaries for SPURV are not currently available -- you have to build it yourself from the source code. Still, it's an interesting proof-of-concept, and hopefully someone turns it into a full-featured product. ' -- source: https://linux.slashdot.org/story/19/04/03/2222207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Serious Apache server bug gives root to baddies in shared host environments
by Peter Reutemann 04 Apr '19

04 Apr '19

'The Apache HTTP Server, the Internet’s most widely used Web server, just fixed a serious vulnerability that makes it possible for untrusted users or software to gain unfettered control of the machine the software runs on. CVE-2019-0211, as the vulnerability is indexed, is a local privilege escalation, meaning it allows a person or software that already has limited access to the Web server to elevate privileges to root. From there, the attacker could do just about anything. The vulnerability makes it possible for unprivileged scripts to overwrite sensitive parts of a server’s memory, Charles Fol, the independent researcher who discovered the bug, wrote in a blog post. A malicious script could exploit the vulnerability to gain root. The vulnerability poses the most risk inside Web-hosting facilities that offer shared instances, in which a single physical machine serves content for more than one website. Typically, such servers prevent an administrator of one site from accessing other sites or from accessing sensitive settings of the machine itself.' -- source: https://arstechnica.com/information-technology/2019/04/serious-apache-serve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Facebook Records Found on Amazon Cloud Servers
by Peter Reutemann 03 Apr '19

03 Apr '19

'Researchers at UpGuard, a cybersecurity firm, found troves of Facebook user information hiding in plain sight, inadvertently posted publicly on Amazon.com's cloud computing servers. From a report: The discovery shows that a year after the Cambridge Analytica scandal exposed how unsecure and widely disseminated Facebook users' information is online, companies that control that information at every step still haven't done enough to seal up private data, Bloomberg News reports. In one instance, Mexico City-based media company Cultura Colectiva openly stored 540 million records on Facebook users, including identification numbers, comments, reactions and account names. That database was closed on Wednesday after Bloomberg alerted Facebook to the problem and Facebook contacted Amazon. Facebook shares pared their gains after the Bloomberg News report. UpGuard adds: The data sets vary in when they were last updated, the data points present, and the number of unique individuals in each. What ties them together is that they both contain data about Facebook users, describing their interests, relationships, and interactions, that were available to third party developers. As Facebook faces scrutiny over its data stewardship practices, they have made efforts to reduce third party access. But as these exposures show, the data genie cannot be put back in the bottle. Data about Facebook users has been spread far beyond the bounds of what Facebook can control today. Combine that plenitude of personal data with storage technologies that are often misconfigured for public access, and the result is a long tail of data about Facebook users that continues to leak' -- source: https://yro.slashdot.org/story/19/04/03/182215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds on Social Media: 'It's a Disease. It Seems To Encourage Bad Behavior.'
by Peter Reutemann 03 Apr '19

03 Apr '19

'From a wide-ranging interview of Linus Torvalds with Linux Journal on the magazine's 25th anniversary: Linux Journal: If you had to fix one thing about the networked world, what would it be? Linus: Nothing technical. But, I absolutely detest modern "social media" -- Twitter, Facebook, Instagram. It's a disease. It seems to encourage bad behavior. I think part of it is something that email shares too, and that I've said before: "On the internet, nobody can hear you being subtle". When you're not talking to somebody face to face, and you miss all the normal social cues, it's easy to miss humor and sarcasm, but it's also very easy to overlook the reaction of the recipient, so you get things like flame wars, etc., that might not happen as easily with face-to-face interaction. But email still works. You still have to put in the effort to write it, and there's generally some actual content (technical or otherwise). The whole "liking" and "sharing" model is just garbage. There is no effort and no quality control. In fact, it's all geared to the reverse of quality control, with lowest common denominator targets, and click-bait, and things designed to generate an emotional response, often one of moral outrage. Add in anonymity, and it's just disgusting. When you don't even put your real name on your garbage (or the garbage you share or like), it really doesn't help. I'm actually one of those people who thinks that anonymity is overrated. Some people confuse privacy and anonymity and think they go hand in hand, and that protecting privacy means that you need to protect anonymity. I think that's wrong. Anonymity is important if you're a whistle-blower, but if you cannot prove your identity, your crazy rant on some social-media platform shouldn't be visible, and you shouldn't be able to share it or like it. Linux Journal: Is there any advice you'd like to give to young programmers/computer science students? Linus: I'm actually the worst person to ask. I knew I was interested in math and computers since an early age, and I was largely self-taught until university. And everything I did was fairly self-driven. So I don't understand the problems people face when they say "what should I do?" It's not where I came from at all.' -- source: https://tech.slashdot.org/story/19/04/03/1829244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How (Not) To Damage A Flash Storage Device
by Lawrence D'Oliveiro 02 Apr '19

02 Apr '19

Came across this article <http://wiki.laptop.org/go/How_to_Damage_a_FLASH_Storage_Device> on the OLPC wiki about some of the things to beware of when reformatting a flash device (USB stick or SD card -- what about SSDs?). Basically, if there is a mismatch between the blocking of data at the filesystem level and the device page size, then you could be increasing the number of hardware-level writes by a factor of 2 or more. This leads to a corresponding reduction in the life of the device.

1 0

Mozilla Will Run Two Experiments This Month With Firefox To Explore Ways To Fight Push Notification Permission Spam
by Peter Reutemann 02 Apr '19

02 Apr '19

'Mozilla said this week that it intends to run two experiments over the course of this month to determine the most adequate way of dealing with push notification spam, a growing problem that is slowly deteriorating the web experience for everyone. From a report: The experiments will run in Firefox Nightly (v68) and Firefox Beta (v67). The Firefox Nightly experiment will run from April 1 to April 29. During this time, Mozilla said Firefox Nightly would only allow websites to show a push notification permission only after the user has clicked or pressed a key while on a website. All attempts to show a push notification permission request before a click or key press will be blocked by default. [...] In the last two weeks of the experiment, Firefox will show an icon in the URL bar, but with no visible popup on the page. Users can click this icon and accept any push notification permission requests if they wish so.' -- source: https://news.slashdot.org/story/19/04/02/1941232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Introducing Google Tulip
by Ian Stewart 02 Apr '19

02 Apr '19

For those of you with two minutes to spare, here<https://www.youtube.com/watch?v=nsPQvZm_rgM> is a video clip introducing the Google Tulip product which was released on 1st April 2019.

2 1

Linux Mint 19.2 'Tina' is On the Way, But the Developers Seem Defeated and Depressed
by Peter Reutemann 02 Apr '19

02 Apr '19

'Brian Fagioli, reporting for BetaNews: Today should be happy times for the Linux Mint community, as we finally learn some new details about the upcoming version 19.2! It will be based on Ubuntu 18.04 and once again feature three desktop environments -- Xfce, Mate, and Cinnamon. We even found out the code name for Linux Mint 19.2 -- "Tina." And yet, it is hard to celebrate. Why? Because the developers seem to be depressed and defeated. They even appear to be a bit disenchanted with Free Software development overall. Clement Lefebvre, leader of the Linux Mint project, shared a very lengthy blog post today, and it really made me sad. He wrote, "For a team to work, developers need to feel like heroes. They want the same things as users, they are users, they were 'only' users to start with. At some stage they decide to get involved and they start investing time, efforts and emotions into improving our project. What they're looking for the most is support and happiness. They need feedback and information to understand bugs or feature requests and when they're done implementing something, they need to feel like heroes, they literally do, that's part of the reason they're here really." Upon publication of the article, Jason Hicks, Muffin maintainer and member of the Linux Mint team, corroborated the claims made by others.' -- source: https://linux.slashdot.org/story/19/04/02/1359246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SUSE Will Soon Be the Largest Independent Linux Company
by Peter Reutemann 02 Apr '19

02 Apr '19

'At SUSECon in Nashville, Tennessee, European Linux power SUSE CEO Nils Brauckmann said his company would soon be the largest independent Linux company. "That's because, of course, IBM is acquiring Red Hat," reports ZDNet. "But, simultaneously, SUSE has continued to grow for seven-straight years." From the report: Brauckmann said, "We believe that makes our status as a truly independent open source company more important than ever. Our genuinely open-source solutions, flexible business practices, lack of enforced vendor lock-in, and exceptional service are more critical to customer and partner organizations, and our independence coincides with our single-minded focus on delivering what is best for them." Practically speaking, SUSE has been growing by focusing on delivering high-quality Linux and open-source programs and services to enterprise customers. Looking ahead Brauckmann said, "SUSE is better positioned to bring more innovation to customers and partners faster through both organic growth and acquisitions, keeping us on track to provide them with the open solutions that keep them ahead with their own customers in their own markets. We continue to adapt so our customers and partners can succeed." Last year SUSE's revenue grew by 15 percent in fiscal year 2018, and the business is about to surpass the $400 million revenue mark for the first time. SUSE, which sees not quite half of its business in Europe, is also seeing revenue growth around the world. North America, for example, now accounts for almost 40 percent of SUSE's revenues. The company is also expanding. SUSE added more than 300 employees in the last 12 months. For the most part this has been in engineering followed by sales and services. SUSE staff is now approaching 1,750 globally and its plans on continuing to hire aggressively. ' -- source: https://news.slashdot.org/story/19/04/01/222245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Sway – Tiling Window Manager Specially Crafted for Wayland
by Peter Reutemann 01 Apr '19

01 Apr '19

'Tiling window managers are popular lightweight alternatives to full desktop environments, especially among power users. Recently, a newer window manager reached its 1.0 release. This window manager, named Sway, is designed solely for systems that can use Wayland).' -- source: https://itsfoss.com/sway-window-manager/ Funny that, only came across Sway at the last meeting. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Devuan.org Now Points To 'Pwned' Page With Gopher URLs
by Peter Reutemann 31 Mar '19

31 Mar '19

'"DEVUAN.ORG HAS BEEN PWNED" reads a new message at the home page for Devuan (a fork of Debian without systemd) -- which re-redirects to a new page named pwned.html, reports Slashdot reader DevNull127: In all capital letters, its carefully-indented message (complete with an ascii-art logo) now informs visitors that "the web sucks -- JavaScript sucks -- browsers suck." Posting the URLs to several gopher sites, it adds that "Gopher is the way -- gopher is the future." "Kiss port 80 goodbye. Join the revolution on port 70." The attackers identify themselves as "Green Hat Hackers," a term generally understood to mean ambitious newbie hackers who want to improve their skills. "Stop the madness," continues their message, which appeared just hours before the first day of April. "Get yourself a gopher client."' -- source: https://idle.slashdot.org/story/19/03/31/212227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

File-transfer Android to Linux using rsync
by tom butz 31 Mar '19

31 Mar '19

1 0

Fwd: File-transfer between Android amd Linux using rsync
by tom butz 31 Mar '19

31 Mar '19

HOW TO TRANSFER FILES FROM ANDROID-PDA TO LINUX-LAPTOP ====================================================== I'm running Android 7.1 on an OPPO A73 phone/PDA, and sometimes need to transfer photos and other files to a laptop running Linux Mint 19.1. Steps required on the PDA: 1) install termux from Android PlayStore 2) install rsync (in termux, type: pkg install rsync) 3) install perl (in termux, type: pkg install perl) 4) in termux, type: termux-setup-storage (also automatically creates links) 5) in termux, type: cd storage, then type: ls to see the following directories: dcim: photos/videos taken with the PDA downloads: stuff you downloaded movies: music: pictures: shared: everything (includes the above directories) In the following examples we will use /dcim/ and /downloads/: oppopictures.prl ================ In termux, type: perl system "rsync -av /sdcard/DCIM/ username_on_laptop\@1.2.3.4:/oppo_pictures/" This will transfer photos (*.jpg) and videos (*.mp4) to /oppo_pictures/Camera/, and screenshots to /oppo_pictures/Screenshots/. Directory /oppo/pictures/ must exist on the laptop and grant world-access (chmod 777). Ignore rsync error-messages regarding file-attributes. oppodownloads.prl ================= In termux, type: perl system "rsync -av /storage/downloads/ username_on_laptop\@1.2.3.4:/oppo_downloads/" This will transfer files to /oppo_downloads/. Directory /oppo_downloads/ must exist on laptop and grant world-access (chmod 777). Ignore rsync error-messages regarding file-attributes. NOTE: REPLACE the numbers 1.2.3.4 in the above examples with your laptop's IP-address (as provided by your IP-router). Get them using ifconfig. Theoretically you could do the above using the /shared/ directory to get a copy of Android-files.

1 0

Researchers Find 36 New Security Flaws In LTE Protocol
by Peter Reutemann 28 Mar '19

28 Mar '19

'A group of academics from South Korea have identified 36 new vulnerabilities in the Long-Term Evolution (LTE) standard used by thousands of mobile networks and hundreds of millions of users across the world. The vulnerabilities allow attackers to disrupt mobile base stations, block incoming calls to a device, disconnect users from a mobile network, send spoofed SMS messages, and eavesdrop and manipulate user data traffic. They were discovered by a four-person research team from the Korea Advanced Institute of Science and Technology Constitution (KAIST), and documented in a research paper they intend to present at the IEEE Symposium on Security and Privacy in late May 2019. The Korean researchers said they found 51 LTE vulnerabilities, of which 36 are new, and 15 have been first identified by other research groups in the past. They discovered this sheer number of flaws by using a technique known as fuzzing --a code testing method that inputs a large quantity of random data into an application and analyzes the output for abnormalities, which, in turn, give developers a hint about the presence of possible bugs. The resulting vulnerabilities, see image below or this Google Docs sheet, were located in both the design and implementation of the LTE standard among the different carriers and device vendors. The KAIST team said it notified both the 3GPP (industry body behind LTE standard) and the GSMA (industry body that represents mobile operators), but also the corresponding baseband chipset vendors and network equipment vendors on whose hardware they performed the LTEFuzz tests.' -- source: https://it.slashdot.org/story/19/03/28/2035257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ASUS Releases Fix For ShadowHammer Malware Attack
by Peter Reutemann 26 Mar '19

26 Mar '19

'ASUS may have inadvertently pushed malware to some of its computers through its update tool, but it at least it has a fix ready to go. The PC maker has released a new version of its Live Update software for laptops that addresses the ShadowHammer backdoor attack. It also promised "multiple security verification mechanisms" to reduce the chances of further attacks, and started using an "enhanced end-to-end encryption mechanism." There are upgrades to the behind-the-scenes server system to prevent future attacks, ASUS added. The company simultaneously reiterated the narrow scope of ShadowHammer, noting that the malware targeted a "very small and specific user group." It's believed to be an Advanced Persistent Threat -- that is, a state-backed assault against organizations rather than everyday users. Other ASUS devices weren't affected, according to a notice. While the fix is reassuring, it also raises questions as to why the systems weren't locked down earlier. Update tools are prime targets for hackers precisely because they're both trusted and have deep access to the operating system -- tight security is necessary to prevent an intruder from hijacking the process.' -- source: https://hardware.slashdot.org/story/19/03/26/2025229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Refuse To Be Terrorized
by Lawrence D'Oliveiro 26 Mar '19

26 Mar '19

I have written up some thoughts about those horrible happenings in Christchurch today. You can read them here <https://default-cube.deviantart.com/journal/Refuse-To-Be-Terrorized-Christc…>. I hope we learn the right lessons from others who have been here before us, and not repeat too many of their mistakes.

1 2

Firefox Lockbox Comes To Android To Ease Password Pain
by Peter Reutemann 26 Mar '19

26 Mar '19

'If you're a Firefox true believer, or even just a Firefox user, your password struggles just got a little easier with the release of Firefox Lockbox for Android devices. From a report: The password manager, based on login information already in Firefox, makes it easier to sign into apps as well. It integrates with login autocomplete systems in both Apple's iOS and Google's Android software, Mozilla said. It's not as fancy as password managers like LastPass, BitWarden, 1Password and Dashlane, and the only browser it works with is Firefox. On the other hand, if you're already in the Firefox world, it's basically already set up for you. There's no migration process as with dedicated password managers.' -- source: https://news.slashdot.org/story/19/03/26/1559243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Makes Emails More Dynamic With AMP For Email
by Peter Reutemann 26 Mar '19

26 Mar '19

'Google today officially launched AMP for Email, its effort to turn emails from static documents into dynamic, web page-like experiences. >From a report: AMP for Email is coming to Gmail, but other major email providers like Yahoo Mail, Outlook and Mail.ru will also support AMP emails. It's been more than a year since Google first announced this initiative. Even by Google standards, that's a long incubation phase, though there's also plenty of backend work necessary to make this feature work. The promise of AMP for Email is that it'll turn basic messages into a surface for actually getting things done. "Over the past decade, our web experiences have changed enormously -- evolving from static flat content to interactive apps -- yet email has largely stayed the same with static messages that eventually go out of date or are merely a springboard to accomplishing a more complex task," Gmail product manager Aakash Sahney writes. "If you want to take action, you usually have to click on a link, open a new tab, and visit another website." With AMP for Email, those messages become interactive. That means you'll be able to RSVP to an event right from the message, fill out a questionnaire, browse through a store's inventory or respond to a comment -- all without leaving your web-based email client.' -- source: https://tech.slashdot.org/story/19/03/26/1838254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Users' Security and Privacy At Risk From Shadowy Ecosystem of Pre-Installed Software, Study Warns
by Peter Reutemann 25 Mar '19

25 Mar '19

'Researchers behind a large-scale independent study of pre-installed Android apps "unearthed a complex ecosystem of players with a primary focus on advertising and 'data-driven services' -- which they argue the average Android user is likely to be unaware of (while also likely lacking the ability to uninstall/evade the baked in software's privileged access to data and resources themselves)," reports TechCrunch. From the report: The study, which was carried out by researchers at the Universidad Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) at Berkeley (USA) and Stony Brook University of New York (US), encompassed more than 82,000 pre-installed Android apps across more than 1,700 devices manufactured by 214 brands, according to the IMDEA institute. "The study shows, on the one hand, that the permission model on the Android operating system and its apps allow a large number of actors to track and obtain personal user information," it writes. "At the same time, it reveals that the end user is not aware of these actors in the Android terminals or of the implications that this practice could have on their privacy. Furthermore, the presence of this privileged software in the system makes it difficult to eliminate it if one is not an expert user." In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."' -- source: https://tech.slashdot.org/story/19/03/25/2058215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Fixes Chrome 'Evil Cursor' Bug Abused by Tech Support Scam Sites
by Peter Reutemann 25 Mar '19

25 Mar '19

'Google has patched a Chrome bug that was being abused in the wild by tech support scammers to create artificial mouse cursors and lock users inside browser pages by preventing them from closing and leaving browser tabs. From a report: The trick was first spotted in September 2018 by Malwarebytes analyst Jerome Segura. Called an "evil cursor," it relied on using a custom image to replace the operating system's standard mouse cursor graphic. A criminal group that Malwarebytes called Partnerstroka operated by switching the standard OS 32-by-32 pixels mouse cursor with one of 128 or 256 pixels in size. A normal cursor would still appear on screen, but in the corner of a bigger transparent bounding box. [...] The "evil cursor" fix is currently live for Google Canary users, and is scheduled to land in the Chrome 75 stable branch, to be released later this spring.' -- source: https://tech.slashdot.org/story/19/03/25/210220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Telegram Adds 'Delete Everywhere' Nuclear Option -- Killing Chat History
by Peter Reutemann 25 Mar '19

25 Mar '19

'Instant messaging service Telegram has added a feature that lets a user delete messages in one-to-one and/or group private chats, after the fact, and not only from their own inbox. From a report: The new 'nuclear option' delete feature allows a user to selectively delete their own messages and/or messages sent by any/all others in the chat. They don't even have to have composed the original message or begun the thread to do so. They can just decide it's time. Let that sink in. All it now takes is a few taps to wipe all trace of a historical communication -- from both your own inbox and the inbox(es) of whoever else you were chatting with (assuming they're running the latest version of Telegram's app).' -- source: https://tech.slashdot.org/story/19/03/25/1641204 Something that WhatsApp could add as well... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Hackers Hijacked ASUS Software Updates To Install Backdoors on Thousands of Computers
by Peter Reutemann 25 Mar '19

25 Mar '19

'ASUS is believed to have pushed malware to hundreds of thousands of customers through its trusted automatic software update tool after attackers compromised the company's server and used it to push the malware to machines. From a report: Researchers at cybersecurity firm Kaspersky Lab say that ASUS, one of the world's largest computer makers, was used to unwittingly to install a malicious backdoor on thousands of its customers' computers last year after attackers compromised a server for the company's live software update tool. The malicious file was signed with legitimate ASUS digital certificates to make it appear to be an authentic software update from the company, Kaspersky Lab says. ASUS, a multi-billion dollar computer hardware company based in Taiwan that manufactures desktop computers, laptops, mobile phones, smart home systems, and other electronics, was pushing the backdoor to customers for at least five months last year before it was discovered, according to new research from the Moscow-based security firm. The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses. Once on a system, if it found one of these targeted addresses, the malware reached out to a command-and-control server the attackers operated, which then installed additional malware on those machines. Kaspersky Lab said it uncovered the attack in January after adding a new supply-chain detection technology to its scanning tool to catch anomalous code fragments hidden in legitimate code or catch code that is hijacking normal operations on a machine. The company plans to release a full technical paper and presentation about the ASUS attack, which it has dubbed ShadowHammer, next month at its Security Analyst Summit in Singapore' -- source: https://yro.slashdot.org/story/19/03/25/144248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

topic for meeting this month?
by Peter Reutemann 24 Mar '19

24 Mar '19

Hi everyone Anyone got a topic that they'd like to present on? Any interesting open-source software that they've come across and would like to demo for a few minutes? Linux distro roundup? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Two serious WordPress plugin vulnerabilities are being exploited in the wild
by Peter Reutemann 24 Mar '19

24 Mar '19

'Attackers have been actively exploiting serious vulnerabilities in two widely used WordPress plugins to compromise websites that run the extensions on top of the content management system. The two affected plugins are Easy WP SMTP with 300,000 active installations and Social Warfare, which has about 70,000 active installations. While developers have released patches for both exploited flaws, download figures indicate many vulnerable websites have yet to install the fixes. Figures for Easy WP SMTP, which was fixed five days ago, show the plugin has just short of 135,000 downloads in the past seven days. Figures for Social Warfare show it has been downloaded fewer than 20,000 times since a patch was published on WordPress on Friday. Sites that use either plugin should disable them immediately and then ensure they have been updated to version 1.3.9.1 of Easy WP SMTP and 3.5.3 of Social Warfare.' -- source: https://arstechnica.com/information-technology/2019/03/two-serious-wordpres… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stallman Suggests Install Fest 'Deals With Devil' Include Actual Man Dressed As Devil
by Peter Reutemann 24 Mar '19

24 Mar '19

'This weekend's annual LibrePlanet conference, hosted by the Free Software Foundation, prompted a new essay about "install fests" from Richard Stallman: Install fests invite users to bring their computers so that experts can install GNU/Linux on them... The problem is that most computers can't run with a completely free GNU/Linux distro. They contain peripherals, or coprocessors, that won't operate unless the installed system contains some nonfree drivers or firmware... This presents the install fest with a dilemma. If it upholds the ideals of freedom, by installing only free software from 100%-free distros, partly-secret machines won't become entirely functional and the users that bring them will go away disappointed. However, if the install fest installs nonfree distros and nonfree software which make machines entirely function, it will fail to teach users to say no for freedom's sake. They may learn to like GNU/Linux, but they won't learn what the free software movement stands for.... In effect, the install fest makes the deal with the devil, on the user's behalf, behind a curtain so the user doesn't recognize that it is one. I propose that the install fest show users exactly what deal they are making. Let them talk with the devil individually, learn the deal's bad implications, then make a deal -- or refuse! As always, I call on the install fest itself to install only free software, taking a strict stance. In this way it can set a clear moral example of rejecting nonfree software. My new idea is that the install fest could allow the devil to hang around, off in a corner of the hall, or the next room. (Actually, a human being wearing a sign saying "The Devil," and maybe a toy mask or horns.) The devil would offer to install nonfree drivers in the user's machine to make more parts of the computer function, explaining to the user that the cost of this is using a nonfree (unjust) program... Those users that get nonfree drivers would see what their moral cost is, and that there are people in the community who refuse to pay that cost. They would have the chance to reflect afterwards on the situation that their flawed computers have put them in, and about how to change that situation, in the small and in the large. Stallman adds that the Free Software Foundation itself would never let a devil near its events. "But given the fact that most install fests quietly play the role of the devil, I think that an explicit devil would be less bad. "It would convert the install-fest dilemma from a debilitating contradiction into a teaching experience."' -- source: https://news.slashdot.org/story/19/03/23/1624242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play Store Mistakenly Removed KDE Connect
by Peter Reutemann 24 Mar '19

24 Mar '19

'Google's Play Store made a bad mistake on Tuesday, long-time Slashdot reader sombragris writes: KDE Connect, a project designed to enable seamless communcation and control between a desktop computer and a mobile phone, was suddenly removed from Android's Google Play store. According to a Twitter thread by Albert Vaca, KDE Connect's maintainer, the removal was allegedly because the app was in breach of Google's new SMS policy. There's an exemption which applies to KDE Connect, but the maintainer was unable to contact anyone at Google to provide support. "There is simply no way to talk to a human being at @Google", he said. Cintora also announced on Twitter that while trying to comply with the Play Store's new policy, he'd initially been stopped again by technical problems. "The @GooglePlay console gives me an internal error, so I can't upload the version without SMS support." But on Thursday Cintora tweeted that KDE Connect "finally got approved, and SMS support is back in version 1.12.4, both on the Play Store and F-Droid!" Cintora credits this resolution partly to his Twitter thread, which got over half a million impressions. Its last tweet now features a picture of a celebrating parrot.' -- source: https://tech.slashdot.org/story/19/03/23/1852220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Share Buybacks
by Lawrence D'Oliveiro 23 Mar '19

23 Mar '19

Seems that Oracle has been buying back its own shares to keep its share price high <https://www.theregister.co.uk/2019/03/22/oracle_buyback_programme/>. On its own, this is not automatically a bad thing. I remember reading about a conversation between Steve Jobs and Warren Buffett some years ago, along the lines of: WB: You think your company shares are undervalued? SJ: Yes. WB: You have plenty of spare cash on hand? SJ: Yes. WB: Then use some of that cash to buy back some of your own shares. If you can spend 80¢ and get a dollar, why wouldn’t you? However, the warning sign in the above article is this: The overall effect is that Oracle is now in a net debt position for the first time since 2008, the Wall Street Journal reported this week. In other words, it seems to be borrowing in order to boost its share price. This might not end well ...

2 1

Tor-Powered Tails 3.13 Anonymous Linux OS Adds Extra Security and Latest Updates
by Peter Reutemann 21 Mar '19

21 Mar '19

'Powered by the Linux 4.19.28 kernel, the Tails 3.13 operating system is now available with latest TOR technologies to help you stay hidden while surfing the Internet, including the Tor Browser 8.0.7 anonymous web browser and Tor 0.3.5.8 client and server for the anonymous Tor network. However, probably the most important addition in the Tails 3.13 release is the updated Intel microcode to version 3.20180807a.2, which adds an extra security measure against more variants of the well-known Spectre, Meltdown, and L1TF (Level 1 Terminal Fault) security vulnerabilities. Furthermore, Tails 3.13 updates the Mozilla Thunderbird email and news client to version 65.1.0, adds support for the Bopomofo input method and improves support for the Pinyin input method for Chinese users, and implements automatic backup of the persistent storage's configuration whenever a change occurs.' -- source: https://news.softpedia.com/news/tor-powered-tails-3-13-ethical-hacking-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

For Years, Hundreds of Millions of Facebook Users Had Their Account Passwords Stored in Plain Text and Searchable By Thousands of Facebook Employees
by Peter Reutemann 21 Mar '19

21 Mar '19

'Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees -- in some cases going back to 2012, KrebsOnSecurity reported Thursday. From the report: Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data. Facebook is probing the causes of a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers. That's according to a senior Facebook employee who is familiar with the investigation and who spoke on condition of anonymity because they were not authorized to speak to the press. The Facebook source said the investigation so far indicates between 200 million and 600 million Facebook users may have had their account passwords stored in plain text and searchable by more than 20,000 Facebook employees. The source said Facebook is still trying to determine how many passwords were exposed and for how long, but so far the inquiry has uncovered archives with plain text user passwords in them dating back to 2012.' -- source: https://yro.slashdot.org/story/19/03/21/1525243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGM next week
by Peter Reutemann 19 Mar '19

19 Mar '19

Hi everyone Just a reminder for our (paying) society members that our SGM is on next Monday at 7pm: https://www.meetup.com/WaikatoLinuxUsersGroup/events/259341905/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a wireless keyboard lets hackers take full control of connected computers
by Peter Reutemann 19 Mar '19

19 Mar '19

'There’s a critical vulnerability in a model of Fujitsu wireless keyboard that makes it easy for hackers to take full control of connected computers, security researchers warned on Friday. Anyone using the keyboard model should strongly consider replacing it immediately. The Fujitsu Wireless Keyboard Set LX901 uses a proprietary 2.4 GHz radio communication protocol called WirelessUSB LP from Cypress Semiconductor. While the keyboard and mouse send input that’s protected with the time-tested Advanced Encryption Standard, the USB dongle that accepts the input accepts unencrypted packets as well, as long as they’re in the proper format. Researchers with the Germany-based penetration-testing firm SySS developed a proof-of-concept attack that exploits the insecure design. Using a small hardware device, they are able to send commands to vulnerable Fujitsu keyboard receiver dongles that are within range. As the video below demonstrates, the researchers were able to send input of their choice that’s automatically funneled to the connected computer.' -- source: https://arstechnica.com/information-technology/2019/03/how-a-wireless-keybo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0