- wlug - list.wlug.org.nz

National Oracle System Is A Write-Off
by Lawrence D'Oliveiro 10 Dec '18

10 Dec '18

Looks like the nationwide attempt to streamline and update the IT systems of all the DHBs is now going to be written off <https://www.theregister.co.uk/2018/12/10/national_oracle_solution_write_dow…>. It hasn’t officially been abandoned, mind you, but because it’s been “on hold” for so long, the DHBs are now obliged to start recording “impairments” in their accounts over their investment in the system. By the way, the Waikato DHB was one of the four that managed a rollout of the system so far. Not sure whether that stays in place or gets rolled back...

1 0

How to Auto Backup Files to USB Media When Connected
by Peter Reutemann 10 Dec '18

10 Dec '18

'A backup is the last defense against data loss, offering a means to restore original data. You can use either a removable media such as an external hard drive or USB flash disk or a shared network folder, or a remote host to back up your data. It’s very easy (and equally essential) to automatically backup your important files without you having to remember to do so. In this article, we will learn how to auto backup data to a removable media after connecting it to your Linux machine. We will test with an external disk. This is a basic guide to get you started with using udev for real-life solutions.' -- source: https://www.tecmint.com/auto-backup-files-to-usb-media-in-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Linux.org's DNS Got Hijacked
by Peter Reutemann 09 Dec '18

09 Dec '18

'Linux.org reports: Wednesday afternoon around 5pm EST someone was able to get into the registrar account for our domain and point DNS to another server -- as well as lock us out from changing it. They pointed the domain name to a pretty rude page for most of the evening until Cloudflare stepped in and blocked the domain for us. After a lot of back and forth with our registrar, we were able to get things back under our control. I'd like to point out that our server environment was not touched so there are no worries about your data. We've gone over security protocols and are tightening things up that may have slipped through in the past. Thanks for your support! Linux.org apparently pointed to a page exclaiming "G3T 0WNED L1NUX N3RDZ", which also included a NSFW picture, some abusive language, a shout-out to recently-deceased programmer Terry Davis, and a link to an article about Linus Torvalds' controversial apology for "his hostile behavior towards others in the community." Long-time Slashdot reader Grady Martin says he also saw the page pointing to "presumably doxed info" about the creator of Linux's code of conduct, a fact confirmed by a report in the Register. "As for how it was hacked, [Linux.org owner Mike] McLagan blames the public Whois displaying his partner's email address -- presumably the hacker worked their way into the Yahoo email account listed as the admin of the site and from there requested a password change in her Network Solutions account to gain access to the domain."' -- source: https://it.slashdot.org/story/18/12/08/0355227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

50 Years Since “The Mother Of All Demos”
by Lawrence D'Oliveiro 08 Dec '18

08 Dec '18

On the 9th of December 1968, Doug Engelbart did a demo of NLS, his system for real-time interactive collaboration at a distance. This was also the first known use of a computer mouse. <https://www.techdirt.com/articles/20181207/15484041180/been-50-years-take-s…>

1 0

Running Linux Mint 19.1
by tom butz 07 Dec '18

07 Dec '18

Linux Mint 19.1 works well using my laptop (Toshiba Z930 6 GB RAM) and a USB3 connection to a 500G USB3-harddisk. I first tried a fast 10-speed 64GB SD-card, but that actually seemed to be slower - and the SD-card would have worn out in the end. For some reason Mint has got a swapFILE in the root directory - pretty hard on the SD-card. I haven't got USB3.1 (yet). 19.1 supports Bluetooth in both directions: under Mint 19, I couldn't send from Mint to my Android phone (Android 7.1) 19.1 also features snapshots. I didn't have to test them as I prefer to run Mint off my laptop (no power-cuts there). Occasionally I run it off my MacMini (8 GB of RAM, OS 10.7.5). The MacOS is too old for many things, and to avoid having to buy new Mac gear, I 'upgraded' by running Mint on it. Tom Butz.

3 2

Report: Microsoft is scrapping Edge, switching to just another Chrome clone
by Peter Reutemann 06 Dec '18

06 Dec '18

'Windows Central reports that Microsoft is planning to replace its Edge browser, which uses Microsoft's own EdgeHTML rendering engine and Chakra JavaScript engine, with a new browser built on Chromium, the open source counterpart to Google's Chrome. The new browser has the codename Anaheim. The report is short on details. The easiest thing for Microsoft to do would be to use Chromium's code wholesale—the Blink rendering engine, the V8 JavaScript engine, and the Chrome user interface with the Google Account parts omitted—to produce something that looks, works, and feels almost identical to Chrome. Alternatively, Redmond could use Blink and V8 but wrap them in Edge's user interface (or some derivative thereof), to retain its own appearance. It might even be possible to do something weird, such as use Blink with the Chakra JavaScript engine. We'll have to wait and see.' -- source: https://arstechnica.com/gadgets/2018/12/report-microsoft-is-scrapping-edge-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

White House Cybersecurity Advisor Gets Hacked
by Lawrence D'Oliveiro 05 Dec '18

05 Dec '18

Rudy Giuliani, the White House cybersecurity advisor, has posted a tweet <https://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=12172128> <https://www.techdirt.com/articles/20181205/07205841164/rudy-giulianis-paran…> where he meant to say “... just as the President left for G-20. In July...” Unfortunately he left out the space in “G-20. In”, turning it into “G-20.In”, which Twitter automatically formatted as a link. Someone noticed that the domain name in question was available, and promptly snapped it up and used it to post an anti-Trump message. This has made Mr Giuliani somewhat angry. He has tried to blame Twitter for the slipup, claiming the social media service “allowed someone to invade my text with a disgusting anti-President message”, as though he was not the one who created the link in the first place. Remember, this man has the job of advising the entire executive arm of the US government on keeping people’s computer usage secure. I wonder if he’s figured out how to delete a tweet yet?

1 0

Google Personalizes Search Results Even When You're Logged Out, a DuckDuckGo Study Finds
by Peter Reutemann 05 Dec '18

05 Dec '18

'According to a new study conducted by Google competitor DuckDuckGo, it does not seem possible to avoid personalization when using Google search, even by logging out of your Google account and using the private browsing "incognito" mode. From a report: DuckDuckGo conducted the study in June of this year, at the height of the US midterm election season. It did so with the ostensible goal of confirming whether Google's search results exacerbate ideological bubbles by feeding you only information you've signaled you want to consume via past behavior and the data collected about you. It's not clear whether that question can be reliably answered with these findings, and it's also obvious DuckDuckGo is a biased source with something to gain by pointing out how flawed Google's approach may be. But the study's findings are nonetheless interesting because they highlight just how much variance there are in Google search results, even when controlling for factors like location.' -- source: https://search.slashdot.org/story/18/12/04/1610237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kubernetes' First Major Security Hole Discovered
by Peter Reutemann 05 Dec '18

05 Dec '18

'Kubernetes has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered. And the bug, CVE-2018-1002105, aka the Kubernetes privilege escalation flaw, is a doozy. It's a CVSS 9.8 critical security hole. From a report: With a specially crafted network request, any user can establish a connection through the Kubernetes application programming interface (API) server to a backend server. Once established, an attacker can send arbitrary requests over the network connection directly to that backend. Adding insult to injury, these requests are authenticated with the Kubernetes API server's Transport Layer Security (TLS) credentials. Can you say root? I knew you could. Worse still, "In default configurations, all users (authenticated and unauthenticated) are allowed to perform discovery API calls that allow this escalation." So, yes, anyone who knows about this hole can take command of your Kubernetes cluster.' -- source: https://it.slashdot.org/story/18/12/04/1958222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers breach Quora.com and steal password data for 100 million users
by Peter Reutemann 04 Dec '18

04 Dec '18

'Brace yourself for yet another massive data breach. Quora.com, a site where people ask and answer questions on a range of topics, said hackers breached its computer network and accessed a variety of potentially sensitive personal data for about 100 million users. Compromised information includes cryptographically protected passwords, full names, email addresses, data imported from linked networks, and a variety of non-public content and actions, including direct messages, answer requests, and downvotes. The breached data also included public content and actions, such as questions, answers, comments, and upvotes. In a post published late Monday afternoon, Quora officials said they discovered the unauthorized access on Friday. They have since hired a digital forensics and security firm to investigate and have also reported the breach to law enforcement officials.' -- source: https://arstechnica.com/information-technology/2018/12/quora-says-hackers-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blockchain Study Finds 0% Success Rate and Vendors Don't Call Back When Asked For Evidence
by Peter Reutemann 04 Dec '18

04 Dec '18

'Though Blockchain has been touted as the answer to everything, a study of 43 solutions advanced in the international development sector has found exactly no evidence of success. From a report: Three practitioners including erstwhile blockchain enthusiast John Burg, a Fellow at the US Agency for International Development (USAID), looked at instances of the distributed crypto ledger being used in a wide range of situations by NGOs, contractors and agencies. But they drew a complete blank. "We found a proliferation of press releases, white papers, and persuasively written articles," Burg et al wrote. "However, we found no documentation or evidence of the results blockchain was purported to have achieved in these claims. We also did not find lessons learned or practical insights, as are available for other technologies in development." Blockchain vendors were keen to puff the merits of the technology, but when the three asked for proof of success in the field, it all went very quiet. "We fared no better when we reached out directly to several blockchain firms, via email, phone, and in person. Not one was willing to share data on program results, MERL [monitoring, evaluation, research and learning] processes, or adaptive management for potential scale-up. Despite all the hype about how blockchain will bring unheralded transparency to processes and operations in low-trust environments, the industry is itself opaque." Burg was an enthusiastic advocate for blockchain until recently -- as he explained in this Medium post.' -- source: https://news.slashdot.org/story/18/12/03/2058244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Twitter User Hacks 50, 000 Printers To Tell People To Subscribe To a YouTube Channel
by Peter Reutemann 03 Dec '18

03 Dec '18

'A Twitter user using the pseudonym of @TheHackerGiraffe has hacked over 50,000 printers to print out flyers telling people to subscribe to PewDiePie's YouTube channel. The message the printers received was a simple one. It urged people to subscribe to PewDiePie's YouTube channel in order for PewDiePie -- a famous YouTuber from Sweden, real name Felix Kjellberg -- to keep the crown of most subscribed to YouTube channel. If this sounds ...odd... it's because over the past month, an Indian record label called T-Series has caught up and surpassed PewDiePie, once considered untouchable in terms of YouTube followers. The Swedish Youtube star made a comeback after his fans banded together in various social media campaigns, but T-Series is catching up with PewDiePie again.' -- source: https://hardware.slashdot.org/story/18/12/02/2241230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Linux Taking Over The World?
by Peter Reutemann 02 Dec '18

02 Dec '18

'"2019 just might be the Year of Linux -- the year in which Linux is fully recognized as the powerhouse it has become," writes Network World's "Unix dweeb." The fact is that most people today are using Linux without ever knowing it -- whether on their phones, online when using Google, Facebook, Twitter, GPS devices, and maybe even in their cars, or when using cloud storage for personal or business use. While the presence of Linux on all of these systems may go largely unnoticed by consumers, the role that Linux plays in this market is a sign of how critical it has become. Most IoT and embedded devices -- those small, limited functionality devices that require good security and a small footprint and fill so many niches in our technology-driven lives -- run some variety of Linux, and this isn't likely to change. Instead, we'll just be seeing more devices and a continued reliance on open source to drive them. According to the Cloud Industry Forum, for the first time, businesses are spending more on cloud than on internal infrastructure. The cloud is taking over the role that data centers used to play, and it's largely Linux that's making the transition so advantageous. Even on Microsoft's Azure, the most popular operating system is Linux. In its first Voice of the Enterprise survey, 451 Research predicted that 60 percent of nearly 1,000 IT leaders surveyed plan to run the majority of their IT off premises by 2019. That equates to a lot of IT efforts relying on Linux. Gartner states that 80 percent of internally developed software is now either cloud-enabled or cloud-native. The article also cites Linux's use in AI, data lakes, and in the Sierra supercomputer that monitors America's nuclear stockpile, concluding that "In its domination of IoT, cloud technology, supercomputing and AI, Linux is heading into 2019 with a lot of momentum." And there's even a long list of upcoming Linux conferences...' -- source: https://linux.slashdot.org/story/18/12/01/2018223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Node.js Event-Stream Hack Reveals Open Source 'Developer Infrastructure' Exploit
by Peter Reutemann 02 Dec '18

02 Dec '18

'"[O]n Nov. 26 it was publicly revealed that a widely deployed open-source Node.js programming language module known as event-stream had been injected with malicious code that looked to steal cryptocurrency wallets," reports eWeek, adding "The event-stream library has over two million downloads." An anonymous reader quotes Ars Technica: The backdoor came to light [November 20th] with this report from Github user Ayrton Sparling. Officials with the NPM, the open source project manager that hosted event-stream, didn't issue an advisory until six days later.... "This compromise was not targeting module developers in general or really even developers," an NPM official told Ars in an email. "It targeted a select few developers at a company, Copay, that had a very specific development environment set up. Even then, the payload itself didn't run on those developers' computers; rather, it would be packaged into a consumer-facing app when the developers built a release. The goal was to steal Bitcoin from this application's end users...." According to the Github discussion that exposed the backdoor, the longtime event-stream developer no longer had time to provide updates. So several months ago, he accepted the help of an unknown developer. The new developer took care to keep the backdoor from being discovered. Besides being gradually implemented in stages, it also narrowly targeted only the Copay wallet app. The malicious code was also hard to spot because the flatmap-stream module was encrypted. The attack is the latest to exploit weaknesses in a widely used supply chain to target downstream end users... The supply-chain attacks show one of the weaknesses of open source code. Because of its openness and the lack of funds of many of its hobbyist developers and users, open source code can be subject to malicious modifications that often escape notice. "The time has come," concludes Ars Technica, "for maintainers and users of open source software to devise new measures to better police the millions of packages being used all around us." Sophos' security blog also asks why so many developers "immediately and blindly trusted the new maintainer," and shared a concerned comment from developer named Chris Northwood.' -- source: https://it.slashdot.org/story/18/12/01/2217231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Australia Has Rushed Through Its Copyright Amendment Bill
by Lawrence D'Oliveiro 30 Nov '18

30 Nov '18

Seems like the Aussie government has disregarded <https://www.theregister.co.uk/2018/11/28/australia_to_build_a_pirateproof_f…> <https://www.techdirt.com/articles/20181127/13425541113/australian-parliamen…> most of the objections to its plan to impose more draconian copyright restrictions on Internet usage. Rightsholders will be able to get injunctions against sites whose “primary effect” (no longer just “primary purpose”) is to facilitate copyright infringement, and they will also have “adaptive injunctions”, meaning they can reinterpret an existing court order as circumstances change, instead of having to go back to court to get a new order. You’d think a statement like “The Government has zero tolerance for online piracy. It is theft...” should be an instant disqualification from making any kind of statement about copyright law...

1 0

Mass Router Hack Exposes Millions of Devices To Potent NSA Exploit
by Peter Reutemann 29 Nov '18

29 Nov '18

'More than 45,000 Internet routers have been compromised by a newly discovered campaign that's designed to open networks to attacks by EternalBlue, the potent exploit that was developed by, and then stolen from, the National Security Agency and leaked to the Internet at large, researchers say. From a report: The new attack exploits routers with vulnerable implementations of Universal Plug and Play to force connected devices to open ports 139 and 445, content delivery network Akamai said in a blog post. As a result, almost 2 million computers, phones, and other network devices connected to the routers are reachable to the Internet on those ports. While Internet scans don't reveal precisely what happens to the connected devices once they're exposed, Akamai said the ports --which are instrumental for the spread of EternalBlue and its Linux cousin EternalRed -- provide a strong hint of the attackers' intentions. The attacks are a new instance of a mass exploit the same researchers documented in April. They called it UPnProxy because it exploits Universal Plug and Play -- often abbreviated as UPnP -- to turn vulnerable routers into proxies that disguise the origins of spam, DDoSes, and botnets.' -- source: https://tech.slashdot.org/story/18/11/29/1849254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Proprietary Software Subverts Security Of Your PC
by Lawrence D'Oliveiro 28 Nov '18

28 Nov '18

Audio company Sennheiser has just issued a fix <https://arstechnica.com/information-technology/2018/11/sennheiser-discloses…> for a really nasty vulnerability where their software for Windows and Mac would install a special fake browser certificate that the machine would continue to trust thereafter, even after the software was removed. Unfortunately, because the installation also included the private key for that certificate (which is never supposed to be distributed), it could then be exploited by arbitrary third parties to trick such machines into trusting random sites.

1 0

Deleting Windows Server Child Folder Changes Parent Folder Permissions
by Lawrence D'Oliveiro 28 Nov '18

28 Nov '18

<https://www.theregister.co.uk/2018/11/28/microsoft_windows_10_server_2016_p…>: ... Microsoft's support team [said] initially that the behaviour was by design and introduced in Windows Server 2016. Interestingly, it only occurs when folders are deleted (or cut and pasted) using File Explorer. Using the command line makes things behave as one would expect. It also only occurred when using a local path. Deleting using a UNC path was fine.

1 0

Half of all Phishing Sites Now Have the Padlock
by Peter Reutemann 27 Nov '18

27 Nov '18

'You may have heard you should look for the padlock symbol at the top of a website before entering your password or credit card information into an online form. It's well-meaning advice, but new data shows it isn't enough to keep your sensitive information secure. From a report: Recent data from anti-phishing company PhishLabs shows that 49 percent of all phishing sites in the third quarter of 2018 bore the padlock security icon next to the phishing site domain name as displayed in a browser address bar. That's up from 25 percent just one year ago, and from 35 percent in the second quarter of 2018. This alarming shift is notable because a majority of Internet users have taken the age-old "look for the lock" advice to heart, and still associate the lock icon with legitimate sites. A PhishLabs survey conducted last year found more than 80% of respondents believed the green lock indicated a website was either legitimate and/or safe. In reality, the https:// part of the address (also called "Secure Sockets Layer" or SSL) merely signifies the data being transmitted back and forth between your browser and the site is encrypted and can't be read by third parties. The presence of the padlock does not mean the site is legitimate, nor is it any proof the site has been security-hardened against intrusion from hackers.' -- source: https://it.slashdot.org/story/18/11/27/1521240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 26 Nov '18

26 Nov '18

Hi everyone Just a friendly reminder that our AGM is next Monday: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ In order to be eligible to vote, "only those people who were paid members in the previous financial year and who have signed a membership form for the then-current financial year will be eligible to vote." (https://github.com/WLUG/charter/blob/master/rules_140120.pdf) See you next Monday! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Two Linux Kernels Revert Performance-Killing Spectre Patches
by Peter Reutemann 25 Nov '18

25 Nov '18

'Friday Greg Kroah-Hartman released stable point releases of Linux kernel 4.19.4, as well as 4.14.83 and 4.9.139. While they were basic maintenance updates, the 4.19.4 and 4.14.83 releases are significant because they also reverted the performance-killing Spectre patches (involving "Single Thread Indirect Branch Predictors", or STIBP) that had been back-ported from Linux 4.20, according to Phoronix: There is improved STIBP code on the way for Linux 4.20 that by default just applies STIBP to SECCOMP threads and processes requesting it via prctl() but otherwise is off by default (that behavior can also be changed via kernel parameters). Once that code is ready to go for Linux 4.20, we may see it then back-ported to these stable trees. Aside from reverting STIBP, these point releases just have various fixes in them as noted for 4.19.4, 4.14.83, and 4.9.139. Last Sunday Linus Torvalds complained that the performance impact of the STIPB code "was clearly way more expensive than people were told," according to ZDNet: "When performance goes down by 50 percent on some loads, people need to start asking themselves whether it was worth it. It's apparently better to just disable SMT entirely, which is what security-conscious people do anyway," wrote Torvalds. "So why do that STIBP slow-down by default when the people who *really* care already disabled SMT?"' -- source: https://linux.slashdot.org/story/18/11/24/2320228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Cybersecurity Group Touts Its New Open Source Private VPN
by Peter Reutemann 25 Nov '18

25 Nov '18

'Alphabet's cybersecurity division Jigsaw has designed a new open source private VPN aimed at journalists and the people sending them data. "Their work makes them more vulnerable to attack," said Santiago Andrigo, Jigsaw's product manager. "It can get really scary when they're outed and you're passing over information." Unscrupulous VPN providers can steal your identity, peek in on your data, inject their own ads on non-secure pages, or analyze your browsing habits and sell that information to advertisers, says one Jigsaw official. And you can't know for sure whether you can trust them, no matter what they say in the app store. "Journalists should be aware that their online activities might be subject to surveillance either by government agencies, their internet service providers or a hacker with malicious intent," said Laura Tich, technical evangelist for Code for Africa, a resource for African journalists. "As surveillance becomes ubiquitous in today's world, journalists face an increasing challenge in establishing secure communication in the digital space." The new private VPN, dubbed "Outline", is specifically designed to be resistant to censorship — because it's harder to detect as a VPN (and therefore is less likely to be blocked). Outline uses an encrypted socks5 proxy that looks like normal internet traffic. Once the user chooses a server location, Outline spins up a DigitalOcean server on Ubuntu, installs Docker, and imports an image of the actual server. It's been named Outline because in places where internet use may be restricted — it gives you a line out.' -- source: https://yro.slashdot.org/story/18/11/25/0117226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Gmail Bug Allows Sending Messages Anonymously
by Peter Reutemann 25 Nov '18

25 Nov '18

'Earlier this week software developer Tim Cotten discovered a serious glitch in Gmail. An anonymous reader quotes BleepingComputer: Tampering with the 'From:' header by replacing some text with an <object>, <script> or <img> tag causes the interface to show a blank space instead of the sender's address.... Opening the email does not help, either, as the sender's address continues to remain hidden and shows no info even when hovering on it, an action that typically reveals the details.... Trying to reply to the message is also of no help. Cotten attempted this thinking that Gmail would read the original email headers and determine the destination. "Wrong again! Gmail is at a complete loss at what to do!" Cotten writes in a blog post that details his new finding.... Using the Show Original option, which allows users with more experience to trace an email, the desired detail is still unavailable in the user-friendly view. Looking at the raw info, however, shows the source address buried at the end of the <img> tag Cotten used in his experiment. He didn't even have to spell correctly the data type to trigger the bug. Unfortunately, it is highly unlikely that the average Gmail user will be able to navigate to this area and determine who the apparently anonymous message is coming from. Due to this, for these users the risk of phishing is high. Cotten's bug report "relies on his previous discovery that proved how a malformed 'From:' header allows placing an arbitrary email address in the sender field," the article points out, also noting a third recently-reported Gmail bug that "allows fraudsters to create a 'mailto:' link that populates the destination field in the app with whatever address they want; the latter was reported about 19 months ago to Google and is still present in the Gmail app for Android." "According to the developer, one solution Google could implement to avoid forging the From field is to properly check the email headers and deny communication with an anomalous structure in the sender or recipient fields. Another method proposed by Cotten is Joran Greef's project Ronomon, which can trigger errors when email specifications are not followed." Threatpost reported Tuesday that Google "did not respond to a request for comment."' -- source: https://it.slashdot.org/story/18/11/25/1731238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Potentially disastrous Rowhammer bitflips can bypass ECC protections
by Peter Reutemann 22 Nov '18

22 Nov '18

'In early 2015, researchers unveiled Rowhammer, a cutting-edge hack that exploits unfixable physical weaknesses in the silicon of certain types of memory chips to transform data they stored. In the 42 months that have passed since then, an enhancement known as error-correcting code (or ECC) available in higher-end chips was believed to be an absolute defense against potentially disastrous bitflips that changed 0s to 1s and vice versa. Research published Wednesday has now shattered that assumption.' -- source: https://arstechnica.com/information-technology/2018/11/potentially-disastro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Have We Reached Peak Silicon Valley?
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121638…>: ... global smartphone sales saw their first year-on-year fall in history at the end of 2017. Apple seemed unaffected at the time, but its latest quarterly results now show falls in unit sales, as a result of which it will stop reporting them in future. >From beginnings that we might date to around the mid-1970s, PC sales (and development) went on an uninterrupted upward curve right through the 1990s, only starting to stutter around about the 2000s. The smartphone revolution, even if it includes the Symbian era and not just Android and Apple, has not lasted quite as long. So what new information-processing technology will ignite the mass market next? If any?

2 1

Germany Proposes Rules For Home Router Security
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

The federal German body responsible for information security has published some recommendations for how consumers’ internet routers should behave by default, including limiting the initially-enabled services, requiring firewall functionality, and mandating the deletion of all personal data on a factory reset <https://www.theregister.co.uk/2018/11/20/germany_versus_openwrt_ccc/>. This looks like a welcome first step, even if some argue it doesn’t go far enough.

1 0

Microsoft Azure Outage Fixed, Office 365 Still Broken
by Lawrence D'Oliveiro 20 Nov '18

20 Nov '18

They fixed Azure by turning the multi-factor authentication servers off and on again <https://www.theregister.co.uk/2018/11/19/microsoft_azure_office_outage_late…>. Lawrence “You Couldn’t Make This Up” D’Oliveiro

2 1

Microsoft Disputing Its NZ Tax Payments
by Lawrence D'Oliveiro 19 Nov '18

19 Nov '18

The IRD is demanding that Microsoft NZ pay more tax <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121627…>. This is over the whole notorious business of “transfer pricing”, where sales by multinational corporations are recorded in jurisdictions where they attract less tax, rather than where the customers are located. Looks like there have already been some changes to this, though obviously the dispute would be over whether those changes are enough: From February 2018, the local unit's accounts were extended to include the distribution of computer software and hardware, having previously covered marketing. The change effectively means local product sales are being captured. Concomitant with this: The changes to Microsoft's revenue recognition also seem to route GST through the local unit, with GST payments of $8.1 million in the year ended June 30, compared to just $13,441 a year earlier. Man, that’s quite a jump. All of Microsoft’s NZ customers incurring just $13,441 in GST over an entire year ...

1 0

A little collection of cool unix terminal/console/curses tools
by Peter Reutemann 19 Nov '18

19 Nov '18

'Kristof Kovacs: Just a list of 20 (now 28) tools for the command line. Some are little-known, some are just too useful to miss, some are pure obscure -- I hope you find something useful that you weren't aware of yet! Use your operating system's package manager to install most of them. (Thanks for the tips, everybody!) ' -- source: https://kkovacs.eu/cool-but-obscure-unix-tools Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mark Shuttleworth Reveals Ubuntu 18.04 Will Get a 10-Year Support Lifespan
by Peter Reutemann 18 Nov '18

18 Nov '18

'At the OpenStack Summit in Berlin last week, Ubuntu Linux founder Mark Shuttleworth said in a keynote that Ubuntu 18.04 Long Term Support (LTS) support lifespan would be extended from five years to 10 years. "I'm delighted to announce that Ubuntu 18.04 will be supported for a full 10 years," said Shuttleworth, "In part because of the very long time horizons in some of industries like financial services and telecommunications but also from IoT where manufacturing lines for example are being deployed that will be in production for at least a decade." ZDNet reports: Ubuntu 18.04 released in April 2018. While the Ubuntu desktop gets most of the ink, most of Canonical's dollars comes from server and cloud customers. It's for these corporate users Canonical first extended Ubuntu 12.04 security support, then Ubuntu 14.04's support, and now, preemptively, Ubuntu 18.04. In an interview after the keynote, Shuttleworth said Ubuntu 16.04, which is scheduled to reach its end of life in April 2021, will also be given a longer support life span. When it comes to OpenStack, Shuttleworth promised again to support versions of OpenStack dating back to 2014's IceHouse. Shuttleworth said, "What matters isn't day two, what matters is day 1,500." He also doubled-down on Canonical's promise to easily enable OpenStack customers to migrate from one version of OpenStack to another. Generally speaking, upgrading from one version of OpenStack is like a root canal: Long and painful but necessary. With Canonical OpenStack, you can step up all the way from the oldest supported version to the newest one with no more than a second of downtime. ' -- source: https://news.slashdot.org/story/18/11/17/1748205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Uber Joins Linux Foundation Cementing Commitment To Open Source Tools
by Peter Reutemann 15 Nov '18

15 Nov '18

'At the 2018 Uber Open Summit, Uber announced it was joining the Linux Foundation as a Gold Member, making a firm commitment to using and contributing to open source tools. TechCrunch reports: Uber CTO Thuan Pham sees the Linux Foundation as a place for companies like his to nurture and develop open source projects. "Open source technology is the backbone of many of Uber's core services and as we continue to mature, these solutions will become ever more important," he said in a blog post announcing the partnership. "Uber has made significant investments in shared software development and community collaboration through open source over the years, including contributing the popular open source project Jaeger, a distributed tracing system, to the Linux Foundation's Cloud Native Computing Foundation in 2017," an Uber spokesperson told TechCrunch. As the report mentions, it took the ride-hailing service a long time for them to join the Linux Foundation. "Uber has been long known for making use of open source in its core tools working on over 320 open source projects and repositories from 1500 contributors involving over 70,000 commits, according to data provided by the company," reports TechCrunch.' -- source: https://linux.slashdot.org/story/18/11/15/226212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's 'Privacy Not Included' Gift Report Highlights Security Concerns
by Peter Reutemann 15 Nov '18

15 Nov '18

'Mozilla has released its second annual "Privacy Not Included" guide that rates 70 products to help give you an idea as to how secure or insecure they are. "We want to provide people information about how to make informed decisions when shopping for gifts that are connected to the internet," says Ashley Boyd, vice president of advocacy at Mozilla. "These products are becoming really popular. And in some cases, it's easy to forget that they're even connected to the internet." Wired reports: Among the important signifiers of a trustworthy stocking stuffer, according to Mozilla's rubric: the use of encryption, pushing automatic software security updates, strong password hygiene, a way to deal with vulnerabilities should they arise, and a privacy policy that doesn't take a PhD to parse. The most surprising result of Mozilla's testing may be how many products actually earned its seal of approval. Thirty-three of the 70 items in the "Privacy Not Included" guide passed muster; fans of the Nintendo Switch, Google Home, and Harry Potter Kano Coding Kit can sleep a little easier. On the other end of the scale, Mozilla highlighted seven products that may not hit the mark -- yes, including the sous vide wand, the Anova Precision Cooker. Also scoring low marks in Mozilla's accounting: the DJI Spark Selfie Drone (no encryption, does not require users to change the default password), the Parrot Bebop 2 drone (no encryption, complex privacy policy), and unsurprisingly, at least one baby monitor. The remaining 30 items on the list all exist somewhere in the murky middle, usually because Mozilla was unable to confirm at least one attribute. Which may be the real takeaway from the report: Typically, you have no reasonable way to find out if a given internet-connected device is secure. "If you can't tell, that says that there's a problem of communication between manufacturers and consumers," says Boyd. "We would love for makers of these products to be more clear and more transparent about what they're doing and not doing. That's a big place we think change is needed." ' -- source: https://tech.slashdot.org/story/18/11/15/0042210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A New Raspberry Pi 3 Model A+ Has Arrived With Bluetooth 4.2 and Dual-Band Wi-Fi For $25
by Peter Reutemann 15 Nov '18

15 Nov '18

'Raspberry Pi has introduced a new version of one of its most popular models just in time to stuff your stocking: the Model A+. And this time around, it's even more attractive. From a report: The Raspberry Pi 3 Model A+ costs $25, $5 more than the previous generation, but has a lot more going for it. Just like the top-of-the-line Model B+, the new Model A+ has a 1.4GHz 64-bit quad-core processor, and you'll also get dual-band Wi-Fi (2.4GHz + 5 GHz), a feature that was missing from the previous A+. And you'll have to use it, since the A+ doesn't have an Ethernet port. It does, however, have Bluetooth 4.2 on board. For $10 less than the $35 Model B+, you'll also only get a single USB port (versus four on the B+) as well as 512MB of RAM (versus 1GB on the B+). But otherwise, the devices are identical, with a full-size HDMI port, CSI camera port, DSI display port, stereo output and composite video port, and a micro SD port. The Raspberry Pi 3 Model A+ isn't the cheapest Pi model available -- the Zero costs $5 and the Zero W costs just $10 -- but it rounds out the options nicely. The new model is available now through Raspberry Pi retailers.' -- source: https://hardware.slashdot.org/story/18/11/15/1846205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM
by Peter Reutemann 15 Nov '18

15 Nov '18

Hi everyone For those who weren't at the meeting last night or aren't on meetup.com, the WLUG AGM is next month: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ProtonVPN Passes 1 Million Users and Launches on iOS
by Peter Reutemann 14 Nov '18

14 Nov '18

'Encrypted email service provider ProtonMail has launched its standalone VPN app for iOS devices. From a report: The announcement comes more than a year after ProtonVPN launched globally for desktop users and 10 months after it landed on Android, so the iOS launch has been a long time coming. There is, of course, no shortage of VPN apps out there already, but ProtonMail has built a solid reputation in the encrypted communications realm since it was founded out of CERN in 2013. Following the launch of its privacy-focused email service nearly three years ago, the company subsequently added two-factor authentication (2FA), Tor support, an encrypted contacts manager, and of course a VPN service. ProtonMail offers various pricing tiers for ProtonVPN, ranging from free to $24 per month. Those who choose not to pay can access three countries' servers, with access on one device, but will have slower speeds, while the top $24/month tier offers access on 10 devices with server access in all available countries. In related news, ProtonMail said that ProtonVPN now has 1 million users globally.' -- source: https://yro.slashdot.org/story/18/11/14/1646222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discover Seven New Meltdown and Spectre Attacks
by Peter Reutemann 14 Nov '18

14 Nov '18

'A team of nine academics has revealed today seven new CPU attacks. The seven impact AMD, ARM, and Intel CPUs to various degrees. From a report: Two of the seven new attacks are variations of the Meltdown attack, while the other five are variations on the original Spectre attack -- two well-known attacks that have been revealed at the start of the year and found to impact CPUs models going back to 1995. Researchers say they've discovered the seven new CPU attacks while performing "a sound and extensible systematization of transient execution attacks" -- a catch-all term the research team used to describe attacks on the various internal mechanisms that a CPU uses to process data, such as the speculative execution process, the CPU's internal caches, and other internal execution stages. The research team says they've successfully demonstrated all seven attacks with proof-of-concept code. Experiments to confirm six other Meltdown-attacks did not succeed, according to a graph published by researchers.' -- source: https://it.slashdot.org/story/18/11/14/181225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

USB Hardware Firewall
by Lawrence D'Oliveiro 14 Nov '18

14 Nov '18

You may know that it is possible for USB devices to be created that do malicious things to your PC by committing deceptions right at the USB protocol level. This kind of thing cannot be defeated by antivirus software or erased by, for example, reformatting a USB stick. For example, a device that is labelled as a USB storage stick could actually identify to the PC as two devices, one the actual storage device and the other a keyboard, that feeds malicious keystrokes at carefully-chosen times. Alternatively, it can detect when the PC is booting, and activate a separate partition containing a virus, which is otherwise invisible to antivirus software, at only that point. More details about such possibilities are available here <https://opensource.srlabs.de/projects/badusb>. Here <https://github.com/robertfisk/USG/wiki> is an interesting project to create a hardware device that will act as a “firewall” for untrusted USB devices, to prevent malicious protocol exchanges from occurring between them and your PC. If you don’t want to build your own, there’s a link in the readme to buy NZ-made ones.

1 0

World’s Top Three Most Powerful Supercomputers Are Non-Intel
by Lawrence D'Oliveiro 13 Nov '18

13 Nov '18

Machines based on IBM’s Power9 architecture have taken the top two spots in the list of the world’s most powerful (publicly-known) supercomputers <https://www.theregister.co.uk/2018/11/13/500_supercomputers_list/>. China’s Sunway TaihuLight machine, which is based on some derivative of MIPS, is in third place, with another Chinese machine, the highest-ranking Intel-based one, coming next. There is also the first ARM-based beastie, built by HP Enterprises, appearing on the list, at number 203.

1 0

Windows 10 Spontaneous Downgrade
by Lawrence D'Oliveiro 08 Nov '18

08 Nov '18

Some users of Windows 10 Pro are discovering that their machines are suddenly claiming to only have a Windows 10 Home licence <https://www.theregister.co.uk/2018/11/08/windows_10_activation/>. This isn’t confined to the “Insider” prereleases, but production releases as well (both upgrades and fresh installs). Seems some Microsoft support staff have confirmed that there is a “temporary issue” with the licence servers, which may take 1-2 days to fix.

2 1

WLinux, the First Paid-for Linux Distro for Windows 10, Goes On Sale on Microsoft Store
by Peter Reutemann 07 Nov '18

07 Nov '18

'WLinux is a $20 open-source, Debian-based distribution, designed to run on Windows 10's Windows Subsystem for Linux (WSL). The WSL allows Windows 10 to run various GNU/Linux distros inside Windows as Microsoft Store apps, providing access to Ubuntu, openSUSE, Debian, Fedora, Kali Linux, and others. The WSL has disadvantages over a running a dedicated GNU/Linux system. For example, there's no official support for desktop environments or graphical applications, and I/O performance bottlenecks, but it is being improved over time. The developers of WLinux describe it as a "fast Linux terminal environment for developers", saying it is the first distribution to be "pre-configured and optimized to run specifically on Windows Subsystem for Linux". Announcing WLinux's availability, Microsoft program manager Tara Raj, called out the wlinux-setup tool, "which allows users to easily set up common developer toolchains, and removes unsupported features like systemd."' -- source: https://linux.slashdot.org/story/18/11/07/1510223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How New, Polite Linus Torvalds Points Out Bad Kernel Code
by Peter Reutemann 06 Nov '18

06 Nov '18

'Linus Torvalds "has shown already for the new Linux 4.20~5.0 cycle he isn't relaxing his standards but is communicating better when it comes to bringing up coding," reports Phoronix, adding "So far it looks like Linus' brief retreat is paying off with still addressing code quality issues -- and not blatantly accepting new code into the kernel as some feared -- but in doing so in a professional manner compared to his past manner of exclaiming himself over capitalized sentences and profanity that at time put him at odds with some in the Linux kernel community." AmiMoJo quotes their report: Last Saturday he took issue with the HID pull request and its introduction of the BigBen game controller driver that was introduced: the developer enabled this new driver by default. Linus Torvalds has always frowned upon random new drivers being enabled by default in the kernel configuration driver. [H]e still voiced his opinion over this driver's default "Y" build configuration, but did so in a more professional manner than he has done in the past: We do *not* enable new random drivers by default. And we most *definitely* don't do it when they are odd-ball ones that most people have never heard of. Yet the new "BigBen Interactive" driver that was added this merge window did exactly that. Just don't do it. Yes, yes, every developer always thinks that _their_ driver is so special and so magically important that it should be enabled by default. But no. When we have thousands of drivers, we don't randomly pick one new driver to be enabled by default just because some developer thinks it is special. It's not.... Please don't do things like this. Phoronix also describes another "kernel oops" testing Torvalds' patience, in which Linus responded tactfully that "What makes me *very* unhappy about this is that if I'm right, I think it means that code was literally not tested at all by anybody who didn't have one of the entries in that list."' -- source: https://linux.slashdot.org/story/18/11/03/1833213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Explicating Neural Networks
by Lawrence D'Oliveiro 06 Nov '18

06 Nov '18

The usual problem with neural nets is, once you have trained them, you have no actual idea why they come to the decisions that they do. One classic example was a net that was being trained to distinguish between pictures of huskies and wolves, where it turned out it was actually assigning the highest weight to the area of snow in the background of the pictures. Enter LIME, which is a Python-based toolkit that tries to analyze the trained net to show you how each part of the dataset is being interpreted <https://www.theregister.co.uk/2018/11/05/hands_on_with_lime/>. The article shows example pictures where areas are colour-coded green or red to indicate whether they make a positive or negative contribution to a particular classification decision. This way, you can spot if any parts that should be ignored are being given an anomalously high weight. Or vice versa.

1 0

Microsoft Microsoft Working on Porting Sysinternals To Linux
by Peter Reutemann 05 Nov '18

05 Nov '18

'A Microsoft exec has confirmed yesterday that the company's engineers are working on porting the highly popular Sysinternals software package to Linux. Microsoft engineers have already ported the ProcDump utility and are currently working on porting ProcMon as well. More tools to follow. Microsoft's decision to port this highly popular debugging utility to Linux comes after two months ago, in September, Scott Guthrie, Microsoft's executive vice president of the cloud and enterprise group, revealed that "sometimes slightly over half of Azure VMs are Linux." With Linux's growing adoption as the preferred OS for running Azure VMs, it's only natural that Azure engineers are now looking into porting their favorite debugging utilities to Linux, for both themselves but also for the company's customers.' -- source: https://linux.slashdot.org/story/18/11/05/157226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaws in Self-Encrypting SSDs Let Attackers Bypass Disk Encryption
by Peter Reutemann 05 Nov '18

05 Nov '18

'Researchers have found flaws that can be exploited to bypass hardware encryption in well known and popular SSD drives. Master passwords and faulty standards implementations allow attackers access to encrypted data without needing to know the user-chosen password. SSDs from Micron (Crucial) and Samsung are affected. These are SSDs that support hardware-level encryption via a local built-in chip, separate from the main CPU. Some of these devices have a factory-set master password that bypasses the user-set password, while other SSDs store the encryption key on the hard drive, from where it can be retrieved. The issue is worse on Windows, where BitLocker defers software-level encryption to hardware encryption-capable SSDs, meaning user data is vulnerable to attacks without the user's knowledge. More in the research paper.' -- source: https://it.slashdot.org/story/18/11/05/213255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot poll: What do you make of programming languages and open source organizations adopting a code of conduct?
by Peter Reutemann 05 Nov '18

05 Nov '18

See this link for poll: https://slashdot.org/poll/3103 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Old School 'Sniffing' Attacks Can Still Reveal Your Browsing History
by Peter Reutemann 04 Nov '18

04 Nov '18

'Most modern browsers -- such as Chrome, Firefox, and Edge, and even browsers such as FuzzyFox and DeterFox (different, security-focused versions of Firefox) -- have vulnerabilities that allow hosts of malicious websites to extract hundreds to thousands of URLs in a user's web history, per new research from the University of California San Diego. What's worse, the vulnerabilities are built into the way they structure links, meaning that major structural changes will have to take place in these browsers in order to protect user privacy. The only browser that was immune to the attacks was Tor Browser, as the browser does not keep track of a user's internet history. The vulnerabilities have to do with why, for instance, unclicked links appear blue while visited links appear violet: there's a different set of rules and style that apply to links depending on whether they've been visited or not. However, a bad actor building a web page can manipulate this faster loading time for visited links by "sniffing," or inferting your browsing history. In essence, sniffing is finding and exploiting proxies that reveal your web history. As outlined in the UC San Diego report, this sniffing could happen in a couple of ways: they could force the browser to reload multiple complex images or image transformations that differ based on whether you've visited a link or not, which would create drastic differences in the loading time for each. With this strategy, actors can test 60 sensitive URLs per second. Bad actors could exploit a "bytecode cache," which speeds up the loading time for revisiting a link that you've already visited. "By embedding a special script in a web page, the actor can test how long it takes for a web page to load and infer whether you've visited it or not," reports Motherboard. "Actors can probe 3,000 URLs per second with this method. When the vulnerability was reported to Google, the company marked the issue as "security-sensitive" but "low-priority."' -- source: https://it.slashdot.org/story/18/11/04/0426252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs fall to new hyperthreading exploit that pilfers crypto keys
by Peter Reutemann 04 Nov '18

04 Nov '18

'Over the past 11 months, the processors running our computers, and in some cases phones, have succumbed to a host of attacks. Bearing names such as Meltdown and Spectre, BranchScope, TLBleed, and Foreshadow, the exploits threaten to siphon some of our most sensitive secrets—say passwords or cryptographic keys—out of the silicon microarchitecture in ways that can’t be detected or stopped by traditional security defenses. On Friday, researchers disclosed yet another leak that has already been shown to exist on a wide range of Intel chips and may also affect other makers, too. PortSmash, as the new attack is being called, exploits a largely overlooked side-channel in Intel’s hyperthreading technology. A proprietary implementation of simultaneous multithreading, hyperthreading reduces the amount of time needed to carry out parallel computing tasks, in which large numbers of calculations or executions are carried out simultaneously. The performance boost is the result of two logical processor cores sharing the hardware of a single physical processor. The added logical cores make it easier to divide large tasks into smaller ones that can be completed more quickly.' -- source: https://arstechnica.com/information-technology/2018/11/intel-cpus-fall-to-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Paper Books Still Legal?
by Lawrence D'Oliveiro 04 Nov '18

04 Nov '18

But how do they charge you the streaming fees? <http://www.dieselsweeties.com/ics/500/>

1 0

Booting a Raspberry-Pi 3B without using a SD-Card
by Ian Stewart 02 Nov '18

02 Nov '18

Hi, If you have a Raspberry Pi Model 3B, then you may be able use it with no micro SD-Card and have it boot Raspbian off a USB flash drive stick. I have found this possible with an Apacer AH356 64GB USB 3.1 Flash Drive<https://www.pbtech.co.nz/product/MEMAPC11464/Apacer-AH356-64GB-USB-31-Flash…> stick that I bought from PB-Tech a couple of weeks ago for $21.85. Admittedly you can buy a micro SD-card like the Apacer 64GB microSDXC UHS-I Class10<https://www.pbtech.co.nz/product/MEMAPC81064/Apacer-64GB-microSDXC-UHS-I-Cl…> from PB-Tech for $28.75 and put Raspbian onto it. So using the USB flash drive stick only saves a few dollars. However, there may be other advantages over using a USB flash drive vs. a micro SD-Card for the Raspbian OS. For example, you can shutdown the Raspberry Pi and remove the USB stick, take it to another computer, and backup your data. I also installed the Raspbian distro onto WD Elements Portable 2TB 2.5" USB 3.0 External HDD<https://www.pbtech.co.nz/product/HDDWDX2621/WD-Elements-Portable-2TB-25-USB…> which PB-Tech sell for $129. The R-Pi (with no SD-Card) would not boot this drive. Possibly because the USB drive is too slow to initialize after power on??? I also found that the R-Pi would not boot up Raspbian on an old 8GB Kingston USB flash drive. Maybe its too slow to initialize??? All the above tests were done using the current latest Raspbian release which is dated 2018_10_09. FYI: Below are details on how to install the Raspbian distro image onto a USB flash drive stick. cheers, Ian. Installing the Raspbian distro onto USB flash drive... Download the latest 1.4GB Raspbian distribution file: 2018-10-09-raspbian-stretch.zip Unzip the file to create a 4.1GB image file: 2018-10-09-raspbian-stretch.img Copy the 4.1GB image to a USB flash drive stick... $ sudo dd bs=4M if=2018-10-09-raspbian-stretch.img of=/dev/sdX status=progress conv=fsync Note: For the device /dev/sdX replace the X with the drive letter of your USB flash drive stick. e.g. /dev/sdc Insert the USB flash drive stick into the R-Pi model 3B. Remove any SD-Card that may be installed in the Raspberry Pi. Power on the R-Pi. After about 10 seconds the colourful POST display will appear, and the USB stick will commence its first boot. It will detect that it is a 4.1GB partition, expand to being a partition that fills the whole of the USB flash drive stick and reboot. The second reboot will be slow and takes about one minute. I assume it is expanding the squashed file system??? Subsequent reboots are faster.

3 6

Blockchain For International Trade
by Lawrence D'Oliveiro 01 Nov '18

01 Nov '18

ASB is close to offering a general blockchain-based service for international trading payments, starting with this <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121526…>: ... the transaction was a landmark because the blockchain-based service meant digital payment and paperwork for the deal were wrapped up in an hour - compared to the two to four days it would take to process using more traditional means. Also: Trade is currently paperwork-heavy, Beehre says, making it susceptible to fraud or human error. Which is odd, because isn’t it precisely the point of all that paperwork to reduce the chance of fraud or human error? However: ... blockchain also appealed because of[sic] the technology was created to be unhackable. Every time I hear the word “unhackable”, I reach for my ... never mind.

1 0