- wlug - list.wlug.org.nz

Malware Found in Arch Linux AUR Package Repository
by Peter Reutemann 11 Jul '18

11 Jul '18

'Malware has been discovered in at least three Arch Linux packages available on AUR (Arch User Repository), the official Arch Linux repository of user-submitted packages. The malicious code has been removed thanks to the quick intervention of the AUR team. The incident happened because AUR allows anyone to take over "orphaned" repositories that have been abandoned by their original authors. On Saturday, a user going by the pseudonym of "xeactor" took over one such orphaned package named "acroread" that allows Arch Linux users to view PDF files. According to a Git commit to the packag's source code, xeactor added malicious code that would download a file named "~x" from ptpb [dot] pw, a lightweight site mimicking Pastebin that allows users to share small pieces of texts.' -- source: https://it.slashdot.org/story/18/07/10/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stolen certificates from D-Link used to sign password-stealing malware
by Peter Reutemann 10 Jul '18

10 Jul '18

'Criminals recently stole code-signing certificates from router and camera maker D-Link and another Taiwanese company and used them to pass off malware that steals passwords and backdoors PCs, a researcher said Monday. The certificates were used to cryptographically verify that legitimate software was issued by D-Link and Changing Information Technology. Microsoft Windows, Apple’s macOS, and most other operating systems rely on the cryptographic signatures produced by such certificates to help users ensure that executable files attached to emails or downloaded on websites were developed by trusted companies rather than malicious actors masquerading as those trusted companies. Somehow, members of an advanced persistent-threat hacking group known as BlackTech obtained the certificates belonging to D-Link and Changing Information Technology, the researcher with antivirus provider Eset said in a blog post. The attackers then used the certificates to sign two pieces of malware, one a remotely controlled backdoor and the other a related password stealer. Both pieces of malware are referred to as Plead and are used in espionage campaigns against targets located in East Asia. The Japan Computer Emergency Response team recently documented the Plead malware here. AV provider Trend Micro recently wrote about BlackTech here. “The ability to compromise several Taiwan-based technology companies and reuse their code-signing certificates in future attacks shows that this group is highly skilled and focused on that region,” Eset researcher Anton Cherepanov wrote in Monday’s post.' -- source: https://arstechnica.com/information-technology/2018/07/stolen-certificates-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-like attack uses speculative execution to overflow buffers
by Peter Reutemann 10 Jul '18

10 Jul '18

'When the Spectre and Meltdown attacks were disclosed earlier this year, the expectation was that these attacks would be the first of many, as researchers took a closer look at the way that the speculative execution in modern processors could be used to leak sensitive information and undermine the security of software running on those processors. In May, we saw the speculative store bypass, and today we have a new variant on this theme: speculative buffer overflows, discovered by Vladimir Kiriansky at MIT and independent researcher Carl Waldspurger.' -- source: https://arstechnica.com/gadgets/2018/07/new-spectre-like-attack-uses-specul… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With So Many Eyeballs, Is Open Source Security Better?
by Peter Reutemann 10 Jul '18

10 Jul '18

'Back in 1999, Eric Raymond coined the term "Linus' Law," which stipulates that given enough eyeballs, all bugs are shallow. Linus' Law, named in honor of Linux creator Linus Torvalds, has for nearly two decades been used by some as a doctrine to explain why open source software should have better security. In recent years, open source projects and code have experienced multiple security issues, but does that mean Linus' Law isn't valid? According to Dirk Hohndel, VP and Chief Open Source Officer at VMware, Linus' Law still works, but there are larger software development issues that impact both open source as well as closed source code that are of equal or greater importance. "I think that in every development model, security is always a challenge," Hohndel said. Hohndel said developers are typically motivated by innovation and figuring out how to make something work, and security isn't always the priority that it should be. "I think security is not something we should think of as an open source versus closed source concept, but as an industry," Hohndel said.' -- source: https://it.slashdot.org/story/18/07/10/1642226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Breaches Chrome Extension of Popular VPN Service Hola, Directs Users To Compromised Cryptocurrency Website
by Peter Reutemann 10 Jul '18

10 Jul '18

'A hacker has breached a Hola VPN developer account and has replaced the official Chrome extension with one that redirected users of the MyEtherWallet.com website to a phishing page controlled by the attacker. The compromise took place yesterday and only lasted for five hours the MyEtherWallet (MEW) team said in a tweet. The Hola VPN team admitted to the hack. "The attack was programmed to inject a JavaScript tag in to the MEW site to 'phish' information about MEW accounts that are logging in without being in 'incognito mode', by re-directing the MEW users to the hacker's website," the Hola VPN team said.' -- source: https://yro.slashdot.org/story/18/07/10/1720243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM’s Anti-RISC-V FUD
by Lawrence D'Oliveiro 10 Jul '18

10 Jul '18

ARM put up a site attacking the open-source RISC-V processor architecture a few days ago, then had to take it down as a result of objections from its own staff <https://www.theregister.co.uk/2018/07/10/arm_riscv_website/>. Seems ARM is feeling the heat from the increasing traction that RISC-V is getting. Even though the original site is gone, it is still accessible via the Wayback Machine. And also one of the commenters points out that this graphic <https://www.arm.com/-/media/global/company/arm-risc-v-infographic.png> is still on ARM’s own site.

1 0

Firefox and Chrome Pull Popular Browser Extension Stylish From Their Stores After Report Claimed It Logs and Shares Browsing History, Credentials
by Peter Reutemann 05 Jul '18

05 Jul '18

'Stylish, a popular extension available for Chrome and Firefox which allows for easy customization of any website, now phones home and shares its users' browser history with its corporate parent, according to blogger Robert Heaton. This prompted Firefox to ban the extension from its addons site and prompt all users to disable it. The discussion can be seen in the relevant bug report. In Heaton's words: Stylish is no longer a well-meaning product with your best interests at heart. If you use and like Stylish, please uninstall it and switch to an alternative like Stylus, an offshoot from the good old version of Stylish that works in much the same way, minus the spyware. Google too has pulled the extension from its extension store. This is not the first time Stylish is at the centre of a privacy debacle' -- source: https://yro.slashdot.org/story/18/07/04/218234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Download Bomb Trick Returns in Chrome -- Also Affects Firefox, Opera, Vivaldi and Brave
by Peter Reutemann 03 Jul '18

03 Jul '18

'The release of Google Chrome 67 has reopened a "download bomb" bug that was exploited by tech support scammers last winter, and which had been fixed with the release of Chrome 65 in March 2018. Furthermore, the issue also appears to affect other browsers as well, such as Firefox, Vilvadi, Opera, and Brave, according to tests carried out by Bleeping Computer. The "download bomb" trick is a technique that involves initiating hundreds or thousands of downloads to freeze a browser on a specific page. Across the years, there have been multiple variations of download bombs, and they have often been used by tech support scammers to trap users on shady sites that tried to lure victims into calling a tech support number to have their browser unlocked. Over the winter, security researchers from Malwarebytes noticed a tech support scam campaign that employed a new "download bomb" technique to trap users on its shady sites.' -- source: https://news.slashdot.org/story/18/07/03/1416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study Finds That a Large Number of Popular Android Apps Secretly Cast the Screen To Third Parties, But They Don't Listen To Conversations
by Peter Reutemann 03 Jul '18

03 Jul '18

'It's the smartphone conspiracy theory that just won't go away: Many, many people are convinced that their phones are listening to their conversations to target them with ads. [...] Some computer science academics at Northeastern University had heard enough people talking about this technological myth that they decided to do a rigorous study to tackle it. For the last year, Elleen Pan, Jingjing Ren, Martina Lindorfer, Christo Wilson, and David Choffnes ran an experiment involving more than 17,000 of the most popular apps on Android to find out whether any of them were secretly using the phone's mic to capture audio. The apps included those belonging to Facebook, as well as over 8,000 apps that send information to Facebook. Sorry, conspiracy theorists: They found no evidence of an app unexpectedly activating the microphone or sending audio out when not prompted to do so. Like good scientists, they refuse to say that their study definitively proves that your phone isn't secretly listening to you, but they didn't find a single instance of it happening. Instead, they discovered a different disturbing practice: apps recording a phone's screen and sending that information out to third parties.' -- source: https://yro.slashdot.org/story/18/07/03/1822250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Allows Outside App Developers To Read People's Gmails, Says Report
by Peter Reutemann 03 Jul '18

03 Jul '18

'According to The Wall Street Journal, hundreds of app developers have access to millions of inboxes belonging to Gmail users (Warning: source paywalled; alternative source). The developers reportedly receive access to messages from Gmail users who signed up for things like price-comparison services or automated travel-itinerary planners. Some of these companies train software to scan the email, while others enable their workers to pore over private messages. INSIDER reports: It's not news that Google and many top email providers enable outside developers to access users' inboxes. In most cases, the people who signed up for the price-comparison deals or other programs agreed to provide access to their inboxes as part of the opt-in process. In Google's case, outside developers must pass a vetting process, and as part of that, Google ensures they have an acceptable privacy agreement, The Journal reported, citing a Google representative. What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails. ' -- source: https://yro.slashdot.org/story/18/07/02/2057256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Micro Focus Sells SUSE
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

<https://www.theregister.co.uk/2018/07/02/linux_makes_suse_sold_for_a_cool_2…>: Micro Focus CEO Chris Hsu subsequently decided that spending time with his family seemed more fun than piloting a juggernaut made of more offcuts than a cut-and-shut Ford Fiesta from Honest Bob's Motors. ... However, SUSE was a bright spot in the gloom, showing revenues of $164.4m and a solid, if unexciting, growth rate of 13.1 per cent in the six months to October 2017. ... For its part, SUSE is pretty happy with the deal. It will retain its CEO, Nils Brauckman, who seemed pleased to be free of Micro Focus ...

1 0

Metric-Compatible Fonts
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

I was idly doing some web searches the other day (as you do), and stumbled across this page <https://wiki.archlinux.org/index.php/Metric-compatible_fonts> at the ever-dependable Arch Wiki. My specific question was, what had happened to the “URW Palladio” font? Up until recently, this was the one that Fontconfig would offer up when I used the old “Palatino” name from Adobe PostScript days. (I used to like the way the curve of the “P” didn’t quite join up with the stem, but left a little gap with a pointy bit on the end. Ahem...) Turns out it’s still there, just under another name; it’s now called “P052” for some unfathomable reason. Anyway, that page gives a bunch of handy alternatives if you are looking for Free alternatives to proprietary fonts that preserve the metrics (widths, spacing etc), so substituting them won’t stuff up the formatting of a document.

1 0

'Why You Should Not Use Google Cloud'
by Peter Reutemann 02 Jul '18

02 Jul '18

'A user on Medium named "Punch a Server" says you should not use Google Cloud due to the "'no-warnings-given, abrupt way' they pull the plug on your entire system if they (or the machines) believe something is wrong." The user has a project running in production on Google Cloud (GCP) that is used to monitor hundreds of wind turbines and scores of solar plants scattered across 8 countries. When their project goes down, money is lost. An anonymous Slashdot reader shares the report: Early today morning (June 28, 2018) I receive an alert from Uptime Robot telling me my entire site is down. I receive a barrage of emails from Google saying there is some "potential suspicious activity" and all my systems have been turned off. EVERYTHING IS OFF. THE MACHINE HAS PULLED THE PLUG WITH NO WARNING. The site is down, app engine, databases are unreachable, multiple Firebases say I've been downgraded and therefore exceeded limits. Customer service chat is off. There's no phone to call. I have an email asking me to fill in a form and upload a picture of the credit card and a government issued photo id of the card holder. Great, let's wake up the CFO who happens to be the card holder. What if the card holder is on leave and is unreachable for three days? We would have lost everything -- years of work -- millions of dollars in lost revenue. I fill in the form with the details and thankfully within 20 minutes all the services started coming alive. The first time this happened, we were down for a few hours. In all we lost everything for about an hour. An automated email arrives apologizing for "inconvenience" caused. Unfortunately The Machine has no understanding of the "quantum of inconvenience" caused.' -- source: https://news.slashdot.org/story/18/07/01/0354200 The cloud is convenient, as you don't have to look after your own hardware and it allows you to add more processing power as needed. But this is a good example of why your own hardware might not be a bad idea... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PB Tech Used Trade Me Data For Spam
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120816…>: PB Tech has signed an enforceable undertaking with the [Department of Internal Affairs] after it was found to have collected Trade Me customer details during trades and then sent them unsolicited messages. This was in breach of the Unsolicited Electronic Messages Act.

1 0

Massive New 'Salesforce Tower' Light Sculpture: AI, Ubuntu, Fog, and a MacBook
by Peter Reutemann 30 Jun '18

30 Jun '18

'The new tallest building on the San Francisco skyline -- and the tallest building in America west of the Mississippi -- includes a nine-story electronic sculpture that's been called the tallest piece of public art on Earth. It uses 11,000 LED bulbs reflected off the tower-topping aluminum panels -- each pixel created by a set of red, green, blue and white lights controlled by 8-bit PIC microcontrollers. "On a clear night, the show is visible for 30 miles," reports IEEE Spectrum. Slashdot reader Tekla Perry shares their article about "the technology involved in the light show at the top of Salesforce Tower. Electrical engineer and artist Jim Campbell explains it all -- and how the window-washer problem stumped him for nearly a year." "[O]n the 62nd floor, a central PC-based computer runs Ubuntu Linux, sending instructions to a communications control system that splits the data and sends it at 11 Mbit to the 32 enclosures using a custom communications protocol... We will capture images throughout the day, sending them to Amazon's cloud, and run some algorithms designed to identify visual interesting-ness. For example, at its simplest, when we look at the sky, if it's all blue, it's boring, if it's all white, it's boring, if it has white and blue it is likely to be interesting. We'll chose the best half hour of the day at each camera, based on movement and color, to display...." And finally, when the main display shuts down late at night, another system designed by Campbell will kick in. In this static display, a set of 36 white LEDs will create a three-dimensional constellation of lights that will look like stars. "It's quieter, it has a random aspect to it," he says. "Since construction started, the tower has emerged as an icon of the new San Francisco -- techie, ambitious, perhaps a little grandiose," writes the New Yorker, capturing the moment when Campbell finally unveiled his four-year project -- while fighting stomach flu and a chest cold, on a night which turned out to be prohibitively foggy. The executive vice-president of Boston Properties told him cheerily, "Jim! Look on the brighter side. We've got every night for the rest of our lives." "There was a long silence from the people on the terrace. The fog was thick. At last, someone exclaimed, 'Woo-hoo!,' and a volley of cheers followed." Although the colors they were seeing came from the celebratory fireworks and not from Jim's light sculpture. Are there any San Francisco-area Slashdotters who want to weigh in on the Salesforce Tower?' -- source: https://tech.slashdot.org/story/18/06/30/2031224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not A Bug, It’s A Feature!
by Lawrence D'Oliveiro 30 Jun '18

30 Jun '18

The IndexByDate.txt files available on the various Bitsavers directories (e.g. <http://bitsavers.trailing-edge.com/pdf/>) list the various items available in order of date. But if you want them ordered by name, so items in the same directory come together, the logical thing to do is use the sort(1) <https://linux.die.net/man/1/sort> command on this file. You specify the sort key by a “field definition”. The man page says that, by default, each field starts at a non-whitespace character after whitespace. The file has a very regular format: splitting by whitespace, you get the date, the time, and then the pathname. So a command like sort -k3 IndexByDate.txt should work. Except I was seeing a sequence like this: 2006-08-17 22:17:12 ge/MarkI_Timesharing/IPC-202646_FORTRAN_Aug66.pdf 2012-08-29 02:26:21 generalAutomation/18_30/88A00026A-A_GA1830_Industrial_Supervisory_System_Reference_Manual_May69.pdf ... 2018-05-16 00:33:35 georgiaTech/GTL_Programmers_Reference_Manual_for_the_Burroughs_B_5500_Aug1974.pdf 2006-08-27 11:36:57 ge/PAC-4000/GET-3201B_PAC-4000_SysMan_Mar66.pdf As you can see, the “ge” section is interrupted by “generalAutomation” and others, and then resumes after them. What was going on? It took me a while to realize that the sorting is done by locale, and the locale setting is set to ignore the slashes. Thus, the above sequence is effectively “gem” followed by “gen”, then “geo” and “gep”. What I wanted was a straight ASCII sort on the full pathname, without regard to any locale settings. But there is no hint in the man page as to how to specify this. Then I realized: the locale is controlled by environment variables. If you want the “non-localized” locale, then specify the locale called “C”, thus: LC_ALL=C sort -k3 IndexByDate.txt and this gives the order I want.

1 0

Linux Mint 19 'Tara' Released
by Peter Reutemann 30 Jun '18

30 Jun '18

'Linux Mint, the maker of popular Linux distro, announced on Friday the general availability of a new version of their operating system. Called Linux Mint 19 "Tara", the new version offers a range of new features, improvements, and a promise that it would stick around for a while. Writing for BetaNews, Brian Fagioli: The most significant aspect of Linux Mint 19 is the new Ubuntu 18.04 LTS base. Tara will receive updates until 2023 -- very impressive. The kernel is at 4.15, and all three desktop environments are being updated too. Mate is now at version 1.2, Cinnamon gets bumped up to 3.8, and Xfce is updated to 4.12. In Linux Mint 19, the star of the show is Timeshift, said, Clement Lefebvre, Linux Mint Project Leader. Although it was introduced in Linux Mint 18.3 and backported to all Linux Mint releases, it is now at the center of Linux Mint's update strategy and communication, he added. Thanks to Timeshift you can go back in time and restore your computer to the last functional system snapshot. If anything breaks, you can go back to the previous snapshot and it's as if the problem never happened.' -- source: https://linux.slashdot.org/story/18/06/29/2041255 Cheers, Petre -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Invests $22 Million In Feature Phone Operating System KaiOS
by Peter Reutemann 30 Jun '18

30 Jun '18

'Google is turning startup investor to further its goal of putting Google services like search, maps, and its voice assistant front and center for the next billion internet users in emerging markets. It has invested $22 million into KaiOS, the company that has built an eponymous operating system for feature phones that packs a range of native apps and other smartphone-like services. As part of the investment, KaiOS will be working on integrating Google services like search, maps, YouTube and its voice assistant into more KaiOS devices, after initially announcing Google apps for KaiOS-powered Nokia phones earlier this year. KaiOS is a U.S.-based project that started in 2017, built on the ashes of Mozilla's failed Firefox OS experiment, as a fork of the Linux codebase. Firefox OS was intended to be the basis of a new wave of HTML-5, low-cost smartphones. And while those devices and the wider ecosystem never really took off, KaiOS has fared significantly better. KaiOS powers phones made by OEMs including Nokia (HMD), Micromax and Alcatel, and it works with carriers including Sprint and AT&T -- it counts offices in North America, Europe and Asia. But its most significant deployment to date has been with India's Reliance Jio, the challenger telco that disrupted the Indian market with affordable 4G data packages. "This funding will help us fast-track development and global deployment of KaiOS-enabled smart feature phones, allowing us to connect the vast population that still cannot access the internet, especially in emerging markets," said KaiOS CEO Sebastien Codeville in a statement.' -- source: https://mobile.slashdot.org/story/18/06/29/2118251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook, Google, and Microsoft Use Design To Trick You Into Handing Over Your Data, Report Warns
by Peter Reutemann 29 Jun '18

29 Jun '18

'A study from the Norwegian Consumer Council dug into the underhanded tactics used by Microsoft, Facebook, and Google to collect user data. "The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-or-leave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users," states the report, which includes images and examples of confusing design choices and strangely worded statements involving the collection and use of personal data. Google makes opting out of personalized ads more of a chore than it needs to be and uses multiple pages of text, unclear design language, and, as described by the report, "hidden defaults" to push users toward the company's desired action. "If the user tried to turn the setting off, a popup window appeared explaining what happens if Ads Personalization is turned off, and asked users to reaffirm their choice," the report explained. "There was no explanation about the possible benefits of turning off Ads Personalization, or negative sides of leaving it turned on." Those who wish to completely avoid personalized ads must traverse multiple menus, making that "I agree" option seem like the lesser of two evils. In Windows 10, if a user wants to opt out of "tailored experiences with diagnostic data," they have to click a dimmed lightbulb, while the symbol for opting in is a brightly shining bulb, says the report. Another example has to do with Facebook. The social media site makes the "Agree and continue" option much more appealing and less intimidating than the grey "Manage Data Settings" option. The report says the company-suggested option is the easiest to use. "This 'easy road' consisted of four clicks to get through the process, which entailed accepting personalized ads from third parties and the use of face recognition. In contrast, users who wanted to limit data collection and use had to go through 13 clicks."' -- source: https://tech.slashdot.org/story/18/06/27/2233234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

GitHub Gentoo Organization Hacked
by Peter Reutemann 29 Jun '18

29 Jun '18

'June 28 at approximately 20:20 UTC unknown individuals have gained control of the Github Gentoo organization, and modified the content of repositories as well as pages there. We are still working to determine the exact extent and to regain control of the organization and its repositories. All Gentoo code hosted on GitHub should for the moment be considered compromised. This does NOT affect any code hosted on the Gentoo infrastructure. Since the master Gentoo ebuild repository is hosted on our own infrastructure and since Github is only a mirror for it, you are fine as long as you are using rsync or webrsync from gentoo.org. Details are sparse, but we will update this story once we learn more.' -- source: https://it.slashdot.org/story/18/06/28/2240254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's Up With ProtonMail Outages?
by Peter Reutemann 28 Jun '18

28 Jun '18

Since we talked about ProtonMail in the past... 'ProtonMail, a secure email service provider used by more than two million users and references of which has been made in shows like Mr. Robot, has been facing outages for the last two days as it fights numerous DDoS attacks. "The attacks went on for several hours, although the outages were far more brief, usually several minutes at a time with the longest outage on the order of 10 minutes," a ProtonMail spokesperson told BleepingComputer, adding that it has tracked the attack to a group that claims to have ties to Russia. But things are more complicated than that, and it appears ProtonMail users, who are already annoyed at the frequent outages over the last few days, are up for more such downtimes in the coming days. BleepingComputer: But in reality, the DDoS attacks have no ties to Russia, weren't even planned to in the first place, and the group behind the attacks denounced being Russian, to begin with. Responsible for the attacks is a hacker group named Apophis Squad. In a private conversation with Bleeping Computer today, one of the group's members detailed yesterday's chain of events. The Apophis member says they targeted ProtonMail at random while testing a beta version of a DDoS booter service the group is developing and preparing to launch. The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail, which they later revealed to have been a 200 Gbps SSDP flood, according to one of their tweets. "After we sent the first attack, we downed it for 60 seconds," an Apophis Squad member told us. He said the group didn't intend to harass ProtonMail all day yesterday or today but decided to do so after ProtonMail's CTO, Bart Butler, responded to one of their tweets calling the group "clowns." This was a questionable response on the part of the ProtonMail CTO, as it set the hackers against his company even more. "So we then downed them for a few hours," the Apophis Squad said. Subsequent attacks included a whopping TCP-SYN flood estimated at 500 Gbps, as claimed by the group.' -- source: https://it.slashdot.org/story/18/06/28/159252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Every Android Device Launched Since 2012 Impacted By RAMpage Vulnerability
by Peter Reutemann 28 Jun '18

28 Jun '18

'Almost all Android devices released since 2012 are vulnerable to RAMpage bug, an international team of academics has revealed today. >From a report: The vulnerability, tracked as CVE-2018-9442, is a variation of the Rowhammer attack. Rowhammer is a hardware bug in modern memory cards. A few years back researchers discovered that when someone would send repeated write/read requests to the same row of memory cells, the write/read operations would create an electrical field that would alter data stored on nearby memory. In the following years, researchers discovered that Rowhammer-like attacks affected personal computers, virtual machines, and Android devices. Through further researcher, they also found they could execute Rowhammer attacks via JavaScript code, GPU cards, and network packets.' -- source: https://it.slashdot.org/story/18/06/28/160220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Doubles Down on Linux and Open Source
by Peter Reutemann 28 Jun '18

28 Jun '18

'Google couldn't exist without Linux and open-source software. While you may not think of Google as a Linux company in the same way as you do Canonical, Red Hat, or SUSE, it wouldn't be the search and advertising giant it is today without Linux. So, it makes sense that Google is moving up from its Silver membership in The Linux Foundation, to the Platinum level. With this jump in status, Google gets a seat on the Foundation's board of directors. This position will be filled by Sarah Novotny, the head of open source strategy for Google Cloud Platform. Earlier this week, Chinese tech giant Tencent joined the Linux Foundation as a platinum member.' -- source: https://news.slashdot.org/story/18/06/27/1926211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

BBC Releases Computer History Archive
by Peter Reutemann 28 Jun '18

28 Jun '18

'A slice of computing history has been made public, giving people the opportunity to delve into an archive that inspired a generation of coders. The Computer Literacy Project led to the introduction of the BBC Micro alongside programs which introduced viewers to the principles of computing. It included interviews with innovators such as Bill Gates and Steve Wozniak. The BBC hopes the 1980s archive will encourage today's youngsters to become involved in computing. With the release of the archive, viewers can now search and browse all of the programmes from the project. The archive includes 267 programs, and 166 BBC Micro programs that were used on-screen.' -- source: https://news.slashdot.org/story/18/06/27/2037216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Finally, It's the Year of the Linux... Supercomputer
by Peter Reutemann 27 Jun '18

27 Jun '18

'From ZDNet: "The latest TOP500 Supercomputer list is out. What's not surprising is that Linux runs on every last one of the world's fastest supercomputers. Linux has dominated supercomputing for years. But, Linux only took over supercomputing lock, stock, and barrel in November 2017. That was the first time all of the TOP500 machines were running Linux. Before that IBM AIX, a Unix variant, was hanging on for dear life low on the list." An interesting architectural note: "GPUs, not CPUs, now power most of supercomputers' speed."' -- source: https://linux.slashdot.org/story/18/06/27/152216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anonymizing Printed Documents
by Lawrence D'Oliveiro 27 Jun '18

27 Jun '18

It’s been known for a while that many printer vendors add extra hard-to-detect dots to their printouts to make a pattern that can be used to identify the source of the document later. Now a research group <http://www.theregister.co.uk/2018/06/27/german_researchers_defeat_printer_t…> has found a way to stymie this process by adding extra dots that fit the patterns, but confuse the identification system. They even have source code on GitHub.

1 0

OpenBSD Chief De Raadt Says No Easy Fix For New Intel CPU Bug 'TLBleed'
by Peter Reutemann 26 Jun '18

26 Jun '18

'Recompiling is unlikely to be a catch-all solution for a recently unveiled Intel CPU vulnerability known as TLBleed, the details of which were leaked on Friday, the head of the OpenBSD project Theo de Raadt says. iTWire reports: The details of TLBleed, which gets its name from the fact that the flaw targets the translation lookaside buffer, a CPU cache, were leaked to the British tech site, The Register; the side-channel vulnerability can be theoretically exploited to extract encryption keys and private information from programs. Former NSA hacker Jake Williams said on Twitter that a fix would probably need changes to the core operating system and were likely to involve "a ton of work to mitigate (mostly app recompile)." But de Raadt was not so sanguine. "There are people saying you can change the kernel's process scheduler," he told iTWire on Monday. "(It's) not so easy." He said that Williams was lacking all the details and not thinking it through. "They actually have sufficient detail to think it through: the article says the TLB is shared between hyperthreading CPUs, and it is unsafe to share between two different contexts. Basically you can measure evictions against your own mappings, which indicates the other process is touching memory (you can determine the aliasing factors)." De Raadt said he was still not prepared to say more, saying: "Please wait for the paper [which is due in August]."' -- source: https://it.slashdot.org/story/18/06/25/2219217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Likely NSA Data-Collection Facilities
by Lawrence D'Oliveiro 26 Jun '18

26 Jun '18

Further to the mention last night of secret facilities operated by AT&T in the US where the NSA has access, this article <https://arstechnica.com/tech-policy/2018/06/meet-the-8-spooky-att-buildings…> reports on a list of eight likely places as detailed by The Intercept <https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/>. While the NSA is not technically allowed to spy on wholly “domestic” communications, there seem to be no limits on any “incidental collection” as a result of targetting some foreign communication. That means they can grab the contents of entire mailboxes just for the sake of one message. Then keep the lot for whatever use they like.

1 0

How Should Open Source Development Be Subsidized?
by Peter Reutemann 24 Jun '18

24 Jun '18

'"Open source maintainers are exhausted and rarely paid," writes TechCrunch's editorial manager. "A new generation wants to change the economics." An anonymous reader quotes their report: [Patreon] is increasingly being used by notable open source contributors as a way to connect with fans and sustain their work... For those who hit it big, the revenues can be outsized. Evan You, who created the popular JavaScript frontend library Vue.js, has reached $15,206 in monthly earnings ($182,472 a year) from 231 patrons... While Patreon is one direct approach for generating revenues from users, another one is to offer dual licenses, one free and one commercial... Companies care about proper licensing, and that becomes the leverage to gain revenue while still maintaining the openness and spirit of open source software... Tidelift is designed to offer assurances "around areas like security, licensing, and maintenance of software," CEO Donald Fischer explained... In addition, Tidelift handles the mundane tasks of setting up open source for commercialization such as handling licensing issues... Open Collective wants to open source the monetization of open source itself. Open Collective is a non-profit platform that provides tools to "collectives" to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way. TechCrunch warns that "It's not just that people are free riding, it's often that they don't even realize it. Software engineers can easily forget just how much craftsmanship has gone into the open source code that powers the most basic of applications... "If you work at a for-profit company, take the lead in finding a way to support the code that allows you to do your job so efficiently. The decentralization and volunteer spirit of the open source community needs exactly the same kind of decentralized spirit in every financial contributor. Sustainability is each of our jobs, every day."' -- source: https://news.slashdot.org/story/18/06/23/2113222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Birth Of PDF
by Lawrence D'Oliveiro 21 Jun '18

21 Jun '18

<http://www.theregister.co.uk/2018/06/21/how_a_tax_form_kludge_gave_us_25_ye…>: [In 1985] ... both Apple and Adobe wanted to show off the LaserWriter's abilities with some sample files. Warnock thought it would be great to have the printer producing something complex but familiar so he personally hand-programmed an IRS tax form in PostScript. ... all those boxes and form fields required Warnock to code in lots of subroutines and utilities. The page took 2 minutes 45 seconds to print. Jobs was horrified at how slow that was. ... His new version of the IRS tax form printed on the LaserWriter in 22 seconds. In other words, by abandoning all the programming-language constructs (subroutines, conditionals, looping etc) in PostScript and just writing out a straight sequence of imaging commands, the code ran a lot faster, even if it was bigger. The article mentions the release of PDF 2.0, which is now being managed by ISO. Unfortunately, unlike Adobe, ISO do not make their specs available for free.

1 0

OpenBSD Disables Intel CPU Hyper-Threading Due To Security Concerns
by Peter Reutemann 21 Jun '18

21 Jun '18

'The OpenBSD project announced today plans to disable support for Intel CPU hyper-threading due to security concerns regarding the theoretical threat of more "Spectre-class bugs." Bleeping Computer reports: Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU. The feature has been added to all Intel CPUs released since 2002 and has come enabled by default, with Intel citing its performance boost as the main reason for its inclusion. But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup." ' -- source: https://bsd.slashdot.org/story/18/06/19/2327212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Widely used D-Link modem/router under mass attack by potent IoT botnet
by Peter Reutemann 21 Jun '18

21 Jun '18

'Malicious hackers are mass exploiting a critical vulnerability in D-Link DSL routers in an attempt to make them part of Satori, the potent Internet-of-things botnet that is used to take down websites and mine digital coins, researchers said. Since making its debut late last year, Satori has proven to be a particularly versatile and sophisticated botnet. It made a name for itself in December when it infected more than 100,000 Internet-connected devices in just 12 hours by exploiting remote code-execution vulnerabilities in Huawei and RealTek routers. A month later, Satori operators released a new version that infected devices used to mine digital coins, proving that the IoT botnet could also take control of more traditional computing devices. In February, Satori resurfaced when it infected tens of thousands of routers manufactured by Dasan Networks.' -- source: https://arstechnica.com/information-technology/2018/06/widely-used-d-link-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TPP Versus Free-Software Licensing
by Lawrence D'Oliveiro 20 Jun '18

20 Jun '18

Seems like the “CPTPP” aka “TPP-11” (TPP minus the USA) may not be entirely free of objectionable provisions. A submission to the Australian ratification process <https://www.techdirt.com/articles/20180615/09090440050/open-source-industry…> has pointed out the following problematic clause: No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory. As you may know, such an access requirement is an integral part of copyleft licences like the GPL. What this clause seems to be saying is that such a requirement is unenforceable under the TPP.

2 4

meeting next Monday?
by Peter Reutemann 19 Jun '18

19 Jun '18

Hi everyone Any suggestions for next week's meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives
by Peter Reutemann 18 Jun '18

18 Jun '18

'Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.' -- source: https://apple.slashdot.org/story/18/06/18/1336248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.18 Preparing Many New Features While Dropping 100k+ Lines of Code
by Peter Reutemann 18 Jun '18

18 Jun '18

'Linux 4.18 development is going strong with recent 4.18-rc1 release. This kernel cycle has dropped 107,210 lines of code so far but Linux 4.18 is adding many new features. The kernel is coming in lighter as a result of the LustreFS code being removed and other code cleanups. On the feature front, Phoronix reports, "ew AMDGPU support improvements, mainlining of the V3D DRM driver, initial open-source work on NVIDIA Volta GV100 hardware, merging of the Valve Steam Controller kernel driver, merging of the BPFILTER framework, ARM Spectre mitigation work, Speck file-system encryption support, removal of the Lustre file-system, the exciting restartable sequences system call was merged, the new DM writecache target, and much more."' -- source: https://linux.slashdot.org/story/18/06/18/1334205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Reason To Move To GPLv3?
by Lawrence D'Oliveiro 18 Jun '18

18 Jun '18

Red Hat has decided <http://www.theregister.co.uk/2018/06/18/red_hat_gpl_violation/> that it prefers the more lenient remediation provisions in GPLv3 for licence violators. So as a matter of policy, it is going to adhere to them even for products it has licensed GPL/LGPLv2.x. [Licensing export Paul] Berg said the GPL and LGPL version 3 have more lenient termination clauses for good reason: Most people have no idea they've violated the terms and would comply if made aware of the problem. The article mentions the case of a Linux kernel developer who has been exploiting--some say abusing--his contributions to extract money from various firms. This has been a great annoyance to the kernel community--the same community that made it clear some years ago that they were against moving to GPLv3.

1 0

Another Day, Another Intel CPU Security Hole: Lazy State
by Peter Reutemann 15 Jun '18

15 Jun '18

'The latest Intel revelation, Lazy FP state restore, can theoretically pull data from your programs, including encryption software, from your computer regardless of your operating system. Like its forebears, this is a speculative execution vulnerability. In an interview, Red Hat Computer Architect Jon Masters explained: "It affects Intel designs similar to variant 3-a of the previous stuff, but it's NOT Meltdown." Still, "it allows the floating point registers to be leaked from another process, but alas that means the same registers as used for crypto, etc." Lazy State does not affect AMD processors. This vulnerability exists because modern CPUs include many registers (internal memory) that represent the state of each running application. Saving and restoring this state when switching from one application to another takes time. As a performance optimization, this may be done "lazily" (i.e., when needed) and that is where the problem hides. This vulnerability exploits "lazy state restore" by allowing an attacker to obtain information about the activity of other applications, including encryption operations' -- source: https://it.slashdot.org/story/18/06/14/1553255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Decades-old PGP bug allowed hackers to spoof just about anyone’s signature
by Peter Reutemann 15 Jun '18

15 Jun '18

'For their entire existence, some of the world's most widely used email encryption tools have been vulnerable to hacks that allowed attackers to spoof the digital signature of just about any person with a public key, a researcher said Wednesday. GnuPG, Enigmail, GPGTools, and python-gnupg have all been updated to patch the critical vulnerability. Enigmail and the Simple Password Store have also received patches for two related spoofing bugs. Digital signatures are used to prove the source of an encrypted message, data backup, or software update. Typically, the source must use a private encryption key to cause an application to show that a message or file is signed. But a series of vulnerabilities dubbed SigSpoof makes it possible in certain cases for attackers to fake signatures with nothing more than someone’s public key or key ID, both of which are often published online. The spoofed email shown at the top of this post can't be detected as malicious without doing forensic analysis that's beyond the ability of many users.' -- source: https://arstechnica.com/information-technology/2018/06/decades-old-pgp-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Censorship Of Telegram
by Lawrence D'Oliveiro 14 Jun '18

14 Jun '18

Bruce Schneier <https://www.schneier.com/blog/archives/2018/06/russian_censors.html>: Iran attempts to block Telegram have been more successful than Russia's, less because Iran's censorship technology is more sophisticated but because Telegram is not willing to go as far to defend Iranian users. The reasons are not rooted in business decisions. Simply put, Telegram is a Russian product and the designers are more motivated to poke Russia in the eye. ... In 1993, John Gilmore famously said that "The Internet interprets censorship as damage and routes around it." That was technically true when he said it but only because the routing structure of the Internet was so distributed. As centralization increases, the Internet loses that robustness, and censorship by governments and companies becomes easier.

1 0

KDE Plasma 5.13 Released
by Peter Reutemann 13 Jun '18

13 Jun '18

'KDE unveils the final release of Plasma 5.13, the free and open-source desktop environment. Members of the Plasma team have focused on optimizing startup and minimizing memory usage. Plasma Browser Integration is a suite of new features which make Firefox, Chrome and Chromium-based browsers work with your desktop. For example, downloads are now displayed in the Plasma notification popup, and the Media Controls Plasmoid can mute and skip videos and music playing from within the browser. Browser tabs can be opened directly using KRunner via the Alt-Space keyboard shortcut. System Settings design has been improved further. Window manager gained much-improved effects for blur and desktop switching. Wayland work continued, with the return of window rules, and initial support for screencasts and desktop sharing.' -- source: https://tech.slashdot.org/story/18/06/12/206253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Google Disables Inline Installation For Chrome Extensions
by Peter Reutemann 12 Jun '18

12 Jun '18

'Google today announced that Chrome will no longer support inline installation of extensions. New extensions lose inline installation starting today, existing extensions will lose the ability in three months, and in early December the inline install API will be removed from the browser with the release of Chrome 71. Critics have pointed out such moves make the Chrome Web Store a walled garden, while Google insists pushing users to the store ultimately protects them.' -- source: https://tech.slashdot.org/story/18/06/12/1820217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Slimbook 2 Review
by Peter Reutemann 08 Jun '18

08 Jun '18

'The kind folks at Slimbook recently sent me the latest generation of their ultrabook-style laptop line for review, the KDE Slimbook 2. You can hear my thoughts on the latest episode of the Ubuntu Podcast, released on June 7th 2018. Slimbook are a small laptop vendor based in Spain. All the laptops ship with KDE Neon as the default operating system. In addition to their hardware, they also contribute to and facilitate local Free Software events in their area. I was sent the laptop only for review purposes. There's no other incentive provided, and Slimbook didn't see this blog post before I published it. Being a small vendor, they don't have the same buying power with OEM vendors as other big name laptop suppliers. This is reflected in the price you pay. You're supporting a company who are themselves supporting Free Software developers and communities. If you're after the cheapest possible laptop, and don't care about its origin or the people behind the device, then maybe this laptop isn't for you. However, if you like to vote with your wallet, then the KDE Slimbook should absolutely be on your list to seriously consider.' -- source: https://popey.com/blog/posts/kde-slimbook-2-review.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Stymied by browsers, attackers embed Flash 0-day inside MS Office document
by Peter Reutemann 08 Jun '18

08 Jun '18

'As browser makers make it increasingly hard to exploit vulnerabilities in Adobe Flash and other plugins, hackers targeting diplomats in the Middle East tried a new approach this month: using Microsoft Office to remotely load Flash content that used a potent zero-day flaw to take control of computers.' -- source: https://arstechnica.com/information-technology/2018/06/stymied-by-browsers-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Much Physical Memory Do I Have?
by Lawrence D'Oliveiro 07 Jun '18

07 Jun '18

The free(1) <https://linux.die.net/man/1/free> command shows you system memory usage. E.g. on my laptop a few seconds ago: ldo(a)theodora:~> free total used free shared buff/cache available Mem: 7922644 1210968 3137520 135964 3574156 6265612 Swap: 8388604 24912 8363692 But there’s something not quite right about that “total” number. The machine has 8GiB of RAM, which should show as 8388608KiB. What happened to the remaining 465964KiB? That is taken up by the kernel. But where can you find a figure for this amount? Where can you make up a total that adds up to 8388608KiB? Seems there is no such place, at least not one accessible to non-privileged software. free(1) gets its info from /proc/meminfo, which is where the kernel reports it. But there is no place in this file (or anywhere else that I know of) that the kernel calculates its own memory usage. However, there is a privileged tool, dmidecode(8) <https://linux.die.net/man/8/dmidecode>, which can get information direct from the “DMI” (aka “SMBIOS”) table. In particular, the command dmidecode -t 17 on the laptop reports two “Memory Device” entries (slots for RAM DIMMs?), one of which says “Size: No Module Installed” while the other has “Size: 8192 MB” (which obviously means 8192MiB). So you have to take the total from here as your actual physical RAM, and subtract the amount shown by free(1) (or read from /proc/meminfo) to get the kernel RAM usage.

1 0

Microsoft Addresses Pressure From Developer Community, Promises To Rename GVFS
by Peter Reutemann 07 Jun '18

07 Jun '18

'Earlier this week an article ran about how Microsoft's multi-year refusal to rename its terabyte-scale Git extension "GVFS" (Git Virtual File System) had drawn the ire and dismay of the GNOME GVfs project (Gnome Virtual File System) which predates the Microsoft project by years. Thanks to Slashdot coverage and community pressure, Microsoft has now officially promised to rename GVFS to something else, and is asking the community for suggestions for a new name. Is this an official sign that MIcrosoft is finally listening to developers (albeit with a Slashdot-level of negative attention), or are they simply trying to appease the crowd while they are still in the news due to their acquisition of GitHub?' -- source: https://developers.slashdot.org/story/18/06/06/132215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Adds Post-Quantum Cryptography To an OpenVPN Fork
by Peter Reutemann 07 Jun '18

07 Jun '18

'Microsoft recently published an interesting open source project called "PQCrypto-VPN" that implements post-quantum cryptography (PQC) within OpenVPN. Being developed by the Microsoft Research Security and Cryptography group, as part of their research into post-quantum cryptography, this fork is being used to test PQC algorithms and their performance and functionality when used with VPNs. Microsoft's PQCrypto-VPN is published on Github and allows anyone to build an OpenVPN implementation that can encrypt communications using three different post-quantum cryptography protocols, with more coming as they are developed. These protocols are: (1) Frodo: a key exchange protocol based on the learning with errors problem (2) SIKE: a key exchange protocol based on Supersingular Isogeny Diffie-Hellman and (3) Picnic: a signature algorithm using symmetric-key primitives and non-interactive zero-knowledge proofs.' -- source: https://tech.slashdot.org/story/18/06/06/138258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPNFilter malware infecting 500, 000 devices is worse than we thought
by Peter Reutemann 07 Jun '18

07 Jun '18

'Two weeks ago, officials in the private and public sectors warned that hackers working for the Russian government infected more than 500,000 consumer-grade routers in 54 countries with malware that could be used for a range of nefarious purposes. Now, researchers from Cisco’s Talos security team say additional analysis shows that the malware is more powerful than originally thought and runs on a much broader base of models, many from previously unaffected manufacturers.' -- source: https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UN Plan To Move The World To IPv6
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

The UN has a plan to try to increase IPv6 adoption <http://www.theregister.co.uk/2018/05/30/internet_engineers_united_nations_i…>. However, it does it by essentially saddling IPv6 with all the limitations of IPv4 that IPv6 was specifically created to overcome. The UN has been trying for a while to take over governance of the Internet and its standards. This has been fought off by a US-led effort in favour of the IETF, ICANN etc -- all the bodies we know and love. However, the UN can claim some moral high ground in its advocacy for greater adoption among the developing world -- places where such bodies tend to be under-represented.

1 1

Web Radio
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

Just came across this WebSDR website <http://websdr.ewi.utwente.nl:8901/> which lets people listen to short-wave stations remotely. I haven’t actually tried fiddling with it -- it was linked from this article <https://warontherocks.com/2018/05/explaining-the-mystery-of-numbers-station…> on those mysterious “numbers stations” for broadcasting messages to spies.

1 0