- wlug - list.wlug.org.nz

Google Play app downloaded more than 10,000 times contained data-stealing RAT
by Peter Reutemann 03 Mar '22

03 Mar '22

'A malicious app downloaded from Google Play more than 10,000 times surreptitiously installed a remote access trojan that stole users’ passwords, text messages, and other confidential data, a security firm reported. The trojan, which goes under the names TeaBot and Anatsa, came to light last May. It used streaming software and abused Android’s accessibility services in a way that allowed the malware creators to remotely view the screens of infected devices and interact with the operations the devices carried out. At the time, TeaBot was programmed to steal data from a predefined list of apps from about 60 banks around the world. On Tuesday, security firm Cleafy reported that TeaBot was back. This time, the trojan spread through a malicious app called QR Code & Barcode Scanner, which as the name suggested, allowed users to interact with QR codes and barcodes. The app had more than 10,000 installations before Cleafy researchers notified Google of the fraudulent activity and Google removed it.' -- source: https://arstechnica.com/information-technology/2022/03/google-play-app-drop… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Demand NVIDIA Open Source Their Drivers Or They Leak More Data
by Peter Reutemann 03 Mar '22

03 Mar '22

'VideoCardz: Hackers that infiltrated NVIDIA systems are now threatening to release more confidential information unless the company commits to open sourcing their drivers. It is unclear what the stolen data contains, but the group confirmed that there are 250GB of hardware related data in their possession. Furthermore, the group confirmed they have evaluated NVIDIA position, which means that NVIDIA is might trying to communicate with the group to prevent future leaks. The group has already published information on NVIDIA DLSS technology and upcoming architectures. Yesterday, Nvidia reportedly retaliated against the hacker group known as "Lapsus$" by sneaking back into the hacker's system and encrypting the stolen data. The group claimed that it had a backup of the data, though.' -- source: https://news.slashdot.org/story/22/03/02/2228207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fixing The Fiji-Tonga Cable
by Lawrence D'Oliveiro 02 Mar '22

02 Mar '22

Reconnecting Tonga’s sole Internet cable link (to Fiji) turned out to be a tricky job <https://www.theregister.com/2022/03/02/tonga_submarine_cable_reconnection_r…>. The cable was ripped in six different places, and a quarter-million-dollar repeater unit went missing altogether. 40km of existing cable was able to be recovered and reused, but another 50km of new cable was needed to complete the repair. Parts of the cable actually moved 5km closer to the volcano, courtesy of an earthquake and associated turbidity currents. Next step: fixing the connections between Tonga’s islands.

1 0

DDoSers are using a potent new method to deliver attacks of unthinkable size
by Peter Reutemann 02 Mar '22

02 Mar '22

'Last August, academic researchers discovered a potent new method for knocking sites offline: a fleet of misconfigured servers more than 100,000 strong that can amplify floods of junk data to once-unthinkable sizes. These attacks, in many cases, could result in an infinite routing loop that causes a self-perpetuating flood of traffic. Now, content-delivery network Akamai says attackers are exploiting the servers to target sites in the banking, travel, gaming, media, and web-hosting industries. These servers—known as middleboxes—are deployed by nation-states such as China to censor restricted content and by large organizations to block sites pushing porn, gambling, and pirated downloads. The servers fail to follow transmission control protocol specifications that require a three-way handshake—comprising an SYN packet sent by the client, a SYN+ACK response from the server, followed by a confirmation ACK packet from the client—before a connection is established. This handshake limits the TCP-based app from being abused as amplifiers because the ACK confirmation must come from the gaming company or other target rather than an attacker spoofing the target’s IP address. But given the need to handle asymmetric routing, in which the middlebox can monitor packets delivered from the client but not the final destination that’s being censored or blocked, many such servers drop the requirement by design.' -- source: https://arstechnica.com/information-technology/2022/03/unending-data-floods… Considering that we suffered a widespread internet outage earlier today (and my internet is still flaky or slow), seems rather relevant: https://www.newshub.co.nz/home/technology/2021/09/internet-down-for-many-ar… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 28 Feb '22

28 Feb '22

Hi everyone We have a (virtual) meeting scheduled for next Monday: Peter Reutemann will demo openbalena (https://www.balena.io/open/) and how it can be used for managing an IoT fleet of devices. Ian Stewart will present his modem running the latest version of OpenWrt ( https://openwrt.org/ ). Using ssh into his modem and what the web-based user interface looks like, we will see some of the improvements that have gone into this latest release. Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776605/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Australia’s Standoff Against Google And Facebook Worked--Sort Of
by Lawrence D'Oliveiro 28 Feb '22

28 Feb '22

Analysis of how Australia forced Google and Facebook to negotiate with news outlets over compensation for carrying their stories <https://arstechnica.com/tech-policy/2022/02/australias-standoff-against-goo…>. Other countries (most famously Spain) had previously tried something similar, only to have it backfire spectacularly. Australia has succeeded where others failed—up to a point. Seems the two online behemoths are paying off some bigger news outlets, but rebuffing attempts from others to come to a similar deal. While the country’s news media bargaining code is now law, it has not (yet) actually needed enforcement: all the deals so far have been voluntary. So, has it been beneficial for Australian media as a whole, or only for certain favoured players? But even critics of the code suggest it could be a useful starting point. Emily Bell, director of Columbia University’s Tow Center for Digital Journalism, says she is concerned by the code’s lack of transparency, but concedes that Facebook and Google have paid more to publishers in Australia than they do under their philanthropic donations elsewhere. “What we do know is that some legislation is better than none.”

1 0

Samsung Shattered Encryption On 100 Million Phones
by Peter Reutemann 25 Feb '22

25 Feb '22

'Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year's Galaxy S21. Threatpost reports: Researchers at Tel Aviv University found what they called "severe" cryptographic design flaws that could have let attackers siphon the devices' hardware-based cryptographic keys: keys that unlock the treasure trove of security-critical data that's found in smartphones. What's more, cyber attackers could even exploit Samsung's cryptographic missteps -- since addressed in multiple CVEs -- to downgrade a device's security protocols. That would set up a phone to be vulnerable to future attacks: a practice known as IV (initialization vector) reuse attacks. IV reuse attacks screw with the encryption randomization that ensures that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts will each be distinct. The design flaws primarily affect devices that use ARM's TrustZone technology: the hardware support provided by ARM-based Android smartphones (which are the majority) for a Trusted Execution Environment (TEE) to implement security-sensitive functions. TrustZone splits a phone into two portions, known as the Normal world (for running regular tasks, such as the Android OS) and the Secure world, which handles the security subsystem and where all sensitive resources reside. The Secure world is only accessible to trusted applications used for security-sensitive functions, including encryption. Matthew Green, associate professor of computer science at the Johns Hopkins Information Security Institute, explained on Twitter that Samsung incorporated "serious flaws" in the way its phones encrypt key material in TrustZone, calling it "embarrassingly bad." "They used a single key and allowed IV re-use," Green said. "So they could have derived a different key-wrapping key for each key they protect," he continued. "But instead Samsung basically doesn't. Then they allow the app-layer code to pick encryption IVs." The design decision allows for "trivial decryption," he said. Samsung responded to the academics' disclosure by issuing a patch for affected devices that addressed CVE-2021-25444: an IV reuse vulnerability in the Keymaster Trusted Application (TA) that runs in the TrustZone. Keymaster TA carries out cryptographic operations in the Secure world via hardware, including a cryptographic engine. The Keymaster TA uses blobs, which are keys "wrapped" (encrypted) via AES-GCM. The vulnerability allowed for decryption of custom key blobs. Then, in July 2021, the researchers revealed a downgrade attack -- one that lets attacker trigger IV reuse vulnerability with privileged process. Samsung issued another patch -- to address CVE-2021-25490 -- that remoged the legacy blob implementation from devices including Samsung's Galaxy S10, S20 and S21 phones. ' -- source: https://mobile.slashdot.org/story/22/02/24/222207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeDOS Puts Out New Release
by Peter Reutemann 25 Feb '22

25 Feb '22

'FreeDOS has put out release 1.3, the latest release in 6-years. Some of the improvements since the 1.2 release, include: new FreeCOM 0.85a, new Kernel 2043 and an 8086 version with FAT32 support, floppy edition now uses compression...let's party like it's 1994.' -- source: https://tech.slashdot.org/story/22/02/24/1540240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia’s most cutthroat hackers infect network devices with new botnet malware
by Peter Reutemann 24 Feb '22

24 Feb '22

'Hackers for one of Russia’s most elite and brazen spy agencies have infected home and small-office network devices around the world with a previously unseen malware that turns them into attack platforms that can steal confidential data and target other networks. Cyclops Blink, as the advanced malware has been dubbed, has infected about 1 percent of network firewall devices made by network device manufacturer Watchguard, the company said on Wednesday. The malware is able to abuse a legitimate firmware update mechanism found in infected devices in a way that gives it persistence, meaning it survives reboots. [...] So far, the advisory stated, Sandworm has “primarily” used the malware to infect network devices from WatchGuard, but it’s likely the hackers are able to compile it to run on other platforms as well. The malware gains persistence on WatchGuard devices by abusing the legitimate process they use to receive firmware updates.' -- source: https://arstechnica.com/information-technology/2022/02/russias-most-cut-thr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ReiserFS Proposed To Be Removed From Linux In 2022
by Peter Reutemann 24 Feb '22

24 Feb '22

'Linux kernel developers have discussed on the kernel developers forum to remove ReiserFS from the kernel starting in 2022. ReiserFS was added as Linux's first journaling file system 21 years ago with SUSE using it as the default filesystem until 2006. However, since Hans Reiser was sent to jail 15 years ago for murder, there has not been much development or interest in it. Noting that there have been no user-spotted fixes since 2019, longtime kernel developer Matthew Wilcox also cited that ReiserFS was only block for some kernel changes he wished to implement. These days there are better alternatives like EXT4, Btrfs, XFS, and OpenZFS.' -- source: https://linux.slashdot.org/story/22/02/23/0537213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2