- wlug - list.wlug.org.nz

Tsunami of junk traffic that broke DDoS records delivered by tiniest of botnets
by Peter Reutemann 16 Jun '22

16 Jun '22

'A massive flood of malicious traffic that recently set a new distributed denial-of-service record came from an unlikely source. A botnet of just 5,000 devices was responsible as extortionists and vandals continue to develop ever more powerful attacks to knock sites offline, security researchers said. The DDoS delivered 26 million HTTPS requests per second, breaking the previous record of 15.3 million requests for that protocol set only seven weeks ago, Cloudflare Product Manager Omer Yoachimik reported. Unlike more common DDoS payloads such as HTTP, SYN, or SYN-ACK packets, malicious HTTPS requests require considerably more computing resources for the attacker to deliver and for the defender or victim to absorb. ' -- source: https://arstechnica.com/information-technology/2022/06/tsunami-of-junk-traf… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft finds Linux desktop flaw that gives root to untrusted users
by Peter Reutemann 14 Jun '22

14 Jun '22

'Vulnerabilities recently discovered by Microsoft make it easy for people with a toehold on many Linux desktop systems to quickly gain root system rights— the latest elevation of privileges flaw to come to light in the open source OS. As operating systems have been hardened to withstand compromises in recent years, elevation of privilege (EoP) vulnerabilities have become a crucial ingredient for most successful hacks. They can be exploited in concert with other vulnerabilities that on their own are often considered less severe, with the latter giving what’s called local access and the former escalating the root access. From there, adversaries with physical access or limited system rights can deploy backdoors or execute code of their choice. Nimbuspwn, as Microsoft has named the EoP threat, is two vulnerabilities that reside in the networkd-dispatcher, a component in many Linux distributions that dispatch network status changes and can run various scripts to respond to a new status. When a machine boots, networkd-dispatcher runs as root. The flaws, tracked as CVE-2022-29799 and CVE-2022-29800, combine threats including directory traversal, symlink race, and time-of-check time-of-use (TOCTOU) race condition.' -- source: https://arstechnica.com/information-technology/2022/04/microsoft-finds-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Credentials for thousands of open source projects free for the taking—again!
by Peter Reutemann 14 Jun '22

14 Jun '22

'A service that helps open source developers write and test software is leaking thousands of authentication tokens and other security-sensitive secrets. Many of these leaks allow hackers to access the private accounts of developers on Github, Docker, AWS, and other code repositories, security experts said in a new report. The availability of the third-party developer credentials from Travis CI has been an ongoing problem since at least 2015. At that time, security vulnerability service HackerOne reported that a Github account it used had been compromised when the service exposed an access token for one of the HackerOne developers. A similar leak presented itself again in 2019 and again last year. The tokens give anyone with access to them the ability to read or modify the code stored in repositories that distribute an untold number of ongoing software applications and code libraries. The ability to gain unauthorized access to such projects opens the possibility of supply chain attacks, in which threat actors tamper with malware before it's distributed to users. The attackers can leverage their ability to tamper with the app to target huge numbers of projects that rely on the app in production servers. Despite this being a known security concern, the leaks have continued, researchers in the Nautilus team at the Aqua Security firm are reporting. A series of two batches of data the researchers accessed using the Travis CI programming interface yielded 4.28 million and 770 million logs from 2013 through May 2022. After sampling a small percentage of the data, the researchers found what they believe are 73,000 tokens, secrets, and various credentials.' -- source: https://arstechnica.com/information-technology/2022/06/credentials-for-thou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email client K-9 Mail will become Thunderbird for Android
by Peter Reutemann 14 Jun '22

14 Jun '22

'The open source Thunderbird email client has a long and storied history, but until now, that history has been limited to the desktop. That's about to change, according to a post on the Thunderbird blog. Thunderbird will be coming to Android through the popular open source mobile email client K-9 Mail. According to Thunderbird's Jason Evangelho, the Thunderbird team has acquired the source code and naming rights to K-9 Mail. K-9 Mail project maintainer Christian Ketterer (who goes by "cketti" in the OSS community) will join the Thunderbird team, and over time, K-9 Mail will become Thunderbird for Android.' -- source: https://arstechnica.com/gadgets/2022/06/email-client-k-9-mail-will-become-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Working To Provide Good Support For The VisionFive Low-Cost RISC-V Board
by Peter Reutemann 13 Jun '22

13 Jun '22

'"Ubuntu developers have been working on bringing up and improving support for the Starfive VisionFive," writes Phoronix, calling the $179 device "one of the most promising 'low-cost' RISC-V single board computers to date... intended to run full-blown RISC-V Linux distributions." The board comes in two varieties with 4GB or 8GB of system memory, powered by a dual-core SiFive U74 RV64 SoC @ 1.0GHz, an NVDLA deep learning accelerator engine, a Tensilica-VP6 Vision DSP, and a neural network engine.... Considering the performance of the much more capable HiFive Unmatched development board (that is also multiple times more expensive) and even that sometimes being outpaced by the Raspberry Pi, don't get too excited for the dual-core 1.0GHz RISC-V 64-bit SoC for general purpose workloads. But this VisionFive board may be interesting for some machine learning and other use-cases thanks to its additional accelerators. It's also one of the few RISC-V boards capable of running a full Linux distribution in the sub-$200 space. Since the upstream Linux 5.17 kernel there has been mainline support for the VisionFive v1 board. Ubuntu developers are working on enabling the StarFive VisionFive board for their RISC-V kernel build. ' -- source: https://linux.slashdot.org/story/22/06/12/1524230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox and Chrome are squaring off over ad-blocker extensions
by Peter Reutemann 12 Jun '22

12 Jun '22

'There’s a growing split over how much room browsers should leave for ad blocking — and Chrome and Firefox have ended up on opposite sides of the fight. The rupture centers on a feature called Web Request, commonly used in ad blockers and crucial for any system that looks to block off a domain wholesale. Google has long had security concerns about Web Request and has worked to cut it out of the most recent extension standard, called Manifest V3, or MV3 for short. But, in a recent blog post, Mozilla made clear that Firefox will maintain support for Web Request, keeping the door open for the most sophisticated forms of ad blocking. Google’s strategy has been roundly criticized by privacy advocates — the Electronic Frontier Foundation has been a vocal opponent — but the search company hasn’t been swayed. Though Firefox has a far smaller share of the desktop marketplace than Chrome, it could be a chance for Mozilla’s product to really define itself. For Google though, sticking with MV3 will have a huge impact on the overall role of ad blocking on the modern web. ' -- source: https://www.theverge.com/2022/6/10/23131029/mozilla-ad-blocking-firefox-goo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MIT Researchers Uncover 'Unpatchable' Flaw in Apple M1 Chips
by Peter Reutemann 12 Jun '22

12 Jun '22

'Apple's M1 chips have an "unpatchable" hardware vulnerability that could allow attackers to break through its last line of security defenses, MIT researchers have discovered. TechCrunch reports: The vulnerability lies in a hardware-level security mechanism utilized in Apple M1 chips called pointer authentication codes, or PAC. This feature makes it much harder for an attacker to inject malicious code into a device's memory and provides a level of defense against buffer overflow exploits, a type of attack that forces memory to spill out to other locations on the chip. Researchers from MIT's Computer Science and Artificial Intelligence Laboratory, however, have created a novel hardware attack, which combines memory corruption and speculative execution attacks to sidestep the security feature. The attack shows that pointer authentication can be defeated without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it. The attack, appropriately called "Pacman," works by "guessing" a pointer authentication code (PAC), a cryptographic signature that confirms that an app hasn't been maliciously altered. This is done using speculative execution -- a technique used by modern computer processors to speed up performance by speculatively guessing various lines of computation -- to leak PAC verification results, while a hardware side-channel reveals whether or not the guess was correct. What's more, since there are only so many possible values for the PAC, the researchers found that it's possible to try them all to find the right one.' -- source: https://apple.slashdot.org/story/22/06/11/0250238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HP releases its $1,099 Linux laptop for developers
by Peter Reutemann 11 Jun '22

11 Jun '22

'HP released its Dev One Linux laptop today. Aimed at coders, the 14-inch clamshell comes at a lower price than previous Ubuntu-based HP clamshells. Starting at $1,099, the Dev One begins to keep costs low by opting for an AMD, rather than Intel, CPU and skipping the discrete graphics card. HP's last Linux laptops, part of its ZBook workstation lineup, went well over $2,000 and offered up to Intel Xeon processors and Nvidia RTX GPUs.' -- source: https://arstechnica.com/gadgets/2022/06/hps-linux-based-amd-laptop-releases… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
by Peter Reutemann 10 Jun '22

10 Jun '22

'Researchers have unearthed a discovery that doesn’t occur all that often in the realm of malware: a mature, never-before-seen Linux backdoor that uses novel evasion techniques to conceal its presence on infected servers, in some cases even with a forensic investigation. On Thursday, researchers from Intezer and The BlackBerry Threat Research & Intelligence Team said that the previously undetected backdoor combines high levels of access with the ability to scrub any sign of infection from the file system, system processes, and network traffic. Dubbed Symbiote, it targets financial institutions in Brazil and was first detected in November.' -- source: https://arstechnica.com/information-technology/2022/06/novel-techniques-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Who Needs Modern Emacs?
by Peter Reutemann 08 Jun '22

08 Jun '22

'Every now and again I come across some discussion on making Emacs "modern". The argument always go more or less like this - Emacs doesn't look and behave like and the world will end if we don't copy something "crucial" from it. [...] If you ask me -- there's pretty much nothing we can do that would suddenly make Emacs as popular as VS Code. But you know what -- that's perfectly fine. After all there are plenty of "modern" editors that are even less popular than Emacs, so clearly being "modern" doesn't make you popular. And there's also our "arch-nemesis" vim, that's supposedly as "dated" as Emacs, but is extremely popular.' -- source: https://it.slashdot.org/story/22/06/07/1942258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1