- wlug - list.wlug.org.nz

Warnings That Work: Combating Misinformation Without Deplatforming
by Lawrence D'Oliveiro 29 Jul '21

29 Jul '21

How do you flag misleading postings on Facebook and elsewhere about vaccination, Covid-19 and other issues? Currently these platforms add a little warning next to the posting. Evidence accumulated over many years has shown that such “contextual” warnings are mostly disregarded. What does work is “interstitial” warnings: something that interrupts the user, and forces them to make a choice to continue. This works for security issues on PCs and when browsing the Internet; it can work for postings on social media, too. This article <https://freedom-to-tinker.com/2021/07/26/warnings-that-work-combating-misin…> goes into more details.

1 0

New On Bitsavers This/Last Week
by Lawrence D'Oliveiro 28 Jul '21

28 Jul '21

Among the recent additions to the Bitsavers retrocomputing archive is a scan of the Mt Xinu 1993 calendar <http://bitsavers.trailing-edge.com/pdf/mtXinu/1993_MT_XINU_Calendar.pdf>. On the flip side of each month’s page is a collection of clippings from some interestingly mythical magazines and newspapers. For example, a purported article on “How to eat a meal near a keyboard -- Safely!” hints at an implement that is both “a mouse AND a scrub-brush!”. The cover of a magazine targeted at “computer professionals” touts a report on “Strategic partnerships: What CEOs should know about space aliens” as well as “DOS removers, do they do what they claim?” And then there’s the ad for improving the productivity of your staff with a department-wide installation of a product called ... UrethraNet ...

1 0

The Debian usrmerge Package
by Lawrence D'Oliveiro 27 Jul '21

27 Jul '21

There is a package in Debian (and no doubt also in its derivatives) called “usrmerge” <https://wiki.debian.org/UsrMerge>. The mere act of installing this will perform a “usr merge” on your system, which means that the contents of /bin are merged with /usr/bin, with the former becoming just a symlink to the latter, and similarly /sbin merged into /usr/sbin, and /lib merged into /usr/lib. Back in the last century, when hard drives were smaller, it was standard practice to put only the minimum core of executables and libraries into /bin, /sbin and /lib that would allow the system to boot into a state where a sysadmin could perform some basic maintenance tasks. All the less crucial, but nice to have stuff, would be in /usr, which would be mounted as a separate disk or partition. This way, I suppose, problems with the /usr volume could be fixed without the entire system becoming unbootable. These days, such a division is considered an anachronism. Debian hasn’t supported booting without /usr available for a long while now. I think some other distros, like Fedora, made the move a long time ago. And if you have problems with your OS partition, it’s easier to boot and fix things with something like SystemRescueCD anyway. Note that the usr merge, once performed, is not (easily) reversible. Also note that new Debian installs have been creating a merged usr system since version 10.

1 0

Microsoft Warns of 'Evolving' LemonDuck Mining Malware Targeting Linux and Windows Machines
by Peter Reutemann 26 Jul '21

26 Jul '21

'The threat intelligence team for Microsoft's 365 Defender security suite recently focused on an example of "modern mining malware infrastructure," describing how "Anything that can gain access to machines — even so-called commodity malware — can bring in more dangerous threats." Specifically, it offered a case study of LemonDuck. The blog post's title? "When coin miners evolve..." Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity. LemonDuck's threat to enterprises is also in the fact that it's a cross-platform threat. It's one of a few documented bot malware families that targets Linux systems as well as Windows devices. It uses a wide range of spreading mechanisms — phishing emails, exploits, USB devices, brute force, among others — and it has shown that it can quickly take advantage of news, events, or the release of new exploits to run effective campaigns... Notably, LemonDuck removes other attackers from a compromised device by getting rid of competing malware and preventing any new infections by patching the same vulnerabilities it used to gain access... LemonDuck spreads in a variety of ways, but the two main methods are (1) compromises that are either edge-initiated or facilitated by bot implants moving laterally within an organization, or (2) bot-initiated email campaigns. LemonDuck acts as a loader for many other follow-on activities, but one if its main functions is to spread by compromising other systems. Since its first appearance, the LemonDuck operators have leveraged scans against both Windows and Linux devices for open or weakly authenticated SMB, Exchange, SQL, Hadoop, REDIS, RDP, or other edge devices that might be vulnerable to password spray or application vulnerabilities... Other common methods of infection include movement within the compromised environment, as well as through USB and connected drives. These processes are often kicked off automatically and have occurred consistently throughout the entirety of LemonDuck's operation.' -- source: https://linux.slashdot.org/story/21/07/25/2112228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Stops FTP Support in Firefox 90
by Peter Reutemann 25 Jul '21

25 Jul '21

'A post on Mozilla's security blog calls FTP "by now one of the oldest protocols still in use" — and it's suffering from "a number of serious security issues." The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user's device using the FTP protocol. Aligning with our intent to deprecate non-secure HTTP and increase the percentage of secure connections, we, as well as other major web browsers, decided to discontinue support of the FTP protocol. Removing FTP brings us closer to a fully-secure web which is on a path to becoming HTTPS only and any modern automated upgrading mechanisms such as HSTS or also Firefox's HTTPS-Only Mode, which automatically upgrade any connection to become secure and encrypted do not apply to FTP. The FTP protocol itself has been disabled by default since version 88 and now the time has come to end an era and discontinue the support for this outdated and insecure protocol — Firefox 90 will no longer support the FTP protocol.' -- source: https://news.slashdot.org/story/21/07/24/0213220 There is always FileZilla: https://filezilla-project.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Researchers Found a Malicious NPM Package Using Chrome's Password-Recovery Tools
by Peter Reutemann 25 Jul '21

25 Jul '21

'Threatpost reports on "another vast software supply-chain attack" that was "found lurking in the npm open-source code repository...a credentials-stealing code bomb" that used the password-recovery tools in Google's Chrome web browser. Researchers caught the malware filching credentials from Chrome on Windows systems. The password-stealer is multifunctional: It also listens for incoming commands from the attacker's command-and-control (C2) server and can upload files, record from a victim's screen and camera, and execute shell commands... ReversingLabs researchers, who published their findings in a Wednesday post, said that during an analysis of the code repository, they found an interesting embedded Windows executable file: a credential-stealing threat. Labeled "Win32.Infostealer.Heuristics", it showed up in two packages: nodejs_net_server and temptesttempfile. At least for now, the first, main threat is nodejs_net_server. Some details: nodejs_net_server: A package with 12 published versions and a total of more than 1,300 downloads since it was first published in February 2019...finally upgrading it last December with a script to download the password-stealer, which the developer hosts on a personal website. It was subsequently tweaked to run TeamViewer.exe instead, "probably because the author didn't want to have such an obvious connection between the malware and their website," researchers theorized... ReversingLabs contacted the npm security team on July 2 to give them a heads-up about the nodejs_net_server and tempdownloadtempfile packages and circled back once again last week, on Thursday, since the team still hadn't removed the packages from the repository. When Threatpost reached out to npm Inc., which maintains the repository, a GitHub spokesperson sent this statement: "Both packages were removed following our investigation...."' -- source: https://developers.slashdot.org/story/21/07/24/0152218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Reading about Firefox makes it seem a faster web browser than Chrome'
by Matthew Skiffington 25 Jul '21

25 Jul '21

Spotted in New Scientist, who sadly paywall everything. 'Going into the test, people overall tended to view Chrome as faster than Firefox (~39 per cent to ~31 per cent). While the researchers noted that many participants brought their own strong brand preferences, priming participants had an effect that overcame the inertia of that affinity. "When respondents read one of the priming articles, we saw a prevalence of the priming effect over brand preferences, providing support for the hypothesis that Firefox is faster after reading about Firefox improvements," the researchers said.' https://www.theregister.com/2021/03/11/mozilla_google_speed/ https://arxiv.org/abs/2103.06181 <https://www.theregister.com/2021/03/11/mozilla_google_speed/> Cognitive psychology + UX/UI, nifty. Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

'Update to Windows Defender will delete files Microsoft doesn't want to exist'
by Matthew Skiffington 23 Jul '21

23 Jul '21

Stumbled across something interesting on r/datahoarder, xpost from r/sysadmin. https://www.reddit.com/r/DataHoarder/comments/oopz4c/update_to_windows_defe… Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

Do Software Bugs Really Cost 100× More To Fix In Production Than In Testing?
by Lawrence D'Oliveiro 23 Jul '21

23 Jul '21

There is an oft-cited claim that if you let a bug get into production code, the cost of fixing it increases a hundredfold, compared to if you had flushed it out during testing. This report <https://www.theregister.com/2021/07/22/bugs_expense_bs/> looks into the basis of that claim, and it seems to originate from a book published in 1987, which gave it a reference “[IBM81]”, which was “course notes at the IBM System Sciences Institute”. Only there was no such “Institute”, it seems it was really just the name for an internal training program for IBM employees. It also seems a related claim, that “defects cost more to fix the later you fix them”, also has weak, if any, empirical support. Nowhere in there is the issue of “technical debt” addressed, though. That is real, and can be very costly, and its costs do increase over time.

1 0

Say hi to Microsoft's own Linux: CBL-Mariner
by Peter Reutemann 23 Jul '21

23 Jul '21

'Ok, so it's not named MS-Linux or Lindows, but Microsoft now has its very own, honest-to-goodness general-purpose Linux distribution: Common Base Linux, (CBL)-Mariner. And, just like any Linux distro, you can download it and run it yourself. Amazing isn't it? Why the next thing you know Microsoft will let you run Windows applications on Linux! Oh, wait it has!' -- source: https://www.zdnet.com/article/say-hi-to-microsofts-own-linux-cbl-mariner/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0