- wlug - list.wlug.org.nz

Firewalls and Middleboxes Can Be Weaponized For Gigantic DDoS Attacks
by Peter Reutemann 18 Aug '21

18 Aug '21

'In an award-winning paper last week, academics said they discovered a way to abuse the TCP protocol, firewalls, and other network middleboxes to launch giant distributed denial of service (DDoS) attacks against any target on the internet. Authored by computer scientists from the University of Maryland and the University of Colorado Boulder, the research is the first of its kind to describe a method to carry out DDoS reflective amplification attacks via the TCP protocol, previously thought to be unusable for such operations. Making matters worse, researchers said the amplification factor for these TCP-based attacks is also far larger than UDP protocols, making TCP protocol abuse one of the most dangerous forms of carrying out a DDoS attack known to date and very likely to be abused in the future.' -- source: https://it.slashdot.org/story/21/08/17/1941202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Glibc Security Fix Created a Nastier Linux Bug
by Peter Reutemann 17 Aug '21

17 Aug '21

'A fix that was made in early June to the GNU C Library (glibc) introduced a new and nastier problem. Steven J. Vaughan-Nichols writes via ZDNet: The first problem wasn't that bad. As Siddhesh Poyarekar, a Red Hat principal software engineer wrote, "In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug." Still, it needed patching and so it was fixed. Alas, the fix contained an even nastier bug. While checking the patch, Nikita Popov, a member of the CloudLinux TuxCare Team, found the problem. It turns out that it is possible to cause a situation where a segmentation fault could be triggered within the library. This can lead to any application using the library crashing. This, of course, would cause a Denial-of-Service (DoS) issue. This problem, unlike the earlier one, would be much easier to trigger. Whoops. Red Hat gives the problem in its Common Vulnerability Scoring System (CVSS) a score of 7.5, which is "high." An attack using it would be easy to build and requires no privileges to be made. In short, it's bad news. Popov himself thinks "every Linux application including interpreters of other languages (python, PHP) is linked with glibc. It's the second important thing after the kernel itself, so the impact is quite high." [...] The good news is both the vulnerability and code fix have been submitted to the glibc development team. It has already been incorporated into upstream glibc. In addition, a new test has been submitted to glibc's automated test suite to pick up this situation and prevent it from happening in the future. The bottom line is sometimes changed in unrelated code paths can lead to behaviors changing elsewhere without the programmer realizing what's going on. This test will catch this situation. The Linux distributors are still working out the best way to deploy the fix. In the meantime, if you want to be extra careful -- and I think you should be -- you should upgrade to the newest stable version of glibc 2.34 or higher. ' -- source: https://it.slashdot.org/story/21/08/16/2131221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 11 'Bullseye' Released As Stable
by Peter Reutemann 16 Aug '21

16 Aug '21

'"One of the oldest and most renowned distributions of Linux has been released!" âwrites Slashdot reader Washuu2. Phoronix reports it took "just over two years in development." Debian 11 brings many new features as outlined this morning with the big upgrade to Linux 5.10 LTS, exFAT file-system support, control groups v2, yescrypt for password hashing, and a plethora of updated packages. GNOME 3.38, KDE Plasma 5.20, and Xfce 4.16 are among the desktop options for Debian 11. Debian.org adds: Do you want to celebrate the release? We provide some bullseye artwork that you can share or use as base for your own creations. Follow the conversation about bullseye in social media via the #ReleasingDebianBullseye and #Debian11Bullseye hashtags... Around the world, there were even several in-person and online release parties — with a few more upcoming!' -- source: https://linux.slashdot.org/story/21/08/15/171228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting this month
by Peter Reutemann 16 Aug '21

16 Aug '21

Hi everyone At this stage, we don't have any talk(s) lined up for our meeting this month. Anybody feeling like a quick show and tell about some software or project that they've been working on lately? Or another topic that they'd like to discuss? Thanks! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

“Androids”: A History Of The Development Of The Android Operating System
by Lawrence D'Oliveiro 15 Aug '21

15 Aug '21

Chet Haase, one of the Android engineers, has published a book called “Androids”, giving an account of the early development of the mobile OS. A review is here <https://arstechnica.com/gadgets/2021/08/review-androids-is-a-developer-comm…>, and an excerpt is here <https://arstechnica.com/information-technology/2021/08/excerpt-the-history-…>. Before Android the company got acquired by Google, they were shopping themselves around to various groups of venture capitalists. From the beginning, the platform was going to be built on Open Source components like the Linux kernel. So how were they going to make money, if the main part of the platform was being given away for free? The initial answer was to offer paid-for services that would be resold by the carriers. This whole idea went away after the Google acquisition. Interesting to review the state of play at the time Android Inc were pitching their new OS: Symbian had some support from different vendors, but surprisingly (to me, at least), it left the whole UI layer up to the device maker, with no attempt at standardization between vendors. How were you to write portable apps in that situation? No wonder it had limited uptake. Sun were offering Java ME for mobile devices, but again, this was subject to differing, not-quite-compatible “profiles” for different devices, further complicating the headache of writing code to run across those devices. As I understand it, it also ran just a single Java VM on the device which had to be shared across all applications, which made it totally unsuited to a modern multitasking OS. The Hiptop device from Danger, Inc also gets a mention. Not a few people considered it probably the best mobile device to come out up to that point. Not mentioned in the above is that Microsoft acquired Danger. But because its platform was built on Java, which Microsoft had an allergy to, they wasted 18 months of product development time excising the Java dependency, totally losing the window of opportunity for releasing a new device. When the Kin finally came out, it probably held the world record for some product category for the shortest time on the market before being heavily discounted in clearance sales (about a month). One key point is that, when Google acquired Android, they continued to let it run like an independent company, at least for the first few years. This allowed the innovation to continue to flourish ... at least for a while.

1 0

Fwd: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022
by Peter Reutemann 13 Aug '21

13 Aug '21

Apologies for cross-posting, but you might be interested in the call for papers outlined below. Cheers, Peter ---------- Forwarded message --------- From: Simon Lyall <simon(a)darkmere.gen.nz> Date: Thu, Aug 12, 2021 at 11:29 PM Subject: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> The Call for Proposals is now up for the Sysadmin Miniconf at Linux.conf.au 2022. The Miniconf is on January 14th and the rest of the conference is the 2 days afterwards. All events are online. We are looking for 30 minute long Operations-related talks. We'd particularly love your War Stories about responding to the global pandemic and general work for home, or how you avoided earning war stories. The good news is that all talks accepted to the Miniconf get a free ticket for the whole of the conference! The bad news is that the CFP closes in just over 3 weeks from now on September 5th. So don't delay getting your proposal in. See our long CFP for more details: https://sysadmin.miniconf.org/cfp22.html Then Register and Login the the Conference dashboard to submit a proposal: https://linux.conf.au/dashboard -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Centralization Versus Decentralization On The Internet
by Lawrence D'Oliveiro 12 Aug '21

12 Aug '21

A thoughtful, at times somewhat technical article <https://www.theregister.com/2021/08/11/decentralized_internet/> on the original philosophy of the designers of the Internet that nothing should be centralized, and how that was modified somewhat with the concept of “Software-Defined Networking”, without compromising the robustness of a decentralized underlying framework. The World-Wide Web, on the other hand, is a very different matter: rampant centralization, not just at the level of social-media networks and cloud services, but also at the lower layer of “Content-Delivery Networks” (CDNs) has led to the creation of way too many of what the engineers call SPOFs (“Single Points Of Failure”), where a breakdown in any of these can lead to a complete failure of any number of services that have become crucially dependent on them. Is the pendulum swinging away from centralization now? The author seems to think so; but I suspect the fat profit margins are still driving things in the wrong direction.

1 0

Firefox 91 Pushes Privacy With Stronger New Cookie-clearing Option
by Peter Reutemann 11 Aug '21

11 Aug '21

'WIth the release of Firefox 91 on Tuesday, Mozilla has introduced a bigger hammer for smashing the cookies that websites, advertisers and tracking companies can use to record your online behavior. From a report: The new feature, called enhanced cookie clearing, is designed to block tracking not just from a website, but also from third parties whose code appears on the site. The technology is designed to let you clear cookies for a particular website but also the more aggressive "supercookies" designed to evade lesser privacy protections. The feature is an option if you enable Firefox's strict mode for cookie handling, which partitions website data into separate storage containers. "You can easily recognize and remove all data a website has stored on your computer, without having to worry about leftover data from third parties embedded in that website," Mozilla said in a blog post. ' -- source: https://news.slashdot.org/story/21/08/10/1637219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." Just been looking at the DMARC overview <https://dmarc.org/overview/>, and I think there is some confusion here. What the University is doing is changing the recommended action for other MTAs receiving mail purporting to come _from_ the waikato.ac.nz domain, not the action it takes on receiving mail sent _to_ the waikato.ac.nz domain. In other words, this shouldn’t really make any difference to members of this list. If the systems that pick up their mail do DMARC checks, this shouldn’t matter (assuming the Uni sysadmins haven’t misconfigured anything ;)); if they don’t, it doesn’t matter anyway.

2 1

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." What was the effect of “quarantine” before? Would it have been causing delays in posts getting through? (Because I don’t think I noticed any on mine.) On a further look, I found the following header line in the echo of my last posting back to myself: spf=pass (google.com: best guess record for domain of ldo(a)geek-central.gen.nz designates 72.249.182.57 as permitted sender) So it seems like Google’s algorithms are smart enough to figure out that my mail is coming from an address associated with that domain.

2 1