- wlug - list.wlug.org.nz

Hackers got past Windows Hello by tricking a webcam
by Peter Reutemann 20 Jul '21

20 Jul '21

'Biometric authentication is a key piece of the tech industry's plans to make the world password-less. But a new method for duping Microsoft's Windows Hello facial-recognition system shows that a little hardware fiddling can trick the system into unlocking when it shouldn't. Services like Apple's FaceID have made facial-recognition authentication more commonplace in recent years, with Windows Hello driving adoption even farther. Apple only lets you use FaceID with the cameras embedded in recent iPhones and iPads, and it's still not supported on Macs at all. But because Windows hardware is so diverse, Hello facial recognition works with an array of third-party webcams. Where some might see ease of adoption, though, researchers from the security firm CyberArk saw potential vulnerability. That's because you can't trust any old webcam to offer robust protections in how it collects and transmits data. Windows Hello facial recognition works only with webcams that have an infrared sensor in addition to the regular RGB sensor. But the system, it turns out, doesn't even look at RGB data. Which means that with one straight-on infrared image of a target's face and one black frame, the researchers found that they could unlock the victim's Windows Hello–protected device. By manipulating a USB webcam to deliver an attacker-chosen image, the researchers could trick Windows Hello into thinking the device owner’s face was present and unlocking.' -- source: https://arstechnica.com/information-technology/2021/07/hackers-got-past-win… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Case Against SQL
by Peter Reutemann 19 Jul '21

19 Jul '21

'Long-time Slashdot reader RoccamOccam shares "an interesting take on SQL and its issues from Jamie Brandon (who describes himself as an independent researcher who's built database engines, query planners, compilers, developer tools and interfaces). It's title? "Against SQL." The relational model is great... But SQL is the only widely-used implementation of the relational model, and it is: Inexpressive, Incompressible, Non-porous. This isn't just a matter of some constant programmer overhead, like SQL queries taking 20% longer to write. The fact that these issues exist in our dominant model for accessing data has dramatic downstream effects for the entire industry: - Complexity is a massive drag on quality and innovation in runtime and tooling - The need for an application layer with hand-written coordination between database and client renders useless most of the best features of relational databases The core message that I want people to take away is that there is potentially a huge amount of value to be unlocked by replacing SQL, and more generally in rethinking where and how we draw the lines between databases, query languages and programming languages... I'd like to finish with this quote from Michael Stonebraker, one of the most prominent figures in the history of relational databases: "My biggest complaint about System R is that the team never stopped to clean up SQL... All the annoying features of the language have endured to this day. SQL will be the COBOL of 2020..." It's been interesting to follow the discussion on Twitter, where the post's author tweeted screenshots of actual SQL code to illustrate various shortcomings. But he also notes that "The SQL spec (part 2 = 1732) pages is more than twice the length of the Javascript 2021 spec (879 pages), almost matches the C++ 2020 spec (1853) pages and contains 411 occurrences of 'implementation-defined', occurrences which include type inference and error propagation." His Twitter feed also includes a supportive retweet from Rust creator Graydon Hoare, and from a Tetrane developer who says "The Rust of SQL remains to be invented. I would like to see it come."' -- source: https://developers.slashdot.org/story/21/07/18/1844225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

meeting next Monday (July 26th)
by Peter Reutemann 19 Jul '21

19 Jul '21

Hi everyone We have a WLUG meeting coming up next Monday (July 26th): 'Looking for a replacement of Dropbox or Google Drive that respects your privacy? Then come to our meeting, as Glenn will show you how to install, run and use the open-source solution Nextcloud (https://nextcloud.com/) on a Raspberry Pi and check out the various clients that you can use with it.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861069/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1.4 Million Cubans Bypass Censorship Using US Government-Funded Software Psiphon
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Cuban officials rallied tens of thousands of supporters in the streets on Saturday — nearly a week after they were stunned by the most widespread protests in decades," the Associated Press reports. President Miguel Díaz-Canel — accompanied by 90-year-old former President Raul Castro — "made an impassioned speech blaming unrest on the U.S. and its economic embargo, 'the blockade, aggression and terror... The enemy has returned to throw all it has at destroying the sacred unity and tranquility of the citizens.'" "I think the government is just trying to signal to people that it understands their desperation and that it's going to try to alleviate some of the misery that they're experiencing. The problem is that the government just doesn't have much in the way of resources that it can devote to doing that," said William LeoGrande, an expert on Cuba at the American University in the United States. Meanwhile, Reuters reports: Psiphon Inc's freely available internet censorship circumvention tool has helped nearly 1.4 million Cubans this week gain access to websites, the company said on Friday, after Cuba's government curbed access to popular social media and messaging platforms... Thousands of Cubans joined nationwide protests over shortages of basic goods, limits on civil liberties and the government's handling of a surge in COVID-19 infections on Sunday, the most significant unrest in decades in the communist-run country. Psiphon said 1.389 million users accessed the open web from Cuba through its network on Thursday, as well as 1.238 million as noon EDT (1600 GMT) on Friday. "Internet is ON; circumvention tools ARE working," Psiphon said in a statement. Psiphon said the roughly 1.4 million represents about 20% of Cuban internet users. Its open source circumvention tool can be downloaded from app stores like Google Play or Apple to "maximize your chances of bypassing censorship," according to the company. Canadian university researchers developed the software in 2007 to let users evade governmental internet firewalls. The censorship-circumvention tool — which combines VPN, SSH, and HTTP Proxy tools — has also been used in Iran, China, Belarus, Myanmar, according to recent news reports. Bloomberg notes that the Toronto-based nonprofit Psiphon "has received funding from the Open Technology Fund, a U.S. government nonprofit that aims to support global internet freedom technologies... "On Thursday, President Biden said the U.S. is examining whether it's able to restore internet access shut down by the Cuban government."' -- source: https://yro.slashdot.org/story/21/07/18/009221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon's Elasticsearch Fork 'OpenSearch' Reaches General Availability 1.0 Milestone
by Peter Reutemann 19 Jul '21

19 Jul '21

'Mike Melanson's "This Week in Programming" column shares an update on Amazon's ongoing battle with scalable data search solution ElasticSearch: Earlier this year, AWS completed its fork of ElasticSearch with the first release of OpenSearch. If you haven't followed along, the whole affair was a bit of a tug of war between AWS and Elastic, with AWS eventually coming out seemingly on top. After Elastic changed the licensing on ElasticSearch in an attempt to prevent AWS from selling a service based on the then-open-source project, AWS forked the project to release OpenSearch under Apache 2.0, effectively preserving its open source status. Now, OpenSearch has reached 1.0, which AWS says not only "marks the first production-ready version of OpenSearch," but also introduces "multiple new enhancements," such as data streams, trace analytics span filtering, report scheduling and more. The 1.0 release also involved quite a bit of code cleanup, removing proprietary code and marks, and adds the ability to upgrade from ElasticSearch to OpenSearch as if you were performing a normal upgrade of ElasticSearch. If you're interested in learning where the project is going, head on over to the public roadmap to learn more. ' -- source: https://news.slashdot.org/story/21/07/18/1656208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will a New Law Help the Chinese Government Stockpile Zero-Days?
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Starting September 1, 2021, the Chinese government will require that any Chinese citizen who finds a zero-day vulnerability must pass the details to the Chinese government," reports SecurityWeek, "and must not sell or give the knowledge to any third-party outside of China (apart from the vulnerable product's manufacturer)." Brief details are provided in a report by the Associated Press (AP) published Tuesday, July 13, 2021. No source is provided beyond the statement, "No one may 'collect, sell or publish information on network product security vulnerabilities,' say the rules issued by the Cyberspace Administration of China and the police and industry ministries...." AP describes this action as "further tightening the Communist Party's control over information". This is unlikely to be the primary motivation for the new rule since the government already has a vice-like grip on data. Companies may not store data on Chinese customers outside of China. Foreign companies selling routers and some other network devices in China must disclose to regulators how any encryption features work. "I would expect the Chinese Government to weaponize any discovered security vulnerabilities to enhance China's cybersecurity capabilities," Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, tells SecurityWeek. And Jake Williams, co-founder and CTO at BreachQuest adds that "the defensive advantages of Chinese government organizations being able to mitigate vulnerabilities discovered may well outweigh any offensive gains...." But he also believes this could rebound against China. "One of the biggest likely issues is brain drain. If Chinese researchers can profit handsomely from their work anywhere else, but can't do so in China, why would they stay? This probably helps China in the short term but harms them in the long term." The new law does encourage network operators and product vendors to set up a reward mechanism for reported vulnerabilities, according to the Record. But Katie Moussouris, founder and CEO of Luta Security, also raises the issue of western-based bug bounty platforms that have been working with Chinese security researchers for the past years. "If Western-based bug bounty platforms comply with this requirement in order to continue to legally receive bug reports from Chinese researchers, we must assume they will be required to hand over vulnerability data to the Ministry within two days of receiving the reports," Moussouris said. "That requirement will effectively introduce a backdoor straight to the Chinese government in any VDP [vulnerability disclosure program] or bug bounty program where Chinese researchers submit bugs via platforms, even to non-Chinese companies."' -- source: https://it.slashdot.org/story/21/07/18/2143207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hey Google: It’s Not (Just) A Joke
by Lawrence D'Oliveiro 14 Jul '21

14 Jul '21

Looking at this list <https://www.nzherald.co.nz/entertainment/the-best-inappropriate-and-annoyin…> of complaints about ads that didn’t get far with the Advertising Standards Authority, one stood out for me: The complaint: One avid Google Assistant user was very riled by this ad, explaining that when the shop assistant asks "Hey Google", it ended up triggering every Google smart device in his home. "I have 10 such devices in the house which includes smart speakers, smart displays and Chromecast which all respond to the advert," they write. "This is not only highly annoying, but also a deliberate attempt to trigger these devices." Yes, it seems it really does happen ... (Though I think the award for most nitpicking has to go to the “Clair de Lune” one.)

1 0

Speed Up Microsoft Teams By Bypassing Antivirus Checks
by Lawrence D'Oliveiro 13 Jul '21

13 Jul '21

Microsoft’s official recommendation <https://github.com/MicrosoftDocs/OfficeDocs-SkypeForBusiness/blob/9df8f4069…> for improving the performance of Teams on Windows is to exclude it from antivirus checks: Add the following Teams programs to your antivirus safe list. %localappdata%\Microsoft\Teams\current\Teams.exe %localappdata%\Microsoft\Teams\Update.exe Add the following Teams folders to your antivirus safe list. %localappdata%\Microsoft\Teams %appdata%\Microsoft\Teams| Because antivirus software only exists to slow your system down, right? (Found from this <https://forums.theregister.com/forum/all/2021/07/12/windows_11_still_doesnt…> reader comment.)

2 1

Libre-SOC's Open Hardware 180nm ASIC Submitted To IMEC for Fabrication
by Peter Reutemann 11 Jul '21

11 Jul '21

'"We're building a chip. A fast chip. A safe chip. A trusted chip," explains the web page at Libre-SOC.org. "A chip with lots of peripherals. And it's VPU. And it's a 3D GPU... Oh and here, have the source code." And now there's big news, reports long-time Slashdot reader lkcl: Libre-SOC's entirely Libre 180nm ASIC, which can be replicated down to symbolic level GDS-II with no NDAs of any kind, has been submitted to IMEC for fabrication. It is the first wholly-independent Power ISA ASIC outside of IBM to go Silicon in 12 years. Microwatt went to Skywater 130nm in March; however, it is also developed by IBM, as an exceptionally well-made Reference Design, which Libre-SOC used for verification. Whilst it would seem that Libre-SOC is jumping on the chip-shortage era's innovation bandwagon, Libre-SOC has actually been in development for over three and a half years so far. It even pre-dates the OpenLane initiative, and has the same objectives: fully automated HDL to GDS-II, full transparency and auditability with Libre VLSI tools Coriolis2 and Libre Cell Libraries from Chips4Makers. With €400,000 in funding from the NLNet Foundation [a long-standing non-profit supporting privacy, security, and the "open internet"], plus an application to NGI Pointer under consideration, the next steps are to continue development of Draft Cray-style Vectors (SVP64) to the already supercomputer-level Power ISA, under the watchful eye of the upcoming OpenPOWER ISA Workgroup.' -- source: https://hardware.slashdot.org/story/21/07/10/0154220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Edge Beats Firefox To Become the Third-Most Popular Browser
by Peter Reutemann 11 Jul '21

11 Jul '21

'"New data from Statcounter shows that Edge has now overtaken established rival Firefox in the rankings," reports TechRadar: In recent months, the pair have been neck-and-neck, but Microsoft's browser has now put daylight between itself and Firefox. Figures for June suggest Microsoft Edge now holds 3.4% of the browser market, while Firefox has slipped to 3.29%, continuing a downward trajectory that has seen the browser either lose or maintain market share in ten of the last twelve months. The change pushes Edge into third position in the browser rankings, behind only Chrome (65.27%) and Safari (18.34%). Launched in January 2020, the new Chromium-based Edge got off to a slow start, but began to gather momentum as the year progressed. Since last summer, the browser's market share has more than tripled. The increase in adoption can be attributed in part to renewed marketing efforts, but also to improvements that brought the experience in line with other modern web browsers. That may be true, but the article also acknowledges that it was just last month that Microsoft began rolling out Edge to all Windows PCs (via Windows 10 updates), "expanding the install base by millions almost overnight. "Now, Microsoft is doing everything in its power to encourage users to abandon Internet Explorer in favor of Edge, such as removing support for Microsoft 365 web apps and automatically launching certain web pages in the new browser."' -- source: https://news.slashdot.org/story/21/07/10/0353201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0