- wlug - list.wlug.org.nz

Word Of The Week: “Footgun”
by Lawrence D'Oliveiro 30 Jun '21

30 Jun '21

You know the phrase “shooting yourself in the foot” -- wielding a tool or capability with great power that, if not used carefully, has great capacity to cause harm, to the wielder and others. A “footgun” is a (mis)feature of some system that makes it more likely that this will happen. You thought security was an intrinsic feature of the container concept? Well, it seems <https://www.theregister.com/2021/06/29/newsblur_docker_ransomware/> Docker has long had an oddly insecure default setting, where network ports on a container are automatically punched through your kernel’s firewall settings, allowing access from the entire Internet. This is often not what you want.

1 0

Hackers exploited 0-day, not 2018 bug, to mass-wipe My Book Live devices
by Peter Reutemann 30 Jun '21

30 Jun '21

'Last week’s mass-wiping of Western Digital My Book Live storage devices involved the exploitation of not just one vulnerability but also a second critical security bug that allowed hackers to remotely perform a factory reset without a password, an investigation shows. The vulnerability is remarkable because it made it trivial to wipe what is likely petabytes of user data. More notable still was that, according to the vulnerable code itself, a Western Digital developer actively removed code that required a valid user password before allowing factory resets to proceed.' -- source: https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-bu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Python Implementation Pyston Aims To Speed Up the Programming Language's Code for Web Applications
by Peter Reutemann 30 Jun '21

30 Jun '21

'When Kevin Modzelewski and his colleagues at Dropbox set out to create Pyston in 2014, they had a very simple objective: to lower the costs of running Python code on Dropbox's servers, by making the code itself faster. "We were growing exponentially, so our server cost was growing exponentially," Modzelewski tells TechRepublic. "If we could get Python running faster, we would spend less money running Python." The original cost reduction initiative at Dropbox snowballed into a bigger project for Modzelewski when the company moved away from Python in 2017 and cancelled the Pyston project. He had realized while working on the language that there was a strong demand for faster Python among the developer community, and while there were plenty of tools around for improving the performance in smaller applications, there were none designed for big, business logic-type applications such as Dropbox. "There's a lot of tools out there for helping you run Python faster, but there weren't any that were a good fit for Dropbox's use case," says Modzelewski. "This was an area of the Python market where a lot of money was being spent, but not very many tools were being developed for helping. It was under served." Fast forward to today and Pyston is now in version 2.2, and has been open-sourced, with Modzelewski and fellow developer Marius Wachtler now leading the project as co-founders. The latest implementation promises a 30% performance improvement over Python 3.8.8, with a key benefit being that developers can simply drop their Python applications into Pyston and get going, without having to rewrite their code. It's also a "completely separate thing" to what Modzelewski and fellow developers built for Dropbox some seven years ago.' -- source: https://developers.slashdot.org/story/21/06/29/195244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Inside Neeva, the Ad-Free, Privacy-First Search Engine From ex-Googlers
by Peter Reutemann 30 Jun '21

30 Jun '21

'Sridhar Ramaswamy and Vivek Raghunathan helped turn Google into an ad giant. Now they're starting over with a service whose only customers are its users. From a report: A new search engine? One that people have to pay to use? At first blush, it may seem like a textbook example of a startup idea destined never to get anywhere. By definition, any new search engine competes with Google, whose 90 percent-plus market share leaves little oxygen for other players. And we've been accustomed to getting our search for free since well before there was a Google -- which might make paying for it sound like being expected to purchase a phone book. But Neeva is indeed a new search engine, officially launching today, that carries a subscription fee. Though it's extremely similar to Google in many respects -- with a few twists of its own -- it dumps the web giant's venerable ad-based business model in the interest of avoiding distractions, privacy quandaries, and other compromises. It's free for three months -- long enough for users to grow accustomed to it without obligation -- and $4.95 a month thereafter. Apps for iPhones and iPads, and browser extensions for Chrome, Firefox, Safari, Edge, and Brave, are part of the deal. Neeva may have a certain whiff of improbability about it, but its cofounders, Sridhar Ramaswamy and Vivek Raghunathan, are the furthest thing from naifs. Two long-time Google executives with more than a quarter-century of experience at the web giant between them, they have an insider's understanding of how it operates. Moreover, about 30 percent of the roughly 60-person staff they've assembled at Neeva consists of ex-Googlers, including Hall-of-Famers such as Udi Manber (a former head of Google search) and Darin Fisher (one of the inventors of Chrome). They've also secured $77.5 million in funding, including investments from venture-capital titans Greylock and Sequoia.' -- source: https://yro.slashdot.org/story/21/06/29/2017205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hubble Computer Trouble
by Lawrence D'Oliveiro 29 Jun '21

29 Jun '21

The Hubble Space Telescope is currently out of action, seemingly from a computer-related fault, though booting up the backup computer hasn’t made a difference (so far). In the meantime, here <https://www.theregister.com/2021/06/28/hubbles_cosmic_science_is_mindblowin…> is a retrospective on how that outermost of our sky-seeing eyes came to be, and what it has achieved. Born out of repurposed parts from an unneeded spy satellite? You might think that; those who know couldn’t possibly comment ... By the way, this description of the fault with the mirror And oh yes, that mirror. Younger readers won’t recall the shock at first light when a tiny mistake in its shape made the star of the show useless. Nobody’s saying how many spybirds were similarly afflicted, but where it mattered the most, Hubble was blind. is wrong. Hubble wasn’t blind, it was merely short-sighted. Those pictures that were supposed to have more detail than anything achievable from ground level were only fair-to-middling. I remember a visit to Waikato University in the early 1990s from a researcher in the US who was part of a team that was modelling the blurring effect of the mirror aberration, and applying it in reverse to sharpen up the images to something resembling the quality they were supposed to have. I think they were achieving some useful results. Eventually, of course, their work became unnecessary, as that wonder of eyeglass contraptions called COSTAR was installed.

1 0

Intel To Disable TSX By Default On More CPUs With New Microcode
by Peter Reutemann 29 Jun '21

29 Jun '21

'Intel is going to be disabling Transactional Synchronization Extensions (TSX) by default for various Skylake through Coffee Lake processors with forthcoming microcode updates. Phoronix reports: Transactional Synchronization Extensions (TSX) have been around since Haswell for hardware transactional memory support and going off Intel's own past numbers can be around 40% faster in specific workloads or as much 4~5 times faster in database transaction benchmarks. TSX issues have been found in the past such as a possible side channel timing attack that could lead to KASLR being defeated and CVE-2019-11135 (TSX Async Abort) for an MDS-style flaw. Now in 2021 Intel is disabling TSX by default across multiple families of Intel CPUs from Skylake through Coffee Lake. [...] The Linux kernel is preparing for this microcode change as seen in the flow of new patches this morning for the 5.14 merge window. A memory ordering issue is what is reportedly leading Intel to now deprecate TSX on various processors. There is this Intel whitepaper (PDF) updated this month that outlines the problem at length. As noted in the revision history, the memory ordering issue has been known to Intel since at least before October 2018 but only now in June 2021 are they pushing out microcode updates to disable TSX by default. With forthcoming microcode updates will effectively deprecate TSX for all Skylake Xeon CPUs prior to Stepping 5 (including Xeon D and 1st Gen Xeon Scalable), all 6th Gen Xeon E3-1500m v5 / E3-1200 v5 Skylake processors, all 7th/8th Gen Core and Pentium Kaby/Coffee/Whiskey CPUs prior to 0x8 stepping, and all 8th/9th Gen Core/Pentium Coffee Lake CPUs prior to 0xC stepping will be affected. That ultimately spans from various Skylake steppings through Coffee Lake; it was with 10th Gen Comet Lake and Ice Lake where TSX/TSX-NI was subsequently removed. In addition to disabling TSX by default and force-aborting all RTM transactions by default, a new CPUID bit is being enumerated with the new microcode to indicate that the force aborting of RTM transactions. It's due to that new CPUID bit that the Linux kernel is seeing patches. Previously Linux and other operating systems applied a workaround for the TSX memory ordering issue but now when this feature is disabled, the kernel can drop said workaround. These patches are coming with the Linux 5.14 cycle and will likely be back-ported to stable too.' -- source: https://hardware.slashdot.org/story/21/06/28/205240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation's New 'OVN Network' Pushes Open Standards for AI-Powered Voice Apps
by Peter Reutemann 29 Jun '21

29 Jun '21

'"Organizations are beginning to develop, design, and manage their own AI-powered voice assistant systems independent of platforms such as Siri and Alexa," reports VentureBeat: The transition is being driven by the desire to manage the entirety of the user experience and integrate voice assistance into multiple business processes and brand environments, from call centers to stores. In a recent survey of 500 IT and business decision-makers in the U.S., France, Germany, and the U.K., 28% of respondents said they were using voice technologies and 84% expect to be using them in the next year. To support the evolution, the Linux Foundation launched the Open Voice Network (OVN), an alliance advocating for the adoption of open standards across voice assistant apps in automobiles, smartphones, smart home devices, and more. With founding members Target, Schwarz Gruppe, Wegmans Food Markets, Microsoft, Veritone, Deutsche Telekom, and others, the OVN's goal — much like Amazon's Voice Interoperability Initiative — is to standardize the development and use of voice assistant systems and conversational agents that use technologies including automatic speech recognition, natural language processing, advanced dialog management, and machine learning... It was first announced as the Open Voice Initiative in 2019, but expanded significantly as the COVID-19 pandemic spurred enterprises to embrace digital transformation. "Voice is expected to be a primary interface to the digital world, connecting users to billions of sites, smart environments and AI bots ... Key to enabling enterprise adoption of these capabilities and consumer comfort and familiarity is the implementation of open standards," Mike Dolan, SVP and general manager of projects at the Linux Foundation, said in a statement. "The potential impact of voice on industries including commerce, transportation, healthcare, and entertainment is staggering and we're excited to bring it under the open governance model of the Linux foundation to grow the community and pave a way forward." Besides a focus on standards and technology-sharing, the group plans to collaborate with existing industry associations on regulatory/legislative issues — including data privacy."' -- source: https://news.slashdot.org/story/21/06/28/0051204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using VMs To Hide Ransomware Attacks is Becoming More Popular
by Peter Reutemann 29 Jun '21

29 Jun '21

'In early 2020, security researchers were baffled to discover that a ransomware gang had come up with an innovative trick that allowed it to run its payload inside virtual machines on infected hosts as a technical solution that bypassed security software. One year later, that technique has spread among the cybercrime underground and is now used by multiple ransomware operators. Initially seen with the Ragnar Locker gang in May 2020, the technique was also adopted by a Maze ransomware subgroup later in the year and has been recently spotted in attacks where the Conti and MountLocker ransomware strains were deployed. In hindsight, it should be no surprise that this technique is becoming more popular, as it has tangible benefits for any threat actor. The general idea behind such an attack is that a ransomware gang that has a small foothold on an infected host can download and install VM software. The ransomware gang will then start a VM instance, share the host computer's storage space with the VM, and then proceed to encrypt the victim's files from within the VM, where the host's antivirus software cannot reach and detect the ransomware during execution.' -- source: https://it.slashdot.org/story/21/06/28/1521220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.13 Kernel Released, Includes Apple M1 Support, Clang CFI, and Landlock's Linux Security Module
by Peter Reutemann 28 Jun '21

28 Jun '21

'"Linus Torvalds has just released the Linux 5.13 kernel as stable," reports Phoronix: Linux 5.13 brings initial but still early support for the Apple M1 with basic support but not yet accelerated graphics and a lot more to iron out moving ahead. There are also new Linux 5.13 security features like the Landlock security module, Clang control flow integrity support, and optionally randomizing the kernel stack offset at each system call. There is also AMD fun this cycle around FreeSync HDMI support, initial Aldebaran bring-up, and more. Intel has more work on Alder Lake, a new cooling driver, and more discrete graphics bring-up. There are also other changes for Linux 5.13 around faster IO_uring, a generic USB display driver, and other new hardware enablement. "5.13 overall is actually fairly large," Linus Torvalds posted on the Linux Kernel Mailing List, calling it "one of the bigger 5.x releases, with over 16,000 commits (over 17k if you count merges), from over 2,000 developers. But it's a "big all over" kind of thing, not something particular that stands out as particularly unusual..."' -- source: https://linux.slashdot.org/story/21/06/28/0026252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anti-Ransomware Technology ... But Where Have I Heard That Before?
by Lawrence D'Oliveiro 28 Jun '21

28 Jun '21

This report <https://blocksandfiles.com/2021/06/25/dell-technologies-capital-invests-in-…> describes a company called Calamu, whose “safe harbour” technology hashes, compresses, encrypts data, and then breaks it up into three fragments with redundancy. Then it re-encrypts them and stores them in in three separate locations, using different public clouds ... or local file systems. ... Calamu says Protect doesn’t store a complete file in any one location, giving customers full control over who can view their data — even if subpoenaed. That means it cannot be surreptitiously acquired by US law enforcement or intelligence agencies. Now, where have I heard that before? Oh yes ... <https://tahoe-lafs.org/trac/tahoe-lafs>.

1 0