- wlug - list.wlug.org.nz

Security Versus Requirements For Internationalization
by Lawrence D'Oliveiro 01 Aug '21

01 Aug '21

Yet another incident <https://arstechnica.com/gadgets/2021/07/with-help-from-google-impersonated-…> of substituting characters with different diacritic marks in a domain name to fool people into visiting the wrong site. Seems this problem is fundamentally unfixable. We need the ability to represent words in non-English languages, simply because the world does not revolve around the English language. And differences in meanings of words just from mixing up those diacritics can sometimes be quite major.

1 0

New Android Malware Records Smartphones via VNC To Steal Passwords
by Peter Reutemann 30 Jul '21

30 Jul '21

'Security researchers have discovered a novel piece of Android malware that uses the VNC technology to record and broadcast a victim's smartphone activity, allowing threat actors to collect keyboard presses and app passwords. From a report: First spotted in March 2021 by Dutch security firm ThreatFabric, this new piece of malware, named Vultur, is a departure from other Android malware strains that usually rely on fake login screens floating on top of legitimate apps to collect a victim's credentials. Instead, Vultur opens a VNC server on the infected phone, and broadcasts screen captures to an attacker command and control server, where the Vultur operator extracts passwords for desired apps.' -- source: https://it.slashdot.org/story/21/07/29/1549220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Warnings That Work: Combating Misinformation Without Deplatforming
by Lawrence D'Oliveiro 29 Jul '21

29 Jul '21

How do you flag misleading postings on Facebook and elsewhere about vaccination, Covid-19 and other issues? Currently these platforms add a little warning next to the posting. Evidence accumulated over many years has shown that such “contextual” warnings are mostly disregarded. What does work is “interstitial” warnings: something that interrupts the user, and forces them to make a choice to continue. This works for security issues on PCs and when browsing the Internet; it can work for postings on social media, too. This article <https://freedom-to-tinker.com/2021/07/26/warnings-that-work-combating-misin…> goes into more details.

1 0

New On Bitsavers This/Last Week
by Lawrence D'Oliveiro 28 Jul '21

28 Jul '21

Among the recent additions to the Bitsavers retrocomputing archive is a scan of the Mt Xinu 1993 calendar <http://bitsavers.trailing-edge.com/pdf/mtXinu/1993_MT_XINU_Calendar.pdf>. On the flip side of each month’s page is a collection of clippings from some interestingly mythical magazines and newspapers. For example, a purported article on “How to eat a meal near a keyboard -- Safely!” hints at an implement that is both “a mouse AND a scrub-brush!”. The cover of a magazine targeted at “computer professionals” touts a report on “Strategic partnerships: What CEOs should know about space aliens” as well as “DOS removers, do they do what they claim?” And then there’s the ad for improving the productivity of your staff with a department-wide installation of a product called ... UrethraNet ...

1 0

The Debian usrmerge Package
by Lawrence D'Oliveiro 27 Jul '21

27 Jul '21

There is a package in Debian (and no doubt also in its derivatives) called “usrmerge” <https://wiki.debian.org/UsrMerge>. The mere act of installing this will perform a “usr merge” on your system, which means that the contents of /bin are merged with /usr/bin, with the former becoming just a symlink to the latter, and similarly /sbin merged into /usr/sbin, and /lib merged into /usr/lib. Back in the last century, when hard drives were smaller, it was standard practice to put only the minimum core of executables and libraries into /bin, /sbin and /lib that would allow the system to boot into a state where a sysadmin could perform some basic maintenance tasks. All the less crucial, but nice to have stuff, would be in /usr, which would be mounted as a separate disk or partition. This way, I suppose, problems with the /usr volume could be fixed without the entire system becoming unbootable. These days, such a division is considered an anachronism. Debian hasn’t supported booting without /usr available for a long while now. I think some other distros, like Fedora, made the move a long time ago. And if you have problems with your OS partition, it’s easier to boot and fix things with something like SystemRescueCD anyway. Note that the usr merge, once performed, is not (easily) reversible. Also note that new Debian installs have been creating a merged usr system since version 10.

1 0

Microsoft Warns of 'Evolving' LemonDuck Mining Malware Targeting Linux and Windows Machines
by Peter Reutemann 26 Jul '21

26 Jul '21

'The threat intelligence team for Microsoft's 365 Defender security suite recently focused on an example of "modern mining malware infrastructure," describing how "Anything that can gain access to machines — even so-called commodity malware — can bring in more dangerous threats." Specifically, it offered a case study of LemonDuck. The blog post's title? "When coin miners evolve..." Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity. LemonDuck's threat to enterprises is also in the fact that it's a cross-platform threat. It's one of a few documented bot malware families that targets Linux systems as well as Windows devices. It uses a wide range of spreading mechanisms — phishing emails, exploits, USB devices, brute force, among others — and it has shown that it can quickly take advantage of news, events, or the release of new exploits to run effective campaigns... Notably, LemonDuck removes other attackers from a compromised device by getting rid of competing malware and preventing any new infections by patching the same vulnerabilities it used to gain access... LemonDuck spreads in a variety of ways, but the two main methods are (1) compromises that are either edge-initiated or facilitated by bot implants moving laterally within an organization, or (2) bot-initiated email campaigns. LemonDuck acts as a loader for many other follow-on activities, but one if its main functions is to spread by compromising other systems. Since its first appearance, the LemonDuck operators have leveraged scans against both Windows and Linux devices for open or weakly authenticated SMB, Exchange, SQL, Hadoop, REDIS, RDP, or other edge devices that might be vulnerable to password spray or application vulnerabilities... Other common methods of infection include movement within the compromised environment, as well as through USB and connected drives. These processes are often kicked off automatically and have occurred consistently throughout the entirety of LemonDuck's operation.' -- source: https://linux.slashdot.org/story/21/07/25/2112228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Stops FTP Support in Firefox 90
by Peter Reutemann 25 Jul '21

25 Jul '21

'A post on Mozilla's security blog calls FTP "by now one of the oldest protocols still in use" — and it's suffering from "a number of serious security issues." The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user's device using the FTP protocol. Aligning with our intent to deprecate non-secure HTTP and increase the percentage of secure connections, we, as well as other major web browsers, decided to discontinue support of the FTP protocol. Removing FTP brings us closer to a fully-secure web which is on a path to becoming HTTPS only and any modern automated upgrading mechanisms such as HSTS or also Firefox's HTTPS-Only Mode, which automatically upgrade any connection to become secure and encrypted do not apply to FTP. The FTP protocol itself has been disabled by default since version 88 and now the time has come to end an era and discontinue the support for this outdated and insecure protocol — Firefox 90 will no longer support the FTP protocol.' -- source: https://news.slashdot.org/story/21/07/24/0213220 There is always FileZilla: https://filezilla-project.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Researchers Found a Malicious NPM Package Using Chrome's Password-Recovery Tools
by Peter Reutemann 25 Jul '21

25 Jul '21

'Threatpost reports on "another vast software supply-chain attack" that was "found lurking in the npm open-source code repository...a credentials-stealing code bomb" that used the password-recovery tools in Google's Chrome web browser. Researchers caught the malware filching credentials from Chrome on Windows systems. The password-stealer is multifunctional: It also listens for incoming commands from the attacker's command-and-control (C2) server and can upload files, record from a victim's screen and camera, and execute shell commands... ReversingLabs researchers, who published their findings in a Wednesday post, said that during an analysis of the code repository, they found an interesting embedded Windows executable file: a credential-stealing threat. Labeled "Win32.Infostealer.Heuristics", it showed up in two packages: nodejs_net_server and temptesttempfile. At least for now, the first, main threat is nodejs_net_server. Some details: nodejs_net_server: A package with 12 published versions and a total of more than 1,300 downloads since it was first published in February 2019...finally upgrading it last December with a script to download the password-stealer, which the developer hosts on a personal website. It was subsequently tweaked to run TeamViewer.exe instead, "probably because the author didn't want to have such an obvious connection between the malware and their website," researchers theorized... ReversingLabs contacted the npm security team on July 2 to give them a heads-up about the nodejs_net_server and tempdownloadtempfile packages and circled back once again last week, on Thursday, since the team still hadn't removed the packages from the repository. When Threatpost reached out to npm Inc., which maintains the repository, a GitHub spokesperson sent this statement: "Both packages were removed following our investigation...."' -- source: https://developers.slashdot.org/story/21/07/24/0152218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Reading about Firefox makes it seem a faster web browser than Chrome'
by Matthew Skiffington 25 Jul '21

25 Jul '21

Spotted in New Scientist, who sadly paywall everything. 'Going into the test, people overall tended to view Chrome as faster than Firefox (~39 per cent to ~31 per cent). While the researchers noted that many participants brought their own strong brand preferences, priming participants had an effect that overcame the inertia of that affinity. "When respondents read one of the priming articles, we saw a prevalence of the priming effect over brand preferences, providing support for the hypothesis that Firefox is faster after reading about Firefox improvements," the researchers said.' https://www.theregister.com/2021/03/11/mozilla_google_speed/ https://arxiv.org/abs/2103.06181 <https://www.theregister.com/2021/03/11/mozilla_google_speed/> Cognitive psychology + UX/UI, nifty. Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

'Update to Windows Defender will delete files Microsoft doesn't want to exist'
by Matthew Skiffington 23 Jul '21

23 Jul '21

Stumbled across something interesting on r/datahoarder, xpost from r/sysadmin. https://www.reddit.com/r/DataHoarder/comments/oopz4c/update_to_windows_defe… Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1