- wlug - list.wlug.org.nz

OpenWRT Forum User Data Stolen In Weekend Data Breach
by Peter Reutemann 19 Jan '21

19 Jan '21

'The OpenWRT forum, a large community of enthusiasts of alternative, open-source operating systems for routers, announced a data breach over the weekend. Bleeping Computer reports: The attack occurred on Saturday, around 04:00 (GMT), when an unauthorized third party gained admin access to and copied a list with details about forum users and related statistical information. The intruder used the account of an OpenWRT administrator. Although the account had "a good password," additional security provided by two-factor authentication (2FA) was not active. Email addresses and handles of the forum users have been stolen, the moderators say. They add that they believe the attacker was not able to download the forum database, meaning that passwords should be safe. However, they reset all the passwords on the forum just to be on the safe side and invalidated all the API keys used for project development processes. Users have to set the new password manually from the login menu by providing their user name and following the "get a new password" instructions. Those logging in using GitHub credentials are advised to reset or refresh it. The OpenWRT forum credentials are separate from the Wiki. Currently, there is no suspicion that the Wiki credentials have been compromised in any way. OpenWRT forum administrators warn that since this breach exposed email addresses, users may become targets of credible phishing attempts. ' -- source: https://it.slashdot.org/story/21/01/18/2148210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Surpasses 100 Million Daily Search Queries For the First Time
by Peter Reutemann 19 Jan '21

19 Jan '21

'Privacy-focused search engine DuckDuckGo reached a major milestone in its 12-year-old history last week when it recorded on Monday its first-ever day with more than 100 million user search queries. From a report: The achievement comes after a period of sustained growth the company has been seeing for the past two years, and especially since August 2020, when the search engine began seeing more than 2 billion search queries a month on a regular basis. The numbers are small in comparison to Google's 5 billion daily search queries but it's a positive sign that users are looking for alternatives. DuckDuckGo's popularity comes after the search engine has expanded beyond its own site and now currently offers mobile apps for Android and iOS, but also a dedicated Chrome extension. More than 4 million users installed these apps and extension, the company said in a tweet in September 2020.' -- source: https://tech.slashdot.org/story/21/01/18/1450258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 18 Jan '21

18 Jan '21

Hi everyone Just a reminder that our AGM is coming up next week: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Tim Berners-Lee Will Fix the Internet
by Peter Reutemann 18 Jan '21

18 Jan '21

'"Sir Tim Berners-Lee, the British computer scientist who was knighted for inventing the internet navigation system known as the World Wide Web, wants to re-make cyberspace once again," reports Reuters: With a new startup called Inrupt, Berners-Lee aims to fix some of the problems that have handicapped the so-called open web in an age of huge, closed platforms such as Facebook. Building on ideas developed by an open-source software project called Solid, Inrupt promises a web where people can use a single sign-on for any service and personal data is stored in "pods," or personal online data stores, controlled by the user. "People are fed up with the lack of controls, the silos," said Berners-Lee, co-founder and chief technology officer of Inrupt, in an interview at the Reuters Next conference... John Bruce, a veteran technology executive who is CEO of Inrupt, said the company had signed up Britain's National Health Service, the BBC and the government of Flanders in Belgium as pilot customers, and hoped to announce many more by April... A key aim for Inrupt is to get software developers to write programs for the platform. Inrupt, like the original web, is at its core mostly a set of protocols for how machines talk to one another, meaning that specific applications bring it to life. "The use cases are so broad, it's like a do-over for the web," Berners-Lee said. In a video interview, Berners-Lee tells Reuters that what people are worried about isn't privacy per se but "the lack of empowerment" — for example, to collaborate with people. And then he acknowledges that the worldwide web does suffer from limited access control. "I wanted it to be a collaborative space, but in a way that was naive, because collaborative spaces you need to be private. You need to start off with just a limited sharing, and then you allow the sharing to increase." Social networks provided some features like a unique login and identity. But unfortunately, then "The large social networks will tend to get larger" — and ultimately without a single global signon, users then become trapped in separate silos.' -- source: https://tech.slashdot.org/story/21/01/16/2336244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Jamie Zawinski Calls Cinnamon Screensaver Lock-Bypass Bug 'Unconscionable'
by Peter Reutemann 18 Jan '21

18 Jan '21

'Legendary programmer Jamie Zawinski has worked on everything from the earliest releases of the Netscape Navigator browser to XEmacs, Mozilla, and, of course, the XScreenSaver project. Now Slashdot reader e432776 writes: JWZ continues to track issues with screensavers on Linux (since 2004!), and discusses a new bug in cinnamon-screensaver. Long-standing topics like X11, developer interaction, and code licensing all feature. Solutions to these long-standing issues remain elusive. Jamie titled his blog post "I told you so, 2021 edition": You will recall that in 2004 , which is now seventeen years ago, I wrote a document explaining why I made the design trade-offs that I did in XScreenSaver, and in that document I predicted this exact bug as my example of, "this is what will happen if you don't do it this way." And they went and made that happen. Repeatedly. Every time this bug is re-introduced, someone pipes up and says something like, "So what, it was a bug, they've fixed it." That's really missing the point. The point is not that such a bug existed, but that such a bug was even possible. The real bug here is that the design of the system even permits this class of bug. It is unconscionable that someone designing a critical piece of security infrastructure would design the system in such a way that it does not fail safe . Especially when I have given them nearly 30 years of prior art demonstrating how to do it right, and a two-decades-old document clearly explaining What Not To Do that coincidentally used this very bug as its illustrative strawman! These bugs are a shameful embarrassment of design -- as opposed to merely bad code... ZDNet reports that Linux Mint has issued a patch for Cinnamon that fixes the screensaver bug. But HotHardware notes that it was discovered when "one Dad let the kids play with the keyboard. This button-mashing actually crashed the machine's screensaver by sheer luck, allowing them onto the desktop, ultimately leading to the discovery of a high priority security vulnerability for the Linux Mint team." But that's not the only thing bothering Jamie Zawinski: Just to add insult to injury, it has recently come to my attention that not only are Gnome-screensaver, Mint-screensaver and Cinnamon-screensaver buggy and insecure dumpster fires, but they are also in violation of my license and infringing my copyright. XScreenSaver was released under the BSD license, one of the oldest and most permissive of the free software licenses. It turns out, the Gnome-screensaver authors copied large parts of XScreenSaver into their program, removed the BSD license and slapped a GPL license on my code instead -- and also removed my name. Rude... Mint-screensaver and Cinnamon-screensaver, being forks and descendants of Gnome-screensaver, have inherited this license violation and continue to perpetuate it. Every Linux distro is shipping this copyright- and license-infringing code. I eagerly await hearing how they're going to make this right.' -- source: https://tech.slashdot.org/story/21/01/17/0024243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With Jon “maddog” Hall
by Lawrence D'Oliveiro 17 Jan '21

17 Jan '21

Been watching this nearly-hour-long conversation <https://www.youtube.com/watch?v=EZMA3Ge144U> with Jon “maddog” Hall, who if you don’t know him, was very likely the inspiration for the famous Dilbert cartoon featuring the Unix-using neckbeard telling the corporate jobsworth to “get a better computer” <https://dilbert.com/strip/1995-06-24>. Seems that there were several round-number anniversaries related to Unix coming due in 2019 (the year after the video was made), including the 50th anniversary of its creation at Bell Labs. After an early career on IBM mainframe equipment, maddog got a job as a sysadmin at Bell Labs, where he was introduced to Unix. Then he did various different jobs over many years at DEC. At about the half-hour mark, he talks about how he met Linus Torvalds, and asked the latter about porting his still-only-32-bit x86-only fledgling Linux kernel onto the 64-bit Alpha architecture. Linus wanted to do this, but he couldn’t get an Alpha machine from the Helsinki DEC office. So maddog went to bat, pulled a few strings, and got one for him. And it took just 9 months to take Linux from being x86-only and 32-bit-only to being cross-platform and 64-bit-native.

1 0

Windows 10 Bug Corrupts Your Hard Drive On Seeing This File's Icon
by Peter Reutemann 15 Jan '21

15 Jan '21

'An unpatched zero-day in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command. Bleeping Computer reports: In August 2020, October 2020, and finally this week, infosec researcher Jonas L drew attention to an NTFS vulnerability impacting Windows 10 that has not been fixed. When exploited, this vulnerability can be triggered by a single-line command to instantly corrupt an NTFS-formatted hard drive, with Windows prompting the user to restart their computer to repair the corrupted disk records. The researcher told BleepingComputer that the flaw became exploitable starting around Windows 10 build 1803, the Windows 10 April 2018 Update, and continues to work in the latest version. What's worse is, the vulnerability can be triggered by standard and low privileged user accounts on Windows 10 systems. [...] It is unclear why accessing this attribute corrupts the drive, and Jonas told BleepingComputer that a Registry key that would help diagnose the issue doesn't work. One striking finding shared by Jonas with us was that a crafted Windows shortcut file (.url) that had its icon location set to C:\:$i30:$bitmap would trigger the vulnerability even if the user never opened the file! As observed by BleepingComputer, as soon as this shortcut file is downloaded on a Windows 10 PC, and the user views the folder it is present in, Windows Explorer will attempt to display the file's icon. To do this, Windows Explorer would attempt to access the crafted icon path inside the file in the background, thereby corrupting the NTFS hard drive in the process. Next, "restart to repair hard drive" notifications start popping up on the Windows PC -- all this without the user even having opened or double-clicked on the shortcut file. ' -- source: https://hardware.slashdot.org/story/21/01/14/232238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BeagleV is a $150 RISC-V Computer Designed To Run Linux
by Peter Reutemann 15 Jan '21

15 Jan '21

'Seeed Studios -- the makers of the Odyssey mini-PC -- have teamed up with well-known SBC vendor BeagleBoard to produce an affordable RISC-V system designed to run Linux. The new BeagleV (pronounced "Beagle Five") system features a dual-core, 1GHz RISC-V CPU made by StarFive -- one of a network of RISC-V startups created by better-known RISC-V vendor SiFive. The CPU is based on two of SiFive's U74 Standard Cores -- and unlike simpler microcontroller-only designs, it features a MMU and all the other trimmings necessary to run full-fledged modern operating systems such as Linux distributions. StarFive's VIC7100 processor design is aimed at edge AI tasks as well as general-purpose computing. In addition to the two RISC-V CPU cores, it features a Tensilica Vision VP6 DSP for machine-vision applications, a Neural Network Engine, and a single-core NVDLA (Nvidia Deep Learning Accelerator) engine.' -- source: https://hardware.slashdot.org/story/21/01/13/1928249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Reveals Sophisticated Windows and Android Hacking Operation
by Peter Reutemann 15 Jan '21

15 Jan '21

'Google published a six-part report this week detailing a sophisticated hacking operation that the company detected in early 2020 and which targeted owners of both Android and Windows devices. >From a report: The attacks were carried out via two exploit servers delivering different exploit chains via watering hole attacks, Google said. "One server targeted Windows users, the other targeted Android," Project Zero, one of Google's security teams, said in the first of six blog posts. Google said that both exploit servers used Google Chrome vulnerabilities to gain an initial foothold on victim devices. Once an initial entry point was established in the user's browsers, attackers deployed an OS-level exploit to gain more control of the victim's devices. The exploit chains included a combination of both zero-day and n-day vulnerabilities, where zero-day refers to bugs unknown to the software makers, and n-day refers to bugs that have been patched but are still being exploited in the wild.' -- source: https://tech.slashdot.org/story/21/01/14/1610220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10X for Single Screens Leaks
by Peter Reutemann 15 Jan '21

15 Jan '21

'Just ahead of its launch for commercial PC-like devices, an install image of Windows 10X for single screens has leaked, giving us an early peek at Microsoft's new OS. And yes, it's just like Chrome OS. From a report: Let's just get that out of the way. Microsoft has been working for years on a Chromebook competitor, but it has been largely unsuccessful. Windows 10 S, which was originally called Windows 10 Cloud, was Terry Myerson's approach, and that, of course, crashed and burned, in part because it looked identical to Windows 10 but couldn't run downloaded Windows 10 desktop applications. And now we have Windows 10X. Microsoft tried to hide its true intent with this product by pretending last year that it was aimed at a new generation of dual-display PCs, but the software giant really created 10X to compete with Chrome OS on inexpensive single-display PCs. So after failing to get its container-based Windows desktop application compatibility solution to work, Microsoft scaled back and repositioned Windows 10X as was originally intended: It will now ship only on new traditional PCs aimed at education and other commercial markets.' -- source: https://tech.slashdot.org/story/21/01/14/1657218 Wouldn't be surprised if they got bitten again by not having separate kernel/window manager architecture in Windows... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0