- wlug - list.wlug.org.nz

Richard Stallman Answers Questions at EmacsConf 2020
by Peter Reutemann 07 Dec '20

07 Dec '20

'All the videos have now appeared online for the talks at this year's virtual EmacsConf 2020, "the conference about the joy of Emacs, Emacs Lisp, and memorizing key sequences." And among them are an appearance by 67-year-old Richard Stallman, reminding the audience he'd created the first Emacs editor in 1976 "with some help from Guy Steele," then created GNU Emacs in 1984. Stallman was there to tell the history of the GNU Emacs Lisp Package Archive (and the licensing issues involved) — and how it's ultimately led to the creation of the NonGNU ELPA. "The fundamental plan of NonGNU ELPA is that we won't ask for copyright assignments for those packages, so we won't be able to put them into core Emacs, at least not easily — but we will have some control over how we distribute them. We can put any package into NonGNU ELPA as long as its free software. "If we like it, we can set up that way for users to get it. We can put the package in exactly as it is, if there's no problem at all with it. We can make an arrangement with the package's developers to work on it with us and maintain it directly for distribution by NonGNU ELPA. But if they are not interested, we can put it in ourselves, and if we need to make any changes we can do so. So NonGNU ELPA is not meant to be just a way that others can distribute their packages. Its meant at least in a minimal, technical sense to work with GNU Emacs, and we will make changes if necessary so that it works smoothly with GNU Emacs... "The idea is to have a single Git repository where you can download various packages, but they won't be maintained there. Each of those packages will be copied automatically from some other place, probably some other people have the right access to work on it. This way we can avoid giving a gigantic number of people access to it. "So far NonGNU ELPA is just a plan. We need people to implement the plan, so if you'd like to help, please write to me. I think this is a very important step for progress, and it's got to be implemented. Thanks, and happy hacking." Stallman provided a status update on NonGNU ELPA as part of the 46-minute Q&A that followed. ' -- source: https://news.slashdot.org/story/20/12/06/1957219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenZFS 2.0 release unifies Linux, BSD and adds tons of new features
by Peter Reutemann 04 Dec '20

04 Dec '20

'This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between "ZFS on Linux" and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.' -- source: https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

One of the Internet’s most aggressive threats could take UEFI malware mainstream
by Peter Reutemann 04 Dec '20

04 Dec '20

'One of the Internet’s most aggressive threats has just gotten meaner, with the ability to infect one of the most critical parts of any modern-day computer. Trickbot is a piece of malware that’s notable for its advanced capabilities. Its modular framework excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks and performing reconnaissance that identifies infected computers belonging to high-value targets. It often uses readily available software like Mimikatz or exploits like EternalBlue stolen from the National Security Agency. Once a simple banking fraud trojan, Trickbot over the years has evolved into a full-featured malware-as-a-service platform. Trickbot operators sell access to their vast number of infected machines to other criminals, who use the botnet to spread bank trojans, ransomware, and a host of other malicious software. Rather than having to go through the hassle of ensnaring victims themselves, customers have a ready-made group of computers that will run their crimeware. Now, Trickbot has acquired a new power: the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove.' -- source: https://arstechnica.com/information-technology/2020/12/dangerous-uefi-malwa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FBI Warns of Email Forwarding Rules Being Abused in Recent Hacks
by Peter Reutemann 03 Dec '20

03 Dec '20

'The US Federal Bureau of Investigation says that cyber-criminals are increasingly relying on email forwarding rules in order to disguise their presence inside hacked email accounts. From a report: In a PIN (Private Industry Notification) alert sent last week and made public today, the FBI says the technique has been seen and abused in recent BEC (Business Email Compromise) attacks reported over the summer. The hackers' technique relies on a feature found in some email services called "auto-forwarding email rules." As its name implies, the feature allows the owner of an email address to set up "rules" that forward (redirect) an incoming email to another address if a certain criteria is met. Threat actors absolutely love email auto-forwarding rules as they allow them to receive copies of all incoming emails without having to log into an account each day -- and be at risk of triggering a security warning for a suspicious login.' -- source: https://it.slashdot.org/story/20/12/02/1944205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malicious npm Packages Caught Installing Remote Access Trojans
by Peter Reutemann 03 Dec '20

03 Dec '20

'The security team behind the "npm" repository for JavaScript libraries removed two npm packages this Monday for containing malicious code that installed a remote access trojan (RAT) on the computers of developers working on JavaScript projects. From a report: The name of the two packages was jdb.js and db-json.js., and both were created by the same author and described themselves as tools to help developers work with JSON files typically generated by database applications. Both packages were uploaded on the npm package registry last week and were downloaded more than 100 times before their malicious behavior was detected by Sonatype, a company that scans package repositories on a regular basis. According to Sonatype's Ax Sharma, the two packages contained a malicious script that executed after web developers imported and installed any of the two malicious libraries. The post-install script performed basic reconnaissance of the infected host and then attempted to download and run a file named patch.exe that later installed njRAT, also known as Bladabindi, a very popular remote access trojan that has been used in espionage and data theft operations since 2015.' -- source: https://tech.slashdot.org/story/20/12/02/1939247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Zero-Click Wi-Fi Exploit is One of the Most Breathtaking Hacks Ever
by Peter Reutemann 03 Dec '20

03 Dec '20

'Dan Goodin, writing for ArsTechnica: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device -- over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable -- meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed. This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly. Almost immediately, fellow security researchers took notice. "This is a fantastic piece of work," Chris Evans, a semi-retired security researcher and executive and the founder of Project Zero, said in an interview. "It really is pretty serious. The fact you don't have to really interact with your phone for this to be set off on you is really quite scary. This attack is just you're walking along, the phone is in your pocket, and over Wi-Fi someone just worms in with some dodgy Wi-Fi packets." Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel -- one of the most privileged parts of any operating system -- the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.' -- source: https://apple.slashdot.org/story/20/12/02/1933245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: 'Don't Make Users Mad'
by Peter Reutemann 01 Dec '20

01 Dec '20

'Greg Kroah-Hartman, the Linux Foundation fellow currently responsible for stable Linux kernel releases, shared the lessons he's learned as a kernel developer that are applicable to other developers at this year's Linux App Summit. He started by showing how he could succinctly distill the essence of the talk into a single five-word slide: "Don't make your users mad...." Kroah-Hartman explains that one of Linus Torvalds' most deeply-held convictions: don't break userspace. "Other operating systems have this rule as well — it's a very solid rule — because we always want you to upgrade. And we want you to upgrade without worrying about it. We don't want you to feel scared. If you see a new release, and we say, 'Hey, this fixes a bunch of problems,' we don't want you to feel worried about taking that. That's really really important — especially with security...." If you do make a change, make sure there truly is a compelling reason. "You have to provide enough reason and enough goodness to force somebody to take the time to learn to do something else. That's very rare." His example of this was systemd, which unified a variety of service configurations and initialization processes. "They did it right. They provided all the functionality, they solved a real problem that was there. They unified all these existing tools and problems in such a way that it was just so much better to use, and it provided enough impetus that everybody was willing to do the work to modify their own stuff and move to the new model. It worked. People still complain about it, but it worked. Everybody switched... It works well. It solves a real problem. "That was an example of how you can provide a compelling reason to move on — and make the change."' -- source: https://linux.slashdot.org/story/20/11/28/0714229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Used To Hack Tesla Model X SUV Key Fob
by Peter Reutemann 29 Nov '20

29 Nov '20

'According to this Tom's Hardware story, a Belgian PhD student managed to wrest full control of a Tesla Model X SUV, by way of hijacking the Bluetooth keyfob and reprogramming it, using a Raspberry Pi. Tesla has since issued a software update to protect against that kind of attack Since the attack is done via Bluetooth, control could be gained wirelessly from 5 meters away. According to the article this is the third time the same student "has managed to exploit the key fob and gain access to the car. Previously he was able to clone the fob..." Computer Weekly also got an interesting quote from a senior security consultant at the electronic design automation company Synopsys, who argues that the research "demonstrates the impacts of security requirements and security features not having proper validation."' -- source: https://tech.slashdot.org/story/20/11/28/2325210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PHP 8.0 Brings Major (And Breaking) Changes to a 25-Year-Old Language
by Peter Reutemann 29 Nov '20

29 Nov '20

'"PHP version 8.0 has arrived, bringing with it a major update to the 25-year-old programming language..." writes Tech Republic. New language features include the nullsafe operator and attributes (commonly known as annotations in other languages) to add metadata to classes — and more: The JIT compiler is designed to bring performance improvements to web applications by turning code into instructions for the CPU at runtime. Meanwhile, union types is a feature that allows data of more than one type to be held by a variable. Named arguments allow developers to assign values to a function by specifying the value name, allowing optional parameters to be ignored. Alongside these, version 8.0 of PHP brings optimizations and enhancements to the language's type system, syntax, error handling and consistency.... Commenting on PHP 8.0, PHP programmer and stitcher.io developer, Brent Roose, noted that the latest version of the language may require developers to review code for any breaking changes.' -- source: https://developers.slashdot.org/story/20/11/28/1030246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Successfully Virtualizes Windows for Arm on M1 Mac
by Peter Reutemann 29 Nov '20

29 Nov '20

'Developer Alexander Graf has successfully virtualized the Arm version of Windows on an M1 Mac, proving that the M1 chip is capable of running Microsoft's operating system. From a report: Currently, Macs with the M1 chip do not support Windows and there is no Boot Camp feature as there is on Intel Macs, but support for Windows is a feature that many users would like to see. Using the open-source QEMU virtualizer, Graf was able to virtualize the Arm version of Windows on Apple's M1 chip, with no emulation. Since the M1 chip is a custom Arm SoC, it is no longer possible to install the x86 version of Windows or x86 Windows apps using Boot Camp, as was the case with previous Intel-based Macs. However, he said in a Tweet that when virtualized on an M1 Mac, "Windows ARM64 can run x86 applications really well. It's not as fast as Rosetta 2, but close."' -- source: https://apple.slashdot.org/story/20/11/27/2343223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0