- wlug - list.wlug.org.nz

When in Doubt: Hang Up, Look Up, and Call Back
by Peter Reutemann 24 Apr '20

24 Apr '20

'Many security-conscious people probably think they'd never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Brian Krebs: Here's how one security and tech-savvy reader got taken for more than $10,000 in an elaborate, weeks-long ruse. Today's lesson in how not to get scammed comes from "Mitch," the pseudonym I picked for a reader in California who shared his harrowing tale on condition of anonymity. Mitch is a veteran of the tech industry -- having worked in security for several years at a fairly major cloud-based service -- so he's understandably embarrassed that he got taken in by this confidence scheme. On Friday, April 17, Mitch received a call from what he thought was his financial institution, warning him that fraud had been detected on his account. Mitch said the caller ID for that incoming call displayed the same phone number that was printed on the back of his debit card. But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. Most were relatively small charges -- under $100 apiece -- but there were also two very recent $800 ATM withdrawals from cash machines in Florida. If the caller had been a fraudster, he reasoned at the time, they would have asked for personal information. But the nice lady on the phone didn't ask Mitch for any personal details. Instead, she calmly assured him the bank would reverse the fraudulent charges and said they'd be sending him a new debit card via express mail. After making sure the representative knew which transactions were not his, Mitch thanked the woman for notifying him, and hung up. The following day, Mitch received another call about suspected fraud on his bank account. Something about that conversation didn't seem right, and so Mitch decided to use another phone to place a call to his bank's customer service department -- while keeping the first caller on hold. "When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch," he said. "But as it turned out, that other call was the attackers also talking to my bank pretending to be me."' -- source: https://it.slashdot.org/story/20/04/23/1933254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NordVPN Unveils First Mainstream WireGuard Virtual Private Network
by Peter Reutemann 23 Apr '20

23 Apr '20

'One of the largest VPN companies, NordVPN, is rolling out NordLynx -- it's first mainstream WireGuard virtual private network for its Windows, Mac, Android and iOS client-software applications. ZDNet reports: NordVPN's own tests have shown NordLynx easily outperforms the other protocols, IKEv2/IPsec and OpenVPN. How much faster? According to NordVPN's 256,886 speed tests, "When a user connects to a nearby VPN server and downloads content that's served from a content delivery network (CDN) within a few thousand miles/kilometers, they can expect up to twice higher download and upload speed." While speed is what customers will notice, security experts like WireGuard for its code's simplicity. With only about 4,000 lines of code, WireGuard's code can be comprehensively reviewed by a single individual. Besides WireGuard, NordVPN adds in its double Network Address Translation (NAT) system to protect users' privacy. This enables users to establish a secure VPN connection while storing no identifiable user data on a server. You're assigned a dynamic local IP address that remains assigned only while the session is active. User authentication is done with the help of a secure external database. To switch to NordLynx, users need to update their NordVPN app to the latest version. The NordLynx protocol can be chosen manually from the Settings menu. ' -- source: https://tech.slashdot.org/story/20/04/22/2029227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

From The “Too Much Time On Their Hands” Department ...
by Lawrence D'Oliveiro 23 Apr '20

23 Apr '20

... comes this pure-CSS recreation <https://www.theregister.co.uk/2020/04/22/windows_98_css/> of the “Windows-98” look for your web pages. Personally, I can relate to this comment of the author: “Buttons just don't look like buttons anymore, it's so sad”. Basically, UI experts nowadays seem to be concentrating more on fashion, and the whole concept of “usability testing” has gone out the window.

1 0

Stripe Is Silently Recording Your Movements On Its Customers' Websites
by Peter Reutemann 23 Apr '20

23 Apr '20

'Michael Lynch, blogger and former software engineer at Microsoft and Google, discovered that the payment processing platform Stripe and its official JavaScript library records all browsing activity on its customers' websites and reports it back to the company. Lynch says this data includes the following: 1. Every URL the user visits on my site, including pages that never display Stripe payment forms 2. Telemetry about how the user moves their mouse cursor while browsing my site 3. Unique identifiers that allow Stripe to correlate visitors to my site against other sites that accept payment via Stripe In his blog post, Lynch shares what he found, who else it affects, and how you can limit Stripe's data collection in your web applications. Here's how he says he made the discovery: I discovered this by accident while adding paid plans to my portfolio rebalancer. As part of development, I was using an HTTP proxy that allows me to inspect HTTP traffic from my browser. After successfully implementing my app's payment flow with Stripe, I noticed that every page navigation generated a new HTTP POST request to a Stripe URL. This was strange because none of the pages I visited contained any calls to Stripe's library. In fact, my app doesn't collect payment information from users until they create an account, but Stripe was making HTTP requests when I landed on my app's homepage as a brand new user with no cookies or stored credentials. "I looked around for an official disclosure from Stripe about this behavior, but I couldn't find anything," adds Lynch. "The closest I found is this vague paragraph on their npm package description, which the Stripe support rep quoted to me: 'To best leverage Stripe's advanced fraud functionality, ensure that Stripe.js is loaded on every page, not just your checkout page. This allows Stripe to detect anomalous behavior that may be indicative of fraud as customers browse your website.'" "The privacy policy is a bit more specific about the data they collect, but it implies that they're collecting this data on stripe.com rather than on customer sites," writes Lynch. "Worryingly, the privacy policy also includes loose wording that allows Stripe to sell this data to advertisers: 'When you visit our Sites or online services, both we and certain third parties collect information about your online activities over time and across different sites to provide you with advertising about products and services tailored to your individual interests.'"' -- source: https://yro.slashdot.org/story/20/04/22/0023222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Vivaldi Browser Gets Built-in Tracking Blocker, Goes GA on Android
by Peter Reutemann 23 Apr '20

23 Apr '20

'Vivaldi, the browser launched by former Opera CEO Jon von Tetzchner, has long positioned itself as a highly customizable alternative to Chrome and Firefox for power users. Today, the team is launching version 3.0 of its desktop browser, with built-in tracker and ad blockers, and it's bringing its Android browser out of beta. From a report: I've long been a fan of Vivaldi, but the company was relatively late to the tracking protection game. Now it's doubling down by integrating a blocklist powered by DuckDuckGo's Tracker Radar. Like competing browsers, Vivaldi offers three blocking levels that users can easily toggle on and off for individual websites. Those blocking levels are relatively blunt, though, with the options to either block trackers, block trackers and ads, or disable blocking. Competitors like Edge offer slightly more nuanced options for blocking trackers, though I would expect Vivaldi to adopt a similar scheme over time.' -- source: https://slashdot.org/story/20/04/22/1550251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge TV Now Online-Only
by Lawrence D'Oliveiro 22 Apr '20

22 Apr '20

If there is anybody else besides me who wondered what happened to Edge TV, as of the beginning of this month it is no longer on Freeview, it can now only be viewed as an online stream <https://www.stuff.co.nz/entertainment/tv-radio/113928839/the-edge-tv-remove…>. In the last few days of June, there was a promo announcing that it was going HD, but I don’t recall it mentioning that it was leaving the broadcast airwaves. Quote: MediaWorks chief executive Michael Anderson says the move is in line with audience trends, which show people primarily consume music videos online. While that may be mostly true, personally I would go look for videos on YouTube after seeing them first on Edge TV.

6 12

Discord Switching From Go To Rust
by Lawrence D'Oliveiro 22 Apr '20

22 Apr '20

Came across this blog post <https://blog.discordapp.com/why-discord-is-switching-from-go-to-rust-a190bb…> explaining why Discord, which has been using Google’s Go language to implement its services, has now decided to rewrite them in Mozilla’s Rust. The problem was garbage collection. Go has a similar memory-allocation model to Java or LISP, where you can create objects and simply forget about them when you don’t need them any more, and a background process will automatically reclaim the storage at some point. The trouble is, that reclamation process (the “garbage collector”) tends to be the source of performance bottlenecks in the system. Not to mention that the memory usage of your program can grow to fill all available space, unless you impose arbitrary limits on it. Languages like Perl and Python use a hybrid model, where objects have reference counts attached to them, keeping track of how many other objects or variables still point to them, so they can be automatically freed when the count goes to zero. There are cases where this isn’t enough, and in those cases a full garbage-collection process kicks in. One benefit that I certainly observe with this is that memory usage for a program can remain reasonable, even after it has been running for a long time. Rust avoids the whole issue in a clever way, by having the compiler enforce memory-ownership restrictions in the language itself, so memory can be correctly allocated and freed without resorting to a garbage collector. The result is that Rust can achieve significantly higher performance than Go, while avoiding most of the attendant risks of dumping the whole responsibility for memory management on the programmer, as is done in languages like C++ and C.

1 1

Google Wants To Phase Out Browser User-Agent Strings
by Lawrence D'Oliveiro 21 Apr '20

21 Apr '20

Google wants to reduce the large amount of information browsers typically pack into the “User-Agent” header lines they send out, but this has been delayed for now <https://www.theregister.co.uk/2020/04/20/google_useragent_string_revision/>. This makes sense. Sites should not be changing their behaviour based on how browsers identify themselves, but on what functionality they actually support. But I wonder what this will mean for sites that routinely block the default user agents for scripting tools like wget and Python’s urllib ... But who is objecting to Google’s plan? Advertisers, who are apparently relying on user-agent checks as an important part of their mechanism for detecting ad fraud. Which is quite an incredible admission, really.

1 0

GhostBSD
by tom butz 21 Apr '20

21 Apr '20

There still are several BSDs around: OpenBSD, NetBSD, FreeBSD, TrueOS and GhostBSD. They usually lack desktops, but GhostBSD has got one, and it looks good. I started with the latest version, 20 something: that one didn't work properly for me Then I used 18.10 where there were issues with the LAN, and finally everything worked using 19.10 - both on my laptop and an old Macmini. BTW, I've also installed it on an external USB3-drive (500 GB) and it can boot from it. GhostBSD supports the ZFS-filesystem and will read/write from/to msdos and linux filesystems. I haven't tried writing to an ext4 system, only read from ext-sticks. You need to do some extra work to enable read/write to extfat. LAN and WiFi worked well and Firefox is very fast. My laptop has 6 GB of RAM and I ran everything in single-user mode, just to get some extra speed. Thanks go to Peter who found the older versions on a US-server - GhostBSD is made in Canada. Tom Butz.

1 0

XCP-ng Motors Along
by Lawrence D'Oliveiro 20 Apr '20

20 Apr '20

First I heard of this XCP-ng project, which aims to produce an open-source version (!) of XenServer <https://www.theregister.co.uk/2020/04/20/xcpng_100000_download_milestone_an…>. To add to the surprise, it is actually getting support from the Xen Project.

1 0