- wlug - list.wlug.org.nz

Apple's Privacy Software Allowed Users To Be Tracked, Says Google
by Peter Reutemann 23 Jan '20

23 Jan '20

'Google researchers have exposed details of multiple security flaws in its rival Apple's Safari web browser that allowed users' browsing behavior to be tracked, despite the fact that the affected tool was specifically designed to protect their privacy. From a report: The flaws, which were ironically found in an anti-tracking feature known as Intelligent Tracking Prevention, were first disclosed by Google to Apple in August last year. In a soon-to-be published paper seen by the Financial Times, researchers in Google's cloud team have since identified five different types of potential attack that could have resulted from the vulnerabilities, allowing third parties to obtain "sensitive private information about the user's browsing habits." "You would not expect privacy-enhancing technologies to introduce privacy risks," said Lukasz Olejnik, an independent security researcher who has seen the paper. "If exploited or used, [these vulnerabilities] would allow unsanctioned and uncontrollable user tracking. Apple rolled out Intelligent Tracking Prevention in 2017, with the specific aim of protecting Safari browser users from being tracked around the web by advertisers' and other third-parties' cookies.' -- source: https://tech.slashdot.org/story/20/01/22/2119245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 5.0 Released
by Peter Reutemann 22 Jan '20

22 Jan '20

'Wine 5.0 has been released today and contains over 7,400 bug fixes and numerous audio and graphics improvements that will increase performance in gaming on Linux. With the release of Wine 5.0, WineHQ hopes to resolve many of these issues, with the main improvements being: -Builtin modules in PE format: To make games think Wine is a real Windows environment, most Wine 5.0 modules have been converted into the PE format rather than ELF binaries. It is hoped that this will allow copy-protection and anti-cheat programs to not flag games running under Wine as being modified. -Multi-monitor support: Multiple displays adapters and multi-monitor configurations are now supported under Wine. -XAudio2 reimplementation: XAudio2 libraries have been added back to Wine and will use the FAudio library for better compatibility. -Vulkan 1.1 support: "The Vulkan driver supports up to version 1.1.126 of the Vulkan spec."' -- source: https://tech.slashdot.org/story/20/01/21/223205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reuters: Apple cut backup end-to-end encryption plans after FBI complained
by Peter Reutemann 22 Jan '20

22 Jan '20

'Two years ago, Apple dropped a plan that would have made it impossible for the company to decrypt iPhone and iPad backups for law enforcement, according to a Reuters report today. Reuters wrote that "six sources familiar with the matter" confirmed that Apple dropped the end-to-end encryption plan for iCloud Backup "after the FBI complained that the move would harm investigations." Apple had "told the FBI that it planned to offer users end-to-end encryption when storing their phone data on iCloud" more than two years ago, Reuters wrote. "Under that plan, primarily designed to thwart hackers, Apple would no longer have a key to unlock the encrypted data, meaning it would not be able to turn material over to authorities in a readable form even under court order," the report continued. But the FBI objected, and Apple dropped the plan, although the exact reason for doing so isn't clear. One former Apple employee told Reuters that the company "decided they weren't going to poke the bear anymore." However, another former Apple employee "said it was possible the encryption project was dropped for other reasons, such as concern that more customers would find themselves locked out of their data more often."' -- source: https://arstechnica.com/tech-policy/2020/01/apple-reportedly-nixed-plan-for… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notorious Crime Gang Targets Internet Routers Using Tomato Firmware
by Peter Reutemann 22 Jan '20

22 Jan '20

'Internet routers running the Tomato alternative firmware are under active attack by a self-propagating exploit that searches for devices using default credentials. When credentials are found, the exploit then makes the routers part of a botnet that's used in a host of online attacks, researchers said on Tuesday. The Muhstik botnet came to light about two years ago when it started unleashed a string of exploits that attacked Linux servers and Internet-of-things devices. It opportunistically exploited a host of vulnerabilities, including the so-called critical Drupalgeddon2 vulnerability disclosed in early 2018 in the Drupal content management system. Muhstik has also been caught using vulnerabilities in routers that use Gigabit Passive Optical Network (GPON) or DD-WRT software. The botnet has also exploited previously patched vulnerabilities in other server applications, including the Webdav, WebLogic, Webuzo, and WordPress. On Tuesday, researchers from Palo Alto Networks said they recently detected Muhstik targeting Internet routers running Tomato, an open-source package that serves as an alternative to firmware that ships by default with routers running Broadcom chips. The ability to work with virtual private networks and provide advanced quality of service control make Tomato popular with end users and in some cases router sellers. The exploits use already infected devices to scan the Internet for Tomato routers and, when found, to check if they use the default username and password of "admin:admin" or "root:admin" for remote administration. The exploit causes Tomato routers that haven't been locked down with a strong password to join an IRC server that's used to control the botnet. The infection also causes the routers to scan the Internet for servers or devices running WordPress, Webuzo, or WebLogic packages that are vulnerable.' -- source: https://it.slashdot.org/story/20/01/21/2039246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

14% of Android App Privacy Policies Contain Contradictions About Data Collection
by Peter Reutemann 22 Jan '20

22 Jan '20

'A large number of Android mobile apps listed on the official Google Play Store contain self-contradictory language in their privacy policies in regards to data collection practices. From a report: In an academic study published last year, researchers created a tool named PolicyLint that analyzed the language used in the privacy policies of 11,430 Play Store apps. They found that 14.2% (1,618 apps) contained a privacy policy with logical contradicting statements about data collection. Examples include privacy policies that stated in one section that they do not collect personal data, only to contradict themselves in subsequent sections, where they state they collect emails or customer names -- which are clearly personally-idenfiable information. While the research team could not determine the app maker's intent in using contradicting statements in their privacy policy, researchers feel the primary purpose was to mislead users if they ever took the time to read the policies.' -- source: https://yro.slashdot.org/story/20/01/21/188216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Official Kubuntu 'Focus' Linux Laptop Goes on Sale
by Peter Reutemann 21 Jan '20

21 Jan '20

'You can buy an official Kubuntu laptop. Called "Focus". It is an absolutely powerhouse with top specs. From a report: Here's the specs list: CPU: Core i7-9750H 6c/12t 4.5GHz Turbo GPU: 6GB GTX-2060 RAM: 32GB Dual Channel DDR4 2666 RAM Storage: 1TB Samsung 970 EVO Plus NVMe Display: 16.1" matte 1080p IPS Keyboard: LED backlit, 3-4mm travel User expandable SDD, NVMe, and RAM Superior cooling The starting price for the Kubuntu Focus Laptop is $2395. ' -- source: https://linux.slashdot.org/story/20/01/20/1856240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Why This Time The New Browser Wars Are Different
by Peter Reutemann 21 Jan '20

21 Jan '20

'The Verge argues that the browser wars "are back, but it's different this time." The mobile web is broken and unfettered tracking and data sharing have made visiting websites feel toxic, but since the ecosystem of websites and ad companies can't fix it through collective action, it falls on browser makers to use technological innovations to limit that surveillance, however each company that makes a browser is taking a different approach to creating those innovations, and everybody distrusts everybody else to act in the best interest of the web instead of the best interest of their employers' profits... I've been avoiding getting into the precise details of the proposals out there to fix the tracking problem because things are changing so quickly across so many different tracks... Until then, know that there are two important things to know. First: there are new browser technologies and limits coming that could radically change how ads work and could make it easier for you to protect your privacy no matter what browser you use. Since this is the web, it'll take time, but everybody seems committed. Second: the way many of us think about a Browser War is in terms of marketshare -- and that is the wrong metric this time. There is a browser war, but it won't be won or lost based on who can convince the most people to switch to their browser. Because most people can't or won't switch on the platform that matters: mobile. In 2020, the desktop is a minor skirmish compared to browsers on phones. On phones, many people aren't really free to choose their browser. That's literally true on the iPhone, which Apple locks down so apps can only use its web rendering technology. And it's for-intents-and-purposes true on Android, where the vast majority of browsers just use Chromium. Yes, there is an Android browser ballot happening in Europe, but it's much too early to know what its effects will be.... The new Browser Wars aren't about who makes the fastest or best browser, they're about whose services you want and whose data policies you trust. ' -- source: https://news.slashdot.org/story/20/01/20/048217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Opera Accused of Offering Predatory Loans Through Android apps
by Peter Reutemann 21 Jan '20

21 Jan '20

'"It's no secret that Opera isn't doing so well in the era of Chrome dominance," reports Android Police. "According to a report published by Hindenburg Research, the company's losses in browser revenue have apparently led it to create multiple loan apps with short payment windows and interest rates of ~365-876%, which are in violation of new Play Store rules Google enacted last year." The apps are aimed at India, Kenya and Nigeria, reports Engadget: The apps would claim to offer maximum annual percentage rate (APR) of 33 percent or less, but the actual rates were much higher, climbing to 438 percent in the case of OPesa. And while they publicly offered reasonable loan terms of 91 to 365 days, the real length was no more than 29 days (for OKash) and more often 15 days -- well under Google's 60-day minimum. The conditions only got worse for borrowers who missed their payments. Falling short by just a day could raise the APR as high as 876 percent. Also, the apps reportedly scraped phone contacts to harass family, friends and others with calls and texts in hopes this would pressure customers into paying up. These same notices often threatened legal action. Android Police points out that Opera became a public company in mid-2017, shortly after it was purchased by a China-based investor group. But since then, "Opera's market share has continued to fall, due to the increasing dominance of Chrome.' -- source: https://slashdot.org/story/20/01/20/0329242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jan '20

20 Jan '20

Hi everyone We have a meeting schedule for *next* Monday (a week earlier than usual due to Auckland Anniversary holiday): 'Is your Android phone no longer supported by your manufacturer? Then you might able to update it using a custom ROM from LineageOS (https://wiki.lineageos.org/devices/) or AospExtended ROM (https://www.aospextended.com/devices/pie) Peter Reutemann will show the process of updating the ROM on an Android phone.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791984 https://gettogether.community/events/3274/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Researchers find serious flaws in WordPress plugins used on 400k sites
by Peter Reutemann 20 Jan '20

20 Jan '20

'Serious vulnerabilities have recently come to light in three WordPress plugins that have been installed on a combined 400,000 websites, researchers said. InfiniteWP, WP Time Capsule, and WP Database Reset are all affected. The highest-impact flaw is an authentication bypass vulnerability in the InfiniteWP Client, a plugin installed on more than 300,000 websites. It allows administrators to manage multiple websites from a single server. The flaw lets anyone log in to an administrative account with no credentials at all. From there, attackers can delete contents, add new accounts, and carry out a wide range of other malicious tasks.' -- source: https://arstechnica.com/information-technology/2020/01/researchers-find-ser… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0