- wlug - list.wlug.org.nz

Inside the Podcast that Hacks Ring Camera Owners Live on Air
by Peter Reutemann 13 Dec '19

13 Dec '19

'In the NulledCast podcast hackers livestream the harassment of Ring camera owners after accessing their devices. Hundreds of people can listen. From a report: A blaring siren suddenly rips through the Ring camera, startling the Florida family inside their own home. "It's your boy Chance on Nulled," a voice says from the Ring camera, which a hacker has taken over. "How you doing? How you doing?" "Welcome to the NulledCast," the voice says. The NulledCast is a podcast livestreamed to Discord. It's a show in which hackers take over people's Ring and Nest smarthome cameras and use their speakers to talk to and harass their unsuspecting owners. In the example above, Chance blared noises and shouted racist comments at the Florida family. "Sit back and relax to over 45 minutes of entertainment," an advertisement for the podcast posted to a hacking forum called Nulled reads. "Join us as we go on completely random tangents such as; Ring & Nest Trolling, telling shelter owners we killed a kitten, Nulled drama, and more ridiculous topics. Be sure to join our Discord to watch the shows live." Software to hack Ring cameras has recently become popular on the forum. The software churns through previously compromised email addresses and passwords to break into Ring cameras at scale. This has led to a recent spate of hacks that have occurred both during the podcast and at other times, several of which have been covered by local media outlets. In Brookhaven a hacker shouted at a sleeping woman through her hacked Ring camera to wake-up. In Texas, a hacker demanded a couple pay a bitcoin ransom. Hackers targeted a family in DeSoto County, Mississippi, and spoke through the device to one of the young children.' -- source: https://yro.slashdot.org/story/19/12/12/204240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Customizing A KDE Desktop
by Lawrence D'Oliveiro 11 Dec '19

11 Dec '19

A video <https://www.youtube.com/watch?v=uyz4-KZOzyI> showing how to set up KDE with an Apple-style dock and the application menu at the top of the screen (with some extra widgets added). Not something I would do myself, but it shows how configurable KDE can be.

1 0

Intel’s SGX coughs up crypto keys when scientists tweak CPU voltage
by Peter Reutemann 11 Dec '19

11 Dec '19

'To counter the growing sophistication of computer attacks, Intel and other chip makers have built digital vaults into CPUs to segregate sensitive computations and secrets from the main engine computers use. Now, scientists have devised an attack that causes the Software Guard Extensions—Intel's implementation of this secure CPU environment to divulge cryptographic keys and induce potentially dangerous memory errors. Plundervault, as the attack has been dubbed, starts with the assumption that an attacker is able to run privileged software on a targeted computer. While that's a lofty prerequisite, it's precisely the scenario Intel's SGX feature is designed to protect against. The chipmaker bills SGX as a private region that uses hardware-based memory encryption to isolate sensitive computations and data from malicious processes that run with high privilege levels. Intel goes as far as saying that "Only Intel SGX offers such a granular level of control and protection." But it turns out that subtle fluctuations in voltage powering the main CPU can corrupt the normal functioning inside the SGX. By subtly increasing or decreasing the current delivered to a CPU—operations known as "overvolting" and "undervolting"—a team of scientists has figured out how to induce SGX faults that leak cryptographic keys, break integrity assurances, and potentially induce memory errors that could be used in other types of attacks.' -- source: https://arstechnica.com/information-technology/2019/12/scientists-pluck-cry… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Teams is the First Office App For Linux
by Peter Reutemann 11 Dec '19

11 Dec '19

'Microsoft today launched Microsoft Teams for Linux in public preview. No, that's not a typo -- Microsoft Teams is indeed the first Office app that the company has ported to Linux. You can download Microsoft Teams as a native Linux package in .deb and .rpm formats from here.' -- source: https://linux.slashdot.org/story/19/12/10/1715255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are You One Of Avast's 400 Million Users? This Is Why It Collects And Sells Your Web Habits.
by Peter Reutemann 11 Dec '19

11 Dec '19

'Avast, the multibillion-dollar Czech security company, doesn't just make money from protecting its 400 million users' information. It also profits in part because of sales of users' Web browsing habits and has been doing so since at least 2013. From a report: That's led to some labelling its tools "spyware," the very thing Avast is supposed to be protecting users from. Both Mozilla and Opera were concerned enough to remove some Avast tools from their add-on stores earlier this month, though the anti-virus provider says it's working with Mozilla to get its products back online. But recently appointed chief executive Ondrej Vlcek tells Forbes there's no privacy scandal here. All that user information that it sells cannot be traced back to individual users, he asserts. Here's how it works, according to Vlcek: Avast users have their Web activity harvested by the company's browser extensions. But before it lands on Avast servers, the data is stripped of anything that might expose an individual's identity, such as a name in the URL, as when a Facebook user is logged in. All that data is analysed by Jumpshot, a company that's 65%-owned by Avast, before being sold on as "insights" to customers. Those customers might be investors or brand managers. What do those customers get? Vlcek says Jumpshot, which was initially acquired in 2013, provides "insights on how cohorts of users on the internet use the web." For instance, it could show a percentage of visitors who went from one website to another. That could be useful to anyone monitoring an advertising campaign. "Typical customers would be, for example, investors, who would be interested in how online companies are doing in terms of their new campaigns," the new Avast chief explains. Say Amazon launches a new product -- Jumpshot could determine how much interest it's getting online.' -- source: https://it.slashdot.org/story/19/12/10/1922243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Releases Chrome 79 With New Features Including an Option To Freeze Tabs and Back-Forward Caching
by Peter Reutemann 11 Dec '19

11 Dec '19

'Google today released Chrome 79 for Windows, Mac, Linux, Chrome OS, Android, and iOS users. This release comes with security and bug fixes, but also with new features such as built-in support for the Password Checkup tool, real-time blacklisting of malicious sites via the Safe Browsing API, general availability of Predictive Phishing protections, a ban on loading HTTPS "mixed content," support for tab freezing, a new UI for the Chrome Sync profile section, and support for a back-forward caching mechanism. ZDNet has outlined each new feature in-depth.' -- source: https://yro.slashdot.org/story/19/12/10/1959205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Gets Dinged By IRD Over Transfer Pricing
by Lawrence D'Oliveiro 10 Dec '19

10 Dec '19

Microsoft has been forced to cough up $25 million to the New Zealand tax authorities over its shifting around of profits between international subsidiaries <https://www.theregister.co.uk/2019/12/09/oracle_facing_kiwi_tax_probe/>, and now Oracle is facing scrutiny over similar tax fiddles.

1 0

Draft algorithm charter
by Roderick Aldridge 10 Dec '19

10 Dec '19

The Government is calling for feedback on the draft algorithm charter. May interest Peter, others? We want your feedback on a draft algorithm charter, an enduring commitment for government agencies to use algorithms in a fair, ethical and transparent way. Draft algorithm charter for consultation <https://data.govt.nz/assets/Uploads/Draft-Algorithm-Charter-for-consultatio…> [PDF 255 KB] Draft algorithm charter for consultation <https://data.govt.nz/use-data/analyse-data/government-algorithm-transparenc…> [HTML] Algorithm assessment report <https://data.govt.nz/use-data/analyse-data/government-algorithm-transparenc…> Computer algorithms are now a fundamental element of data analytics. Algorithms support the services that government provides to people in New Zealand and to help deliver new, innovative, and well targeted policies to achieve government aims. https://data.govt.nz/use-data/analyse-data/government-algorithm-transparenc… Rod

3 4

Yahoo Groups Is Winding Down and All Content Will Be Permanently Removed
by Peter Reutemann 10 Dec '19

10 Dec '19

'Yahoo announced on Wednesday that it is winding down its long-running Yahoo Groups site. From a report: As of October 21, users will no longer be able to post new content to the site, and on December 14 Yahoo will permanently delete all previously posted content. "You'll have until that date to save anything you've uploaded," an announcement post reads. Yahoo Groups, launched in 2001, is a cross between a platform for mailing lists and internet forums. Groups can be interacted with on the Yahoo Groups site itself, or via email. In the 18 years that it existed, numerous niche communities made a home on the platform. Now, with the site's planned obsolescence, users are looking for ways to save their Groups history.' -- source: https://tech.slashdot.org/story/19/10/16/1928228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WireGuard VPN is a step closer to mainstream adoption
by Peter Reutemann 10 Dec '19

10 Dec '19

'As of this morning, Linux network stack maintainer David Miller has committed the WireGuard VPN project into the Linux "net-next" source tree. Miller maintains both net and net-next—the source trees governing the current implementation of the Linux kernel networking stack and the implementation of the next Linux kernel's networking stack, respectively. This is a major step forward for the WireGuard VPN project. Net-next gets pulled into the new Linux kernel during its two-week merge window, where it becomes net. With WireGuard already a part of net-next, this means that—barring unexpected issues—there should be a Linux kernel 5.6 release candidate with built-in WireGuard in early 2020. Mainline kernel inclusion of WireGuard should lead to significantly higher uptake in projects and organizations requiring virtual private network capability. Normal, day-to-day Linux users probably won't see in-kernel WireGuard until late 2020. Ubuntu is one of the faster-moving mainstream distributions, and its next Long Term Support (LTS) release is in April 2020. But the Linux 5.6 kernel and Ubuntu 20.04 will likely be in release candidate status at the same time, so its inclusion in 20.04 seems unlikely. The interim 20.10 Ubuntu release seems like a much safer bet for Canonical's first use of a 5.6 or later kernel. Red Hat Enterprise Linux (RHEL) inclusion will likely be a year or more beyond that; the current RHEL 8.1 shipped in May 2019 with the 4.18 kernel, which was already 9 months old. Although highly speculative, it's also possible that WireGuard could land in-kernel on Ubuntu 20.04 even without the 5.6 kernel—Donenfeld offered to do the work backporting WireGuard into earlier Ubuntu kernels directly. Donenfeld also stated today that a 1.0 WireGuard release is "on the horizon."' -- source: https://arstechnica.com/gadgets/2019/12/wireguard-vpn-is-a-step-closer-to-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0