- wlug - list.wlug.org.nz

Novel attack against virtually all VPN apps neuters their entire purpose
by Peter Reutemann 07 May '24

07 May '24

'Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering. TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then. The effect of TunnelVision is “the victim's traffic is now decloaked and being routed through the attacker directly,” a video demonstration explained. “The attacker can read, drop or modify the leaked traffic and the victim maintains their connection to both the VPN and the Internet.” The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself.' -- source: https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all… Cheers, Peter

1 0

Kernel Modules Are Now Compressed
by Lawrence D'Oliveiro 06 May '24

06 May '24

Not sure if this is mentioned in any release notes anywhere, but the .ko files (loadable kernel modules) that would live in /lib/modules/«kernel version»/ are now .ko.xz files. Looks like this happened starting with the 6.6 kernel. I discovered this a few minutes ago, while trying to count how many .ko files came with my 6.7.9 Debian kernel, with find /lib/modules/$(uname -r) -name \*.ko | wc -l and was surprised to see that the answer was 0. A suitably adjusted command find /lib/modules/$(uname -r) -name \*.ko\* | wc -l returns 4165

1 0

Yet Another New systemd Feature
by Lawrence D'Oliveiro 06 May '24

06 May '24

Lennart Poettering wants to get rid of sudo now, and replace it with a new systemd feature called “run0” <https://itwire.com/business-it-news/open-source/poettering-announces-tool-i…>. It is hard to write code that runs setuid, and sudo has had quite a few security vulnerabilities over the years. So Poettering’s idea is to replace the setuid executable with another use of the existing PolicyKit system. Interesting that Poettering thinks we should get rid of the whole idea of setuid altogether. AT&T actually got a patent on the concept, back in the early days of Unix. Other OSes had the concept of privileged code, but what made setuid different is that any user can set this mode on any executable they create, and when other users run this executable (if they are allowed to), they temporarily get the permissions of the owning user. On Linux, this concept was always constrained a bit: I think it only works on compiled machine-code executables, not on interpreted scripts.

1 0

Maximum-Severity GitLab Flaw Allowing Account Hijacking Under Active Exploitation
by Peter Reutemann 03 May '24

03 May '24

'Dan Goodin reports via Ars Technica: A maximum severity vulnerability that allows hackers to hijack GitLab accounts with no user interaction required is now under active exploitation, federal government officials warned as data showed that thousands of users had yet to install a patch released in January. A change GitLab implemented in May 2023 made it possible for users to initiate password changes through links sent to secondary email addresses. The move was designed to permit resets when users didn't have access to the email address used to establish the account. In January, GitLab disclosed that the feature allowed attackers to send reset emails to accounts they controlled and from there click on the embedded link and take over the account. While exploits required no user interaction, hijackings worked only against accounts that weren't configured to use multi-factor authentication. Even with MFA, accounts remained vulnerable to password resets. The vulnerability, tracked as CVE-2023-7028, carries a severity rating of 10 out of a possible 10. The vulnerability, classified as an improper access control flaw, could pose a grave threat. GitLab software typically has access to multiple development environments belonging to users. With the ability to access them and surreptitiously introduce changes, attackers could sabotage projects or plant backdoors that could infect anyone using software built in the compromised environment. An example of a similar supply chain attack is the one that hit SolarWinds in 2021, infecting more than 18,000 of its customers. Other recent examples of supply chain attacks are here, here, and here. These sorts of attacks are powerful. By hacking a single, carefully selected target, attackers gain the means to infect thousands of downstream users, often without requiring them to take any action at all. According to Internet scans performed by security organization Shadowserver, more than 2,100 IP addresses showed they were hosting one or more vulnerable GitLab instances. In order to protect your system, you should enable MFA and install the latest patch. "GitLab users should also remember that patching does nothing to secure systems that have already been breached through exploits," notes Goodin.' -- source: https://it.slashdot.org/story/24/05/02/1934220 Cheers, Peter -- My Open Source Blog - http://open.fracpete.org

2 1

Bat is a Modern Drop-in Replacement for Cat Command on Linux
by Peter Reutemann 01 May '24

01 May '24

'The bat is a modern command-line program written in the Rust programming language, and I can confidently say it’s a great drop-in replacement for our beloved cat command. If you’re wondering why I’m hyping this so much and what it has to offer you that makes it worth replacing the cat with, then do check out its features below. Bat really has some cool features to offer, which are mentioned below. - Supports syntax highlighting for a large number of programming and markup languages. - Detect and display Git changes. - Pipe output to its own pager (e.g., “less“) if the output is too large for one screen. - Display non-printable characters such as spaces, tabs, line breaks, etc. - Offer multiple themes that can be easily configured using flags or environments. - A user-friendly command-line interface that, of course, inherits all the functionality of the “cat” command.' -- source: https://linuxtldr.com/installing-bat/ Cheers, Peter

2 1

I Have No Luck With Keyboards ...
by Lawrence D'Oliveiro 01 May '24

01 May '24

Yesterday I decided that my heavily-used clicky mechanical keyboard (a Das Keyboard 4) had accumulated far too much grime, and it was time to take the risk of cleaning it. In the past, every time I’ve tried cleaning a keyboard, it has never worked right afterwards. I’m a software guy, not a hardware guy. I found the keys quite easy to pry off. A light amount of leverage with a small screwdriver was helpful when space was tight, but once I’d cleared sufficient room around a key, I could pull it off just with my fingers. Even the wider keys were not hard. I found some warnings online against removing these, because of the trickiness of their extra stabilization mechanisms. But these were actually quite simple: a steel spring with its ends poked through two tiny brackets (removable, but best left in place) at each end of the key. It took a bit of pressure with the screwdriver to bend one end of the spring far enough to take it out of the hole, but it snapped immediately back to its original shape after I had taken the key out, so I saw no problem putting things back afterwards. The space bar was even simpler: just two additional support posts at the ends, in addition to the usual post (common to all the keys) that held the actual switch in the middle. After I had got all the keys off, the grime on the keyboard itself was a wonder to behold (I’ll spare you the details). I tried to use a bunched-up corner of a wet cloth, and even a vacuum cleaner with the smallest nozzle (again heeding warnings online against compressed air), and I was able to remove maybe half the accumulation of deposits, not much more. I figured that was good enough. Of course, in the process, I likely got some water into two slots that were exposed after I removed the keys. There was a recommendation online to leave things to dry for at least 6 hours. Call me impatient; I left it for just 5. Afterwards, I plugged it in, without the key caps, and tried a few keys, and was gratified to find they still worked. After that, I put back all the keys, now nice and clean and dry. Even the ones with those extra springs went back with only a slight amount of fiddling to re-engage with those brackets on the keys. And afterwards, the keyboard still worked. I left it plugged in, and went to do something else. Half an hour later, I came back to my computer ... and the keyboard was dead. Not a single response from any key. Put it back in the heater cupboard and left it overnight. No change this morning: still dead. So I feel very sad. I thought I had broken my keyboard jinx. But it’s currently zero for three. I have some other keyboards, of course, including a colourful oddity I bought from Dick Smith (whose layout leaves out the right-hand super/windows key), and a Kensington “washable” (dare I risk it?), with the pipe/backslash key in a different position. But I had grown accustomed to the volume control knob and other niceties of the Das Keyboard. Looking back through my records, I was surprised to discover I had bought it about ten years ago, from Mighty Ape. So I suppose it’s had a good run. But it seems nobody in NZ sells the things any more. So currently I mourn, and I also look for alternatives ...

3 3

T2 Linux 24.5 Released
by Peter Reutemann 30 Apr '24

30 Apr '24

'A major T2 Linux milestone has been released, shipping with full support for 25 CPU architectures and several C libraries, as well as restored support for Intel IA-64 Itanium. Additionally, many vintage X.org DDX drivers were fixed and tested to work again, as well as complete support for the latest KDE 6 and GNOME 46. T2 is known for its sophisticated cross compile support and support for nearly all existing CPU architectures: Alpha, Arc, ARM(64), Avr32, HPPA(64), IA64, M68k, MIPS(64), Nios2, PowerPC(64)(le), RISCV(64), s390x, SPARC(64), and SuperH x86(64). T2 is an increasingly popular choice for embedded systems and virtualization. It also still supports the Sony PS3, Sgi, Sun and HP workstations, as well as the latest ARM64 and RISCV64 architectures. The release contains a total of 5,140 changesets, including approximately 5,314 package updates, 564 issues fixed, 317 packages or features added and 163 removed, and around 53 improvements. Usually most packages are up-to-date, including Linux 6.8, GCC 13, LLVM/Clang 18, as well as the latest version of X.org, Mesa, Firefox, Rust, KDE 6 and GNOME 46! More information, source and binary distribution are open source and free at T2 SDE.' -- source: https://news.slashdot.org/story/24/04/29/2325210/ To be honest, haven't heard of that distro before, but sounds interesting. Cheers, Peter

2 3

Hackers try to exploit WordPress plugin vulnerability that’s as severe as it gets
by Peter Reutemann 29 Apr '24

29 Apr '24

'Hackers are assailing websites using a prominent WordPress plugin with millions of attempts to exploit a high-severity vulnerability that allows complete takeover, researchers said. The vulnerability resides in WordPress Automatic, a plugin with more than 38,000 paying customers. Websites running the WordPress content management system use it to incorporate content from other sites. Researchers from security firm Patchstack disclosed last month that WP Automatic versions 3.92.0 and below had a vulnerability with a severity rating of 9.9 out of a possible 10. The plugin developer, ValvePress, silently published a patch, which is available in versions 3.92.1 and beyond. Researchers have classified the flaw, tracked as CVE-2024-27956, as a SQL injection, a class of vulnerability that stems from a failure by a web application to query backend databases properly. SQL syntax uses apostrophes to indicate the beginning and end of a data string. By entering strings with specially positioned apostrophes into vulnerable website fields, attackers can execute code that performs various sensitive actions, including returning confidential data, giving administrative system privileges, or subverting how the web app works.' -- source: https://arstechnica.com/security/2024/04/hackers-make-millions-of-attempts-… Cheers, Peter

2 1

Alternative To Microsoft Access
by Lawrence D'Oliveiro 27 Apr '24

27 Apr '24

If anybody asks about an alternative to Microsoft Access, I think SQLite used in combination with LibreOffice will give you a lot of functionality, including comprehensive SQL support and scalability to much larger databases. Of course you can use other backends, like MariaDB/MySQL, as well. SQLite just makes it easy to have an actual database file that you can copy/move about the place, without having to do database dumps/restores. If you don’t need multiuser support, it is very convenient. I notice that libreoffice-base is now a separate package under Debian (and I suppose its derivatives as well), no longer included in the “base” (heh) LibreOffice package. Make sure to install this, along with libsqliteodbc. Now, say you have an existing SQLite3 database that you want to access from LibreOffice. Suppose it is in the file /home/ldo/hack/lo_try/test.db. In order for databases to be accessible via ODBC, they need to have entries in your ~/.odbc.ini file. This is just a text file, in the good old .ini tradition. The format for entries is very simple, e.g.: [test-db] Description=Test database for LibreOffice Base Driver=SQLite3 Database=/home/ldo/hack/lo_try/test.db Now, when you launch the LibreOffice Base database wizard, you have options to “create a new database”, “open an existing database file”, or “connect to an existing database”. Choose that last one “connect to an existing database”. The popup menu shows the available back-end drivers: choose “ODBC”. Now, when you click “Next”, there should be a text field with a “Browse...” button; clicking this should show the names of entries in your ~/.odbc.ini file, e.g. “test-db” if you used the name in my example above. Select this, and click “Finish”. Next you will be prompted for a name to save the “database file”. This is just the LibreOffice Base document that contains the settings for connecting to the actual database: LibreOffice doesn’t know or care where the database back-end keeps the actual data. After having named the LibreOffice database file, you should see the main LibreOffice Base window. In the lower half, under “Tables”, you should see a list of the tables from the database file. You can double-click a table name to see a quick list of all its records. That’s as far as I’ve got. I see a “Design View”, “Form Wizards”, and “Report Wizards”, and all kinds of other fun stuff. Should be great for building simple database applications, with a minimum of programming.

1 0

Ubuntu 24.04 LTS 'Noble Numbat' Officially Released
by Peter Reutemann 26 Apr '24

26 Apr '24

'9to5Linux: Canonical released today Ubuntu 24.04 LTS (Noble Numbat) as the latest version of its popular Linux-based operating system featuring some of the latest GNU/Linux technologies and Open Source software. Powered by Linux kernel 6.8, Ubuntu 24.04 LTS features the latest GNOME 46 desktop environment, an all-new graphical firmware update tool called Firmware Updater, Netplan 1.0 for state-of-the-art network management, updated Ubuntu font, support for the deb822 format for software sources, increased vm.max_map_count for better gaming, and Mozilla Thunderbird as a Snap by default. It also comes with an updated Flutter-based graphical desktop installer that's now capable of updating itself and features a bunch of changes like support for accessibility features, guided (unencrypted) ZFS installations, a new option to import auto-install configurations for templated custom provisioning, as well as new default installation options, such as Default selection (previously Minimal) and Extended selection (previously Normal)."' -- source: https://news.slashdot.org/story/24/04/25/2036234 Cheers, Peter

1 0