- wlug - list.wlug.org.nz

200 Million Devices -- Some Mission-Critical -- Vulnerable To Remote Takeover
by Peter Reutemann 29 Jul '19

29 Jul '19

'About 200 million Internet-connected devices -- some that may be controlling elevators, medical equipment, and other mission-critical systems -- are vulnerable to attacks that give attackers complete control, researchers warned on Monday. In all, researchers with security firm Armis identified 11 vulnerabilities in various versions of VxWorks, a slimmed-down operating system that runs on more than 2 billion devices worldwide. Billed collectively as Urgent 11, the vulnerabilities consist of six remote code flaws and five less-severe issues that allow things like information leaks and denial-of-service attacks. None of the vulnerabilities affects the most recent version of VxWorks or any of the certified versions of the OS, including VxWorks 653 or VxWorks Cert Edition. For the 200 million devices Armis estimated are running a version that's susceptible to a serious attack, however, the stakes may be high. Because many of the vulnerabilities reside in the networking stack known as IPnet, they can often be exploited by little more than boobytrapped packets sent from outside the Internet. Depending on the vulnerability, exploits may also be able to penetrate firewalls and other types of network defenses. The most dire scenarios are attacks that chain together multiple exploits that trigger the remote takeover of multiple devices. "Such vulnerabilities do not require any adaptations for the various devices using the network stack, making them exceptionally easy to spread," Armis researchers wrote in a technical overview. "In most operating systems, such fundamental vulnerabilities in the crucial networking stacks have become extinct, after years of scrutiny unravelled and mitigated such flaws." VxWorks-maker Wind River says the latest release of VxWorks "is not affected by the vulnerability, nor are any of Wind Rivers' safety-critical products that are designed for safety certification, such as VxWorks 653 and VxWorks Cert Edition used in critical infrastructure." Wind River issued patches last month and is in the process of notifying affected customers of the threat.' -- source: https://it.slashdot.org/story/19/07/29/2059248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source RISC-V License Helps Alibaba Sidestep US Trade War
by Peter Reutemann 29 Jul '19

29 Jul '19

'"RISC-V is open source, so it's much more resistant to government bans," reports Tom's Hardware: The Alibaba Group Holding, China's largest e-commerce company, unveiled its first self-designed chip, Xuantie 910, based on the open source RISC-V instruction set architecture. As reported by Nikkei Asian Review, the chip will target edge computing and autonomous driving, while the RISC-V's open source license may help Alibaba side-step the U.S. trade war altogether. Alibaba doesn't intend to manufacture the chips itself. Instead, it could outsource production to other Chinese semiconductor companies, such as Semiconductor Manufacturing International Corp. According to Nikkei, the Chinese government has been encouraging wealthy Chinese companies from various industries to enter the semiconductor industry in recent years. The government's efforts accelerated when the trade war with the U.S. started last year. It reportedly forced foreign companies to transfer their technology and IP to Chinese companies if they wanted any chance at the local Chinese market. "Most Chinese companies are still wary about whether Arm's architecture and Intel's architecture and technical support would remain accessible amid tech tension and further geopolitical uncertainties," Sean Yang, an analyst at research company CINNO in Shanghai, said, according to Nikkei. "It would be very helpful for China to increase long-term semiconductor sufficiency if big companies such as Alibaba jump in to build a chip (design) platform which smaller Chinese developers can just use without worrying about being cut off from supplies." The article also notes that using RISC-V will give Alibaba "the ability to completely customize and extend the ISA of the processors built on top of it without having to get permission from any company first."' -- source: https://news.slashdot.org/story/19/07/29/0224256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'No More Ransom' Decryption Tools Prevent $108M In Ransomware Payments
by Peter Reutemann 29 Jul '19

29 Jul '19

'On the three-year anniversary of the No More Ransom project, Europol announced today that users who downloaded and decrypted files using free tools made available through the No More Ransom portal have prevented ransomware gangs from making profits estimated at at least $108 million... However, an Emsisoft spokesperson told ZDNet that the $108 million estimate that Europol shared today is "actually a huge underestimate. They're based on the number of successful decryptions confirmed by telemetry -- in other words, when the tools phone home to confirm they've done their job," Emsisoft told ZDNet... Just the free decryption tools for the GandCrab ransomware alone offered on the No More Ransom website have prevented ransom payments of nearly $50 million alone, Europol said. The project, which launched in July 2016, now hosts 82 tools that can be used to decrypt 109 different types of ransomware. Most of these have been created and shared by antivirus makers like Emsisoft, Avast, and Bitdefender, and others; national police agencies; CERTs; or online communities like Bleeping Computer. By far the most proficient member has been antivirus maker Emsisoft, which released 32 decryption tools for 32 different ransomware strains... All in all, Europol said that more than three million users visited the site and more than 200,000 users downloaded tools from the No More Ransom portal since its launch. One Emisoft researcher said they were "pretty proud" of their decryptor for MegaLocker, "as not only did it help thousands of victims, but it really riled up the malware author."' -- source: https://it.slashdot.org/story/19/07/28/2358258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Penetration Testing Toolkit Includes Exploit For 'Incredibly Dangerous' Bluekeep Vulnerability
by Peter Reutemann 28 Jul '19

28 Jul '19

'In May, Microsoft released a patch for a bug in several versions of Windows that is so bad that the company felt it even had to release a fix for Windows XP, an operating system that (has been unsupported) for five years. That vulnerability is known as BlueKeep, and it has kept a lot of security researchers up at night. They are worried that someone could write an exploit for it and make a worm that could wreak havoc the way WannaCry or NotPetya -- two viruses that spread almost uncontrollably all over the world locking thousands of computers -- did.... Researchers were so worried about this vulnerability that for months, no one has published the code for a proof-of-concept exploit. In other words, no one wanted to be the guy to even prove that this type of malware was even possible to write. Until now. On Tuesday, Immunity, a long time US government contractor, announced that it had developed an exploit for BlueKeep and included it into its penetration testing toolkit Canvas, which is available only to paying subscribers. Canvas customers, can now exploit this bug using Immunity's own code. ZDNet notes that Canvas licenses "cost between thousands and tens of thousands of US dollars," but also adds that "hackers have been known to pirate or legitimately buy penetration testing tools."' -- source: https://tech.slashdot.org/story/19/07/27/042203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In 80 Days, Google Will Require Chrome Extensions To Request 'The Least Amount of Data'
by Peter Reutemann 28 Jul '19

28 Jul '19

'"Google is giving Chrome extension makers until October 15 to minimize the amount of data they collect during browser sessions or face expulsion from the Chrome Web Store," reports PC Magazine: The change addresses how the extensions generally need to request certain permissions from your browser in order to function. However, some of these permissions can be pretty powerful; they can include the ability to take desktop screenshots, capture audio from a microphone, and collect data from the local file system, among other things, which can open the door to potential abuse. The risks prompted Google to work toward securing the 180,000+ Chrome extensions on the company's official web store. "We're requiring extensions to only request access to the least amount of data," the company said in a Tuesday blog post. "While this has previously been encouraged of developers, now we're making this a requirement for all extensions."' -- source: https://yro.slashdot.org/story/19/07/27/0420225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Focused Android Q Still Lets Advertisers Track You
by Peter Reutemann 28 Jul '19

28 Jul '19

'"The upcoming version of the Android operating system is taking a strong focus on privacy," reports SD Times, "but the Electronic Frontier Foundation (EFF) believes it could still do better." Android Q's new privacy features include: user control over app access to device location, new limits on access to files in shared external storage, restrictions on launching activities, and restrictions on access to the device's hardware and sensors... "However, in at least one area, Q's improvements are undermined by Android's continued support of a feature that allows third-party advertisers, including Google itself, to track users across apps," Bennett Cyphers, engineer for the EFF, wrote in a post. "Furthermore, Android still doesn't let users control their apps' access to the Internet, a basic permission that would address a wide range of privacy concerns." According to Cyphers, while Android Q has new restrictions on non-resettable device identifies, it will allow unrestricted access for its own tracking identifier [called "advertising ID"]... "Facebook and other targeting companies allow businesses to upload lists of ad IDs that they have collected in order to target those users on other platforms," he wrote... "On Android, there is no way for the user to control which apps can access the ID, and no way to turn it off. While we support Google taking steps to protect other hardware identifiers from unnecessary access, its continued support of the advertising ID -- a "feature" designed solely to support tracking -- undercuts the company's public commitment to privacy," he wrote... Cypher also noted that while Apple's iOS has similar identifiers for advertisers that contradict with its privacy campaign, it does enable users to turn off the tracking. In fact, Android Q also ships with an "opt out of ad personalization" checkbox where users can indicate that they don't want Google's identifier to track them, Cyphers reports -- but "the checkbox doesn't affect the ad ID in any way. "It only encodes the user's 'preference', so that when an app asks Android whether a user wants to be tracked, the operating system can reply 'no, actually they don't.' Google's terms tell developers to respect this setting, but Android provides no technical safeguards to enforce this policy."' -- source: https://yro.slashdot.org/story/19/07/27/0526206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Airbus A350 Software Bug Forces Airlines To Turn Planes Off and On Every 149 Hours
by Peter Reutemann 26 Jul '19

26 Jul '19

'Some models of Airbus A350 airliners still need to be hard rebooted after exactly 149 hours, despite warnings from the EU Aviation Safety Agency (EASA) first issued two years ago. In a mandatory airworthiness directive (AD) reissued earlier this week, EASA urged operators to turn their A350s off and on again to prevent "partial or total loss of some avionics systems or functions." The revised AD, effective from tomorrow (26 July), exempts only those new A350-941s which have had modified software pre-loaded on the production line. For all other A350-941s, operators need to completely power the airliner down before it reaches 149 hours of continuous power-on time. Concerningly, the original 2017 AD was brought about by "in-service events where a loss of communication occurred between some avionics systems and avionics network" (sic). The impact of the failures ranged from "redundancy loss" to "complete loss on a specific function hosted on common remote data concentrator and core processing input/output modules." In layman's English, this means that prior to 2017, at least some A350s flying passengers were suffering unexplained failures of potentially flight-critical digital systems.' -- source: https://it.slashdot.org/story/19/07/25/1932229 Oh dear... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VLC player has a critical flaw – and there’s no patch yet
by Peter Reutemann 25 Jul '19

25 Jul '19

'On the flip side, there are currently no known cases of the vulnerability being exploited in the wild Germany’s national Computer Emergency Response Team (CERT-Bund) has issued a security advisory to alert users of VLC media player of a severe vulnerability affecting this extremely popular open-source software. “A remote, anonymous attacker can exploit the vulnerability in VLC to execute arbitrary code, cause a denial-of-service condition, exfiltrate information, or manipulate files,” said CERT-Bund, which also discovered the security loophole. The memory-corruption flaw is known to reside in the player’s latest release, 3.0.7.1, but may also be present in its earlier versions. It affects the program’s Windows, Linux and UNIX versions and has earned a score of 4 out of 5 on the German agency’s severity scale.' -- source: https://cybersafe.mcttrainingconsultant.com/?p=14585 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Advanced mobile surveillanceware, made in Russia, found in the wild
by Peter Reutemann 24 Jul '19

24 Jul '19

'Researchers have discovered some of the most advanced and full-featured mobile surveillanceware ever seen. Dubbed Monokle and used in the wild since at least March 2016, the Android-based application was developed by a Russian defense contractor that was sanctioned in 2016 for helping that country’s Main Intelligence Directorate meddle in the 2016 US presidential election. Monokle uses several novel tools, including the ability to modify the Android trusted-certificate store and a command-and-control network that can communicate over Internet TCP ports, email, text messages, or phone calls. The result: Monokle provides a host of surveillance capabilities that work even when an Internet connection is unavailable.' -- source: https://arstechnica.com/information-technology/2019/07/advanced-mobile-surv… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'The Raspberry Pi 4 Needs a Fan'
by Peter Reutemann 24 Jul '19

24 Jul '19

'Author and programmer Jeff Geerling explains in a blog post why the new Raspberry Pi 4 needs a fan. Unlike previous Pis that didn't require a fan or heatsink to avoid CPU throttling, the Pi 4 is a different beast and "pretty much demands a fan," writes Geerling. "Not only does the CPU get appreciably hot even under normal load, there are a number of other parts of the board that heat up to the point they are uncomfortable to touch." After 5 minutes at idle, he recorded the CPU/System-on-a-Chip (SoC) was around 60C, and it climbed to the 60-70C range when using the USB ports. "[I]magine if you're truly using the Pi 4 as a desktop replacement, with at least one external USB 3.0 hard drive attached, WiFi connected and transferring large amounts of data, a USB keyboard and mouse, a few browser windows open (the average website these days might as well be an AAA video game with how resource-intense it is), a text editor, and a music player," writes Geerling. "This amount of load is enough to cause the CPU to throttle in less than 10 minutes." So, Geerling did what any programmer and DIYer would do and decided to add a fan himself to the official case -- and in addition to the blog post describing the process, he made a 22-minute-long video showing you what he did. From the post: Without any ventilation, it's kind of a little plastic oven inside the Pi 4 case. A heat sink might help in some tiny way, but that heat has nowhere to go! So I decided to follow the lead of Redditor u/CarbyCarberson and put a fan in the top cover. [...] After installing the fan, I booted the Pi and ran "stress --cpu 4" and let it go for an hour. The entire time, the CPU's temperature stayed at or under 60C (140F), a full 20C lower than the throttling point. There are some other options which may be even easier than modifying the official case, like the Fan Shim from Pimoroni or purchasing a 3rd party case with a fan built in. But this option was easy enough and all I needed to complete the project was a $4 fan and a $7 hole saw drill bit (which I can use for other projects in the future). ' -- source: https://hardware.slashdot.org/story/19/07/17/2254204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1