- wlug - list.wlug.org.nz

PC Sales Are Up--Or Are They?
by Lawrence D'Oliveiro 12 Jul '19

12 Jul '19

Another report highlighting the usual discrepancy in analysis of PC sales between IDC and Gartner <https://arstechnica.com/information-technology/2019/07/gartner-idc-agree-th…>: the difference seems down to the fact that one includes Chromebooks in their definition of a “PC”, while the other one counts Microsoft Surface tablets instead. Obvious conclusion: if it weren’t for Chromebooks, the PC market would be a pretty gloomy place indeed.

1 0

The Most Clever 'Zip Bomb' Ever Made Explodes a 46MB File To 4.5 Petabytes
by Peter Reutemann 11 Jul '19

11 Jul '19

'Programmer and engineer David Fifield has unveiled a brand-new Zip bomb that explodes a 46-megabyte file to 4.5 petabytes of data. Fifield's new type of "Zip bomb" or "compression bomb" is particularly novel because he "figured out how to 'overlap' files inside of a Zip archive, allowing for compression rates far beyond those of a traditional archive," reports Motherboard. From the report: In an email interview, Fifield noted that, while 42.zip (which has a 106 billion-to-one compression ratio and has been hosted on the same single-serving website for at least 15 years) gets much of the attention, he finds later attempts more technically interesting. "eI find 42.zip inspiring on an aesthetic level -- not so much the file itself but the circumstances around it," Fifield said. "It's like folklore. There must have been many examples of the same basic idea, but for whatever reason 42.zip is the one that had staying power." Fifield noted that part of what makes his process possible was by coming up with ways to handle cyclic redundancy checks, or CRCs, a basic error-correction functionality baked into Zip, PNG, Ethernet, and numerous other technical standards. Messing around with CRC -- 32 checksums, as they're called, was where Fifield said he learned the most. Fifield, who will present his findings at the USENIX Workshop on Offensive Technologies (WOOT) conference next month, noted that while the work itself adds to a history of research and likely will be superseded in the future, its benefit from an awareness standpoint is importan' -- source: https://hardware.slashdot.org/story/19/07/10/2341251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linode Democratizes Cloud GPUs: Brings Powerful Nvidia GPUs To Its Linux Cloud
by Peter Reutemann 11 Jul '19

11 Jul '19

'Linode today launched new GPU-optimized cloud computing instances tailored specifically for developers and businesses requiring massive parallel computational power. The new instances are built on NVIDIA Quadro RTX 6000 GPU cards with all three major types of processing cores (CUDA, Tensor, and Real-Time Ray Tracing) available to users. Linode is one of the first cloud providers to deploy NVIDIA's latest GPU architecture. These new GPU instances give scientists, artists, and engineers working on artificial intelligence, graphic visualization, and complex modeling a cost-competitive alternative to hyperscale cloud providers.' -- source: https://linux.slashdot.org/story/19/07/10/1826238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Academics Steal Data From Air-Gapped Systems Via a Keyboard's LEDs
by Peter Reutemann 11 Jul '19

11 Jul '19

'The Caps Lock, Num Lock, and Scroll Lock LEDs on a keyboard can be used to exfiltrate data from a secure air-gapped system, academics from an Israeli university have proved. From a report: The attack, which they named CTRL-ALT-LED, is nothing that regular users should worry about but is a danger for highly secure environments such as government networks that store top-secret documents or enterprise networks dedicated to storing non-public proprietary information. he attack requires some pre-requisites, such as the malicious actor finding a way to infect an air-gapped system with malware beforehand. CTRL-ALT-LED is only an exfiltration method. But once these prerequisites are met, the malware running on a system can make the LEDs of an USB-connected keyboard blink at rapid speeds, using a custom transmission protocol and modulation scheme to encode the transmitted data. A nearby attacker can record these tiny light flickers, which they can decode at a later point, using the same modulation scheme used to encode it.' -- source: https://it.slashdot.org/story/19/07/10/1836232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samba 4.11 Removes SMB1 File-Sharing Protocol Version By Default
by Peter Reutemann 11 Jul '19

11 Jul '19

'Samba says version 4.11.0 will switch off previously on-by-default support for the aging and easily subverted SMB1 protocol. Slashdot reader Jeremy Allison - Sam shares a report from The Register detailing the new changes: The open-source SMB toolkit's developers say the Samba 4.11 build, currently in preview, will by default set SMB2_02 as the earliest supported version of the Windows file-sharing protocol. Admins will still have the option to allow SMB1 on their servers if they so choose, but support will be turned off by default. The move by Samba to drop SMB1 can be seen as long overdue, given that Microsoft has been moving to get rid of the file-server protocol version from its operating systems for several years now, even before it was revealed to be one of the NSA's favorite weak points to exploit. ' -- source: https://tech.slashdot.org/story/19/07/10/2119238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Contractors Are Secretly Listening To Your Assistant Recordings
by Peter Reutemann 11 Jul '19

11 Jul '19

'A new report from Belgian broadcaster VRT News describes the process by which Google Home recordings end up being listened to by contractors -- and the scary part is that it apparently doesn't take much, if anything, to start a recording. While the recordings are not listened to live, audio clips are sent to subcontractors. The Next Web reports: VRT, with the help of a whistleblower, was able to listen to some of these clips and subsequently heard enough to discern the addresses of several Dutch and Belgian people using Google Home -- in spite of the fact some hadn't even uttered the words "Hey Google," which are supposed to be the device's listening trigger. The person who leaked the recordings was working as a subcontractor to Google, transcribing the audio files for subsequent use in improving its speech recognition. They got in touch with VRT after reading about Amazon Alexa keeping recordings indefinitely. According to the whistleblower, the recordings presented to them are meant to be carefully annotated, with notes included about the speakers presumed identity and age. From the sound of the report, these transcribers have heard just about everything. Personal information? Bedroom activities? Domestic violence? Yes, yes, and yes. While VRT only listened to recordings from Dutch and Belgian users, the platform the whistleblower showed them had recordings from all over the world -- which means there are probably thousands of other contractors listening to Assistant recordings. The VRT report states that the Google Home Terms of Service don't mention that recordings might be listened to by other humans. The report says that the recordings are identified by numbers rather than user names, but VRT "was able to pick up enough data from the recordings to find the addresses of the users in question, and even confront some of the users in the recordings -- to their great dismay," reports The Next Web. What does Google have to say about all this? That they only transcribe and use "about 0.2% of all audio clips" to improve their voice recognition technology.' -- source: https://yro.slashdot.org/story/19/07/10/2153210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet group brands Mozilla ‘internet villain’ for supporting DNS privacy feature
by Peter Reutemann 10 Jul '19

10 Jul '19

'An industry group of internet service providers has branded Firefox browser maker Mozilla an “internet villain” for supporting a DNS security standard. The U.K.’s Internet Services Providers’ Association (ISPA), the trade group for U.K. internet service providers, nominated the browser maker for its proposed effort to roll out the security feature, which they say will allow users to “bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK.” Mozilla said late last year it was planning to test DNS-over-HTTPS to a small number of users.' -- source: https://techcrunch.com/2019/07/05/isp-group-mozilla-internet-villain-dns-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Snap App Remains Hopelessly Outdated
by Peter Reutemann 10 Jul '19

10 Jul '19

'The official Skype Snap app for Linux has not been updated in nearly six months, and Microsoft is yet to say why. When introducing the cross-distro build in early 2018, the company said the Skype Snap app would give it the "... ability to push the latest features straight to our users, no matter which device or distribution they happen to use." Clearly, not. Because at the time of writing this post the Skype Snap app sits on version 8.34.0.78, which the Snapcraft store reports was 'last updated' in November 2018. However, the "regular" Linux version available to download from the Skype website is on version 8.47.0.73, released June 2019.' -- source: https://linux.slashdot.org/story/19/07/09/2014250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Closes Its $34 Billion Acquisition of Red Hat
by Peter Reutemann 09 Jul '19

09 Jul '19

'IBM closed its $34 billion acquisition of Red Hat, the companies announced Tuesday. From a report: The deal was originally announced in October, when the companies said IBM would buy all shares in Red Hat for $190 each in cash. The acquisition of Red Hat, an open-source, enterprise software maker, marks the close of IBM's largest deal ever. It's one of the biggest in U.S. tech history. Excluding the AOL-Time Warner merger, it follows the $67 billion deal between Dell and EMC in 2016 and JDS Uniphase's $41 billion acquisition of optical-component supplier SDL in 2000. Under the deal, Red Hat will now be a unit of IBM's hybrid cloud division, according to the original announcement. The companies said Red Hat's CEO, Jim Whitehurst, would join IBM's senior management team and report to CEO Ginni Rometty. IBM previously said it hoped its acquisition of Red Hat will help it do more work in the cloud, one of its four key growth drivers, which are also social, mobile and analytics. The company lags behind Amazon and Microsoft in the cloud infrastructure business. IBM has seen three consecutive quarters of declining year-over-year revenue. But some analysts are hopeful about the Red Hat deal's opportunity to bring in new business.' -- source: https://linux.slashdot.org/story/19/07/09/1740223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Logitech Wireless USB Dongles Vulnerable To New Hijacking Flaws
by Peter Reutemann 09 Jul '19

09 Jul '19

'A security researcher has publicly disclosed new vulnerabilities in the USB dongles (receivers) used by Logitech wireless keyboards, mice, and presentation clickers. New submitter raikoseagle shares a report: The vulnerabilities allow attackers to sniff on keyboard traffic, but also inject keystrokes (even into dongles not connected to a wireless keyboard) and take over the computer to which a dongle has been connected. When encryption is used to protect the connection between the dongle and its paired device, the vulnerabilities also allow attackers to recover the encryption key. Furthermore, if the USB dongle uses a "key blacklist" to prevent the paired device from injecting keystrokes, the vulnerabilities allow the bypassing of this security protection system. Marcus Mengs, the researcher who discovered these vulnerabilities, said he notified Logitech about his findings, and the vendor plans to patch some of the reported issues, but not all.' -- source: https://it.slashdot.org/story/19/07/09/182246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0