- wlug - list.wlug.org.nz

Google's New ReCAPTCHA Has a Dark Side
by Peter Reutemann 28 Jun '19

28 Jun '19

'We've all tried to log into a website or submit a form only to be stuck clicking boxes of traffic lights or storefronts or bridges in a desperate attempt to finally convince the computer that we're not actually a bot. For many years, this has been one of the predominant ways that reCaptcha -- the Google-run internet bot detector -- has determined whether a user is a bot or not. But last fall, Google launched a new version of the tool, with the goal of eliminating that annoying user experience entirely. Now, when you enter a form on a website that's using reCaptcha V3, you won't see the "I'm not a robot" checkbox, nor will you have to prove you know what a cat looks like. Instead, you won't see anything at all. Google is also now testing an enterprise version of reCaptcha v3, where Google creates a customized reCaptcha for enterprises that are looking for more granular data about users' risk levels to protect their site algorithms from malicious users and bots. But this new, risk-score based system comes with a serious trade-off: users' privacy. According to two security researchers who've studied reCaptcha, one of the ways that Google determines whether you're a malicious user or not is whether you already have a Google cookie installed on your browser. It's the same cookie that allows you to open new tabs in your browser and not have to re-log in to your Google account every time. But according to Mohamed Akrout, a computer science PhD student at the University of Toronto who has studied reCaptcha, it appears that Google is also using its cookies to determine whether someone is a human in reCaptcha v3 tests. Akrout wrote in an April paper about how reCaptcha v3 simulations that ran on a browser with a connected Google account received lower risk scores than browsers without a connected Google account. "Because reCaptcha v3 is likely to be on every page of a website, if you're signed into your Google account there's a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3 -- and there many be no visual indication on the site that it's happening, beyond a small reCaptcha logo hidden in the corner," the report adds.' -- source: https://tech.slashdot.org/story/19/06/27/2139219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WireGuard on Windows early preview
by Peter Reutemann 28 Jun '19

28 Jun '19

'WireGuard is a new peer-to-peer VPN technology that has the potential for greater speed, smaller attack surface, and easier configuration than commonly used and better-established VPN platforms such as OpenVPN and IPSec. It has been available on Linux, FreeBSD, macOS, Android, and even iOS for quite some time now, with Windows being the one platform frustratingly missing. There are good reasons for that—lead developer Jason Donenfeld didn't want to inherit the problems of OpenVPN's OpenTAP adapter code, and when he investigated Microsoft's built-in VPN API, he didn't like that either. So his first move was to take a giant step backward on the Windows platform and develop an extremely simple virtual adapter that could be used not only for WireGuard, but also for other projects that might need the same kind of very basic, socket-and-tunnel functionality. This became Wintun. For the moment, WireGuard for Windows is still in what creator Jason Donenfeld refers to as "pre-alpha," with an alpha build due out sometime in the next week or two. The good news is that it's an easy install now, with no dev-fu required to get it running happily on a Windows 10 (or Server 2016, as seen below) system. There are self-contained, signed MSI installers for both 64-bit and 32-bit builds there; downloading and running them just works, with no complaints from Defender about unsigned or untrusted anything. I was curious about what makes v0.0.14 "pre-alpha" rather than merely "alpha." Donenfeld told me one reason he called it pre-alpha was to keep journalists like me (as well as the generally unadventurous) from writing about it before it's ready.' -- source: https://arstechnica.com/information-technology/2019/06/taking-a-spin-on-wir… Here's the link the article covering the Linux version: https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connectio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches GeckoView-Powered Firefox Preview For Android
by Peter Reutemann 27 Jun '19

27 Jun '19

'Mozilla today announced Firefox Preview, a pilot of its new Android browser. Firefox Preview, which is powered by Mozilla's own GeckoView engine, will ultimately replace the current Firefox for Android mobile app "this fall." At the same time, Mozilla has put Firefox Focus for Android development on hold. If you're a developer or just an early adopter, you can download Firefox Preview from Google Play. On desktop, Firefox is the second most popular browser after Chrome. Firefox holds about 10% desktop market share, according to Net Applications. On mobile, however, Firefox has less than 0.5% share. Despite regular releases alongside the desktop browser over the years, Firefox's mobile share has not improved.' -- source: https://news.slashdot.org/story/19/06/27/1720215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Demonstrate How US Emergency Alert System Can Be Hijacked and Weaponized
by Peter Reutemann 27 Jun '19

27 Jun '19

'After an emergency alert was accidentally sent to Hawaii residents last year, warning of an impending nuclear ballistic missile attack, researchers at the University of Colorado Boulder were prompted to ask the question: How easy would it be to exploit the nation's emergency alert systems, wreaking havoc on the American public via fake or misleading alerts? In short, they found that it wasn't very difficult at all. Motherboard reports: Their full study was recently unveiled at the 2019 International Conference on Mobile Systems, Applications and Services (MobiSys) in Seoul, South Korea. It documents how spoofing the Wireless Emergency Alert (WEA) program to trick cellular users wasn't all that difficult. To prove it, researchers built a mini "pirate" cell tower using easily-available hardware and open source software. Using isolated RF shield boxes to mitigate any real-world harm, they then simulated attacks in the 50,000 seat Folsom Field at the University. 90 percent of the time, the researchers say they were able to pass bogus alerts on to cell phones within range. The transmission of these messages from the government to the cellular tower is secure. It's the transmission from the cellular tower to the end user that's open to manipulation and interference, the researchers found. The vulnerability potentially impacts not just US LTE networks, but LTE networks from Europe to South Korea. ' -- source: https://tech.slashdot.org/story/19/06/26/2347257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security firms demonstrate subdomain hijack exploit vs. EA/Origin
by Peter Reutemann 26 Jun '19

26 Jun '19

'Israeli security firms Check Point and CyberInt partnered up this week to find, exploit, and demonstrate a nasty security flaw that allows attackers to hijack player accounts in EA/Origin's online games. The exploit chains together several classic types of attacks—phishing, session hijacking, and cross-site scripting—but the key flaw that makes the entire attack work is poorly maintained DNS.' -- source: https://arstechnica.com/information-technology/2019/06/security-firms-demon… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel, Arm To Help Create New IoT Standard For Device Onboarding
by Peter Reutemann 26 Jun '19

26 Jun '19

'Intel is working with rival Arm to create a new industry standard for an important issue in the Internet of Things market: making sure that devices are properly configured and connected to the cloud. From a report: The Santa Clara, Calif.-based chipmaker announced on Wednesday that the company is a founding member of the new IoT Technical Working Group within the FIDO Alliance, an industry consortium founded by PayPal, Lenovo and others in 2012 to develop standards for password-less authentication. The goal of FIDO's IoT Technical Working Group, which will also include experts from Microsoft, Google and Amazon, is to create a standard specification for "large-scale IoT onboarding," the process in which devices are configured and connected to IoT cloud management services at the time of installation. Lorie Wigle, the executive in charge of Intel's platform security efforts, told CRN that it is important to create a standard around IoT onboarding because many companies currently face challenges with the practice when it comes to handling large-scale deployments and security. [...] Once FIDO develops the standard, market forces will compel companies to adhere and participate, according to Wigle, who said it will also increase device variety, lower costs and accelerate deployments.' -- source: https://it.slashdot.org/story/19/06/26/1524200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Now Allows Users To Auto-Delete Their Location History
by Peter Reutemann 26 Jun '19

26 Jun '19

'Google today began rolling out location history deletion tools to Android and iOS, giving users a relatively simple way to limit the scope of Google's location tracking. Users can only choose between deleting data after three or 18 months. In a blog post, Google wrote: Choose a time limit for how long you want your activity data to be saved -- 3 or 18 months -- and any data older than that will be automatically deleted from your account on an ongoing basis. These controls are coming first to Location History and Web & App Activity and will roll out in the coming weeks.' -- source: https://yro.slashdot.org/story/19/06/26/1730250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Will Give You a Fake Browsing History To Fool Advertisers
by Peter Reutemann 26 Jun '19

26 Jun '19

'Security through obscurity is out, security through tomfoolery is in. >From a report: That's the basic philosophy sold by Track THIS, "a new kind of incognito" browsing project, which opens up 100 tabs crafted to fit a specific character -- a hypebeast, a filthy rich person, a doomsday prepper, or an influencer. The idea is that your browsing history will be depersonalized and poisoned, so advertisers won't know how to target ads to you. It was developed as a collaboration between mschf (pronounced "mischief") internet studios and Mozilla's Firefox as a way of promoting Firefox Quantum, the newest Firefox browser. [...] Just a warning -- if you use Track THIS it may take several minutes for all 100 tabs to load. (I used Chrome as my browser.) But when as it gradually loads, it's like taking a first-person journey through someone else's consciousness.' -- source: https://yro.slashdot.org/story/19/06/26/192258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Discovers The Command Line
by Lawrence D'Oliveiro 26 Jun '19

26 Jun '19

A review <https://www.theregister.co.uk/2019/06/25/microsofts_new_terminal_put_throug…> of Microsoft’s revamped Windows Terminal app. Features like session tabs and customizable profiles should be familiar to users of Linux terminal apps. The biggest downside seems to be that this is a UWP app, which means it only works with specific versions of Window 10. Actually, Windows had a sort-of-remotable/virtualizable-command-line support before. The difference is, all the *nix-type systems implement this using “PTY” (“pseudo-terminal”) devices, which one process (like an SSH server or GUI terminal emulator) can open and use to drive other processes on the other side, which act as though they are connecting to a real terminal. All the fancy screen stuff (e.g. direct addressing, coloured text) is done by sending in-band “escape sequences”, which real terminals (which are all museum pieces now) used to respond to, and which the terminal emulators nowadays faithfully mimic. However, Microsoft didn’t like the whole escape-sequence idea; instead, it implemented a whole API it called “ConHost”, where the application had to make special calls to affect the display in special ways. This sounds more advanced than the crude-sounding escape-sequence idea from the 1970s, yet it turns out that the Microsoft approach makes it awkward to implement those same SSH servers and GUI terminal emulators that we take for granted in the Linux world. So now the company is back-pedalling away from that, and towards good old PTYs and escape sequences, in its new “ConPTY” architecture. There is still one issue I don’t think they’ve addressed yet, though <https://forums.theregister.co.uk/forum/all/2019/06/25/microsofts_new_termin…>: ... a working select() would be nice. MS's function cannot wait across a set of fd's of different types (such as a serial port and a network socket). In the end I gave up and used the cygwin platform, which has a working select(), which was enough to do the job of talking to a telehone exchange via RS232 and fielding network requests at the same time. The unix philosophy that at the end of the day, everything is a file, pays huge dividends. Using cygwin also gave me a nice simple tcgetattr()/tcsetattr() which allowed serial port setup in a tiny amount of code, compared to the sheer lovecraftian horror that is the windows API for such things. I still find it remarkable that the Cygwin folks were able to implement a function on top of Windows that Microsoft itself seems unable to figure out.

2 1

Steam and Ubuntu clash over 32-bit libs
by Peter Reutemann 26 Jun '19

26 Jun '19

'It has been a tumultuous week for gaming on Linux. Last Tuesday afternoon, Canonical's Steve Langasek announced that 32-bit libs would be frozen (kept as-is, with no new builds or updates) as of this October's interim 19.10 release, codenamed "Eoan Ermine." Langasek was pretty clear that this did not mean abandoning support for running 32-bit applications, however. "While this means we will not provide 32-bit builds of new upstream versions of libraries, there are a number of ways that 32-bit applications can continue to be made available to users of later Ubuntu releases, as detailed in [4]. We will be working to polish the 32-bit support story over the course of the 19.10 development cycle. To follow the evolution of this support, you can participate in the discourse thread at [5]." Unfortunately, that part of the announcement may not have been entirely clear to all who read it. This group may include Steam lead Pierre-Loup Griffais, who responded by breaking up with Ubuntu in a tweet. "Ubuntu 19.10 and future releases will not be officially supported by Steam or recommended to our users. We will evaluate ways to minimize breakage for existing users, but will also switch our focus to a different distribution, currently TBD." Two days later, Canonical issued another public statement making it very explicit that support for commonly used 32-bit libs would be continued. That statement has been widely reported as an "about-face" from Canonical, but it appears to be more of a clarification of the original statement. The heart of the issue is that 32-bit computing represents an incredibly wide attack surface, with lessening amounts of active maintenance to discover, analyze, and patch flaws and exploits. Canonical, like any company, needs to apply its developer resources intelligently, so it looks for ways to remove unnecessary cruft where possible. The vast majority of 32-bit code is cruft. "We will put in place a community process to determine which 32-bit packages are needed to support legacy software, and can add to that list post-release if we miss something that is needed... We do think it’s reasonable to expect the community to participate and to find the right balance between enabling the next wave of capabilities and maintaining the long tail," Canonical said in a statement. "Nevertheless, in this case it’s relatively easy for us to change plan and enable natively in Ubuntu 20.04 LTS the applications for which there is a specific need." Canonical also promised it would work with "the WINE, Ubuntu Studio and gaming communities to use container technology to address the ultimate end of life of 32-bit libraries; it should stay possible to run old applications on newer versions of Ubuntu. Snaps and LXD enable us both to have complete 32-bit environments, and bundled libraries, to solve these issues in the long term."' -- source: https://arstechnica.com/gaming/2019/06/steam-and-ubuntu-clash-over-32-bit-l… The article mentions "Solus", which I've only come across once before in 2017. Anybody keen on giving that a swirl at the next meeting? -- project page: https://getsol.us/home/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0