- wlug - list.wlug.org.nz

Tor Project To Fix Bug Used For DDoS Attacks On Onion Sites For Years
by Peter Reutemann 06 Jul '19

06 Jul '19

'"The Tor Project is preparing a fix for a bug that has been abused for the past years to launch DDoS attacks against dark web (.onion) websites," reports ZDNet. "Barring any unforeseen problems, the fix is scheduled for the upcoming Tor protocol 0.4.2 release." The bug has been known to Tor developers for years, and has been used to launch Slow Loris-like attacks on the web servers that run the Tor service supporting an .onion site. It works by opening many connections to the server and maxing out the CPU. Since Tor connections are CPU intensive because of the cryptography involved to support the privacy and anonymity of the network, even a a few hundreds connections are enough to bring down dark web portals. A tool to exploit the bug and to automate DDoS attacks has been around for four years, and has been used by hackers to extort dark web marketplaces all spring. At least two markets selling illegal products have shut down after refusing to pay attackers. To get the bug fixed, members of a dark web forum banded together and donated to the Tor Project to sponsor the bug's patch.' -- source: https://it.slashdot.org/story/19/07/05/208230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Apologizes To Andrew Little Over Botched Name Suppression
by Lawrence D'Oliveiro 05 Jul '19

05 Jul '19

Whaddaya know, sometimes it is possible to get a response from a human at a powerful, faceless megacorporation that doesn’t feel it has to abide by your country’s laws <https://www.newshub.co.nz/home/politics/2019/07/google-apologises-to-andrew…>. However, the remedy involves turning off a service completely: “In light of the concerns you expressed this week, Google has… suspended Google Trends emails about searches trending in New Zealand.” Be careful what you wish for?

1 0

Interview With PINE64 On the Upcoming Release of the PineBook Pro
by Peter Reutemann 05 Jul '19

05 Jul '19

'One of the consequences of the explosive popularity of the Raspberry Pi is the flourishing of competing ecosystems of single-board computers (SBCs). Aside from the accessibility a $35 price tag offers, the foremost benefit of the Raspberry Pi is the community -- the proliferation of projects and integrations that center around the Raspberry Pi, and the ease-of-use that creates, makes competing products that look better on spec sheets a disappointment when taken out of the box. PINE64 has attempted to head this off by fostering an involved community; the PINE64 website explains their philosophy as "the community gets to actively shape the devices, as well as the social platform, of PINE64 from the ground up. The goal is to deliver ARM64 devices that you really wish to engage with and a platform that you want to be a part of." The first-generation Pinebook was available in an 11.6" or 14" configuration, with a quad-core Allwinner A64, 2GB RAM, 16GB eMMC, and 1366x768 display for $99, beating Nicolas Negroponte's OLPC XO-1, a decade after that project sputtered. PINE64 is differentiating itself by building not just SBCs, but notebooks, tablets, and phones with community input and feedback. Ahead of the release of the Pinebook Pro this summer, a Rockchip RK3399-based ARM laptop with 4GB LPDDR4 RAM, 64GB eMMC, and a 14" 1080p display, TechRepublic interviewed PINE64 community manager Lukasz Erecinski about the Pinebook Pro, and the PINE64 community philosophy. An excerpt from the interview: TechRepublic: Why is Pine64 building a device ecosystem of not just SBCs, but also finished devices, like tablets, laptops, and phones? Lukasz Erecinski: While SBCs are and will remain our bread and butter, there is no denying that our vision for PINE64 has expanded beyond the SBC market. The core aim of our project remains the same however -- to foster a community and bring affordable ARM64 devices to developers and end-users. You have correctly identified that we are building eco-systems; that is to say, we strive for convergence between our SBCs and other ARM64 devices we manufacture. In result, when evaluating future SOCs, we're not only considering if they'll make for good SBCs but also laptops, modules, tablets, etc. As time progresses, you will see more and more of this type of convergence across devices from us. Allwinner A64 and Rockchip RK3399 are two examples of what we strive for: the Pine64-LTS, the SOPine, Pinebook, PineTab and PinePhone all share the Allwinner A64, whilst the RockPro64, Pinebook Pro and SORock (upcoming module akin to the SOPine) use the Rockchip RK3399.' -- source: https://hardware.slashdot.org/story/19/07/05/0045229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

YouTube Bans Content 'Showing Users How To Bypass Secure Computer Systems'
by Peter Reutemann 04 Jul '19

04 Jul '19

'Kody Kinzie from the Null Byte YouTube channel on Tuesday said YouTube banned a video he made about launching fireworks over Wi-Fi for the 4th of July. According to YouTube's Community Guidelines, you are not allowed to post content "showing users how to bypass secure computer systems or steal user credentials and personal data." Doing so will apparently result in a strike. The Register notes that this written policy "first appears in the Internet Wayback Machine's archive of web history in an April 5, 2019 snapshot." "I'm worried for everyone that teaches about infosec and tries to fill in the gaps for people who are learning," Kinzie said on Twitter. "It is hard, often boring, and expensive to learn cybersecurity." Security professionals like Tim Erlin, VP of product management and strategy at cybersecurity biz Tripwire, also finds the policy questionable. "Google's intention here might be laudable, but the result is likely to stifle valuable information sharing in the information security community," he said. "In cybersecurity, we improve our defenses by understanding how attacks actually work. Theoretical explanations are often not the most effective tools, and forcing content creators onto platforms restricted in distribution, like a paid training course, simply creates roadblocks to the industry. Sharing real world examples brings more people to the industry, rather than creating more criminals." ' -- source: https://news.slashdot.org/story/19/07/03/2121250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Android Q(&A): Android Engineers take us on a deep dive of Android Q
by Peter Reutemann 04 Jul '19

04 Jul '19

'As has become tradition for Ars at Google I/O, we recently sat down with some of the people who make Android to learn more about Google's latest OS. For 2019, the talk was all about Android Q and this year's big engineering effort, Project Mainline. Mainline's goal is to enable Google (and sometimes OEMs!) to directly update core parts of the OS without pushing out a whole system update. If that sounds technical and challenging, well, it is. This year running the Ars Android Interview Gauntlet we have veteran interviewee Dave Burke, VP of engineering for Android. As the head of Team Android, Burke is an encyclopedia of Android knowledge and always manages to come up with insightful answers to my grab bag of esoteric questions. And returning for the second year in a row is Iliyan Malchev, principal engineer at Android, the lead of Project Treble, and all-around Linux integration guru.' -- source: https://arstechnica.com/gadgets/2019/07/android-qa-android-engineers-take-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon confirms it keeps your Alexa recordings basically forever
by Peter Reutemann 04 Jul '19

04 Jul '19

'If you (like so many of us) hate listening to recordings of your own voice, you may be in for an unpleasant future, as Amazon has confirmed it hangs on to every conversation you've ever had with an Alexa-enabled device until or unless you specifically delete them. That confirmation comes as a response to a list of questions Sen. Chris Coons (D-Delaware) sent to Amazon CEO Jeff Bezos in May expressing "concerns" about how Amazon uses and retains customers' Alexa voice assistant data. Amazon's response to Coons, as first reported by CNET, confirms that the company keeps your data as long as it wants unless you deliberately specify otherwise. "We retain customers' voice recordings and transcripts until the customer chooses to delete them," Amazon said—but even then there are exceptions.' -- source: https://arstechnica.com/tech-policy/2019/07/amazon-confirms-it-keeps-your-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Someone Is Spamming and Breaking a Core Component of PGP's Ecosystem
by Peter Reutemann 04 Jul '19

04 Jul '19

'A new wave of spamming attacks on a core component of PGP's ecosystem has highlighted a fundamental weakness in the whole ecosystem. From a report: Unknown attackers are spamming a core component of the ecosystem of the well-known encryption software PGP, breaking users' PGP installations and clients. What's worse, there may be no way to stop them. Last week, contributors to the PGP protocol GnuPG noticed that someone was "poisoning" or "flooding" their certificates. In this case, poisoning refers to an attack where someone spams a certificate with a large number of signatures or certifications. This makes it impossible for the the PGP software that people use to verify its authenticity, which can make the software unusable or break. In practice, according to one of the GnuPG developers targeted by this attack, the hackers could make it impossible for people using Linux to download updates, which are verified via PGP.' -- source: https://it.slashdot.org/story/19/07/03/2048235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

File-Storage App 4shared Caught Serving Invisible Ads and Making Purchases Without Consent
by Peter Reutemann 03 Jul '19

03 Jul '19

'With more than 100 million installs, file-sharing service 4shared is one of the most popular apps in the Android app store. But security researchers say the app is secretly displaying invisible ads and subscribes users to paid services, racking up charges without the user's knowledge -- or their permission -- collectively costing millions of dollars. From a report: "It all happens in the background... nothing appears on the screen," said Guy Krief, chief executive of London-based Upstream, which shared its research exclusively with TechCrunch. The researchers say the app contains suspicious third-party code that allowed the app to automate clicks and make fraudulent purchases. They said the component, built by Hong Kong-based Elephant Data, downloads code which is "directly responsible" for generating the automated clicks without the user's knowledge. The code also sets a cookie to determine if a device has previously been used to make a purchase, likely as a way to hide the activity.' -- source: https://it.slashdot.org/story/19/07/03/1738253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

D-Link To Undergo Security Audits For 10 Years as Part of FTC Settlement
by Peter Reutemann 03 Jul '19

03 Jul '19

'D-Link has agreed to a settlement with the US Federal Trade Commission in regards to a 2017 lawsuit in which the US government agency accused the Taiwanese hardware maker of misrepresenting the security of its devices and ignoring vulnerability reports. From a report: As part of the settlement, D-Link has promised to implement a new software security program for its routers and Internet-connected cameras. The company has also agreed to subject itself to ten years of biennial security audits from a third-party, independent auditor. The FTC gets to choose the auditor, while D-Link got to decide the certifications the auditor must obtain before allowing it to review its security program.' -- source: https://news.slashdot.org/story/19/07/03/1926220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Earth Ported To Browsers With WebAssembly
by Peter Reutemann 03 Jul '19

03 Jul '19

'The Google Earth team recently released a beta preview of a WebAssembly port of Google Earth. The new port runs in Chrome and other Chromium-based browsers, including Edge (Canary version) and Opera, as well as Firefox. From a report: The port thus brings cross-browser support to the existing Earth For Web version, which uses the native C++ codebase and Chrome's Native Client (NaCl) technology. Difference in multi-threading support between browsers leads to varying performance. Google Earth was released 14 years ago and allowed users to explore the earth through the comfort of their home. This original version of Google Earth was released as a native C++ based application intended for desktop install because rendering the whole world in real time required advanced technologies that weren't available in the browser. Google Earth was subsequently introduced for Android and iOS smartphones, leveraging the existing C++ codebase through technologies such as NDK and Objective-C++. In 2017, Google Earth was released for the Chrome browser, using Google's Native Client (NaCl) to compile the C++ code and run it in the browser.' -- source: https://tech.slashdot.org/story/19/07/02/1919251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0