- wlug - list.wlug.org.nz

'RAMBleed' Rowhammer Attack Can Now Steal Data, Not Just Alter It
by Peter Reutemann 12 Jun '19

12 Jun '19

' A team of academics from the US, Austria, and Australia, has published new research today detailing yet another variation of the Rowhammer attack. From a report: The novelty in this new Rowhammer variety -- which the research team has named RAMBleed -- is that it can be used to steal information from a targeted device, as opposed to altering existing data or to elevate an attacker's privileges, like all previous Rowhammer attacks, have done in the past. [...] In a research paper [PDF] published today, academics unveiled RAMBleed, the first Rowhammer attack that can actively deduce and steal data from a RAM card. To do this, researchers had to come up and combine different techniques, which, when assembled, would permit a RAMBleed attack to take place.' -- source: https://tech.slashdot.org/story/19/06/11/1931214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Biggest Data Breach Archive On the Internet Is For Sale
by Peter Reutemann 12 Jun '19

12 Jun '19

'Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced today that he's actively looking for a buyer. "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat," Hunt wrote. "It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own." Motherboard reports: Over the years, Have I Been Pwned has become the repository for data breaches on the internet, a place where users can search for their email address and see whether they have been part of a data breach. It's now also a service where people can sign up to get notified whenever their accounts get breached. It's perhaps the most useful, free, cybersecurity service in the world. Hunt said he's already had informal conversations with some organizations that might be interested in buying the service. Hunt said he's engaged the financial consulting firm KPMG to look for a buyer. In the post, Hunt shared some staggering numbers that explain just how big Have I Been Pwned has become: 8 billion breached records, nearly 3 million people subscribed to notifications, who have been emailed about a breach 7 million times, 150,000 unique visitors to the site on a normal day, 10 million on an abnormal day. Regardless of who buys the site, Hunt made a series of commitments on the future of Have I Been Pwned: searches should remain free for consumers, the platform should expand and grow, and, finally, he wants to stay involved in some capacity. ' -- source: https://it.slashdot.org/story/19/06/11/2017231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Is Always Down To The Weakest Link
by Lawrence D'Oliveiro 11 Jun '19

11 Jun '19

Nice non-paywalled report <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12235615> into how the National Party (and others) were able to obtain supposedly-confidential details of today’s Budget announcements. In summary, a “clone” was made of the Treasury website, containing the Budget info, that was supposed to be swapped for the current production site later today. It was not publicly accessible, at least directly. However, the search function on the public site was inadvertently sucking up the confidential info from the clone server as well, and carefully-worded searches would reveal bits of such info as search context, even if the actual documents being indexed were not accessible in full. The Police have decided that, even though such leaks are considered a serious matter, the accesses were “not unlawful”. Which seems a refreshing change from, say, the UK, where someone was prosecuted and jailed some years ago just for putting “../” into a URL ...

2 2

Dotcom’s Lawyer Says Movie Copyright Warnings Are “Propaganda”
by Lawrence D'Oliveiro 11 Jun '19

11 Jun '19

The defence in the Kim Dotcom extradition case carefully explains why the cases of copyright infringement at issue are civil, not criminal matters, why there is a need for “safe harbour” provisions for ISPs (and services like Megaupload), and warns against the US Justice Department trying to shop around NZ law to find more criminal charges to hit him with. <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12239483>

1 0

Opera, Brave, Vivaldi To Ignore Chrome's Anti-Ad-Blocker Changes, Despite Shared Codebase
by Peter Reutemann 11 Jun '19

11 Jun '19

'Despite sharing a common Chromium codebase, browser makers like Brave, Opera, and Vivaldi don't have plans on crippling support for ad blocker extensions in their products -- as Google is currently planning on doing within Chrome. From a report: The three browsers makers have confirmed to ZDNet, or in public comments, of not intending to support a change to the extensions system that Google plans to add to Chromium, the open-source browser project on which Chrome, Brave, Opera, and Vivaldi are all based on.' -- source: https://tech.slashdot.org/story/19/06/10/1651256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Large 'GoldBrute' RDP Botnet Hunts For Exposed Servers With Weak Passwords
by Peter Reutemann 08 Jun '19

08 Jun '19

'The Internet Storm Center reports: RDP, the remote desktop protocol, made the news recently after Microsoft patched a critical remote code execution vulnerability (CVE-2019-0708). While the reporting around this "Bluekeep" vulnerability focused on patching vulnerable servers, exposing RDP to the Internet has never been a good idea. Botnets have been scanning for these servers and are using weak and reused passwords to gain access to them. The latest example of such a botnet is an ongoing malicious campaign we are refering to as "GoldBrute". This botnet is currently brute forcing a list of about 1.5 million RDP servers exposed to the Internet... Each bot will only try one particular username and password per target. This is possibly a strategy to fly under the radar of security tools as each authentication attempt comes from different addresses. Long-time Slashdot reader UnderAttack writes: Infected systems will retrieve target lists from the command and control server and attempt to brute force credentials against the list, while at the same time looking for more exposed servers. With all the attention spent on patching RDP servers for the recent "BlueKeep" vulnerability, users should also make sure to just not expose RDP in the first place. Even patched, it will still be susceptible to brute forcing.' -- source: https://it.slashdot.org/story/19/06/08/0322234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu MATE 19.10 Is Ditching VLC for GNOME MPV
by Peter Reutemann 07 Jun '19

07 Jun '19

'GNOME MPV (now known as Celluloid) will be the default media player in Ubuntu MATE 19.10. From a report: The app supplants the versatile VLC meda player, which the MATE desktop-toting distro has shipped with following the results of a community poll back in 2017. So why the change now? Better desktop integration. That's according to Ubuntu MATE's Martin Wimpress who revealed news of the swap in the latest Ubuntu MATE monthly update on Patreon: "We will be dropping VLC from the pre-installed applications and shipping GNOME MPV instead. GNOME MPV will soon be renamed to Celluloid. The reasons for switching to GNOME MPV are similar to swapping out Thunderbird for Evolution; better desktop integration." Size is another factor. GNOME MPV takes up a comparatively svelte 27MB on the ISO image, whereas Qt5-based VLC requires closer to 70MB.' -- source: https://news.slashdot.org/story/19/06/06/1840240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

The Ambitious Plan To Reinvent How Websites Get Their Names
by Peter Reutemann 06 Jun '19

06 Jun '19

'When you type in a URL to your browser and press "enter," your browser sends that name to a network of computers called the Domain Name System (DNS), which converts it into IP addresses. These numbers are what allow your browser to find the right server on the internet and connect to it. When you navigate to a website, you are trusting a handful of organizations that have been charged with keeping the DNS working and secure. "To people like Steven McKie, a developer for and investor in an open-source project called the Handshake Network, this centralized power over internet naming makes the internet vulnerable to both censorship and cyberattacks," reports MIT technology review. "Handshake wants to decentralize it by creating an alternative naming system that nobody controls. In doing so, it could help protect us from hackers trying to exploit the DNS's security weaknesses, and from governments hoping to use it to block free expression." From the report: The system would be based on blockchain technology, meaning it would be software that runs on a widely distributed network of computers. In theory, it would have no single point of failure and depend on no human-run organization that could be corrupted or co-opted. Handshake's software is a heavily modified version ("fork") of Bitcoin, and just as Bitcoin's network of miners protects the cryptocurrency from manipulation and makes it virtually impossible for authorities to shut down, a similar network could keep a permanent, censorship-resistant record of internet names. The Handshake team is far from the first to try to create a decentralized naming system for the web. But unlike previous efforts, Handshake isn't trying to replace DNS but work with it. Besides ICANN, there's yet another class of organization whose job Handshake aims to decentralize. See that little padlock icon in your browser bar, to the left of the domain name? That means your computer has verified that your connection to this website is encrypted and that the site is authentic, not a fake one designed by a criminal trying to steal your login credentials. It does that by checking the veracity of a string of numbers called the site's digital certificate, issued by one of a number of so-called certificate authorities. These entities, many of which are for-profit companies, are crucial to internet security. They can also get hacked. And if one gets breached, and an attacker can start issuing fake certificates, it undermines the security of the whole internet. But if website names are managed on a tamper-resistant blockchain, then you don't need certificate authorities; the naming system itself can provide the guarantee that the site you're connected to is real. That's what Handshake aims to do. ' -- source: https://yro.slashdot.org/story/19/06/06/0028220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New RCE Vulnerability Impacts Nearly Half of the Internet's Email Servers
by Peter Reutemann 06 Jun '19

06 Jun '19

'A critical remote command execution (RCE) security flaw impacts over half of the Internet's email servers, security researchers from Qualys have revealed today. The vulnerability affects Exim, a mail transfer agent (MTA), which is software that runs on email servers to relay emails from senders to recipients. According to a June 2019 survey of all mail servers visible on the Internet, 57% (507,389) of all email servers run Exim -- although different reports would put the number of Exim installations at ten times that number, at 5.4 million. In a security alert shared with ZDNet earlier today, Qualys, a cyber-security firm specialized in cloud security and compliance, said it found a very dangerous vulnerability in Exim installations running versions 4.87 to 4.91. The vulnerability is described as a remote command execution -- different, but just as dangerous as a remote code execution flaw -- that lets a local or remote attacker run commands on the Exim server as root. Qualys said the vulnerability can be exploited instantly by a local attacker that has a presence on an email server, even with a low-privileged account. lBut the real danger comes from remote hackers exploiting the vulnerability, who can scan the internet for vulnerable servers, and take over systems. The vulnerability was patched with Exim 4.92, on February 10, 2019, "but at the time the Exim team released v4.92, they didn't know they fixed a major security hole," reports ZDNet. "This was only recently discovered by the Qualys team while auditing older Exim versions. Now, Qualys researchers are warning Exim users to update to the 4.92 version to avoid having their servers taken over by attackers."' -- source: https://it.slashdot.org/story/19/06/06/0046234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany: Backdoor Found in Four Smartphone Models; 20,000 Users Infected
by Peter Reutemann 06 Jun '19

06 Jun '19

'The German Federal Office for Information Security (or the Bundesamt fur Sicherheit in der Informationstechnik -- BSI) has issued security alerts today warning about dangerous backdoor malware found embedded in the firmware of at least four smartphone models sold in the country. Impacted models include the Doogee BL7000, the M-Horse Pure 1, the Keecoo P11, and the VKworld Mix Plus (malware present in the firmware, but inactive). All four are low-end Android smartphones. The BSI said the phones' firmware contained a backdoor trojan named Andr/Xgen2-CY.' -- source: https://tech.slashdot.org/story/19/06/06/199249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0