- wlug - list.wlug.org.nz

File-transfer Android to Linux using rsync
by tom butz 31 Mar '19

31 Mar '19

1 0

Fwd: File-transfer between Android amd Linux using rsync
by tom butz 31 Mar '19

31 Mar '19

HOW TO TRANSFER FILES FROM ANDROID-PDA TO LINUX-LAPTOP ====================================================== I'm running Android 7.1 on an OPPO A73 phone/PDA, and sometimes need to transfer photos and other files to a laptop running Linux Mint 19.1. Steps required on the PDA: 1) install termux from Android PlayStore 2) install rsync (in termux, type: pkg install rsync) 3) install perl (in termux, type: pkg install perl) 4) in termux, type: termux-setup-storage (also automatically creates links) 5) in termux, type: cd storage, then type: ls to see the following directories: dcim: photos/videos taken with the PDA downloads: stuff you downloaded movies: music: pictures: shared: everything (includes the above directories) In the following examples we will use /dcim/ and /downloads/: oppopictures.prl ================ In termux, type: perl system "rsync -av /sdcard/DCIM/ username_on_laptop\@1.2.3.4:/oppo_pictures/" This will transfer photos (*.jpg) and videos (*.mp4) to /oppo_pictures/Camera/, and screenshots to /oppo_pictures/Screenshots/. Directory /oppo/pictures/ must exist on the laptop and grant world-access (chmod 777). Ignore rsync error-messages regarding file-attributes. oppodownloads.prl ================= In termux, type: perl system "rsync -av /storage/downloads/ username_on_laptop\@1.2.3.4:/oppo_downloads/" This will transfer files to /oppo_downloads/. Directory /oppo_downloads/ must exist on laptop and grant world-access (chmod 777). Ignore rsync error-messages regarding file-attributes. NOTE: REPLACE the numbers 1.2.3.4 in the above examples with your laptop's IP-address (as provided by your IP-router). Get them using ifconfig. Theoretically you could do the above using the /shared/ directory to get a copy of Android-files.

1 0

Researchers Find 36 New Security Flaws In LTE Protocol
by Peter Reutemann 28 Mar '19

28 Mar '19

'A group of academics from South Korea have identified 36 new vulnerabilities in the Long-Term Evolution (LTE) standard used by thousands of mobile networks and hundreds of millions of users across the world. The vulnerabilities allow attackers to disrupt mobile base stations, block incoming calls to a device, disconnect users from a mobile network, send spoofed SMS messages, and eavesdrop and manipulate user data traffic. They were discovered by a four-person research team from the Korea Advanced Institute of Science and Technology Constitution (KAIST), and documented in a research paper they intend to present at the IEEE Symposium on Security and Privacy in late May 2019. The Korean researchers said they found 51 LTE vulnerabilities, of which 36 are new, and 15 have been first identified by other research groups in the past. They discovered this sheer number of flaws by using a technique known as fuzzing --a code testing method that inputs a large quantity of random data into an application and analyzes the output for abnormalities, which, in turn, give developers a hint about the presence of possible bugs. The resulting vulnerabilities, see image below or this Google Docs sheet, were located in both the design and implementation of the LTE standard among the different carriers and device vendors. The KAIST team said it notified both the 3GPP (industry body behind LTE standard) and the GSMA (industry body that represents mobile operators), but also the corresponding baseband chipset vendors and network equipment vendors on whose hardware they performed the LTEFuzz tests.' -- source: https://it.slashdot.org/story/19/03/28/2035257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ASUS Releases Fix For ShadowHammer Malware Attack
by Peter Reutemann 26 Mar '19

26 Mar '19

'ASUS may have inadvertently pushed malware to some of its computers through its update tool, but it at least it has a fix ready to go. The PC maker has released a new version of its Live Update software for laptops that addresses the ShadowHammer backdoor attack. It also promised "multiple security verification mechanisms" to reduce the chances of further attacks, and started using an "enhanced end-to-end encryption mechanism." There are upgrades to the behind-the-scenes server system to prevent future attacks, ASUS added. The company simultaneously reiterated the narrow scope of ShadowHammer, noting that the malware targeted a "very small and specific user group." It's believed to be an Advanced Persistent Threat -- that is, a state-backed assault against organizations rather than everyday users. Other ASUS devices weren't affected, according to a notice. While the fix is reassuring, it also raises questions as to why the systems weren't locked down earlier. Update tools are prime targets for hackers precisely because they're both trusted and have deep access to the operating system -- tight security is necessary to prevent an intruder from hijacking the process.' -- source: https://hardware.slashdot.org/story/19/03/26/2025229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Refuse To Be Terrorized
by Lawrence D'Oliveiro 26 Mar '19

26 Mar '19

I have written up some thoughts about those horrible happenings in Christchurch today. You can read them here <https://default-cube.deviantart.com/journal/Refuse-To-Be-Terrorized-Christc…>. I hope we learn the right lessons from others who have been here before us, and not repeat too many of their mistakes.

1 2

Firefox Lockbox Comes To Android To Ease Password Pain
by Peter Reutemann 26 Mar '19

26 Mar '19

'If you're a Firefox true believer, or even just a Firefox user, your password struggles just got a little easier with the release of Firefox Lockbox for Android devices. From a report: The password manager, based on login information already in Firefox, makes it easier to sign into apps as well. It integrates with login autocomplete systems in both Apple's iOS and Google's Android software, Mozilla said. It's not as fancy as password managers like LastPass, BitWarden, 1Password and Dashlane, and the only browser it works with is Firefox. On the other hand, if you're already in the Firefox world, it's basically already set up for you. There's no migration process as with dedicated password managers.' -- source: https://news.slashdot.org/story/19/03/26/1559243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Makes Emails More Dynamic With AMP For Email
by Peter Reutemann 26 Mar '19

26 Mar '19

'Google today officially launched AMP for Email, its effort to turn emails from static documents into dynamic, web page-like experiences. >From a report: AMP for Email is coming to Gmail, but other major email providers like Yahoo Mail, Outlook and Mail.ru will also support AMP emails. It's been more than a year since Google first announced this initiative. Even by Google standards, that's a long incubation phase, though there's also plenty of backend work necessary to make this feature work. The promise of AMP for Email is that it'll turn basic messages into a surface for actually getting things done. "Over the past decade, our web experiences have changed enormously -- evolving from static flat content to interactive apps -- yet email has largely stayed the same with static messages that eventually go out of date or are merely a springboard to accomplishing a more complex task," Gmail product manager Aakash Sahney writes. "If you want to take action, you usually have to click on a link, open a new tab, and visit another website." With AMP for Email, those messages become interactive. That means you'll be able to RSVP to an event right from the message, fill out a questionnaire, browse through a store's inventory or respond to a comment -- all without leaving your web-based email client.' -- source: https://tech.slashdot.org/story/19/03/26/1838254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Users' Security and Privacy At Risk From Shadowy Ecosystem of Pre-Installed Software, Study Warns
by Peter Reutemann 25 Mar '19

25 Mar '19

'Researchers behind a large-scale independent study of pre-installed Android apps "unearthed a complex ecosystem of players with a primary focus on advertising and 'data-driven services' -- which they argue the average Android user is likely to be unaware of (while also likely lacking the ability to uninstall/evade the baked in software's privileged access to data and resources themselves)," reports TechCrunch. From the report: The study, which was carried out by researchers at the Universidad Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) at Berkeley (USA) and Stony Brook University of New York (US), encompassed more than 82,000 pre-installed Android apps across more than 1,700 devices manufactured by 214 brands, according to the IMDEA institute. "The study shows, on the one hand, that the permission model on the Android operating system and its apps allow a large number of actors to track and obtain personal user information," it writes. "At the same time, it reveals that the end user is not aware of these actors in the Android terminals or of the implications that this practice could have on their privacy. Furthermore, the presence of this privileged software in the system makes it difficult to eliminate it if one is not an expert user." In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."' -- source: https://tech.slashdot.org/story/19/03/25/2058215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Fixes Chrome 'Evil Cursor' Bug Abused by Tech Support Scam Sites
by Peter Reutemann 25 Mar '19

25 Mar '19

'Google has patched a Chrome bug that was being abused in the wild by tech support scammers to create artificial mouse cursors and lock users inside browser pages by preventing them from closing and leaving browser tabs. From a report: The trick was first spotted in September 2018 by Malwarebytes analyst Jerome Segura. Called an "evil cursor," it relied on using a custom image to replace the operating system's standard mouse cursor graphic. A criminal group that Malwarebytes called Partnerstroka operated by switching the standard OS 32-by-32 pixels mouse cursor with one of 128 or 256 pixels in size. A normal cursor would still appear on screen, but in the corner of a bigger transparent bounding box. [...] The "evil cursor" fix is currently live for Google Canary users, and is scheduled to land in the Chrome 75 stable branch, to be released later this spring.' -- source: https://tech.slashdot.org/story/19/03/25/210220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Telegram Adds 'Delete Everywhere' Nuclear Option -- Killing Chat History
by Peter Reutemann 25 Mar '19

25 Mar '19

'Instant messaging service Telegram has added a feature that lets a user delete messages in one-to-one and/or group private chats, after the fact, and not only from their own inbox. From a report: The new 'nuclear option' delete feature allows a user to selectively delete their own messages and/or messages sent by any/all others in the chat. They don't even have to have composed the original message or begun the thread to do so. They can just decide it's time. Let that sink in. All it now takes is a few taps to wipe all trace of a historical communication -- from both your own inbox and the inbox(es) of whoever else you were chatting with (assuming they're running the latest version of Telegram's app).' -- source: https://tech.slashdot.org/story/19/03/25/1641204 Something that WhatsApp could add as well... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1