- wlug - list.wlug.org.nz

Linux systemd Affected by Memory Corruption Vulnerabilities, No Patches Yet
by Peter Reutemann 10 Jan '19

10 Jan '19

'Major Linux distributions are vulnerable to three bugs in systemd, a Linux initialization system and service manager in widespread use, California-based security company Qualys said late yesterday. From a report: The bugs exist in 'journald' service, tasked with collecting and storing log data, and they can be exploited to obtain root privileges on the target machine or to leak information. No patches exist at the moment. Discovered by researchers at Qualys, the flaws are two memory corruption vulnerabilities (stack buffer overflow - CVE-2018-16864, and allocation of memory without limits - CVE-2018-16865) and one out-of-bounds error (CVE-2018-16866). They were able to obtain local root shell on both x86 and x64 machines by exploiting CVE-2018-16865 and CVE-2018-16866. The exploit worked faster on the x86 platform, achieving its purpose in ten minutes; on x64, though, the exploit took 70 minutes to complete. Qualys is planning on publishing the proof-of-concept exploit code in the near future, but they did provide details on how they were able to take advantage of the flaws.' -- source: https://linux.slashdot.org/story/19/01/10/1759253 BTW This is an FYI, not a reason to start a flame war again... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Tool Automates Phishing Attacks That Bypass 2FA
by Peter Reutemann 09 Jan '19

09 Jan '19

'A new penetration testing tool published at the start of the year by a security researcher can automate phishing attacks with an ease never seen before and can even blow through login operations for accounts protected by two-factor authentication (2FA). From a report: Named Modlishka --the English pronunciation of the Polish word for mantis -- this new tool was created by Polish researcher Piotr Duszynski. Modlishka is what IT professionals call a reverse proxy, but modified for handling traffic meant for login pages and phishing operations. It sits between a user and a target website -- like Gmail, Yahoo, or ProtonMail. Phishing victims connect to the Modlishka server (hosting a phishing domain), and the reverse proxy component behind it makes requests to the site it wants to impersonate. The victim receives authentic content from the legitimate site --let's say for example Google -- but all traffic and all the victim's interactions with the legitimate site passes through and is recorded on the Modlishka server.' -- source: https://it.slashdot.org/story/19/01/09/1817234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash-5.0 release available
by Peter Reutemann 08 Jan '19

08 Jan '19

'This release fixes several outstanding bugs in bash-4.4 and introduces several new features. The most significant bug fixes are an overhaul of how nameref variables resolve and a number of potential out-of-bounds memory errors discovered via fuzzing. There are a number of changes to the expansion of $@ and $* in various contexts where word splitting is not performed to conform to a Posix standard interpretation, and additional changes to resolve corner cases for Posix conformance. The most notable new features are several new shell variables: BASH_ARGV0, EPOCHSECONDS, and EPOCHREALTIME. The `history' builtin can remove ranges of history entries and understands negative arguments as offsets from the end of the history list. There is an option to allow local variables to inherit the value of a variable with the same name at a preceding scope. There is a new shell option that, when enabled, causes the shell to attempt to expand associative array subscripts only once (this is an issue when they are used in arithmetic expressions). The `globasciiranges' shell option is now enabled by default; it can be set to off by default at configuration time. There are a few incompatible changes between bash-4.4 and bash-5.0. The changes to how nameref variables are resolved means that some uses of namerefs will behave differently, though I have tried to minimize the compatibility issues. By default, the shell only sets BASH_ARGC and BASH_ARGV at startup if extended debugging mode is enabled; it was an oversight that it was set unconditionally and caused performance issues when scripts were passed large numbers of arguments.' -- source: http://lists.gnu.org/archive/html/bug-bash/2019-01/msg00063.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fwd: [NZOSS OpenChat] Linux.conf.au discount for NZOSS financial members!
by Peter Reutemann 08 Jan '19

08 Jan '19

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message --------- From: Dave Lane <president(a)nzoss.org.nz> Date: Tue, Jan 8, 2019 at 4:08 PM Subject: [NZOSS OpenChat] Linux.conf.au discount for NZOSS financial members! To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hello everyone, The organisers of 2019's Linux.conf.au (it's here in Christchurch in 2 weeks - 21-25 Jan!) have kindly extended a discount offer to full (financial) NZOSS members, which makes the hobbyist registration price $399 (discounted from $549, so $150 reduction!) for those wanting to attend! Given that the savings is substantially more than the cost of becoming an NZOSS member ($40 - https://members.nzoss.nz) seems quite worthwhile! If you haven't been to an LCA before (this'll be my 6th), they're superb. Go. I'll provide the discount code to any current (or recent 🙂 ) financial members requesting one... The window for registration closes on 15 January, so don't dilly-dally! Hope to see many of you there! Dave -- Dave Lane, President, New Zealand Open Source Society e: president(a)nzoss.org.nz m: 021 229 8147 w: http://nzoss.org.nz ―― View topic http://groups.nzoss.org.nz/r/topic/60OKMe2P8pajbBBtpNRr4L Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Denies Using Fingerprinting To Track Its Users
by Peter Reutemann 08 Jan '19

08 Jan '19

'Responding to a forum post that accused it of 'fingerprinting users', privacy-centric search engine DuckDuckGo says that fears are unfounded and that it is not tracking its users. The allegation was made after the Firefox extension CanvasBlocker showed a warning to users. The suggestion of fingerprinting -- gathering as much information as possible about a user through their browser to create a unique identifier that can be used for tracking -- is clearly something that would seem to sit in opposition to what DuckDuckGo claims to stand for. The company CEO says the accusation is simply wrong.' -- source: https://search.slashdot.org/story/19/01/07/194206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sony Appears To Be Blocking Kodi On Its Recent Android TVs
by Peter Reutemann 08 Jan '19

08 Jan '19

'Several reports indict that at least some of Sony's recent Android TVs are actively blocking Kodi, the open-source, cross-platform streaming and media player that allows you to access and play local, network, and remote content. Android Police reports: The official Kodi project Twitter account pointed out Sony's deficiency a couple of days ago, but reports on the Kodi forums of issues installing and running the app from the Play Store go even further back to last year. A handful of affected enthusiasts believe they have discovered the cause of the problem: Sony seems to be blocking the package ID for the app from being installed/run. Supporting this theory is the fact that recompiling the app from scratch with a different ID allows it to work. ' -- source: https://yro.slashdot.org/story/19/01/07/2211200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meetings for 2019
by Peter Reutemann 08 Jan '19

08 Jan '19

Hi everyone I finally have all the room bookings for 2019 sorted (the guys doing the bookings are overworked and understaffed due to holidays). The university changed its policy around providing rooms on holiday from a "we'll coordinate with security" to a "should not be allowed". Instead of going to the pub three times (Jan/Apr/Oct), listening to pub quizzes, I decided to break with our 4th Monday tradition for these months and have the meetings on the 3rd Monday instead. Here's the complete list of meetings for 2019, for those that don't use meetup.com: Jan 21 -- 3rd Monday Feb 25 Mar 25 Apr 15 -- 3rd Monday May 27 Jun 24 Jul 22 Aug 26 Sep 23 Oct 21 -- 3rd Monday Nov 25 Here is the link to our meetup.com community page: https://www.meetup.com/WaikatoLinuxUsersGroup/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux For Cars: Tesla Isn't The Only Automaker Running Linux Under the Hood
by Peter Reutemann 06 Jan '19

06 Jan '19

'ZDNet reports that by 2020, "many, if not most, new cars will be running with Linux." While some companies, like Tesla, run their own homebrew Linux distros, most rely on Automotive Grade Linux (AGL). AGL is a collaborative cross-industry effort developing an open platform for connected cars with over 140 members... Its membership includes Audi, Ford, Honda, Mazda, Nissan, Mercedes, Suzuki, and the world's biggest automobile company: Toyota. Why? "Automakers are becoming software companies, and just like in the tech industry, they are realizing that open source is the way forward," said Dan Cauchy, AGL's executive director, in a statement. Car companies know that while horsepower sells, customers also want smart infotainment systems, automated safe drive features, and, eventually, self-driving cars. Linux and open-source company can give them all of that. The AGL's goal is to develop an open-source, common platform for infotainment systems: The Unified Code Base (UCB). This is a Linux distribution and open-source software platform for car infotainment, telematics, and instrument cluster applications... The AGL's hope is that this will serve as a de facto industry standard. It's well on its way. Yesterday Hyundai announced that they were also joining both the AGL effort and the Linux Foundation.' -- source: https://tech.slashdot.org/story/19/01/05/1928205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Eben Upton Remembers The Years Before the First Raspberry Pi
by Peter Reutemann 06 Jan '19

06 Jan '19

'Tech Republic re-visits the story of the earliest attempts to build the Raspberry Pi, and the dramatic launch of a quest "to rekindle the curiosity about computing in a generation immersed in technology but indifferent to how it worked." [T]he dominant computers -- games consoles and later tablets and smartphones -- no longer offered an invitation to create, but rather to consume. Eben Upton recalls a bonfire party in 2007 where an 11-year-old boy told him he wanted to be an electrical engineer, and his disappointment at realizing the boy didn't have access to a computer he could program on. "I said, 'Oh, what computer have you got?'. He said, 'I've got a Nintendo Wii'. And there was just that awful feeling about there being a kid who was excited, a kid who was showing concrete interest in our profession, and who didn't have access to a programmable computer, a computer of any sort. He just had a games console." At this time Upton was working as a system-on-a-chip architect at chip designer Broadcom, and realized he had the skills to try to halt this drift away from computers that encouraged users to code. Upton describes the Raspberry Pi as "a very conscious attempt" to bring back the easily programmable home computers that he remembered as a child in the 1980s -- and he was gratified at its success. "Even early on you started to see those pictures of kids lying on the living room floor, looking up at the TV with Raspberry Pi plugged into it, the same way we used to." It was named "Pi" because it booted into a version of Python, and Raspberry because "There's a lot of fruit-named computer companies, and the 'blowing a raspberry' thing was also deliberate." It's gone on to become the world's third best-selling general-purpose computer.' -- source: https://developers.slashdot.org/story/19/01/05/2031219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux commands for measuring disk activity
by Peter Reutemann 04 Jan '19

04 Jan '19

'Linux systems provide a handy suite of commands for helping you see how busy your disks are, not just how full. In this post, we examine five very useful commands for looking into disk activity. Two of the commands (iostat and ioping) may have to be added to your system, and these same two commands require you to use sudo privileges, but all five commands provide useful ways to view disk activity.' -- source: https://www.networkworld.com/article/3330497/linux/linux-commands-for-measu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1