- wlug - list.wlug.org.nz

Malicious Sites Abuse 11-Year-Old Firefox Bug That Mozilla Failed To Fix
by Peter Reutemann 11 Dec '18

11 Dec '18

'Malware authors, ad farmers, and scammers are abusing a Firefox bug to trap users on malicious sites. From a report: This wouldn't be a big deal, as the web is fraught with this kind of malicious sites, but these websites aren't abusing some new never-before-seen trick, but a Firefox bug that Mozilla engineers appear to have failed to fix in the 11 years ever since it was first reported back in April 2007. The bug narrows down to a malicious website embedding an iframe inside their source code. The iframe makes an HTTP authentication request on another domain. [...] For the past few years, malware authors, ad farmers, and scammers have been abusing this bug to lure users on sites where they show all sorts of nasties, such as tech support scams, ad farms that reload the page with new ads in a loop, pages that push users to buy fake gift cards, or sites that offer malware-laced software updates. Whenever users try to leave, the owners of these shady sites trigger the authentification modal in a loop.' -- source: https://news.slashdot.org/story/18/12/10/0220258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ESET Discovers 21 New Linux Malware Families
by Peter Reutemann 11 Dec '18

11 Dec '18

'In a report published last week by cyber-security firm ESET, the company detailed 21 "new" Linux malware families. All operate in the same manner, as trojanized versions of the OpenSSH client. From a report: They are developed as second-stage tools to be deployed in more complex "botnet" schemes. Attackers would compromise a Linux system, usually a server, and then replace the legitimate OpenSSH installation with one of the trojanized versions.' -- source: https://linux.slashdot.org/story/18/12/10/1538203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Faxes To Be Banned At The NHS
by Lawrence D'Oliveiro 10 Dec '18

10 Dec '18

The UK’s National Health Service is being forced to phase out its heavy reliance on fax machines <https://www.theregister.co.uk/2018/12/10/hancock_fax_ban_nhs/> and resort to more, um, “digital” alternatives like e-mail instead: However, it's worth noting that just last week, up to 1.2 million staffers were locked out of their NHSmail accounts after Accenture reportedly botched a data centre upgrade. [Helen Stokes-Lampard, chair of the Royal College of General Practitioners] raised similar concerns about the resilience of the IT systems the NHS is racing to introduce. "What's shocking is how often digital innovations fall over," she said. "It doesn't mean we shouldn’t do it, but what it does mean is we have to be realistic about with the time scales for this."

1 0

National Oracle System Is A Write-Off
by Lawrence D'Oliveiro 10 Dec '18

10 Dec '18

Looks like the nationwide attempt to streamline and update the IT systems of all the DHBs is now going to be written off <https://www.theregister.co.uk/2018/12/10/national_oracle_solution_write_dow…>. It hasn’t officially been abandoned, mind you, but because it’s been “on hold” for so long, the DHBs are now obliged to start recording “impairments” in their accounts over their investment in the system. By the way, the Waikato DHB was one of the four that managed a rollout of the system so far. Not sure whether that stays in place or gets rolled back...

1 0

How to Auto Backup Files to USB Media When Connected
by Peter Reutemann 10 Dec '18

10 Dec '18

'A backup is the last defense against data loss, offering a means to restore original data. You can use either a removable media such as an external hard drive or USB flash disk or a shared network folder, or a remote host to back up your data. It’s very easy (and equally essential) to automatically backup your important files without you having to remember to do so. In this article, we will learn how to auto backup data to a removable media after connecting it to your Linux machine. We will test with an external disk. This is a basic guide to get you started with using udev for real-life solutions.' -- source: https://www.tecmint.com/auto-backup-files-to-usb-media-in-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Linux.org's DNS Got Hijacked
by Peter Reutemann 09 Dec '18

09 Dec '18

'Linux.org reports: Wednesday afternoon around 5pm EST someone was able to get into the registrar account for our domain and point DNS to another server -- as well as lock us out from changing it. They pointed the domain name to a pretty rude page for most of the evening until Cloudflare stepped in and blocked the domain for us. After a lot of back and forth with our registrar, we were able to get things back under our control. I'd like to point out that our server environment was not touched so there are no worries about your data. We've gone over security protocols and are tightening things up that may have slipped through in the past. Thanks for your support! Linux.org apparently pointed to a page exclaiming "G3T 0WNED L1NUX N3RDZ", which also included a NSFW picture, some abusive language, a shout-out to recently-deceased programmer Terry Davis, and a link to an article about Linus Torvalds' controversial apology for "his hostile behavior towards others in the community." Long-time Slashdot reader Grady Martin says he also saw the page pointing to "presumably doxed info" about the creator of Linux's code of conduct, a fact confirmed by a report in the Register. "As for how it was hacked, [Linux.org owner Mike] McLagan blames the public Whois displaying his partner's email address -- presumably the hacker worked their way into the Yahoo email account listed as the admin of the site and from there requested a password change in her Network Solutions account to gain access to the domain."' -- source: https://it.slashdot.org/story/18/12/08/0355227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

50 Years Since “The Mother Of All Demos”
by Lawrence D'Oliveiro 08 Dec '18

08 Dec '18

On the 9th of December 1968, Doug Engelbart did a demo of NLS, his system for real-time interactive collaboration at a distance. This was also the first known use of a computer mouse. <https://www.techdirt.com/articles/20181207/15484041180/been-50-years-take-s…>

1 0

Running Linux Mint 19.1
by tom butz 07 Dec '18

07 Dec '18

Linux Mint 19.1 works well using my laptop (Toshiba Z930 6 GB RAM) and a USB3 connection to a 500G USB3-harddisk. I first tried a fast 10-speed 64GB SD-card, but that actually seemed to be slower - and the SD-card would have worn out in the end. For some reason Mint has got a swapFILE in the root directory - pretty hard on the SD-card. I haven't got USB3.1 (yet). 19.1 supports Bluetooth in both directions: under Mint 19, I couldn't send from Mint to my Android phone (Android 7.1) 19.1 also features snapshots. I didn't have to test them as I prefer to run Mint off my laptop (no power-cuts there). Occasionally I run it off my MacMini (8 GB of RAM, OS 10.7.5). The MacOS is too old for many things, and to avoid having to buy new Mac gear, I 'upgraded' by running Mint on it. Tom Butz.

3 2

Report: Microsoft is scrapping Edge, switching to just another Chrome clone
by Peter Reutemann 06 Dec '18

06 Dec '18

'Windows Central reports that Microsoft is planning to replace its Edge browser, which uses Microsoft's own EdgeHTML rendering engine and Chakra JavaScript engine, with a new browser built on Chromium, the open source counterpart to Google's Chrome. The new browser has the codename Anaheim. The report is short on details. The easiest thing for Microsoft to do would be to use Chromium's code wholesale—the Blink rendering engine, the V8 JavaScript engine, and the Chrome user interface with the Google Account parts omitted—to produce something that looks, works, and feels almost identical to Chrome. Alternatively, Redmond could use Blink and V8 but wrap them in Edge's user interface (or some derivative thereof), to retain its own appearance. It might even be possible to do something weird, such as use Blink with the Chakra JavaScript engine. We'll have to wait and see.' -- source: https://arstechnica.com/gadgets/2018/12/report-microsoft-is-scrapping-edge-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

White House Cybersecurity Advisor Gets Hacked
by Lawrence D'Oliveiro 05 Dec '18

05 Dec '18

Rudy Giuliani, the White House cybersecurity advisor, has posted a tweet <https://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=12172128> <https://www.techdirt.com/articles/20181205/07205841164/rudy-giulianis-paran…> where he meant to say “... just as the President left for G-20. In July...” Unfortunately he left out the space in “G-20. In”, turning it into “G-20.In”, which Twitter automatically formatted as a link. Someone noticed that the domain name in question was available, and promptly snapped it up and used it to post an anti-Trump message. This has made Mr Giuliani somewhat angry. He has tried to blame Twitter for the slipup, claiming the social media service “allowed someone to invade my text with a disgusting anti-President message”, as though he was not the one who created the link in the first place. Remember, this man has the job of advising the entire executive arm of the US government on keeping people’s computer usage secure. I wonder if he’s figured out how to delete a tweet yet?

1 0