- wlug - list.wlug.org.nz

Could NZ Get Its Own “Assistance and Access” Law?
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

The ever-perceptive Juha Saarinen gives his commentary <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121750…> on the law recently passed in Australia to compel access to decrypted forms of encrypted communications. Thanks to the new law requiring them to quietly add that backdoor that mustn't be called a backdoor into their code, Aussie developers can no longer be trusted by their international peers. You can't say no when government agencies issue a notice, saying absolutely do not tell your employer about it or you'll cop a hefty punishment. But the law is not supposed to achieve this by introducing “systemic weaknesses” into the encryption. Can you use that as a defence against having to weaken the encryption? Not a chance. The not-so-fine irony is that the Aussie Government is doing the same thing it alleges the Chinese spies would force Huawei to do, and which was considered dangerous enough to ban the telco equipment vendor from national communications networks. This gets pointed out repeatedly about similar discussions in the US, UK etc. But there seems to be a mentality among politicians, law enforcement, spies etc that “we’re the good guys, they’re the bad guys, therefore what we do cannot be classed in the same league as what they do”. Forgetting that what makes us good is that we don’t act like bad guys. And the kicker: The risk now is that other Five-Eyes countries, including New Zealand, follow Australia into making the same monumental mistake. What are the odds?

1 0

New Firefox Suggests Ways To Get More Out of the Web
by Peter Reutemann 11 Dec '18

11 Dec '18

'Starting Tuesday, Firefox will nudge you to try out options designed to make the web more interesting, more useful or more productive. From a report: Mozilla's new Firefox 64 keeps an eye on what you're up to and prompts you to try extensions and features that could help you with that activity, the browser maker said. For example, if you open the same tab lots of times, it could suggest you pin it to your tab strip for easier future access. Other suggestions include installing the Facebook Container extension to curtail the social network's snooping, a Google Translate extension to tap into Google's service, and the Enhancer for YouTube extension to do things like block ads and control playback on Google's video site. The feature could help you customize Firefox more to your liking -- something that could help you stick with the browser in the face of Google Chrome's dominance. And that, in turn, could help Mozilla pursue its push toward a privacy-respecting web that's not just effectively controlled by Chrome.' -- source: https://news.slashdot.org/story/18/12/11/1756217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Super Micro Says Review Found No Malicious Chips in Motherboards
by Peter Reutemann 11 Dec '18

11 Dec '18

'Computer hardware maker Super Micro Computer told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards. >From a report: In a letter to customers, the San Jose, California, company said it was not surprised by the result of the review it commissioned in October after a Bloomberg article reported that spies for the Chinese government had tainted Super Micro equipment to eavesdrop on its clients.' -- source: https://hardware.slashdot.org/story/18/12/11/1410200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Trojan Steals Money From PayPal Accounts Even With 2FA On
by Peter Reutemann 11 Dec '18

11 Dec '18

'ESET researchers have discovered a new Android Trojan using a novel Accessibility-abusing technique that targets the official PayPal app, and is capable of bypassing PayPal's two-factor authentication. A report elaborates: At the time of writing, the malware is masquerading as a battery optimization tool, and is distributed via third-party app stores. After being launched, the malicious app terminates without offering any functionality and hides its icon. This video, courtesy of ESET, demonstrates the process in practice.' -- source: https://it.slashdot.org/story/18/12/11/1722251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Fixes Notepad
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Windows Notepad has never been able to handle any newline convention other than the old DOS/Windows/CP/M one (CR-LF). Now, after so many decades, Microsoft has finally decided to give it “universal newline” capability, so it can handle lines ending in LF-only (Unix/Linux) and CR-only (old MacOS) <http://www.theregister.co.uk/2018/05/08/windows_notepad_unix_macos_line_end…>. Gee, I wonder how many lines of code that took...

2 2

No, I Didn’t Know That
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Would you believe, malware can make money by generating fake clicks on ads? Would you further believe, that ad networks pay more for clicks from Apple devices than from Android? Can you guess what happens next? <https://www.theregister.co.uk/2018/12/10/android_ios_clickfraud/>

1 0

Presentations using the Waikato Uni video projector - Console windows font size.
by Ian Stewart 11 Dec '18

11 Dec '18

Hi, This is mostly a memo to myself as I have twice been caught out with Linux consoles being displayed with too small a font on the Uni video projector. However the following may also be useful to other presenters in the future. Most wlug presentations are done with a Linux laptop or PC running in a GUI Environment that is connected to the video projector. If you open a GUI console terminal window or web-browser window and the video projector display is difficult to read, then you can increase the size with the keystroke sequence Control + Shift + Plus, or decrease the size with Control + Minus. Linux also has 6 x console windows available. The keystroke sequence Ctrl + Alt + F1 opens tty1 console, through to Ctrl + Alt + F6 opening tty6 console. Note that Ctrl + Alt + F7 returns you to the laptops GUI environment. As your laptop/pc is likely to auto-size to the resolution of the video projector, then I think your laptop will opt to displaying the 1080p resolution of 1920 x 1080 pixels. By default your Linux consoles are likely to be configured to display a "Fixed" font of "8x16". When you display your console window with the video projector then one page of the display will be about 60 lines of text with 200 characters across the page. This is almost impossible to read on the projector screen. One way to overcome this problem this is to edit... /etc/default/console-setup You will see... FONTFACE="Fixed" FONTSIZE="8x16" At the bottom of the file add something like... # For Waikato University Video Projector # Choices of Fontsize with Terminus font: # 6x12, 8x14, 8x16, 10x20, 11x22, 12x24, 14x28, 16x32 FONTFACE="Terminus" FONTSIZE="14x28" ...save the changes to the console-setup file and execute... $ setupcon The console displayed should now be about 35 rows by 80 character cells, and should allow everyone to read what is displayed. cheers, Ian. PS: Another approach to making these changes is... $ dpkg-reconfigure console-setup ...this will step through 4 x graphical input screens. From these screens select "Terminus" as the Font and the "14x28" as the Font size. To restore to the original settings run dpkg-reconfigure console-setup again and select "Fixed" and "8x16".

1 0

Malicious Sites Abuse 11-Year-Old Firefox Bug That Mozilla Failed To Fix
by Peter Reutemann 11 Dec '18

11 Dec '18

'Malware authors, ad farmers, and scammers are abusing a Firefox bug to trap users on malicious sites. From a report: This wouldn't be a big deal, as the web is fraught with this kind of malicious sites, but these websites aren't abusing some new never-before-seen trick, but a Firefox bug that Mozilla engineers appear to have failed to fix in the 11 years ever since it was first reported back in April 2007. The bug narrows down to a malicious website embedding an iframe inside their source code. The iframe makes an HTTP authentication request on another domain. [...] For the past few years, malware authors, ad farmers, and scammers have been abusing this bug to lure users on sites where they show all sorts of nasties, such as tech support scams, ad farms that reload the page with new ads in a loop, pages that push users to buy fake gift cards, or sites that offer malware-laced software updates. Whenever users try to leave, the owners of these shady sites trigger the authentification modal in a loop.' -- source: https://news.slashdot.org/story/18/12/10/0220258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ESET Discovers 21 New Linux Malware Families
by Peter Reutemann 11 Dec '18

11 Dec '18

'In a report published last week by cyber-security firm ESET, the company detailed 21 "new" Linux malware families. All operate in the same manner, as trojanized versions of the OpenSSH client. From a report: They are developed as second-stage tools to be deployed in more complex "botnet" schemes. Attackers would compromise a Linux system, usually a server, and then replace the legitimate OpenSSH installation with one of the trojanized versions.' -- source: https://linux.slashdot.org/story/18/12/10/1538203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Faxes To Be Banned At The NHS
by Lawrence D'Oliveiro 10 Dec '18

10 Dec '18

The UK’s National Health Service is being forced to phase out its heavy reliance on fax machines <https://www.theregister.co.uk/2018/12/10/hancock_fax_ban_nhs/> and resort to more, um, “digital” alternatives like e-mail instead: However, it's worth noting that just last week, up to 1.2 million staffers were locked out of their NHSmail accounts after Accenture reportedly botched a data centre upgrade. [Helen Stokes-Lampard, chair of the Royal College of General Practitioners] raised similar concerns about the resilience of the IT systems the NHS is racing to introduce. "What's shocking is how often digital innovations fall over," she said. "It doesn't mean we shouldn’t do it, but what it does mean is we have to be realistic about with the time scales for this."

1 0