- wlug - list.wlug.org.nz

A Mysterious Grey-Hat Is Patching People's Outdated MikroTik Routers
by Peter Reutemann 13 Oct '18

13 Oct '18

'A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned. The hacker, who goes by the name of Alexey and says he works as a server administrator, claims to have disinfected over 100,000 MikroTik routers already. "I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions." But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. The vigilante server administrator says he's been only fixing routers that have not been patched by their owners against a MikroTik vulnerability that came to light in late April.' -- source: https://mobile.slashdot.org/story/18/10/12/2052202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Over Nine Million Cameras and DVRs Open To APTs, Botnet Herders, and Voyeurs
by Peter Reutemann 11 Oct '18

11 Oct '18

'Millions of security cameras, DVRs, and NVRs contain vulnerabilities that can allow a remote attacker to take over devices with little effort, security researchers have revealed today. From a report: All vulnerable devices have been manufactured by Hangzhou Xiongmai Technology Co., Ltd. (Xiongmai hereinafter), a Chinese company based in the city of Hangzhou. But end users won't be able to tell that they're using a hackable device because the company doesn't sell any products with its name on them, but ships all equipment as white label products on which other companies put their logo on top. Security researchers from EU-based SEC Consult say they've identified over 100 companies that buy and re-brand Xiongmai devices as their own. All of these devices are vulnerable to easy hacks, researchers say. The source of all vulnerabilities is a feature found in all devices named the "XMEye P2P Cloud." The XMEye P2P Cloud works by creating a tunnel between a customer's device and an XMEye cloud account. Device owners can access this account via their browser or via a mobile app to view device video feeds in real time. SEC Consult researchers say that these XMEye cloud accounts have not been sufficiently protected. For starters, an attacker can guess account IDs because they've been based on devices' sequential physical addresses (MACs). Second, all new XMEye accounts use a default admin username of "admin" with no password.' -- source: https://yro.slashdot.org/story/18/10/11/1925256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Plex for Linux Now Available as a Snap
by Peter Reutemann 11 Oct '18

11 Oct '18

'Today, a very popular app, Plex Media Server, gets the Snap treatment. In other words, you can install the media server program without any headaches -- right from the Snap store. "In adopting the universal Linux app packaging format, Plex will make its multimedia platform available to an ever-growing community of Linux users, including those on KDE Neon, Debian, Fedora, Manjaro, OpenSUSE, Zorin and Ubuntu. Automatic updates and rollback capabilities are staples of Snap software, meaning Plex users will always have the best and latest version running," says Canonical.' -- source: https://linux.slashdot.org/story/18/10/11/193246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apache OpenOffice, the Schrodinger's Application: No One Knows If It's Dead or Alive, No One Really Wants To Look Inside
by Peter Reutemann 11 Oct '18

11 Oct '18

'British IT news outlet The Register looks at the myriad of challenges Apache OpenOffice faces today. From the report: Last year Brett Porter, then chairman of the Apache Software Foundation, contemplated whether a proposed official blog post on the state of Apache OpenOffice (AOO) might discourage people from downloading the software due to lack of activity in the project. No such post from the software's developers surfaced. The languid pace of development at AOO, though, has been an issue since 2011 after Oracle (then patron of the project) got into a fork-fight with The Document Foundation, which created LibreOffice from the OpenOffice codebase, and asked developers backing the split to resign. Back in 2015, Red Hat developer Christian Schaller called OpenOffice "all but dead." Assertions to that effect have continued since, alongside claims to the contrary. Almost a year ago, Jim Jagielski, a member of the Apache OpenOffice Project Management Committee, insisted things were going well and claimed there was renewed interest in the project. For all the concern about AOO, no issues have been raised recently before the Apache Foundation board to suggest ongoing difficulties. The project is due to provide an update this month, according to a spokesperson for the foundation.' -- source: https://apache.slashdot.org/story/18/10/11/1719238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations
by Peter Reutemann 10 Oct '18

10 Oct '18

Apologies for cross-posting, but I though this might be of interest to this list. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill <...> Date: Thu, Oct 11, 2018 at 10:50 AM Subject: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hi NZOSS, Linux.Conf.Au 2019 is being held in Christchurch, New Zealand at the end of January 2019 (21-25 January). Early Bird tickets are on sale *this month* (https://linux.conf.au/attend/tickets/) As usual at LCA, we (Simon Lyall and I) are running a System Administration Miniconf at LCA2019, and we're looking for your proposals for presentations: http://sysadmin.miniconf.org/cfp19.html Please pass this on anywhere else you think people might be interested. The LCA2019 Sysadmin Miniconf CFP text is included below for your convenience. Ewen PS: The Sysadmin Miniconf is part of LCA2019; you'll need a ticket to LCA2019 to attend/speak. Grab your ticket for LCA2019 while the Early Bird pricing is available :-) -=- cut here -=- Call for Presentations Linux.conf.au 2019 Systems Administration Miniconf There will be a one day mini conference on Linux Systems Administration held as part of linux.conf.au 2019. LCA2019 will be held in Christchurch, New Zealand on 21 - 25 January 2019. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. This is our 13th Sysadmin Miniconf at Linux.conf.au. Previous presentations can be found at the website: https://sysadmin.miniconf.org/. Presentation Topics =================== We welcome talks on best current practice, new developments in Systems Administration, cutting edge techniques and technologies, and ways to better manage Linux environments large and small. Topics for presentations could include (but are not limited to): Virtualisation and Cloud Computing Kubernetes / Docker / Containers / Orchestration Infrastructure/Platform/Software as a Service (IAAS, PAAS, SAAS) Sysadmin Administration in a "serverless" environment (FAAS) DevOps and SysAdmin Culture Systems Administration Best Practice Monitoring and metrics. Collection, storage and presentation Networkng: IPv6, SDN (Software Defined Networking), performance DevOps, Configuration Management and provisioning Bootstrapping systems, Lifecycle Management Dealing with BYOD Backups in a virtual/distributed world Troubleshooting techniques Keeping legacy systems functioning War stories from the "Real World" Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Unix/Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= We are now seeking proposals for presentations at the mini-conference. We have openings for: 15-25 minute short presentations 5-10 minute "lightning talks" Please note, due to the single day available (and whole-LCA opening before morning tea), we expect the majority of available timeslots to be 20 minutes or less, with possibly 1-2 slightly longer talks if there is space in the schedule. We have a general policy of accepting a high proportion of proposals but handing out relatively short timeslots. Please see previous years Miniconf schedules for examples of how the programme is organised. Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Presenting at the Miniconf does not entitle you to discounted or free registration at the main conference nor to priority with registration. Unfortunately the Miniconf has no budget for sponsorship of speakers. To submit a talk to the LCA2019 Sysadmin Miniconf, create an account on the LCA2019 website: https://linux.conf.au/dashboard create a speaker profile, and then select "SysAdmin Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2019 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Please pick a preferred length for your presentation from Short Presentation (15/20/25 minutes) or Lightning Talk (5/10 minutes) in the submission form; if you could do either (with more or less detail) use the Private Abstract field to describe the options and what you would prefer. In some cases we maybe able to add a few extra minutes to a few Short Presentations if there is any spare time left in the programme. Use the Private Abstract field to let us know a few more minutes would be useful for your presentation. Questions should be sent to: lca2019 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (any time zone) on 31st of October 2018. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. Please let us know directly if you need an early confirmation to assist you in arranging time off work or travel; we will do our best to help. 2018-10-31 - Deadline for early submissions 2018-11-18 - Deadline for submissions 2018-12-04 - LCA2019 Sysadmin Miniconf programme published 2019-01-21 - LCA2019 Sysadmin Miniconf held (Christchurch, NZ) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2019 at sysadmin.miniconf.org -=- cut here -=- ―― View topic http://groups.nzoss.org.nz/r/topic/1uwhAyhI0xwJwbMnlKgBTZ Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.14 Released
by Peter Reutemann 09 Oct '18

09 Oct '18

'KDE has released Plasma 5.14 desktop. Among many other things, Plasma 5.14 simplifies managing multiple displays thanks to its new Display Configuration widget; Global Menus a la macOS now work also with GTK applications like GIMP; a new safeguard feature warns you if other users are logged in when you log out; and Discover now lets you install Snaps from all available channels (not just the default), orders software by release date, and shows package dependencies.' -- source: https://tech.slashdot.org/story/18/10/09/2159259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 70's Upcoming Security Change Will Break Hundreds of Sites
by Peter Reutemann 09 Oct '18

09 Oct '18

'When Chrome 70 arrives on October 16th, it will drop trust for a major HTTPS certificate provider, putting hundreds of popular websites at risk of breaking. "Chrome 70 is expected to be released on or around October 16, when the browser will start blocking sites that run older Symantec certificates issued before June 2016, including legacy branded Thawte, VeriSign, Equifax, GeoTrust and RapidSSL certificates," reports TechCrunch. From the report: [D]espite more than a year to prepare, many popular sites are not ready. Security researcher Scott Helme found 1,139 sites in the top one million sites ranked by Alexa, including Citrus, SSRN, the Federal Bank of India, Pantone, the Tel-Aviv city government, Squatty Potty and Penn State Federal to name just a few. Ferrari, One Identity and Solidworks were named on the list but recently switched to new certificates, escaping any future outages. HTTPS certificates encrypt the data between your computer and the website or app you're using, making it near-impossible for anyone -- even on your public Wi-Fi hotspot -- to intercept your data. Not only that, HTTPS certificates prove the integrity of the the site you're visiting by ensuring the pages haven't been modified in some way by an attacker. Most websites obtain their HTTPS certificates from a certificate authority, which abide by certain rules and procedures that over time become trusted by web browsers. If you screw that up and lose their trust, the browsers can pull the plug on all of the certificates from that authority. For these reasons, Google stopped supporting Symantec certificates last year after it was found to be issuing misleading and wrong certificates, as well as allowing non-trusted organizations to issue certificates without the proper oversight.' -- source: https://it.slashdot.org/story/18/10/09/008210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Exposed Private Data of Hundreds of Thousands of Google+ Users and Then Opted Not To Disclose, Report Says
by Peter Reutemann 08 Oct '18

08 Oct '18

'Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, WSJ reported Monday, citing people briefed on the incident and documents. From the report: As part of its response to the incident, the Alphabet unit plans to announce a sweeping set of data privacy measures that include permanently shutting down all consumer functionality of Google+, the people said. The move effectively puts the final nail in the coffin of a product that was launched in 2011 to challenge Facebook and is widely seen as one of Google's biggest failures. A software glitch in the social site gave outside developers potential access to private Google+ profile data between 2015 and March 2018, [Editor's note: the link may be paywalled; alternative source] when internal investigators discovered and fixed the issue, according to the documents and people briefed on the incident. A memo reviewed by the Journal prepared by Google's legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger "immediate regulatory interest" and invite comparisons to Facebook's leak of user information to data firm Cambridge Analytica. Update: In an announcement Monday, Google said it was shutting down Google+ for consumers: We are shutting down Google+ for consumers. Over the years we've received feedback that people want to better understand how to control the data they choose to share with apps on Google+. So as part of Project Strobe, one of our first priorities was to closely review all the APIs associated with Google+. This review crystallized what we've known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds. Google+ still receives north of 200 million page views every month on the web, according to SimilarWeb, a third-party web analytics firm.' -- source: https://yro.slashdot.org/story/18/10/08/1710208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: Outside Phone Vendors Aren't Updating Their Linux Kernels
by Peter Reutemann 06 Oct '18

06 Oct '18

'"Linux runs the world, right? So we want to make sure that things are secure," says Linux kernel maintainer Greg Kroah-Hartman. When asked in a new video interview which bug makes them most angry, he first replies "the whole Spectre/Meltdown problem. What made us so mad, in a way, is we were fixing a bug in somebody else's layer!" One also interesting thing about the whole Spectre/Meltdown is the complexity of that black box of a CPU is much much larger than it used to be. Right? Because they're doing -- in order to eke out all the performance and all the new things like that, you have to do extra-special tricks and things like that. And they have been, and sometimes those tricks come back to bite you in the butt. And they have, in this case. So we have to work around that. But a companion article on Linux.com notes that "Intel has changed its approach in light of these events. 'They are reworking on how they approach security bugs and how they work with the community because they know they did it wrong,' Kroah-Hartman said." (And the article adds that "for those who want to build a career in kernel space, security is a good place to get started...") Kroah-Hartman points out in the video interview that "we're doing more and more testing, more and more builds," noting "This infrastructure we have is catching things at an earlier stage -- because it's there -- which is awesome to see." But security issues can persist thanks to outside vendors beyond their control. Linux.com reports: Hardening the kernel is not enough, vendors have to enable the new features and take advantage of them. That's not happening. Kroah-Hartman releases a stable kernel every week, and companies pick one to support for a longer period so that device manufacturers can take advantage of it. However, Kroah-Hartman has observed that, aside from the Google Pixel, most Android phones don't include the additional hardening features, meaning all those phones are vulnerable. "People need to enable this stuff," he said. "I went out and bought all the top of the line phones based on kernel 4.4 to see which one actually updated. I found only one company that updated their kernel," he said. "I'm working through the whole supply chain trying to solve that problem because it's a tough problem. There are many different groups involved -- the SoC manufacturers, the carriers, and so on. The point is that they have to push the kernel that we create out to people." "The good news," according to Linux.com, "is that unlike with consumer electronics, the big vendors like Red Hat and SUSE keep the kernel updated even in the enterprise environment. Modern systems with containers, pods, and virtualization make this even easier. It's effortless to update and reboot with no downtime."' -- source: https://linux.slashdot.org/story/18/10/06/1736258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

California Bans Default Passwords on Any Internet-Connected Device
by Peter Reutemann 06 Oct '18

06 Oct '18

'In less than two years, anything that can connect to the internet will come with a unique password -- that is, if it's produced or sold in California. From a report: The "Information Privacy: Connected Devices" bill that comes into effect on January 1, 2020, effectively bans pre-installed and hard-coded default passwords. It only took the authorities about two weeks to approve the proposal made by the state senate. The new regulation mandates device manufacturers to either create a unique password for each device at the time of production or require the user to create one when they interact with the device for the first time. According to the bill, it applies to any connected device, which is defined as a "physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address."' -- source: https://it.slashdot.org/story/18/10/05/1814242 Good bye, "admin/admin"! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0