- wlug - list.wlug.org.nz

Ghostscript Leaks Like A Sieve
by Lawrence D'Oliveiro 23 Aug '18

23 Aug '18

Tools like ImageMagick commonly accept graphics in PostScript format, which they render through Ghostscript. Trouble is, there are holes in Ghostscript that can be exploited by malicious parties. In short, you should not be accepting PostScript data from untrusted parties. The fact that PostScript is a full programming language just makes it harder -- in terms of vulnerability exposure, it’s similar to JavaScript, except that I think a lot more effort has gone into securing the latter. <https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/>

1 0

Mozilla to Remove Legacy Firefox Add-Ons From Add-On Portal in Early October
by Peter Reutemann 22 Aug '18

22 Aug '18

'Mozilla announced today plans to remove all Firefox legacy add-ons from the official Mozilla add-ons portal in early October. From a report: The move comes after Mozilla updated the Firefox core to use a new add-ons system based on the Chrome-compatible WebExtensions API. This new add-ons API replaced Firefox's old XUL-based add-ons API in November 2017, with the release of Firefox 57. All Firefox legacy add-ons stopped working in Firefox 57, but Mozilla continued to support them in the Firefox Extended Support Release (ESR) 52 branch. Support for Firefox ESR 52 will end on September 5, in two weeks, meaning there won't be any official Firefox version that supports legacy add-ons anymore.' -- source: https://tech.slashdot.org/story/18/08/21/196225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday
by Peter Reutemann 21 Aug '18

21 Aug '18

Hi everyone We have a meeting coming up on Monday: "Linux is Alexa's best mate" Brendon Ranum, owner of a voice driven highly automated accommodation business in Cambridge, discusses Alexa integration from a Linux User perspective. Brendon will bring along his collection of every Amazon Echo ever made (10 models), and talk about adding voice control in front of home automation, the pitfalls, and how a spare Raspberry Pi can be used to solve some of them. He will also demo creating and using Echo Skills, compare differences in features of the Echo's in different countries, and share how guests attitudes have changed over the last year using Alexa. Usually found leading large scale IT change & innovation overseas, Brendon never lost his passion for electrical and electronic engineering and love of shiny things. Come along and learn why someone would put 20 of these in a house! -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737178/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Exam Requires Microsoft Office 365, Laptops, No Chargers Allowed
by Lawrence D'Oliveiro 20 Aug '18

20 Aug '18

Some students are Botany Downs Secondary College are upset at their school’s requirements for them to set the NCEA Level 1 science exam <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12110032>. Their problem is with the ban on chargers, because the school says they cannot provide outlets for 450 students. So laptops have to have a 5-hour battery life to make it through the exam. Which leaves out older machines with batteries in less-than-tiptop condition. Would there be a problem allowing them spare batteries? (And temporary use of an outlet while switching over, to avoid the need to power down?) Come to think of it, do they know they can buy spare batteries?

1 0

Slides Worth Viewing
by Lawrence D'Oliveiro 15 Aug '18

15 Aug '18

Followed this link <https://twitter.com/thepacketrat/status/1029728686734565382> which doesn’t seem to relate to the article that included it, but which has some gems on IoT security worth repeating: Assumptions of Technological Manifest Destiny: 1. Technology is value-neutral and thus will automatically help everyone 2. Technology should be deployed as quickly as possible 3. History is uninteresting and unhelpful The Value of Scepticism In three words: Think before deploying. In two words: Think first. In one word: Don’t. Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? A: Because Keynote Speakers Make Bad Life Decisions And Are Poor Role Models.

1 0

Standardizing The Legalities Of Reporting Security Bugs
by Lawrence D'Oliveiro 03 Aug '18

03 Aug '18

Security researchers often find themselves in for a rough ride (legally speaking) when they try to report holes that they have found. This new effort <https://arstechnica.com/information-technology/2018/08/new-open-source-effo…> tries to put together a clear framework so everybody knows exactly where they stand. Of course, the next step is to get various organizations to adopt it.

1 0

Hāwera High School Hit By Ransomware Attack
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Some students have lost access to their coursework <https://www.theregister.co.uk/2018/08/02/new_zealand_school_hit_by_ransomwa…>.

1 0

Reddit Breached Via Two-Factor Authentication Vulnerability
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Two-factor authentication, using a phone call or SMS text as the second factor, seemed like such a neat idea. But it turned out to be far too easy to hack. And here’s the proof <https://arstechnica.com/information-technology/2018/08/password-breach-teac…>: The 2FA protecting the Reddit accounts, however, relied on OTPs sent through SMS messages, despite reports over the years (such as this one <https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-pr…>) that make it amply clear they are susceptible to interception. Seems like the only reasonable option for a second authentication factor is dedicated hardware security keys.

1 0

sudo Or su?
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Found this piece <https://www.pclinuxos.com/forum/index.php/topic,90479.0.html> in the PCLinuxOS forums, courtesy of a reader link from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>. Basically it says that “sudo”, when used “In The Manner Of the Buntus”, i.e. to be able to run arbitrary commands as root, is a bad idea. Instead, it should be carefully restricted to allow access only to functions needed by a particular user. To get blanket root access, it is better to use “su”, which means having a separate root password. Actually, it goes further than that: it decrees that anybody posting instructions on the PCLinuxOS forums involving “irresponsible” use of sudo (i.e. contrary to the philosophy above) is subject to having their posts deleted, being reprimanded, and ultimately having their account cancelled altogether. Thoughts?

3 2

UK’s National Cyber Security Centre Weighs In On Ubuntu
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Advice for both users and admins about Ubuntu 18.04 LTS <https://www.ncsc.gov.uk/guidance/eud-security-guidance-ubuntu-1804-lts>, from the arm of the GCHQ charged with looking after the security of the computers of ordinary mortals. Points out some gaps in software-only disk encryption, and recommends enabling Secure Boot, among a remarkable amount of other detail. Found from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>.

1 0