- wlug - list.wlug.org.nz

Firefox Blocks Autoplaying Web Audio
by Peter Reutemann 24 Jul '18

24 Jul '18

'Mozilla's latest Nightly builds for Firefox now include an option to mute autoplaying audio. The feature was recently added to the Chrome browser, but Mozilla's update offers a few more options. According to Engadget, "You can turn the feature off entirely, force it to ask for permission, and make exceptions for specific sites." Keep in mind that these are nightly releases, so you will most likely run into some bugs. The "polished version" is likely weeks away.' -- source: https://news.slashdot.org/story/18/07/24/2055217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Detail New CPU Side-Channel Attack Named SpectreRSB
by Peter Reutemann 24 Jul '18

24 Jul '18

'"Scientists from the University of California, Riverside (UCR) have published details last week about a new Spectre-class attack that they call SpectreRSB," reports Bleeping Computer. "Just like all 'Spectre-class' attacks, SpectreRSB takes advantage of the process of speculative execution -- a feature found in all modern CPUs that has the role of improving performance by computing operations in advance and later discarding unneeded data. The difference from previous Spectre-like attacks is that SpectreRSB recovers data from the speculative execution process by attacking a different CPU component involved in this 'speculation' routine, namely the Return Stack Buffer (RSB)." In a research paper, academics say they've used SpectreRSB attacks to recover data belonging to other processes, and have even tricked the RSB into spilling SGX secrets. The attack works on Intel, AMD, and ARM processors, known to use RSB. The attack can also bypass all the mitigations put in place for the original Spectre/Meltdown flaws.' -- source: https://it.slashdot.org/story/18/07/23/2143259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

None of Google's 85, 000 Employees Have Been Phished in More Than a Year After Company Required Them to Use Physical Security Keys For 2FA
by Peter Reutemann 24 Jul '18

24 Jul '18

'Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. From the report: Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device). A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time." The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.' -- source: https://tech.slashdot.org/story/18/07/23/1944236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Academics Publish New Software-Level Protections Against Spectre and Rowhammer Attacks
by Peter Reutemann 23 Jul '18

23 Jul '18

'Academics from multiple universities have announced fixes for two severe security flaws known as Spectre and Rowhammer. Both these fixes are at the software level, meaning they don't require CPU or RAM vendors to alter products, and could, in theory, be applied as basic software patches. The first of these new mitigation mechanisms was announced on Thursday, last week. A research team from Dartmouth College in New Hampshire says it created a fix for Spectre Variant 1 (CVE-2017-5753), a vulnerability discovered at the start of the year affecting modern CPUs. Their fix uses ELFbac, an in-house-developed Linux kernel patch that brings access control policies to runtime virtual memory accesses of Linux processes, at the level of ELF binary executables. [...] The second fix for a major flaw announced last week came on Saturday from the Systems and Network Security Group at VU Amsterdam. Researchers announced a new technique called ZebRAM that they said is a comprehensive software protection against Rowhammer attacks.' -- source: https://it.slashdot.org/story/18/07/23/1613217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NetBSD 8.0 Released
by Peter Reutemann 22 Jul '18

22 Jul '18

'The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system. This release brings stability improvements, hundreds of bug fixes, and many new features. Some highlights of the NetBSD 8.0 release are: — USB stack rework, USB3 support added. — In-kernel audio mixer (audio_system(9)). — Reproducible builds — PaX MPROTECT (W^X) memory protection enforced by default — PaX ASLR enabled by default — Position independent executables by default [...] NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone.' -- source: https://linux.slashdot.org/story/18/07/21/2341255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Fifth Undocumented Cisco Backdoor Has Been Discovered
by Peter Reutemann 21 Jul '18

21 Jul '18

'Cisco released 25 security updates Wednesday, including a critical patch removing an undocumented password for "root" accounts of Cisco Policy Suite (sold to ISPs and large corporate clients). "The vulnerability received a rare severity score of 9.8 out of a maximum of 10 on the CVSSv3 scale," reports Bleeping Computer. An anonymous reader quotes Tom's Hardware: Over the past few months, not one, not two, but five different backdoors joined the list of security flaws in Cisco routers.... In March, a hardcoded account with the username "cisco" was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely. That same month, another hardcoded password was found for Cisco's Prime Collaboration Provisioning software, which is used for remote installation of Cisco's video and voice products. Later this May, Cisco found another undocumented backdoor account in Cisco's Digital Network Architecture Center, used by enterprises for the provisioning of devices across a network. In June, yet another backdoor account was found in Cisco's Wide Area Application Services, a software tool for Wide Area Network traffic optimization... Whether or not the backdoor accounts were created in error, Cisco will need to put an end to them before this lack of care for security starts to affect its business.' -- source: https://tech.slashdot.org/story/18/07/21/2133202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jul '18

20 Jul '18

Hi everyone We have a meeting next Monday: "Tom Butz will bring his RaspberryPi to this meetup. After introducing RISCOS and how the Pi was born, he will give a short demo of RISCOS. He will also use Debian/Raspbian on the Pi and, among other things, demo web-browsing, email-checking, database handling with COBOL, playing games and videos. Instead of using an external display via HDMI, he will also show the use of a pop-on LCD screen." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737169/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Making the Windows Command Line a Lot Better
by Peter Reutemann 19 Jul '18

19 Jul '18

'Over the last few years, Microsoft has been working to improve the Windows console. Console windows now maximize properly, for example. In the olden days, hitting maximize would make the window taller but not wider. Today, the action will fill the whole screen, just like any other window. Especially motivated by the Windows subsystem for Linux, the console in Windows 10 supports 16 million colors and VT escape sequences, enabling much richer console output than has traditionally been possible on Windows. Microsoft is working to build a better console for Windows, one that we hope will open the door to the same flexibility and capabilities that Unix users have enjoyed for more than 40 years. The APIs seem to be in the latest Windows 10 Insider builds, though documentation is a little scarce for now. The command-line team is publishing a series of blog posts describing the history of the Windows command-line, and how the operating system's console works. The big reveal of the new API is coming soon, and with this, Windows should finally be able to have reliable, effective tabbed consoles, with emoji support, rich Unicode, and all the other things that the Windows console doesn't do... yet.' -- source: https://tech.slashdot.org/story/18/07/17/2028206 It's probably gonna get announced as "revolutionary"... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

PC Sales Grow For A Change
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

The first year-on-year growth in quarterly PC shipments has happened in 6 years <https://arstechnica.com/gadgets/2018/07/pc-market-appears-to-have-grown-for…>. Interesting to compare the basis behind the two different figures quoted: excluding Chromebooks, but including tablets (whether running Windows or not), gives a figure of 1.4% increase (Gartner), while the converse gives 2.7% (IDC). In other words, Chromebooks are accounting for something like half that growth, possibly even more.

1 0

Python Creator Steps Down
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

Guido van Rossum, creator of Python and (up to now) “Benevolent Dictator For Life” over the Python project, has decided to relinquish that role <https://www.theregister.co.uk/2018/07/13/python_creator_guido_van_rossum_qu…>. The reason may have been building for a while, but the last straw seems to have been the controversy over this <https://www.python.org/dev/peps/pep-0572/> proposed new feature for Python, “assignment expressions”, using a new “:=” operator. Interestingly enough, back in the day, “:=” was the operator used for assignments in what they called “ALGOL-like” languages (which included Pascal). The use of “=” for assignment was a peculiarity of FORTRAN, and also adopted by C, from which it has spread (unfortunately, in my view) to be adopted in most newer, higher-level languages, like Perl and Python. In the “ALGOL-like” languages, “=” kept close to its mathematical meaning, namely a test for equality. But if “:=” becomes valid, how long before these “assignment expressions” become acceptable stand-alone, as assignment statements? Pity that “=” can never become the equality-test operator ... unless Python 4 provides some way to guard against writing expressions as statements that simply discard their value ...

1 0