- wlug - list.wlug.org.nz

AV1 is Well On Its Way To Becoming a Viable Alternative To Patented Video Codecs, Mozilla Says
by Peter Reutemann 12 Jul '18

12 Jul '18

'Here's a surprising fact: It costs money to watch video online, even on free sites like YouTube. That's because about 4 in 5 videos on the web today rely on a patented technology called the H.264 video codec. >From a report: It took years for companies to put this complex, global set of legal and business agreements in place, so H.264 web video works everywhere. Now, as the industry shifts to using more efficient video codecs, those businesses are picking and choosing which next-generation technologies they will support. The fragmentation in the market is raising concerns about whether our favorite web past-time, watching videos, will continue to be accessible and affordable to all. Over the last decade, several companies started building viable alternatives to patented video codecs. Mozilla worked on the Daala Project, Google released VP9, and Cisco created Thor for low-complexity videoconferencing. All these efforts had the same goal: to create a next-generation video compression technology that would make sharing high-quality video over the internet faster, more reliable, and less expensive. In 2015, Mozilla, Google, Cisco, and others joined with Amazon and Netflix and hardware vendors AMD, ARM, Intel, and NVIDIA to form AOMedia. As AOMedia grew, efforts to create an open video format coalesced around a new codec: AV1. AV1 is based largely on Google's VP9 code and incorporates tools and technologies from Daala, Thor, and VP10. Mozilla loves AV1 for two reasons: AV1 is royalty-free, so anyone can use it free of charge. Software companies can use it to build video streaming into their applications. Web developers can build their own video players for their sites. The second reason we love AV1 is that it delivers better compression technology than even high-efficiency codecs -- about 30% better, according to a Moscow State University study.' -- source: https://news.slashdot.org/story/18/07/11/2246221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Typeform Data Breach Hits A Little Close To Home
by Lawrence D'Oliveiro 12 Jul '18

12 Jul '18

A few days ago, Typeform, a company which specializes in online survey forms, reported <https://www.theregister.co.uk/2018/07/02/typeform_breach/> that someone had gained unauthorized access to one of its backups. This turned out to impact a remarkable variety of institutions using its services <https://www.theregister.co.uk/2018/07/03/hotel_chain_and_uk_political_party…> <https://www.theregister.co.uk/2018/07/04/typeform_breach_continued/>, though the listed ones all seem to be in the UK and Australia. Now, I read today in the Hamilton Press (issue of 11th July, i.e. today), on page 6, that the affected customers include the Hamilton City Council, Waikato District Council, and Waipā District Council. “About 2800 Waikato people” may have used the Typeform service to express views to these local bodies. Information that could have been leaked was “names, email addresses, and in some cases, phone numbers”. Hamilton City used the service to run 10 surveys between November 2014 and February 2018, and a total of 1941 people “may have been affected”; it has contacted them about the breach, and it doesn’t use Typeform any more. Waipā District has similarly contacted 125 participants in its surveys. (No mention of what action Waikato District is taking...)

1 0

Year-old router bug exploited to steal sensitive DOD drone, tank documents
by Peter Reutemann 11 Jul '18

11 Jul '18

'In May, a hacker perusing vulnerable systems with the Shodan search engine found a Netgear router with a known vulnerability—and came away with the contents of a US Air Force captain's computer. The purloined files from the captain—the officer in charge (OIC) of the 432d Aircraft Maintenance Squadron's MQ-9 Reaper Aircraft Maintenance Unit (AMU)at Creech Air Force Base, Nevada—included export-controlled information regarding Reaper drone maintenance. The hacker took the documents to a Dark Web marketplace, where he planned on selling them for a few hundred dollars. And it's there that analysts from Recorded Future, an information security threat intelligence company, discovered them. The vulnerability, which makes it possible for an attacker to remotely execute commands and gain access to the root directory of the router via FTP, was disclosed by Netgear over a year ago. Discoverable by searching Shodan for devices with Internet Protocol port 21 open and response text including "214-ADMIN_LOGIN," the vulnerability allowed attackers to compromise routers and then gain access to the local network. They could then either grab files passing over the network or gain access to devices on it.' -- source: https://arstechnica.com/information-technology/2018/07/year-old-router-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malware Found in Arch Linux AUR Package Repository
by Peter Reutemann 11 Jul '18

11 Jul '18

'Malware has been discovered in at least three Arch Linux packages available on AUR (Arch User Repository), the official Arch Linux repository of user-submitted packages. The malicious code has been removed thanks to the quick intervention of the AUR team. The incident happened because AUR allows anyone to take over "orphaned" repositories that have been abandoned by their original authors. On Saturday, a user going by the pseudonym of "xeactor" took over one such orphaned package named "acroread" that allows Arch Linux users to view PDF files. According to a Git commit to the packag's source code, xeactor added malicious code that would download a file named "~x" from ptpb [dot] pw, a lightweight site mimicking Pastebin that allows users to share small pieces of texts.' -- source: https://it.slashdot.org/story/18/07/10/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stolen certificates from D-Link used to sign password-stealing malware
by Peter Reutemann 10 Jul '18

10 Jul '18

'Criminals recently stole code-signing certificates from router and camera maker D-Link and another Taiwanese company and used them to pass off malware that steals passwords and backdoors PCs, a researcher said Monday. The certificates were used to cryptographically verify that legitimate software was issued by D-Link and Changing Information Technology. Microsoft Windows, Apple’s macOS, and most other operating systems rely on the cryptographic signatures produced by such certificates to help users ensure that executable files attached to emails or downloaded on websites were developed by trusted companies rather than malicious actors masquerading as those trusted companies. Somehow, members of an advanced persistent-threat hacking group known as BlackTech obtained the certificates belonging to D-Link and Changing Information Technology, the researcher with antivirus provider Eset said in a blog post. The attackers then used the certificates to sign two pieces of malware, one a remotely controlled backdoor and the other a related password stealer. Both pieces of malware are referred to as Plead and are used in espionage campaigns against targets located in East Asia. The Japan Computer Emergency Response team recently documented the Plead malware here. AV provider Trend Micro recently wrote about BlackTech here. “The ability to compromise several Taiwan-based technology companies and reuse their code-signing certificates in future attacks shows that this group is highly skilled and focused on that region,” Eset researcher Anton Cherepanov wrote in Monday’s post.' -- source: https://arstechnica.com/information-technology/2018/07/stolen-certificates-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-like attack uses speculative execution to overflow buffers
by Peter Reutemann 10 Jul '18

10 Jul '18

'When the Spectre and Meltdown attacks were disclosed earlier this year, the expectation was that these attacks would be the first of many, as researchers took a closer look at the way that the speculative execution in modern processors could be used to leak sensitive information and undermine the security of software running on those processors. In May, we saw the speculative store bypass, and today we have a new variant on this theme: speculative buffer overflows, discovered by Vladimir Kiriansky at MIT and independent researcher Carl Waldspurger.' -- source: https://arstechnica.com/gadgets/2018/07/new-spectre-like-attack-uses-specul… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With So Many Eyeballs, Is Open Source Security Better?
by Peter Reutemann 10 Jul '18

10 Jul '18

'Back in 1999, Eric Raymond coined the term "Linus' Law," which stipulates that given enough eyeballs, all bugs are shallow. Linus' Law, named in honor of Linux creator Linus Torvalds, has for nearly two decades been used by some as a doctrine to explain why open source software should have better security. In recent years, open source projects and code have experienced multiple security issues, but does that mean Linus' Law isn't valid? According to Dirk Hohndel, VP and Chief Open Source Officer at VMware, Linus' Law still works, but there are larger software development issues that impact both open source as well as closed source code that are of equal or greater importance. "I think that in every development model, security is always a challenge," Hohndel said. Hohndel said developers are typically motivated by innovation and figuring out how to make something work, and security isn't always the priority that it should be. "I think security is not something we should think of as an open source versus closed source concept, but as an industry," Hohndel said.' -- source: https://it.slashdot.org/story/18/07/10/1642226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Breaches Chrome Extension of Popular VPN Service Hola, Directs Users To Compromised Cryptocurrency Website
by Peter Reutemann 10 Jul '18

10 Jul '18

'A hacker has breached a Hola VPN developer account and has replaced the official Chrome extension with one that redirected users of the MyEtherWallet.com website to a phishing page controlled by the attacker. The compromise took place yesterday and only lasted for five hours the MyEtherWallet (MEW) team said in a tweet. The Hola VPN team admitted to the hack. "The attack was programmed to inject a JavaScript tag in to the MEW site to 'phish' information about MEW accounts that are logging in without being in 'incognito mode', by re-directing the MEW users to the hacker's website," the Hola VPN team said.' -- source: https://yro.slashdot.org/story/18/07/10/1720243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM’s Anti-RISC-V FUD
by Lawrence D'Oliveiro 10 Jul '18

10 Jul '18

ARM put up a site attacking the open-source RISC-V processor architecture a few days ago, then had to take it down as a result of objections from its own staff <https://www.theregister.co.uk/2018/07/10/arm_riscv_website/>. Seems ARM is feeling the heat from the increasing traction that RISC-V is getting. Even though the original site is gone, it is still accessible via the Wayback Machine. And also one of the commenters points out that this graphic <https://www.arm.com/-/media/global/company/arm-risc-v-infographic.png> is still on ARM’s own site.

1 0

Firefox and Chrome Pull Popular Browser Extension Stylish From Their Stores After Report Claimed It Logs and Shares Browsing History, Credentials
by Peter Reutemann 05 Jul '18

05 Jul '18

'Stylish, a popular extension available for Chrome and Firefox which allows for easy customization of any website, now phones home and shares its users' browser history with its corporate parent, according to blogger Robert Heaton. This prompted Firefox to ban the extension from its addons site and prompt all users to disable it. The discussion can be seen in the relevant bug report. In Heaton's words: Stylish is no longer a well-meaning product with your best interests at heart. If you use and like Stylish, please uninstall it and switch to an alternative like Stylus, an offshoot from the good old version of Stylish that works in much the same way, minus the spyware. Google too has pulled the extension from its extension store. This is not the first time Stylish is at the centre of a privacy debacle' -- source: https://yro.slashdot.org/story/18/07/04/218234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0