- wlug - list.wlug.org.nz

Another Day, Another Intel CPU Security Hole: Lazy State
by Peter Reutemann 15 Jun '18

15 Jun '18

'The latest Intel revelation, Lazy FP state restore, can theoretically pull data from your programs, including encryption software, from your computer regardless of your operating system. Like its forebears, this is a speculative execution vulnerability. In an interview, Red Hat Computer Architect Jon Masters explained: "It affects Intel designs similar to variant 3-a of the previous stuff, but it's NOT Meltdown." Still, "it allows the floating point registers to be leaked from another process, but alas that means the same registers as used for crypto, etc." Lazy State does not affect AMD processors. This vulnerability exists because modern CPUs include many registers (internal memory) that represent the state of each running application. Saving and restoring this state when switching from one application to another takes time. As a performance optimization, this may be done "lazily" (i.e., when needed) and that is where the problem hides. This vulnerability exploits "lazy state restore" by allowing an attacker to obtain information about the activity of other applications, including encryption operations' -- source: https://it.slashdot.org/story/18/06/14/1553255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Decades-old PGP bug allowed hackers to spoof just about anyone’s signature
by Peter Reutemann 15 Jun '18

15 Jun '18

'For their entire existence, some of the world's most widely used email encryption tools have been vulnerable to hacks that allowed attackers to spoof the digital signature of just about any person with a public key, a researcher said Wednesday. GnuPG, Enigmail, GPGTools, and python-gnupg have all been updated to patch the critical vulnerability. Enigmail and the Simple Password Store have also received patches for two related spoofing bugs. Digital signatures are used to prove the source of an encrypted message, data backup, or software update. Typically, the source must use a private encryption key to cause an application to show that a message or file is signed. But a series of vulnerabilities dubbed SigSpoof makes it possible in certain cases for attackers to fake signatures with nothing more than someone’s public key or key ID, both of which are often published online. The spoofed email shown at the top of this post can't be detected as malicious without doing forensic analysis that's beyond the ability of many users.' -- source: https://arstechnica.com/information-technology/2018/06/decades-old-pgp-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Censorship Of Telegram
by Lawrence D'Oliveiro 14 Jun '18

14 Jun '18

Bruce Schneier <https://www.schneier.com/blog/archives/2018/06/russian_censors.html>: Iran attempts to block Telegram have been more successful than Russia's, less because Iran's censorship technology is more sophisticated but because Telegram is not willing to go as far to defend Iranian users. The reasons are not rooted in business decisions. Simply put, Telegram is a Russian product and the designers are more motivated to poke Russia in the eye. ... In 1993, John Gilmore famously said that "The Internet interprets censorship as damage and routes around it." That was technically true when he said it but only because the routing structure of the Internet was so distributed. As centralization increases, the Internet loses that robustness, and censorship by governments and companies becomes easier.

1 0

KDE Plasma 5.13 Released
by Peter Reutemann 13 Jun '18

13 Jun '18

'KDE unveils the final release of Plasma 5.13, the free and open-source desktop environment. Members of the Plasma team have focused on optimizing startup and minimizing memory usage. Plasma Browser Integration is a suite of new features which make Firefox, Chrome and Chromium-based browsers work with your desktop. For example, downloads are now displayed in the Plasma notification popup, and the Media Controls Plasmoid can mute and skip videos and music playing from within the browser. Browser tabs can be opened directly using KRunner via the Alt-Space keyboard shortcut. System Settings design has been improved further. Window manager gained much-improved effects for blur and desktop switching. Wayland work continued, with the return of window rules, and initial support for screencasts and desktop sharing.' -- source: https://tech.slashdot.org/story/18/06/12/206253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Google Disables Inline Installation For Chrome Extensions
by Peter Reutemann 12 Jun '18

12 Jun '18

'Google today announced that Chrome will no longer support inline installation of extensions. New extensions lose inline installation starting today, existing extensions will lose the ability in three months, and in early December the inline install API will be removed from the browser with the release of Chrome 71. Critics have pointed out such moves make the Chrome Web Store a walled garden, while Google insists pushing users to the store ultimately protects them.' -- source: https://tech.slashdot.org/story/18/06/12/1820217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Slimbook 2 Review
by Peter Reutemann 08 Jun '18

08 Jun '18

'The kind folks at Slimbook recently sent me the latest generation of their ultrabook-style laptop line for review, the KDE Slimbook 2. You can hear my thoughts on the latest episode of the Ubuntu Podcast, released on June 7th 2018. Slimbook are a small laptop vendor based in Spain. All the laptops ship with KDE Neon as the default operating system. In addition to their hardware, they also contribute to and facilitate local Free Software events in their area. I was sent the laptop only for review purposes. There's no other incentive provided, and Slimbook didn't see this blog post before I published it. Being a small vendor, they don't have the same buying power with OEM vendors as other big name laptop suppliers. This is reflected in the price you pay. You're supporting a company who are themselves supporting Free Software developers and communities. If you're after the cheapest possible laptop, and don't care about its origin or the people behind the device, then maybe this laptop isn't for you. However, if you like to vote with your wallet, then the KDE Slimbook should absolutely be on your list to seriously consider.' -- source: https://popey.com/blog/posts/kde-slimbook-2-review.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Stymied by browsers, attackers embed Flash 0-day inside MS Office document
by Peter Reutemann 08 Jun '18

08 Jun '18

'As browser makers make it increasingly hard to exploit vulnerabilities in Adobe Flash and other plugins, hackers targeting diplomats in the Middle East tried a new approach this month: using Microsoft Office to remotely load Flash content that used a potent zero-day flaw to take control of computers.' -- source: https://arstechnica.com/information-technology/2018/06/stymied-by-browsers-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Much Physical Memory Do I Have?
by Lawrence D'Oliveiro 07 Jun '18

07 Jun '18

The free(1) <https://linux.die.net/man/1/free> command shows you system memory usage. E.g. on my laptop a few seconds ago: ldo(a)theodora:~> free total used free shared buff/cache available Mem: 7922644 1210968 3137520 135964 3574156 6265612 Swap: 8388604 24912 8363692 But there’s something not quite right about that “total” number. The machine has 8GiB of RAM, which should show as 8388608KiB. What happened to the remaining 465964KiB? That is taken up by the kernel. But where can you find a figure for this amount? Where can you make up a total that adds up to 8388608KiB? Seems there is no such place, at least not one accessible to non-privileged software. free(1) gets its info from /proc/meminfo, which is where the kernel reports it. But there is no place in this file (or anywhere else that I know of) that the kernel calculates its own memory usage. However, there is a privileged tool, dmidecode(8) <https://linux.die.net/man/8/dmidecode>, which can get information direct from the “DMI” (aka “SMBIOS”) table. In particular, the command dmidecode -t 17 on the laptop reports two “Memory Device” entries (slots for RAM DIMMs?), one of which says “Size: No Module Installed” while the other has “Size: 8192 MB” (which obviously means 8192MiB). So you have to take the total from here as your actual physical RAM, and subtract the amount shown by free(1) (or read from /proc/meminfo) to get the kernel RAM usage.

1 0

Microsoft Addresses Pressure From Developer Community, Promises To Rename GVFS
by Peter Reutemann 07 Jun '18

07 Jun '18

'Earlier this week an article ran about how Microsoft's multi-year refusal to rename its terabyte-scale Git extension "GVFS" (Git Virtual File System) had drawn the ire and dismay of the GNOME GVfs project (Gnome Virtual File System) which predates the Microsoft project by years. Thanks to Slashdot coverage and community pressure, Microsoft has now officially promised to rename GVFS to something else, and is asking the community for suggestions for a new name. Is this an official sign that MIcrosoft is finally listening to developers (albeit with a Slashdot-level of negative attention), or are they simply trying to appease the crowd while they are still in the news due to their acquisition of GitHub?' -- source: https://developers.slashdot.org/story/18/06/06/132215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Adds Post-Quantum Cryptography To an OpenVPN Fork
by Peter Reutemann 07 Jun '18

07 Jun '18

'Microsoft recently published an interesting open source project called "PQCrypto-VPN" that implements post-quantum cryptography (PQC) within OpenVPN. Being developed by the Microsoft Research Security and Cryptography group, as part of their research into post-quantum cryptography, this fork is being used to test PQC algorithms and their performance and functionality when used with VPNs. Microsoft's PQCrypto-VPN is published on Github and allows anyone to build an OpenVPN implementation that can encrypt communications using three different post-quantum cryptography protocols, with more coming as they are developed. These protocols are: (1) Frodo: a key exchange protocol based on the learning with errors problem (2) SIKE: a key exchange protocol based on Supersingular Isogeny Diffie-Hellman and (3) Picnic: a signature algorithm using symmetric-key primitives and non-interactive zero-knowledge proofs.' -- source: https://tech.slashdot.org/story/18/06/06/138258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0