- wlug - list.wlug.org.nz

Linux At The Leading Edge Of Enterprise-Level Storage
by Lawrence D'Oliveiro 26 Apr '18

26 Apr '18

First of all, some background (as I understand it): * “NVMe” is a standard for accessing storage (normally flash rather than hard drives) via a PCI-E bus <https://en.wikipedia.org/wiki/NVM_Express>. * “NVME-oF” (“NVMe over Fabrics”) (mentioned in the above article) is a further spec that allows one node to access storage attached to another node. Sounds like NBD, really <https://en.wikipedia.org/wiki/Network_block_device>, though the term “RDMA” (“Remote Direct Memory Access”) gets tossed around. So, this article <http://www.theregister.co.uk/2018/04/26/nvme_fabric_over_fibre_channel/> says things like NVME-oF “has to be implemented across network or fabric and, so far, Ethernet, with ROCE (RDMA over Converged Ethernet), is the favoured one”, though other lower-layer protocols also work. In particular, the writer is interviewing an industry guru about the prospects for FC-NVMe, which uses Fibre Channel as the transport. A couple of quotes caught my eye: Since the low-level driver isn't a part of the OS, like NVMe-oF, but rather supplied by the HBA vendor (Emulex or QLogic), the deployment for OSes outside the Linux model should be more agile... You must run a recent version of Linux; no other OSes have NVMe-oF drivers available (yet). In other words, NVME-oF is pretty much Linux-only at the moment. But it would be hardware-independent, which should mean you can mix and match storage from different vendors. Unlike FC-NVMe, where the “HBA vendor” needs to supply hardware-specific drivers. In other, other words, NVME-oF works only on Linux, but makes you “hardware-agile”, while FC-NVMe is hardware-specific but should (hopefully) be “OS-agile”. Which kind of “agility” will turn out to be more important, I wonder?

1 0

Drupal Warns of New Remote-Code Bug, the Second in Four Weeks
by Peter Reutemann 26 Apr '18

26 Apr '18

'For the second time in a month, websites that use the Drupal content management system are confronted with a stark choice: install a critical update or risk having your servers infected with ransomware or other nasties. From a report: Maintainers of the open-source CMS built on the PHP programming language released an update patching critical remote-code vulnerability on Wednesday. The bug, formally indexed as CVE-2018-7602, exists within multiple subsystems of Drupal 7.x and 8.x. Drupal maintainers didn't provide details on how the vulnerability can be exploited other than to say attacks work remotely. The maintainers rated the vulnerability "critical" and urged websites to patch it as soon as possible.' -- source: https://developers.slashdot.org/story/18/04/25/1956214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Was Our Census Data Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

According to this article <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12038826>, when we were filling out our census data online last month, it was actually going through the servers of a company called Incapsula, which was scanning the unencrypted data for malware. Since the company is based in the US, this naturally raises concerns about US Government access to the data of NZ residents and citizens. On the one hand, the article says “this is not a data breach”, but on the other hand Adding to the researchers' concerns, Stats NZ's digital key that is required to decrypt the data sent over TLS secured connections is now distributed across Incapsula's global network, Teague and Culnane said. "Our non-exhaustive search found that servers in Australia, the US, as well as New Zealand, all had the Stats NZ key," they added. Digital TLS keys are supposed to be protected and should only be kept on the servers that they relate to, the researchers said. If keys are leaked, attackers could use them to impersonate Stats NZ servers. and further down they use the phrase “clear security flaw”. Stats NZ insists the company is trusted and “Goverment-approved”. Given it’s also protecting the GCSB, I guess that is already very literally true.

1 0

Can Online Elections Ever Be Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Commentary <https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html> from Bruce Schneier: We can securely bank online, but can't securely vote online. If we could do away with anonymity -- if everyone could check that their vote was counted correctly -- then it would be easy to secure the vote. ... We can't, so we need to accept that our voting systems are insecure. We need an election system that is resilient to the threats. And for many parts of the system, that means paper.

1 0

meeting next week
by Peter Reutemann 25 Apr '18

25 Apr '18

Hi guys We have a WLUG meeting next Monday: "With the Cambridge Analytics scandal around (ab)using data obtained through Facebook, how about we have a look at (self-hosted) alternatives to the social network giant? Details on scandal: https://arstechnica.com/tech-policy/2018/03/facebooks-cambridge-analytica-s… Social media alternatives (eg diaspora, gnu social): https://alternativeto.net/software/facebook/" -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737141/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

What Private Browsing Mode Really Means
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Seems like a lot of people <http://www.theregister.co.uk/2018/04/24/private_web_browsing_study/> have the wrong idea about what is really “private” in private browsing mode. Many of them believe that * Activity while logged into an account (e.g. Google) will not be saved in that account’s history * Bookmarks made in private mode are not visible in standard mode * It prevents websites from tracking their location * It affords better protection against malware * It obscures their IP address. None of which is true. To its credit, when you open a private window in Firefox, it clearly states the things that are hidden and the things that are not.

1 0

Ubuntu 18.04?
by Peter Reutemann 24 Apr '18

24 Apr '18

Hi everyone Since April would be the usual month for an Ubuntu release, I was surprised that I hadn't heard anything so far. The following article mentions a release date of 26/4: https://fossbytes.com/ubuntu-18-04-bionic-beaver-release-date-features/ And according to the Ubuntu wiki, this still seems to be happening: https://wiki.ubuntu.com/BionicBeaver/ReleaseTaskSignup Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Accused of Showing 'Total Contempt' for Android Users' Privacy
by Peter Reutemann 23 Apr '18

23 Apr '18

'On the heels of a terse privacy debate, Google may have found another thing to worry about: its attempt to rethink the traditional texting system. From a report: Joe Westby is Amnesty International's Technology and Human Rights researcher. Recently, in response to Google's launch of a new messaging service called "Chat", Westby argued that Google, "shows total contempt for Android users' privacy." "With its baffling decision to launch a messaging service without end-to-end encryption, Google has shown utter contempt for the privacy of Android users and handed a precious gift to cybercriminals and government spies alike, allowing them easy access to the content of Android users' communications. Following the revelations by CIA whistleblower Edward Snowden, end-to-end encryption has become recognized as an essential safeguard for protecting people's privacy when using messaging apps. With this new Chat service, Google shows a staggering failure to respect the human rights of its customers," Westby contended. Westby continued, saying: "In the wake of the recent Facebook data scandal, Google's decision is not only dangerous but also out of step with current attitudes to data privacy."' -- source: https://tech.slashdot.org/story/18/04/23/1946251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Drupalgeddon2” touches off arms race to mass-exploit powerful Web servers
by Peter Reutemann 22 Apr '18

22 Apr '18

'Attackers are mass-exploiting a recently fixed vulnerability in the Drupal content management system that allows them to take complete control of powerful website servers, researchers from multiple security companies are warning. At least three different attack groups are exploiting "Drupalgeddon2," the name given to an extremely critical vulnerability Drupal maintainers patched in late March, researchers with Netlab 360 said Friday. Formally indexed as CVE- 2018-7600, Drupalgeddon2 makes it easy for anyone on the Internet to take complete control of vulnerable servers simply by accessing a URL and injecting publicly available exploit code. Exploits allow attackers to run code of their choice without having to have an account of any type on a vulnerable website. The remote-code vulnerability harkens back to a 2014 Drupal vulnerability that also made it easy to commandeer vulnerable servers. Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.' -- source: https://arstechnica.com/information-technology/2018/04/drupalgeddon2-touche… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Chrome Users Have Installed Malware Posing as Ad Blockers
by Peter Reutemann 19 Apr '18

19 Apr '18

'Andrey Meshkov, the cofounder of ad-blocker AdGuard, recently got curious about the number of knock-off ad blocking extensions available for Google's popular browser Chrome. These extensions were deliberately styled to look like legitimate, well-known ad blockers, but Meshkov wondered why they existed at all, so he downloaded one and took a look at the code. "Basically I downloaded it and checked what requests the extension was making," Meshkov told me over the phone. "Some strange requests caught my attention." Meshkov discovered that the AdRemover extension for Chrome -- which had over 10 million users -- had code hidden inside an image that was loaded from the remote command server, giving the extension creator the ability to change its functions without updating. This alone is against Google's policy, and after Meshkov wrote about a few examples on AdGuard's blog, many of which had millions of downloads, Chrome removed the extensions from the store. I reached out to Google, and a spokesperson confirmed that these extensions had been removed.' -- source: https://yro.slashdot.org/story/18/04/19/1946250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0