- wlug - list.wlug.org.nz

Stymied by browsers, attackers embed Flash 0-day inside MS Office document
by Peter Reutemann 08 Jun '18

08 Jun '18

'As browser makers make it increasingly hard to exploit vulnerabilities in Adobe Flash and other plugins, hackers targeting diplomats in the Middle East tried a new approach this month: using Microsoft Office to remotely load Flash content that used a potent zero-day flaw to take control of computers.' -- source: https://arstechnica.com/information-technology/2018/06/stymied-by-browsers-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Much Physical Memory Do I Have?
by Lawrence D'Oliveiro 07 Jun '18

07 Jun '18

The free(1) <https://linux.die.net/man/1/free> command shows you system memory usage. E.g. on my laptop a few seconds ago: ldo(a)theodora:~> free total used free shared buff/cache available Mem: 7922644 1210968 3137520 135964 3574156 6265612 Swap: 8388604 24912 8363692 But there’s something not quite right about that “total” number. The machine has 8GiB of RAM, which should show as 8388608KiB. What happened to the remaining 465964KiB? That is taken up by the kernel. But where can you find a figure for this amount? Where can you make up a total that adds up to 8388608KiB? Seems there is no such place, at least not one accessible to non-privileged software. free(1) gets its info from /proc/meminfo, which is where the kernel reports it. But there is no place in this file (or anywhere else that I know of) that the kernel calculates its own memory usage. However, there is a privileged tool, dmidecode(8) <https://linux.die.net/man/8/dmidecode>, which can get information direct from the “DMI” (aka “SMBIOS”) table. In particular, the command dmidecode -t 17 on the laptop reports two “Memory Device” entries (slots for RAM DIMMs?), one of which says “Size: No Module Installed” while the other has “Size: 8192 MB” (which obviously means 8192MiB). So you have to take the total from here as your actual physical RAM, and subtract the amount shown by free(1) (or read from /proc/meminfo) to get the kernel RAM usage.

1 0

Microsoft Addresses Pressure From Developer Community, Promises To Rename GVFS
by Peter Reutemann 07 Jun '18

07 Jun '18

'Earlier this week an article ran about how Microsoft's multi-year refusal to rename its terabyte-scale Git extension "GVFS" (Git Virtual File System) had drawn the ire and dismay of the GNOME GVfs project (Gnome Virtual File System) which predates the Microsoft project by years. Thanks to Slashdot coverage and community pressure, Microsoft has now officially promised to rename GVFS to something else, and is asking the community for suggestions for a new name. Is this an official sign that MIcrosoft is finally listening to developers (albeit with a Slashdot-level of negative attention), or are they simply trying to appease the crowd while they are still in the news due to their acquisition of GitHub?' -- source: https://developers.slashdot.org/story/18/06/06/132215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Adds Post-Quantum Cryptography To an OpenVPN Fork
by Peter Reutemann 07 Jun '18

07 Jun '18

'Microsoft recently published an interesting open source project called "PQCrypto-VPN" that implements post-quantum cryptography (PQC) within OpenVPN. Being developed by the Microsoft Research Security and Cryptography group, as part of their research into post-quantum cryptography, this fork is being used to test PQC algorithms and their performance and functionality when used with VPNs. Microsoft's PQCrypto-VPN is published on Github and allows anyone to build an OpenVPN implementation that can encrypt communications using three different post-quantum cryptography protocols, with more coming as they are developed. These protocols are: (1) Frodo: a key exchange protocol based on the learning with errors problem (2) SIKE: a key exchange protocol based on Supersingular Isogeny Diffie-Hellman and (3) Picnic: a signature algorithm using symmetric-key primitives and non-interactive zero-knowledge proofs.' -- source: https://tech.slashdot.org/story/18/06/06/138258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPNFilter malware infecting 500, 000 devices is worse than we thought
by Peter Reutemann 07 Jun '18

07 Jun '18

'Two weeks ago, officials in the private and public sectors warned that hackers working for the Russian government infected more than 500,000 consumer-grade routers in 54 countries with malware that could be used for a range of nefarious purposes. Now, researchers from Cisco’s Talos security team say additional analysis shows that the malware is more powerful than originally thought and runs on a much broader base of models, many from previously unaffected manufacturers.' -- source: https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UN Plan To Move The World To IPv6
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

The UN has a plan to try to increase IPv6 adoption <http://www.theregister.co.uk/2018/05/30/internet_engineers_united_nations_i…>. However, it does it by essentially saddling IPv6 with all the limitations of IPv4 that IPv6 was specifically created to overcome. The UN has been trying for a while to take over governance of the Internet and its standards. This has been fought off by a US-led effort in favour of the IETF, ICANN etc -- all the bodies we know and love. However, the UN can claim some moral high ground in its advocacy for greater adoption among the developing world -- places where such bodies tend to be under-represented.

1 1

Web Radio
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

Just came across this WebSDR website <http://websdr.ewi.utwente.nl:8901/> which lets people listen to short-wave stations remotely. I haven’t actually tried fiddling with it -- it was linked from this article <https://warontherocks.com/2018/05/explaining-the-mystery-of-numbers-station…> on those mysterious “numbers stations” for broadcasting messages to spies.

1 0

Microsoft Acquires GitHub For $7.5B
by Peter Reutemann 04 Jun '18

04 Jun '18

'As rumored, Microsoft said Monday that it has acquired code repository website GitHub for a whopping sum of $7.5B in Microsoft stock. Microsoft Corporate Vice President Nat Friedman, founder of Xamarin and an open source veteran, will assume the role of GitHub CEO. GitHub's current CEO, Chris Wanstrath, will become a Microsoft technical fellow, reporting to Executive Vice President Scott Guthrie, to work on strategic software initiatives. From the blog post: "Microsoft is a developer-first company, and by joining forces with GitHub we strengthen our commitment to developer freedom, openness and innovation," said Satya Nadella, CEO, Microsoft. "We recognize the community responsibility we take on with this agreement and will do our best work to empower every developer to build, innovate and solve the world's most pressing challenges." Under the terms of the agreement, Microsoft will acquire GitHub for $7.5 billion in Microsoft stock. Subject to customary closing conditions and completion of regulatory review, the acquisition is expected to close by the end of the calendar year. GitHub will retain its developer-first ethos and will operate independently to provide an open platform for all developers in all industries. Developers will continue to be able to use the programming languages, tools and operating systems of their choice for their projects -- and will still be able to deploy their code to any operating system, any cloud and any device. The two companies, together, will "empower developers to achieve more at every stage of the development lifecycle, accelerate enterprise use of GitHub, and bring Microsoft's developer tools and services to new audiences," Microsoft said. A portion of the developer community has opposed the move, with some already leaving the platform for alternative services. Update: In a conference call with reporters, Mr. Nadella said today the company is "all in with open source," and requested people to judge the company's commitment to the open source community with its actions in the recent past, today, and in the coming future. GitHub will remain open and independent, Mr. Nadella said.' -- source: https://developers.slashdot.org/story/18/06/04/1314247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.17 Released
by Peter Reutemann 04 Jun '18

04 Jun '18

'In his weekly message to the Linux community on Sunday, Linus Torvalds announced the release of Linux 4.17. The release comes a couple of months after the first release candidate, and in his message Torvalds also talks about version 5.0 of the Linux kernel. Having previously said that Linux kernel v5.0 "should be meaningless," he said that this next major numerical milestone will come around "in the not too distance future." For now, though, it's version 4.17 -- or Merciless Moray, if you prefer -- that's of interest. Linux kernel 4.17 is not a major release, and Torvalds announced it without much fanfare. "So this last week was pretty calm, even if the pattern of most of the stuff coming in on a Friday made it feel less so as the weekend approached. And while I would have liked even less changes, I really didn't get the feeling that another week would help the release in any way, so here we are, with 4.17 released."' -- source: https://linux.slashdot.org/story/18/06/04/0913249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Said to Have Agreed to Acquire Coding Site GitHub
by Peter Reutemann 04 Jun '18

04 Jun '18

'Microsoft Corp. has agreed to acquire GitHub Inc., the code repository company popular with many software developers, and could announce the deal as soon as Monday, according to people familiar with the matter. GitHub preferred selling the company to going public and chose Microsoft partially because it was impressed by Chief Executive Officer Satya Nadella, said one of the people, who asked not to be identified discussing private information. Terms of the agreement weren't known on Sunday. GitHub was last valued at $2 billion in 2015. GitHub is an essential tool for coders. Many corporations, including Microsoft and Alphabet Inc.'s Google, use GitHub to store their corporate code and to collaborate. It's also a social network of sorts for developers. While GitHub's losses have been significant -- it lost $66 million over three quarters in 2016 -- it had revenue of $98 million in nine months of that year. On Friday, it was reported that Microsoft was in talks with GitHub about an acquisition. Now it seems like it's actually happening. Update: Our sister site, SourceForge, has weighed in. Here is a tool that will import your GitHub project to SourceForge. Update #2: Already, we are seeing plenty of backlash over this news. One user has started a petition to stop Microsoft from buying GitHub.' -- source: https://developers.slashdot.org/story/18/06/03/2042255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0