- wlug - list.wlug.org.nz

“Kernel Memory Leaking” Intel Processor Design Flaw Forces Linux, Windows Redesign
by Lawrence D'Oliveiro 20 Jan '18

20 Jan '18

A pretty serious-sounding security hole has been found in recent Intel CPUs, which will require performance-sapping workarounds in both Linux and Windows to fix <http://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/>. The details are not public yet, but AMD, in its announcement that its products are not affected, would seem to have divulged some important clues.

4 13

Trying To Fix Windows Security Problems Breaks Security Software
by Lawrence D'Oliveiro 20 Jan '18

20 Jan '18

Microsoft is having a tough time coming out with good patches for the Spectre and Meltdown vulnerabilities. The main trouble is, these patches cause third-party anti-malware software to malfunction, and so the vendors of those products have to rush out their own patches to work with the fixes <http://www.theregister.co.uk/2018/01/08/meltdown_fix_security_problems/>.

2 3

Introducing The Cryptocurrency-Mining Operating System
by Lawrence D'Oliveiro 19 Jan '18

19 Jan '18

Mentioned in passing in this article <https://arstechnica.com/tech-policy/2018/01/cryptocurrency-boom-creates-ins…> explaining why high-end graphics cards are currently in short supply (they’re being snapped up by cryptocurrency miners) is the existence of a “mining-centric operating system called PIMP OS”. Presumably they’re Linux-based, I thought. And checking the T&Cs <https://getpimp.org/terms/> reveals yes, it’s built on Debian, with a bunch of other pieces, some closed-source, some open.

1 0

Wine 3.0 Released
by Peter Reutemann 18 Jan '18

18 Jan '18

'The Wine (Wine Is Not an Emulator) project has been updated today to version 3.0, a major release that ends 2017 in style for the open-source compatibility layer capable of running Windows apps and games on Linux-based and UNIX-like operating systems. Almost a year in the works, Wine 3.0 comes with amazing new features like an Android driver that lets users run Windows apps and games on Android-powered machines, Direct3D 11 support enabled by default for AMD Radeon and Intel GPUs, AES encryption support on macOS, Progman DDE support, and a task scheduler. In addition, Wine 3.0 introduces the ability to export registry entries with the reg.exe tool, adds various enhancements to the relay debugging and OLE data cache, as well as an extra layer of event support in MSHTML, Microsoft's proprietary HTML layout engine for the Windows version of the Internet Explorer web browser. You can read the full list of features and download Wine 3.0 from WineHQ's website.' -- source: https://tech.slashdot.org/story/18/01/18/2054205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NHoS/NHSBuntu Gives Up After NHS Trademark Bullying
by Lawrence D'Oliveiro 18 Jan '18

18 Jan '18

The small team of volunteers behind the NHoS project (formerly NHSBuntu) are giving up. They wanted to offer an alternative to the current NHS smartcard implementation system, currently running on Windows, using open-source software. First they rebranded from “NHSBuntu” to “NHoS” (along with “overhauling the previous tooling and branding”), which they thought would address trademark concents from the NHS. But now it seems even this name is considered unacceptable. One of the developers, Marcus Baw, ... said openhealthhub had numerous conversations that had led to "several cancelled-at-the-last minute meetings" with NHS England (NHSE) CIO Will Smart and Paul Rice, head of technology strategy in the Digital Health team. Baw alleged the pair "(unbeknown to us) were also duplicitously negotiating with Microsoft about a new NHS Enterprise Wide Agreement". He added: "In fact I now strongly suspect that the reason we were getting any engagement at all at these levels was in order to strength NHSE negotiating position with Microsoft, by being able to say to M$ 'There is a competitor, we are meeting with them next week'." <http://www.theregister.co.uk/2018/01/18/nhs_thanks_for_all_the_free_work_li…>

1 0

Apple Rejects Net-Neutrality-Testing App
by Lawrence D'Oliveiro 18 Jan '18

18 Jan '18

A researcher who has published papers on “traffic differentiation” by ISPs tried to submit an app to perform tests to detect this happening on behalf of Iphone users, only to have Apple turn it down on the grounds that it “has no direct benefits to the user”. That is, until word got around about the rejection. Now it seems they are reconsidering. <https://arstechnica.com/information-technology/2018/01/apple-rejects-app-th…>

1 0

meeting ideas?
by Peter Reutemann 18 Jan '18

18 Jan '18

Hi everyone I hope everyone had a good break and enjoyed the lovely muggy weather in the Waikato... ;-) Unfortunately, I didn't get around to looking into home automation over the break, so currently drawing a blank in terms of topics for next week's meeting. Did you work on a little Linux or open-source related project and feel like sharing? Then please let me know! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 7

Hackers can’t dig into latest Xiaomi phone due to GPL violations
by Peter Reutemann 17 Jan '18

17 Jan '18

'Yet another Android OEM is dragging its feet with its GPL compliance. This time, it's Xiaomi with the Mi A1 Android One device, which still hasn't seen a kernel source code release. Android vendors are required to release their kernel sources thanks to the Linux kernel's GPLv2 licensing. The Mi A1 has been out for about three months now, and there's still no source code release on Xiaomi's official github account. Unfortunately, GPL non-compliance is par for the course in the world of Android. Budget SoC company MediaTek once tried charging users for access to GPL'd code. Motorola under Lenovo has been regularly accused of violating the GPL and releasing incomplete sources or sources that differ from the kernel shipping on devices. Unsurprisingly, the majority of these alleged GPL violators are from China, which often plays fast and loose with IP law. Android developers use the source code to create custom kernels that tweak the way a device works, allowing for overclocking, better battery life, or control over the CPU governor. One of the largest custom kernel developers, Francisco Franco, has started a public Twitter campaign to encourage Xiaomi to comply with the GPL.' -- source: https://arstechnica.com/gadgets/2018/01/xiaomi-is-dragging-its-feet-on-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Found: New Android malware with never-before-seen spying capabilities
by Peter Reutemann 17 Jan '18

17 Jan '18

'Last year, researchers found what at the time was quite possibly the world's most sophisticated espionage app ever written for the Android mobile operating system. Now, in a discovery that underscores the growing arms race among competing malware developers, researchers have uncovered a new Android spying platform that includes location-based audio recording and other features that have never been seen in the wild before. According to a report published Tuesday by antivirus provider Kaspersky Lab, "Skygofree" is most likely an offensive security product sold by an Italy-based IT company that markets various surveillance wares. With 48 different commands in its latest version, the malware has undergone continuous development since its creation in late 2014. It relies on five separate exploits to gain privileged root access that allows it to bypass key Android security measures. Skygofree is capable of taking pictures, capturing video, and seizing call records, text messages, geolocation data, calendar events, and business-related information stored in device memory. Skygofree also includes the ability to automatically record conversations and noise when an infected device enters a location specified by the person operating the malware. Another never-before-seen feature is the ability to steal WhatsApp messages by abusing the Android Accessibility Service that's designed to help users who have disabilities or who may temporarily be unable to fully interact with a device. A third new feature: the ability to connect infected devices to Wi-Fi networks controlled by attackers. Skygofree also includes other advanced features, including a reverse shell that gives malware operators better remote control of infected devices. The malware also comes with a variety of Windows components that provide among other things a reverse shell, a keylogger, and a mechanism for recording Skype conversations' -- source: https://arstechnica.com/information-technology/2018/01/found-new-android-ma… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Phrase Of The Week: “Foveated Rendering”
by Lawrence D'Oliveiro 16 Jan '18

16 Jan '18

<http://www.theregister.co.uk/2018/01/16/human_limits_of_vr_and_ar/>: By some estimates, given a field of view of 180 degrees, around 74 gigabytes of visual data are available to us each second, but only around 125 megabytes are ultimately processed ... Much of the rest is chucked away before it even gets to the optic nerve. But trying to minimize the rendering workload by concentrating on the fovea (the most detail-sensitive part of the eye, the little spot where the image falls when you “look at” something) is not so simple, given the quirks of how our visual perception actually works. Computer graphics doyen Alvy Ray Smith is reputed to have said “reality is 80 million polygons per second”. I think we can achieve that now, but the pixel rate considered acceptable on a conventional monitor is peanuts compared to that required for VR.

1 0