- wlug - list.wlug.org.nz

PC vendors scramble as Intel announces vulnerability in firmware
by Peter Reutemann 22 Nov '17

22 Nov '17

'Intel has issued a security alert that management firmware on a number of recent PC, server, and Internet-of-Things processor platforms is vulnerable to remote attack. Using the vulnerabilities, the most severe of which was uncovered by Mark Ermolov and Maxim Goryachy of Positive Technologies Research, remote attackers could launch commands on a host of Intel-based computers, including laptops and desktops shipped with Intel Core processors since 2015. They could gain access to privileged system information, and millions of computers could essentially be taken over as a result of the bug.' -- source: https://arstechnica.com/information-technology/2017/11/intel-warns-of-wides… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google collects Android users’ locations even when location services are disabled
by Peter Reutemann 21 Nov '17

21 Nov '17

'Many people realize that smartphones track their locations. But what if you actively turn off location services, haven’t used any apps, and haven’t even inserted a carrier SIM card? Even if you take all of those precautions, phones running Android software gather data about your location and send it back to Google when they’re connected to the internet, a Quartz investigation has revealed. Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers—even when location services are disabled—and sending that data back to Google. The result is that Google, the unit of Alphabet behind Android, has access to data about individuals’ locations and their movements that go far beyond a reasonable consumer expectation of privacy.' -- source: https://qz.com/1131515/google-collects-android-users-locations-even-when-lo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, you’re not being paranoid. Sites really are watching your every move
by Peter Reutemann 20 Nov '17

20 Nov '17

'If you have the uncomfortable sense someone is looking over your shoulder as you surf the Web, you're not being paranoid. A new study finds hundreds of sites—including microsoft.com, adobe.com, and godaddy.com—employ scripts that record visitors' keystrokes, mouse movements, and scrolling behavior in real time, even before the input is submitted or is later deleted. Session replay scripts are provided by third-party analytics services that are designed to help site operators better understand how visitors interact with their Web properties and identify specific pages that are confusing or broken. As their name implies, the scripts allow the operators to re-enact individual browsing sessions. Each click, input, and scroll can be recorded and later played back. A study published last week reported that 482 of the 50,000 most trafficked websites employ such scripts, usually with no clear disclosure. It's not always easy to detect sites that employ such scripts. The actual number is almost certainly much higher, particularly among sites outside the top 50,000 that were studied.' -- source: https://arstechnica.com/tech-policy/2017/11/an-alarming-number-of-sites-emp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Technology groups and dealing with predators
by Bryce Utting 20 Nov '17

20 Nov '17

The Verge has a detailed (read: graphic) report of predatory behaviour from ex-Auckland security expert Morgan Marquis-Boire, late of Google and the Citizen Lab of the University of Toronto, with connections to the Freedom of the Press Foundation, the EFF, and presumably others. Content warning for sexual assault issues: https://www.theverge.com/2017/11/19/16675704/morgan-marquis-boire-hacker-se… I can only commend those who have come forward, and also Ron Deibert of Citizen Lab for his well-aimed response. Without opening old wounds, I'd suggest that the Citizen Lab code of conduct might be useful food for thought where public WLUG events are involved. (unless a code of conduct already exists and I missed it?) A separate incorporated society I'm involved in has had to deal with complaints of a predator at an event, and a similar document could have done wonders for laying out how to appropriately evaluate and respond in the absence of a police complaint.The Harvey Weinstein disclosures are making clear how endemic this behaviour is, and how rare appropriate responses are. butting

4 3

Intel Planning To End Legacy BIOS Support By 2020, Report Says
by Peter Reutemann 20 Nov '17

20 Nov '17

'Intel is planning to end "legacy BIOS" support in their new platforms by 2020 in requiring UEFI Class 3 or higher. Making rounds this weekend is a slide deck from the recent UEFI Plugfest. Brian Richardson of Intel talked about the "last mile" barriers to removing legacy BIOS support from systems. By 2020, they will be supporting no less than UEFI Class 3, which means only UEFI support and no more legacy BIOS or CSM compatibility support mode. But that's not going to force on UEFI Secure Boot unconditionally: Secure Boot enabled is considered UEFI Class 3+. Intel hasn't removed legacy BIOS / CSM support yet due to many customers' software packages still relying upon legacy BIOS, among other reasons. Removing the legacy BIOS support will mitigate some security risks, needs less validation by vendors, allows for supporting more modern technologies, etc.' -- source: https://tech.slashdot.org/story/17/11/20/1251249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Tor Browser Feature Makes It Into Firefox: First-Party Isolation
by Peter Reutemann 20 Nov '17

20 Nov '17

'Unbeknown to most users, Mozilla added a privacy-enhancing feature to the Firefox browser over the summer that can help users block online advertisers from tracking them across the Internet. The feature is named First-Party Isolation (FPI) and was silently added to the Firefox browser in August, with the release of Firefox 55. FPI works by separating cookies on a per-domain basis. This is important because most online advertisers drop a cookie on the user's computer for each site the user visits and the advertisers loads an ad. With FPI enabled, the ad tracker won't be able to see all the cookies it dropped on that user's PC, but only the cookie created for the domain the user is currently viewing. This will force the ad tracker to create a new user profile for each site the user visits and the advertiser won't be able to aggregate these cookies and the user's browsing history into one big fat profile. This feature was first implemented in the Tor Browser, a privacy-focused fork of the Firefox browser managed by the Tor Project, where it is known as Cross-Origin Identifier Unlinkability. FPI was added to Firefox as part of the Tor Uplift project, an initiative to bolster the Firefox codebase with some of the Tor Browser's unique privacy-focused features. The feature is not enabled by default. Information on how to enable it is in the linked article.' -- source: https://news.slashdot.org/story/17/11/20/1713235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bluetooth Hack Affects 20 Million Amazon Echo, Google Home Devices
by Peter Reutemann 17 Nov '17

17 Nov '17

'In September, security researchers discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. We have now learned that an estimated 20 million Amazon Echo and Google Home devices are also vulnerable to attacks leveraging the BlueBorne vulnerabilities. The Hacker News reports: Amazon Echo is affected by the following two vulnerabilities: a remote code execution vulnerability in the Linux kernel (CVE-2017-1000251); and an information disclosure flaw in the SDP server (CVE-2017-1000250). Since different Echo's variants use different operating systems, other Echo devices are affected by either the vulnerabilities found in Linux or Android. Whereas, Google Home devices are affected by one vulnerability: information disclosure vulnerability in Android's Bluetooth stack (CVE-2017-0785). This Android flaw can also be exploited to cause a denial-of-service (DoS) condition. Since Bluetooth cannot be disabled on either of the voice-activated personal assistants, attackers within the range of the affected device can easily launch an attack. The security firm [Armis, who disclosed the issue] notified both Amazon and Google about its findings, and both companies have released patches and issued automatic updates for the Amazon Echo and Google Home that fixes the BlueBorne attacks. ' -- source: https://it.slashdot.org/story/17/11/17/0037251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Banking Security
by Lawrence D'Oliveiro 17 Nov '17

17 Nov '17

Here <http://www.theregister.co.uk/2017/11/03/uk_bank_security_audit/> are the results of an audit on UK banks to check their adherence to various established security practices: * HTTP Strict Transport Security <https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security> * Security Headers <https://securityheaders.io/> * Content Security Policy <https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP> * avoidance of weak and obsolete encryption (e.g. RC4) The result: a real mixed bag. Has anyone done a similar thing for our banks?

3 3

Belgium: Skype Is Officially A Telco, Must Comply With Interception Warrants
by Lawrence D'Oliveiro 17 Nov '17

17 Nov '17

Skype has failed in its appeal against a 2016 fine in Belgium for failing to help authorities tap calls in a criminal investigation, with the court saying it must comply with the country's telecommunications laws. <http://www.theregister.co.uk/2017/11/16/skypes_belgian_appeal_fails/>

1 0

Re: [wlug] Scam -- A Service To Scam The Scammers
by Lawrence D'Oliveiro 16 Nov '17

16 Nov '17

When you get a scam e-mail, how about forwarding it to the Re:Scam service <https://www.techdirt.com/articles/20171113/02094138603/great-use-artificial…>. This activates an AI that will engage in long, fruitless conversations with the scammers--basically waste their time. And it’s run by Netsafe, here in New Zealand.

4 7