- wlug - list.wlug.org.nz

Bruce Schneier On The Equifax Breach
by Lawrence D'Oliveiro 08 Nov '17

08 Nov '17

Security expert Bruce Schneier has published <https://www.schneier.com/blog/archives/2017/11/me_on_the_equif.html> the testimony he gave to the US House Energy and Commerce Committee on the breach of confidential personal information on close to half the entire population of the US. His main points are worth summarizing: 1. The Equifax breach was a serious security breach that puts millions of Americans at risk. 2. Equifax was solely at fault. 3. There are thousands of data brokers with similarly intimate information, similarly at risk. 4. These data brokers deliberately hide their actions, and make it difficult for consumers to learn about or control their data. 5. The existing regulatory structure is inadequate. 6. The market cannot fix this because we are not the customers of data brokers. 7. We need effective regulation of data brokers. 8. Resist complaints from the industry that this is "too hard." 9. This has foreign trade implications. 10. This has national security implications. 11. We need to do something about it. Read the article for more detail. I would say this is more than a US-specific problem, it is a worldwide problem. Other places may have stricter privacy regulations, but that might not be enough.

1 0

Linux Has a USB Driver Security Problem
by Peter Reutemann 08 Nov '17

08 Nov '17

'USB drivers included in the Linux kernel are rife with security flaws that in some cases can be exploited to run untrusted code and take over users' computers. The vast majority of these vulnerabilities came to light on Monday, when Google security expert Andrey Konovalov informed the Linux community of 14 vulnerabilities he found in the Linux kernel USB subsystem. "All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine," Konovalov said. The 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the past months. Not all of these 79 vulnerabilities have been reported, let alone patched. Most are simple DoS (Denial of Service) bugs that freeze or restart the OS, but some allow attackers to elevate privileges and execute malicious code.' -- source: https://linux.slashdot.org/story/17/11/08/1730210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Create & manage docker hosts with Docker Machine on VirtualBox
by Peter Reutemann 08 Nov '17

08 Nov '17

'Docker Machine is a tool that let us install Docker Engine on virtual hosts on various platforms, on local environment as well on cloud. With Docker Machine, we can easily install docker hosts a Windows machine, a MAC machine or on cloud platform like AWS, AZURE etc. As we know that Docker Engine runs natively on Linux machines, so its pretty easy to get Docker working on Linux machines but for other OS like MAC or Windows this was a problem. So Docker Machine was introduced, especially for older versions of MAC & Windows (there are new native Docker apps for latest OS). Not meant only for Windows or MAC, Docker machine also provides efficient way to provision multiple Docker hosts on local as well as cloud network. To manage the docker hosts, we use rather than using ‘docker’ command, which is used with docker engine. In this tutorial, we will discuss how we can create & manage docker hosts with Docker Machine on VirtualBox.' -- source: http://linuxtechlab.com/create-manage-docker-hosts-with-docker-machine/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache OpenOffice: We're OK With Not Being Super Cool
by Peter Reutemann 08 Nov '17

08 Nov '17

'Despite being the subject of a deathwatch -- perhaps mainly by fans of rival LibreOffice -- AOO appears to be rather popular, with the 4.1.4 update racking up at least 1.6 million downloads. [...] While AOO and the ASF formulate a formal statement of direction for the project, Jagielski said more or less that all's well. "AOO is not, and isn't designed to be, the 'super coolest open source office suite with all the latest bells and whistles,'" Jagielski continued. "Our research shows that a 'basic,' functional office suite, which is streamlined with a 'simple' and uncluttered, uncomplicated UI, serves an incredible under-represented community. "Other office suites are focusing on the 'power user' which is a valuable market, for sure, but the real power and range for an open-source office suite alternative is the vast majority which is the 'rest of us. Sometimes we all forget how empowering open source is to the entire world."' -- source: https://news.slashdot.org/story/17/11/07/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Improve your bash/sh shell script with ShellCheck lint script analysis tool
by Peter Reutemann 07 Nov '17

07 Nov '17

'ShellCheck is a static analysis tool for shell scripts. One can use it to finds bugs in your shell scripts. It is written in Haskell. You can find warnings and suggestions for bash/sh shell scripts with this tool. Let us see how to install and use ShellCheck on a Linux or Unix-like system to enhance your shell scripts, avoid errors and productivity.' -- source: https://www.cyberciti.biz/programming/improve-your-bashsh-shell-script-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Maltese Law Enforcement Trying To Decrypt Slain Journalist’s Phone
by Lawrence D'Oliveiro 06 Nov '17

06 Nov '17

Daphne Caruana Galizia, the journalist recently killed by a car bomb in Malta, used WhatsApp to communicate securely with her sources. It appears part of her smartphone was salvaged from the wreck, and now the police are enlisting the help of the US FBI to see if they can decrypt whatever information can be found on it. Quoth Bruce: “It will be interesting to see if WhatsApp's security survives this.” <https://www.schneier.com/blog/archives/2017/11/daphne_caruana_.html>

1 0

No, the Linux Desktop Hasn't Jumped in Popularity
by Peter Reutemann 06 Nov '17

06 Nov '17

'Stories have been circulating that the Linux desktop had jumped in popularity and was used more than macOS. Alas, it's not so... These reports have been based on NetMarketShare's desktop operating system analysis, which showed Linux leaping from 2.5 percent in July, to almost 5 percent in September. But unfortunately for Linux fans, it's not true... It seems to be merely a mistake. Vince Vizzaccaro, NetMarketShare's executive marketing share of marketing told me, "The Linux share being reported is not correct. We are aware of the issue and are currently looking into it"... For the most accurate, albeit US-centric operating system and browser numbers, I prefer to use data from the federal government's Digital Analytics Program (DAP). Unlike the others, DAP's numbers come from billions of visits over the past 90 days to over 400 US executive branch government domains... DAP gets its raw data from a Google Analytics account. DAP has open-sourced the code, which displays the data on the web and its data-collection code... In the US Analytics site, which summarizes DAP's data, you will find desktop Linux, as usual, hanging out in "other" at 1.5 percent. Windows, as always, is on top with 45.9 percent, followed by Apple iOS, at 25.5 percent, Android at 18.6 percent, and macOS at 8.5 percent. The article does, however, acknowledge that Linux's real market share is probably a little higher simply because "no one, not even DAP, seems to do a good job of pulling out the Linux-based Chrome OS data' -- source: https://linux.slashdot.org/story/17/11/05/202232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Walkthrough Of The Windows Subsystem For Linux
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Here <https://www.youtube.com/watch?v=VSqAyOY5huQ> is a nice intro to the Linux compatibility layer that Microsoft has added to Windows 10. Their app store gives you a choice of Ubuntu or two flavours of SuSE. But while these omit any X server functionality, they do include all the GUI X clients. So it is perfectly possible to install a Windows-native X server, such as the open-source VcXsrv <https://sourceforge.net/projects/vcxsrv/>. And then he uses this to demonstrate running a full XFCE desktop side-by-side with the regular Windows desktop.

1 0

Mozilla Might Distrust Dutch Government Certs Over 'False Keys'
by Peter Reutemann 05 Nov '17

05 Nov '17

'Mozilla engineers are discussing plans to remove support for a state-operated Dutch TLS/HTTPS provider after the Dutch government has voted a new law that grants local authorities the power to intercept Internet communications using "false keys". If the plan is approved, Firefox will not trust certificates issued by the Staat der Nederlanden (State of the Netherlands) Certificate Authority (CA)... This new law gives Dutch authorities the powers to intercept and analyze Internet traffic. While other countries have similar laws, what makes this one special is that authorities will have authorization to carry out covert technical attacks to access encrypted traffic. Such covert technical capabilities include the use of "false keys," as mentioned in Article 45 1.b, a broad term that includes TLS certificates. "Fears arise of mass Dutch Internet surveillance," reads a subhead on the article, citing a bug report which notes, among other things, the potential for man-in-the-middle attacks and the fact that the Netherlands hosts a major internet transit point' -- source: https://tech.slashdot.org/story/17/11/05/1845240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CyberSquirrel1: Tracking Infrastructure Damage Caused By Wildlife
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Interesting Twitter account <https://twitter.com/CyberSquirrel1> including the following item from a couple of days ago: Bird trips power supply to 4000 http://gisborneherald.co.nz/localnews/3069802-135/bird-trips-power-supply-t… … - Te Hapara, New Zealand

1 0