- wlug - list.wlug.org.nz

Unpatched Exploit Lets You Clone Key Fobs and Open Subaru Cars
by Peter Reutemann 15 Oct '17

15 Oct '17

'Tom Wimmenhove, a Dutch electronics designer, has discovered a flaw in the key fob system used by several Subaru models, a vulnerability the vendor has not patched and could be abused to hijack cars. The issue is that key fobs for some Subaru cars use sequential codes for locking and unlocking the vehicle, and other operations. These codes -- called rolling codes or hopping code -- should be random, in order to avoid situations when an attacker discovers their sequence and uses the flaw to hijack cars. This is exactly what Wimmenhove did. He created a device that sniffs the code, computes the next rolling code and uses it to unlock cars... The researcher said he reached out to Subaru about his findings. "I did [reach out]. I told them about the vulnerability and shared my code with them," Wimmenhove told BleepingComputer. "They referred me to their 'partnership' page and asked me to fill in a questionnaire. It didn't seem like they really cared and I haven't heard back from them." His Subaru-cracking feat -- documented in a video -- was accomplished using a $25 Raspberry Pi B+ and two dongles, one for wifi ($2) and one for a TV ($8), plus a $1 antenna and a $1 MCX-to-SMA convertor.' -- source: https://tech.slashdot.org/story/17/10/14/230254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Everybody Has To Be A Software Company Now
by Lawrence D'Oliveiro 14 Oct '17

14 Oct '17

Wireless speakers made by Pure no longer work with Apple’s newest phone OS, because it has dropped the ability to run 32-bit apps--everything must now be 64-bit-only <http://www.theregister.co.uk/2017/10/12/ios_11_knackers_neglected_pure_conn…>: Part of the problem, it seems, is Pure's inability to maintain and update its own apps, and it is most likely not alone in this respect: companies that have outsourced their mobile app programming are finding themselves locked out of iOS 11 because they can't get the code or the tools or the people to rebuild their contract-developed software. The iOS App Store shows that the last update to Pure Connect was on June 25, 2015, more than two years ago, so Pure has been without a mobile developer for a while, it seems. More and more consumer products need ongoing software updates now. But the companies selling those products are having trouble getting to grips with that fact.

3 2

Impersonating Password Prompts
by Lawrence D'Oliveiro 13 Oct '17

13 Oct '17

An old problem which never seems to be quite solved: how do you distinguish pieces of software on a platform that have a legitimate need to request a password from you, from those which don’t? <https://www.schneier.com/blog/archives/2017/10/impersonating_i.html>

1 0

XikiHub: The Social Command Line
by Peter Reutemann 13 Oct '17

13 Oct '17

'In 2014, Craig Muth developed an open source alternative shell called Xiki (executable wiki) which combined shell and GUI concepts and tried making the shell console more friendly and powerful. The selection was easier with arrow keys or with mouse clicks and there was the option to create menus to access other tools with ease. And, all of this was made possible for beginners with little to no knowledge about the command line. ' [see archive link here: https://list.waikato.ac.nz/pipermail/wlug/2014-June/012983.html] 'Now, Xiki is going a step further with XikiHub by adding a social element to commands. XikiHub aims to be a social repository where you can discover thousands of examples and interfaces contributed from users all over the world. You can pick up the one you like, create your own and contribute it to the social repository. The idea behind XikiHub is to create a social platform where any Xiki user can share a command he/she created that can be picked up and used by any other user. It will include a quick install step that will provide the option to review before installing a command.' -- source: https://itsfoss.com/xikihub-social-command-line/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Endless OS Is First Linux Distro to Support Flatpak Apps from Flathub by Default
by Peter Reutemann 13 Oct '17

13 Oct '17

'Flatpak has been around for some time now, and it's gaining more and more popularity among GNU/Linux distributions. Endless OS is the latest to announce that it brings support for Flatpak apps, though it's the first to offer support for this universal binary format directly from the Flathub repository, by default. Last month, the Flatpak developers over at Red Hat announced that their Flathub software repository received a modern, web-based frontend, which allows users to easily browse all available Flatpak apps at a glance, and developers to add their own Flatpaks to the list of more than 100 apps.' -- source: http://news.softpedia.com/news/endless-os-is-first-linux-distro-to-enable-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Linux smartphone makes its $1.5 million crowdfunding goal
by Peter Reutemann 12 Oct '17

12 Oct '17

'Hundreds of millions are happy with Android smartphones and iPhones. But there are some users who want the maximum possible control over their smartphones. For those people, Purism now has the funding it needs for its free-software smartphone without a trace of proprietary code or firmware: The Purism Librem 5 smartphone. At first, it appeared Purism wouldn't make its $1.5-million goal. The Librem 5 crowdfunding campaign staggered forward at first. Them, when KDE and then GNOME threw their support behind the project, the project picked up steam.' -- source: http://www.zdnet.com/article/purism-linux-smartphone-makes-its-1-5-million-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

How to test internet speed in Linux terminal
by Peter Reutemann 12 Oct '17

12 Oct '17

'Most of us check the internet bandwidth speed whenever we connect to new network or wifi. So why not our servers! Here is a tutorial which will walk you through to test internet speed in Linux terminal. Everyone of us generally uses Speedtest by Ookla to check internet speed. Its pretty simple process for a desktop. Goto their website and just click GO button. It will scans your location and speed test with nearest server. If you are on mobile, they have their app for you. But if you are on terminal with command line interface things are little different. Lets see how to check internet speed from Linux terminal.' -- source: https://kerneltalks.com/tips-tricks/how-to-test-internet-speed-in-linux-ter… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Europe pledges support for open source government solutions
by Peter Reutemann 12 Oct '17

12 Oct '17

'Estonia has long been the digital envy of many European Union member states. An effective and open policy approach to digital government has yielded extraordinary results—from 90%+ uptake of electronic identification (E-ID) solutions to an open source e-government platform (X-Road) to meet the ever-growing expectations of IT-savvy citizens as well as other countries wanting to pool IT across borders. It was thus fitting that Estonia, the current EU presidency, brought together Ministers from 32 countries (under the umbrellas of the EU and European Free Trade Association) to adopt the Tallinn Declaration on E-Government, creating a renewed political dynamism coupled with legal tools to accelerate the implementation of a range of existing EU policy instruments (e.g., the e-Government Action Plan and ISA² program). Perhaps the most significant development for open source supporters is the explicit recognition of open source software (OSS) as a key driver towards achieving ambitious governmental digitisation goals by 2020.' -- source: https://opensource.com/article/17/10/eu-open-source Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Enable Fractional Scaling in Gnome
by Peter Reutemann 12 Oct '17

12 Oct '17

'Fractional scaling is practically necessary if you’re running a HiDPI display, and you want your desktop to scale uniformly to match your display. It’s always been an issue on Linux, but the latest version of the GNOME desktop has implemented a true fractional scaling feature to keep your desktop looking good. Even though GNOME 3.26 does have fractional scaling support, it wasn’t mature enough to make the release. As a result, it’s still a testing feature that you need to enable yourself.' -- source: https://www.maketecheasier.com/enable-fractional-scaling-gnome/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sonos Speakers: Refuse Updates, They Stop Working
by Lawrence D'Oliveiro 12 Oct '17

12 Oct '17

In August, when wireless speaker maker Sonos decided to update its privacy policy to allow it to gather more data on its customers from their devices, it characterized the consequences of refusing to accept the change as being left out of future feature upgrades. ... "If you choose not to provide the functional data, you won't be able to receive software updates," a Sonos spokesperson explained at the time. "It's not like if you don't accept it, we'd be shutting down your device or intentionally bricking it." ... However, the [spokesperson] acknowledged that a few people who have updated their apps, manually or through automatic updates, have ended up with software on their handsets that isn't compatible with their firmware – which did not update because they would not accept the privacy policy change. <http://www.theregister.co.uk/2017/10/11/sonos_privacy_speakers/>

1 0