- wlug - list.wlug.org.nz

The CCleaner Malware Fiasco Targeted at Least 20 Specific Tech Firms
by Peter Reutemann 21 Sep '17

21 Sep '17

'Hundreds of thousands of computers getting penetrated by a corrupted version of an ultra-common piece of security software was never going to end well. But now it's becoming clear exactly how bad the results of the recent CCleaner malware outbreak may be. Researchers now believe that the hackers behind it were bent not only on mass infections, but on targeted espionage that tried to gain access to the networks of at least 20 tech firms. Earlier this week, security firms Morphisec and Cisco revealed that CCleaner, a piece of security software distributed by Czech company Avast, had been hijacked by hackers and loaded with a backdoor that evaded the company's security checks. It wound up installed on more than 700,000 computers. On Wednesday, researchers at Cisco's Talos security division revealed that they've now analyzed the hackers' "command-and-control" server to which those malicious versions of CCleaner connected. On that server, they found evidence that the hackers had attempted to filter their collection of backdoored victim machines to find computers inside the networks of 20 tech firms, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself. In about half of those cases, says Talos research manager Craig Williams, the hackers successfully found a machine they'd compromised within the company's network, and used their backdoor to infect it with another piece of malware intended to serve as a deeper foothold, one that Cisco now believes was likely intended for industrial espionage.' -- source: https://it.slashdot.org/story/17/09/21/1350214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Researchers Warn that Third-Party GO Keyboard App is Spying on Millions of Android Users
by Peter Reutemann 21 Sep '17

21 Sep '17

'Security researchers from Adguard have issued a warning that the popular GO Keyboard app is spying on users. Produced by Chinese developers GOMO Dev Team, GO Keyboard was found to be transmitting personal information about users back to remote servers, as well as "using a prohibited technique to download dangerous executable code." Adguard made the discovery while conducting research into the traffic consumption and unwanted behavior of various Android keyboards. The AdGuard for Android app makes it possible to see exactly what traffic an app is generating, and it showed that GO Keyboard was making worrying connections, making use of trackers, and sharing personal information. Adguard notes that there are two versions of the keyboard in Google Play which it claims have more than 200 million users in tot' -- source: https://it.slashdot.org/story/17/09/21/1959218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox For iOS Gets Tracking Protection, Firefox Focus For Android Gets Tabs
by Peter Reutemann 21 Sep '17

21 Sep '17

'Mozilla today released Firefox 9.0 for iOS and updated Firefox Focus for Android. The iOS browser is getting tracking protection, improved sync, and iOS 11 compatibility. The Android privacy browser is getting tabs. You can download the former from Apple's App Store and the latter from Google Play. This is the first time Firefox has offered tracking protection on iOS, and Nick Nguyen, vice president of product at Mozilla, notes that it's finally possible "thanks to changes by Apple to enable the option for 3rd party browsers." This essentially means iPhone and iPad users with Firefox and iOS 11 will have automatic ad and content blocking in Private Browsing mode, and the option to turn it on in regular browsing. This is the same feature that's available in Firefox for Android, Windows, Mac, and Linux, as well as the same ad blocking technology used in Firefox Focus for Android and iOS' -- source: https://news.slashdot.org/story/17/09/21/1953205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ISO Rejects NSA Encryption Algorithms
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

From <https://www.schneier.com/blog/archives/2017/09/iso_rejects_nsa.html>: The ISO has decided not to approve two NSA-designed block encryption algorithms: Speck and Simon. It's because the NSA is not trusted to put security ahead of surveillance ... I don't trust the NSA, either. I should point out that SELinux was created by the NSA, too. The difference being that that has been subjected to years of careful independent scrutiny.

1 0

FSF Europe Calls For Taxpayer-Funded Software To Be Licensed For Free Re-use
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

There are many things one can say about the US, but they have once nice law, at least at the Federal level--anything that might be copyrightable, that is created with taxpayer funds, is automatically in the public domain. For example, this is why everybody gets to have free use of all that stunning imagery from NASA. It also applies to US-Government-developed software as well. I have often wondered why other governments do not follow the same rule. Here in NZ, as in the UK, there is this weird concept of “Crown copyright”, which means that we, as taxpayers, do not get the use of material developed with our own money, we have to pay for it yet again. The European branch of the Free Software Foundation is calling for software developed with European taxpayer money to be made freely available in the same way <https://www.techdirt.com/articles/20170914/09163238207/free-software-founda…>.

3 4

GNOME Partners With Purism On Librem 5 Linux-based Privacy-focused Smartphone
by Peter Reutemann 20 Sep '17

20 Sep '17

'The Librem 5 smartphone by Purism has a long and difficult road ahead of it. Competing against the likes of Apple and Google on the mobile market has proven to be a death sentence for many platforms -- including Microsoft with its failed Windows 10 Mobile. Luckily, Purism has found itself a new partner on this project -- one of the most important organizations in the Linux community -- The GNOME Foundation. The GNOME Foundation explains, 'The Librem 5 is a hardware platform the Foundation is interested in advancing as a GNOME/GTK phone device. The GNOME Foundation is committed to partnering with Purism to create hackfests, tools, emulators, and build awareness that surround moving GNOME/GTK onto the Librem 5 phone. As part of the collaboration, if the campaign is successful the GNOME Foundation plans to enhance GNOME shell and general performance of the system with Purism to enable features on the Librem 5.'' -- source: https://linux.slashdot.org/story/17/09/20/1723246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Sep '17

20 Sep '17

Hi everyone I might give a quick run down on some security tools next week, depending how much time I have over the weekend (never used any of these apart from ClamAV): - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis Might show off the Pencil Project as well. A volunteer for demoing NixOS? https://nixos.org/ "completely declarative approach to configuration management" "atomic upgrades and rollbacks" Any other cool software that you'd like to demo for a few minutes? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache bug leaks contents of server memory for all to see—Patch now
by Peter Reutemann 20 Sep '17

20 Sep '17

'There's a bug in the widely used Apache Web Server that causes servers to leak pieces of arbitrary memory in a way that could expose passwords or other secrets, a freelance journalist has disclosed. The vulnerability can be triggered by querying a server with what's known as an OPTIONS request. Like the better-known GET and POST requests, OPTIONS is a type of HTTP method that allows users to determine which HTTP requests are supported by the server. Normally, a server will respond with GET, POST, OPTIONS, and any other supported methods. Under certain conditions, however, responses from Apache Web Server include the data stored in computer memory. Patches are available here and here.' -- source: https://arstechnica.com/information-technology/2017/09/apache-bug-leaks-con… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Breaking Your Bubble
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

A class project at Princeton <http://freedom-to-tinker.com/2017/09/19/breaking-your-bubble/>: In the first step, students measured their filter bubble. More specifically, for homework, at three different time points each week, they scrolled through their feeds until they found five political posts (ads included). Then, they coded these posts as either liberal, neutral, or conservative. Students also kept track of how many posts they had to scroll through to get to five posts as a measure of how much political content was in their feed. ... In the second step, the students developed and implemented a procedure to break their bubble. Their goal was to achieve a “balanced diet” of liberal, neutral, and conservative political content that matched the baseline distribution of what is being shared on Facebook ... Followup <http://freedom-to-tinker.com/2017/09/19/what-our-students-found-when-they-t…>: So, were students able to break their bubble? Initially, we expected that because the News Feed algorithm is complicated, it might be hard for students to break out of their bubbles. But we were wrong. The class was able to move to a more balanced diet pretty quickly.

1 0

Speaking Of DRM ...
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

... HP has released <https://www.techdirt.com/articles/20170914/11491238210/hp-brings-back-obnox…> firmware updates for several of its OfficeJet Pro range that block their ability to work with third-party ink cartridges.

1 0