- wlug - list.wlug.org.nz

Researchers Catch Microsoft Zero-Day Used To Install Government Spyware
by Peter Reutemann 13 Sep '17

13 Sep '17

'Government hackers were using a previously-unknown vulnerability in Microsoft's .NET Framework, a development platform for building apps, to hack targets and infect them with spyware, according to security firm FireEye. The firm revealed the espionage campaign on Tuesday, on the same day Microsoft patched the vulnerability. According to FireEye, the bug, which until today was a zero-day, was being used by a customer of FinFisher, a company that sells surveillance and hacking technologies to governments around the world. The hackers sent a malicious Word RTF document to a "Russian speaker," according to Ben Read, FireEye's manager of cyber espionage research. The document was programmed to take advantage of the recently-patched vulnerability to install FinSpy, spyware designed by FinFisher. The spyware masqueraded as an image file called "left.jpg," according to FireEye.' -- source: https://it.slashdot.org/story/17/09/12/2022235 For Windows, there seems to be Detekt (written in Python) which can detect some versions of FinSpy apparently: https://www.kubuntuforums.net/archive/index.php/t-66896.html Maybe we should finally look at demoing some security tools at the next meeting? - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis - ... (other suggestions?) In other words, I'd need volunteers to do a short show and tell. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Only Safe Email is Text-Only Email
by Peter Reutemann 13 Sep '17

13 Sep '17

'Sergey Bratus, Research Associate Professor of Computer Science, Dartmouth College, and Anna Shubina, Post-doctoral Associate in Computer Science, Dartmouth College write: The real issue is that today's web-based email systems are electronic minefields filled with demands and enticements to click and engage in an increasingly responsive and interactive online experience. It's not just Gmail, Yahoo mail and similar services: Desktop-computer-based email programs like Outlook display messages in the same unsafe way. Simply put, safe email is plain-text email -- showing only the plain words of the message exactly as they arrived, without embedded links or images. Webmail is convenient for advertisers (and lets you write good-looking emails with images and nice fonts), but carries with it unnecessary -- and serious -- danger, because a webpage (or an email) can easily show one thing but do another. Returning email to its origins in plain text may seem radical, but it provides radically better security. Even the federal government's top cybersecurity experts have come to the startling, but important, conclusion that any person, organization or government serious about web security should return to plain-text email (PDF).' -- source: https://yro.slashdot.org/story/17/09/12/0436206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BlueBorne Vulnerabilities Impact Over 5 Billion Bluetooth-Enabled Devices
by Peter Reutemann 13 Sep '17

13 Sep '17

'Security researchers have discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. Researchers say the vulnerabilities are undetectable and unstoppable by traditional security solutions. No user interaction is needed for an attacker to use the BleuBorne flaws, nor does the attacker need to pair with a target device. They affect the Bluetooth implementations in Android, iOS, Microsoft, and Linux, impacting almost all Bluetooth device types, from smartphones to laptops, and from IoT devices to smart cars. Furthermore, the vulnerabilities can be concocted into a self-spreading BlueTooth worm that could wreak havoc inside a company's network or even across the world. "These vulnerabilities are the most serious Bluetooth vulnerabilities identified to date," an Armis spokesperson told Bleeping Computer via email. "Previously identified flaws found in Bluetooth were primarily at the protocol level," he added. "These new vulnerabilities are at the implementation level, bypassing the various authentication mechanisms, and enabling a complete takeover of the target device." Consumers are recommended to disable Bluetooth unless you need to use it, but then turn it off immediately. When a patch or update is issued and installed on your device, you should be able to turn Bluetooth back on and leave it on safely. The BlueBorne Android App on the Google Play Store will be able to determine if a user's Android device is vulnerable. A technical report on the BlueBorne flaws is available here (PDF).' -- source: https://mobile.slashdot.org/story/17/09/12/2030213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Eric Light 13 Sep '17

13 Sep '17

Let's keep it on the list, thanks gb. noun: snark; 1. snide and sharply critical comments. I called out your behaviour for what it was, and I would have done so in-person too. I'm not singling you out, either - I did the same with someone else in July. The entire community suffers when that type of behaviour goes unaddressed - and it's the community's job to speak up if we want to protect the high standards we've enjoyed for the last fifteen years. E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es On Wed, 13 Sep 2017, at 10:59, gb wrote: > On the contrary, I was merely pointing out that insulting people on a > public forum is not something you would do to their faces. > > On Tue, 2017-09-12 at 15:02 +1200, Eric Light wrote: > > Did.... You actually just threaten me? > > > > E > > > > -------------------------------------------- > > Q: Why is this email five sentences or less? > > A: http://five.sentenc.es > > > > On Tue, 12 Sep 2017, at 14:39, gb wrote: > > > > > > "snark" ... "being a dick" ... would you like to say that to my face? > > > > > > > > > On Tue, 2017-09-12 at 14:04 +1200, Eric Light wrote: > > > > Is that snark really necessary, gb? I'm not sure about the rest of us, > > > > but I'm in this group for interesting news, tips, guidance, etc. > > > > > > > > The diversity of information here is one of the reasons that I've been > > > > on the list for almost a decade. I'm sure a full 30% of Peter's posts > > > > aren't Linux-specific, for example. That only adds to the benefit that > > > > we get as a group. > > > > > > > > Lawrence's post is fascinating, and could be the starting point for an > > > > interesting discussion if we could go ahead and not be dicks - either to > > > > the poster, or about the content. > > > > > > > > E > > > > > > > > -------------------------------------------- > > > > Q: Why is this email five sentences or less? > > > > A: http://five.sentenc.es > > > > > > > > On Tue, 12 Sep 2017, at 12:51, gb wrote: > > > > > Well that's got zero to do with linux, or Waikato ... unless someone > > > > > owns a Tesla in Waikato? (I doubt it). > > > > > > > > > > I've got some cool anecdotes on crappy things banks do with our money > > > > > supply, shall I share them here too? > > > > > > > > > > On Tue, 2017-09-12 at 12:02 +1200, Lawrence D'Oliveiro wrote: > > > > > > Tesla sometimes sells cars with more hardware battery capacity than > > > > > > is initially available for use by customers, offering the > > > > > > additional capacity as a subsequent software update. > > > > > > > > > > > > ... > > > > > > > > > > > > But last week, Tesla decided to temporarily make this extra > > > > > > capacity available even to Floridians who hadn't paid for the > > > > > > upgrade to ensure they had enough range to get out of Florida ahead > > > > > > of Hurricane Irma. > > > > > > > > > > > > ... > > > > > > > > > > > > Presumably, their vehicles will get a downgrade once hurricane > > > > > > season is over. > > > > > > > > > > > > <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…> > > > > > > _______________________________________________ > > > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > > > > > > > _______________________________________________ > > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > _______________________________________________ > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > > > > . > > _______________________________________________ > > wlug mailing list | wlug(a)list.waikato.ac.nz > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > .

1 0

“Mr Inkscape” Explains How To Pronounce His Name
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

In the comments to an article on an “Inkscape hackfest” from earlier this year, I asked, and he answered <http://libregraphicsworld.org/blog/entry/inkscape-hackfest-planned-for-late…>.

1 0

Bruce Schneier On Securing A Raspberry π
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Make magazine has an article about securing it. Reading it, I am struck by how much work it is to secure. I fear that this is beyond the capabilities of most tinkerers, and the result will be even more insecure IoT devices. <https://www.schneier.com/blog/archives/2017/09/securing_a_rasp.html>

1 0

mailing list etiquette
by Peter Reutemann 12 Sep '17

12 Sep '17

Hi everyone In light of recent events, a little refresher on the mailing list etiquette seems to be appropriate. You can find it here: https://list.waikato.ac.nz/mailman/listinfo/wlug Yes, there are topics which can kick off a flame war (vi/emacs, systemd). Some things are like politics or religion and cannot be discussed objectively. But calling other people names and/or posting snide, demeaning or threatening comments (on- or off-list) is below this list. I usually have a very hands-off approach to moderation, considering that we are all (or at least most of us are) adults and should know what is considered acceptable social behavior. However, if inciting behavior should continue, I reserve my right to ban people from this list. Last but not least: if you don't like the actual content being posted here, no one forces you to be a member of this mailing list. Simply unsubscribe. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Eric Light 12 Sep '17

12 Sep '17

Did.... You actually just threaten me? E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es On Tue, 12 Sep 2017, at 14:39, gb wrote: > > "snark" ... "being a dick" ... would you like to say that to my face? > > > On Tue, 2017-09-12 at 14:04 +1200, Eric Light wrote: > > Is that snark really necessary, gb? I'm not sure about the rest of us, > > but I'm in this group for interesting news, tips, guidance, etc. > > > > The diversity of information here is one of the reasons that I've been > > on the list for almost a decade. I'm sure a full 30% of Peter's posts > > aren't Linux-specific, for example. That only adds to the benefit that > > we get as a group. > > > > Lawrence's post is fascinating, and could be the starting point for an > > interesting discussion if we could go ahead and not be dicks - either to > > the poster, or about the content. > > > > E > > > > -------------------------------------------- > > Q: Why is this email five sentences or less? > > A: http://five.sentenc.es > > > > On Tue, 12 Sep 2017, at 12:51, gb wrote: > > > Well that's got zero to do with linux, or Waikato ... unless someone > > > owns a Tesla in Waikato? (I doubt it). > > > > > > I've got some cool anecdotes on crappy things banks do with our money > > > supply, shall I share them here too? > > > > > > On Tue, 2017-09-12 at 12:02 +1200, Lawrence D'Oliveiro wrote: > > > > Tesla sometimes sells cars with more hardware battery capacity than > > > > is initially available for use by customers, offering the > > > > additional capacity as a subsequent software update. > > > > > > > > ... > > > > > > > > But last week, Tesla decided to temporarily make this extra > > > > capacity available even to Floridians who hadn't paid for the > > > > upgrade to ensure they had enough range to get out of Florida ahead > > > > of Hurricane Irma. > > > > > > > > ... > > > > > > > > Presumably, their vehicles will get a downgrade once hurricane > > > > season is over. > > > > > > > > <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…> > > > > _______________________________________________ > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > _______________________________________________ > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > _______________________________________________ > > wlug mailing list | wlug(a)list.waikato.ac.nz > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > .

1 0

Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Tesla sometimes sells cars with more hardware battery capacity than is initially available for use by customers, offering the additional capacity as a subsequent software update. ... But last week, Tesla decided to temporarily make this extra capacity available even to Floridians who hadn't paid for the upgrade to ensure they had enough range to get out of Florida ahead of Hurricane Irma. ... Presumably, their vehicles will get a downgrade once hurricane season is over. <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…>

3 2

Google Chrome Will Soon Detect Man-in-the-Middle Attacks
by Peter Reutemann 10 Sep '17

10 Sep '17

'Google Chrome 63 will include a new security feature that will detect when third-party software is performing a Man-in-the-Middle (MitM) attack that hijacks the user's Internet connection.... Most MitM toolkits fail to correctly rewrite the user's encrypted connections, causing SSL errors that Chrome will detect. The new Chrome 63 feature is in the form of a new warning screen. This new error will appear whenever Chrome detects a large number of SSL connection errors in a short timespan, a sign that someone is trying -- and failing -- to intercept the user's web traffic. This includes both malware and legitimate applications, such as antivirus and firewall applications. The new Chrome error won't show up for all antivirus and firewall software, but only for those that do not rewrite SSL connections in a proper way, resulting in SSL errors. Chrome 63 is set for release on December 5, but users can already test it by enabling it in the Google Chrome dev branch' -- source: https://it.slashdot.org/story/17/09/10/1928232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0