- wlug - list.wlug.org.nz

You Know The Machines Are Taking Over When ...
by Lawrence D'Oliveiro 07 Jan '17

07 Jan '17

... a San Diego TV station does a story about a young girl who asks her parents’ Amazon Echo to get her a dollhouse, which automatically causes an order to be placed for one; but the fun really begins when the voice of the TV presenter triggers additional Amazon Echo devices in the homes of those watching the news, causing them to try to place orders for dollhouses as well. <http://www.theregister.co.uk/2017/01/07/tv_anchor_says_alexa_buy_me_a_dollh…>

2 1

https://kite.com - Your programming copilot
by Chris O'Halloran 05 Jan '17

05 Jan '17

A utility that may be available to Linux users soon. https://kite.com/

2 2

An SQL Injection Attack Is A Legal Company Name In The UK
by Lawrence D'Oliveiro 04 Jan '17

04 Jan '17

I wonder if any real-world databases will fall over trying to include this name. ;) <https://www.schneier.com/blog/archives/2017/01/an_sql_injectio.html>

1 0

Rutgers U In Financial Trouble From Cloud Failure
by Lawrence D'Oliveiro 04 Jan '17

04 Jan '17

Rutgers University in New Jersey has put its “Cornerstone” admin system on Oracle’s cloud services. Ongoing hiccups in this, going back to September, have caused it serious trouble trying to pay its bills, leading to unpleasant consequences like the electricity supply being cut off to some offices. <http://www.theregister.co.uk/2017/01/03/rutgers_university_oracle_cloud_fou…>

1 0

Cloudflare Leap-Second Panic
by Lawrence D'Oliveiro 03 Jan '17

03 Jan '17

Cloudflare’s DNS proxy software misbehaved on New Year’s Day, because of the extra second that was added to December 31st: <http://arstechnica.co.uk/security/2017/01/cloudflare-leap-second-software-p…>. Because they occur so rarely, it seems very difficult to test software to work correctly with leap seconds. This is one reason why some groups propose getting rid of them altogether.

1 0

Photocopier Security
by Lawrence D'Oliveiro 03 Jan '17

03 Jan '17

<https://www.schneier.com/blog/archives/2017/01/photocopier_sec.html>: A modern photocopier is basically a computer with a scanner and printer attached. This computer has a hard drive, and scans of images are regularly stored on that drive. This means that when a photocopier is thrown away, that hard drive is filled with pages that the machine copied over its lifetime. As you might expect, some of those pages will contain sensitive information. Some of the reader discussion veers into one or two only-semi-related, but interesting areas. For example, did you know that Xerox invented an image-compression technique (JBIG2) for its photocopiers that would actually introduce typos into documents?

1 0

Is The Desktop CPU Dead?
by Lawrence D'Oliveiro 03 Jan '17

03 Jan '17

<http://arstechnica.com/gadgets/2017/01/intel-core-i7-7700k-kaby-lake-review/>: For yet another year, high-end desktop CPU performance remains at a standstill. With low-power laptops and all-in-ones continuing to outsell desktops—and with high-end workloads like video editing, 3D animation, and machine learning increasingly being offloaded to GPUs—perhaps it was inevitable that Intel would stop caring so much about its high-end consumer CPUs. Or maybe Intel's struggles with the 14nm process forced its hand, and the last few years of disappointing performance improvements are down to physics rather than passivity. Those laptop sales are declining, too...

1 0

Listening To Streaming Radio
by Lawrence D'Oliveiro 02 Jan '17

02 Jan '17

Currently listening to Sydney’s TripleJ radio station using the ffplay utility (part of FFmpeg). For anybody else who wants to listen without having to go through a web browser, ABC helpfully provide a list of direct-streaming URLs for their stations at <https://radio.abc.net.au/help/streams>. ffplay reports some interesting additional details about the stream: Metadata: icy-notice1 : <BR>This stream requires <a href="http://www.winamp.com">Winamp</a><BR> icy-notice2 : SHOUTcast DNAS/posix(linux x64) v2.4.7.256<BR> icy-name : Triple J NSW icy-genre : Misc icy-br : 64 icy-url : http://www.abc.net.au/radio icy-pub : 0 In other words, they seem to be streaming from a Linux server, but their recommendation is for a client that doesn’t run on Linux...

2 6

Report on U.S. political party having its e-mail servers hacked
by Ian Stewart 30 Dec '16

30 Dec '16

You may have read in the main-stream media about a U.S. political party having its e-mail servers hacked and then copies of the e-mails were published on a web-site. If you'd like to know more, then a 13 page joint report<https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZ…> has been released on 29 December 2016 by the National Cybersecurity and Communications Integration Center (NCCIC) of The Department of Homeland Security (DHS), and the Federal Bureau of Investigation (FBI). In reading this report please recognise that "The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within." The report commences... "GRIZZLY STEPPE – Russian Malicious Cyber Activity Summary This Joint Analysis Report (JAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This document provides technical details regarding the tools and infrastructure used by the Russian civilian and military intelligence Services (RIS) to compromise and exploit networks and endpoints associated with the U.S. election, as well as a range of U.S. Government, political, and private sector entities. The U.S. Government is referring to this malicious cyber activity by RIS as GRIZZLY STEPPE." While the report contains many abbreviations, please note that "GRIZZLY STEPPE" is never written as "Grizzly Steppe" nor is it abbreviated to "GS". On Page 2... "Description. The U.S. Government confirms that two different RIS actors participated in the intrusion into a U.S. political party." The report does not provide the name of the "U.S. political party". For these details you'll need to use a search engine to search the Internet. The Description continues... "The first actor group, known as Advanced Persistent Threat (APT) 29, entered into the party’s systems in summer 2015, while the second, known as APT28, entered in spring 2016." Page 4 lists 48 "Alternate Names" of the Russian Military and Civilian Intelligence Services (RIS). They are not all called names like Advanced Persistent Threat (APT) 28, APT29, APT30... etc. For example one of them is called "Powershell backdoor". Page 8 has the, "Detailed Mitigation Strategies" with a section on "Protect Against SQL Injection and Other Attacks on Web Services", which states... "Take steps to harden both Web applications and the servers hosting them to reduce the risk of network intrusion via this vector." The "vector" (or "link") is to this webpage... https://msdn.microsoft.com/en-us/library/ff648653.aspx "Improving Web Application Security: Threats and Countermeasures J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan Microsoft Corporation Published: June 2003 Last Revised: January 2006 Applies to: Internet Information Services (IIS) 5.0 Microsoft Windows® 2000 operating system" With a last revision date of January 2006 its interesting to be provided with advice on how to take steps on your Microsoft Windows® 2000 operating system for which mainstream support ended on June 30, 2005 and extended support ended on July 13, 2010. UNIX does get one mention in the section "Credentials" on page 10... "Properly secure password files by making hashed passwords more difficult to acquire. Password hashes can be cracked within seconds using freely available tools. Consider restricting access to sensitive password hashes by using a shadow password file or equivalent on UNIX systems." While the report has IT related abbreviations such as HTTP, HTTPS, FTP, SQL, etc., here is a list to aid you with some of the other abbreviations used in the report... JAR - Joint Analysis Report NCCIC - National Cybersecurity and Communications Integration Center DHS - Department of Homeland Security FBI - Federal Bureau of Investigation RIS - Russian civilian and military intelligence Services APT - Advanced Persistent Threat. RATs - Remote Access Tools IOCs - Indicators of Compromise US-CERT - United States Computer Emergency Readiness Team EMET - Microsoft’s Enhanced Mitigation Experience Toolkit For additional reading on this report, use a search engine or go here<https://www.theguardian.com/technology/2016/dec/29/fbi-dhs-russian-hacking-…> or here<http://caucus99percent.com/content/all-there>. cheers, Ian.

1 0

CyanogenMod Becomes LineageOS
by Lawrence D'Oliveiro 27 Dec '16

27 Dec '16

Cyanogen Inc tried to take its CyanogenMod fork of Android commercial, with limited success. Now it has shut down the open-source project altogether. But a group of contributors has launched their own fork, called LineageOS. <http://arstechnica.com/information-technology/2016/12/cyanogen-inc-shuts-do…>

2 1