- wlug - list.wlug.org.nz

Antivirus Software Is 'Increasingly Useless' and May Make Your Computer Less Safe
by Peter Reutemann 08 Jul '16

08 Jul '16

'Is your antivirus protecting your computer or making it more hackable? Internet security experts are warning that anti-malware technology is becoming less and less effective at protecting your data and devices, and there's evidence that security software can sometimes even make your computer more vulnerable to security breaches. This week, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) issued a warning about popular antivirus software made by Symantec, some of it under the Norton brand, after security researchers with Google's Project Zero found critical vulnerabilities. "These vulnerabilities are as bad as it gets. They don't require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible," wrote Google researcher Tavis Ormandy in a blog post. Symantec said it had verified and addressed the issues in updates that users are advised to install. It's not the only instance of security software potentially making your computer less safe. Concordia University professor Mohammad Mannan and his PhD student Xavier de Carne de Carnavalet recently presented research on antivirus and parental control software packages, including popular brands like AVG, Kaspersky and BitDefender, that bypass some security features built into internet browsers to verify whether sites are safe or not in order to be able to scan encrypted connections for potential threats. In theory, they should make up for it with their own content verification systems. But Mannan's research, presented at the Network and Distributed System Security Symposium in California earlier this year, found they didn't do a very good job. "We were surprised at how bad they were," he said in an interview. "Some of them, they did not even make it secure in any sense."' -- source: https://it.slashdot.org/story/16/07/08/145245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android KeyStore Encryption Scheme Broken
by Peter Reutemann 08 Jul '16

08 Jul '16

'The default implementation for KeyStore, the system in Android designed to store user credentials and cryptographic keys, is broken, researchers say.>In an academic paper published this week, researchers argue that the particular encryption scheme that KeyStore uses fails to protect the integrity of keys and could be exploited to allow an attacker to modify stored keys through a forgery attack. KeyStore, which performs key-specific actions through the OpenSSL library, allows Android apps to store and generate their own cryptographic keys. By storing keys in a container, KeyStore makes it more difficult to remove them from the device. Mohamed Sabt and Jacques Traore, two researchers with the French telecom Orange Labs, claim the scheme associated with the system is "non-provably secure," and could have "severe consequences." The two point out in their paper "Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore," that it's the hash-then-encrypt (HtE) authenticated encryption (AE) scheme in cipher block chaining mode (CBC) in KeyStore that fails to guarantee the integrity of keys.' -- source: https://tech.slashdot.org/story/16/07/07/1819233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 million Android phones infected by all-powerful auto-rooting apps
by Peter Reutemann 07 Jul '16

07 Jul '16

"Security experts have documented a disturbing spike in a particularly virulent family of Android malware, with more than 10 million handsets infected and more than 286,000 of them in the US. Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day, displays 20 million malicious advertisements, and generates more than $300,000 per month in revenue. The success is largely the result of the malware's ability to silently root a large percentage of the phones it infects by exploiting vulnerabilities that remain unfixed in older versions of Android. The Check Point researchers have dubbed the malware family "HummingBad," but researchers from mobile security company Lookout say HummingBad is in fact Shedun, a family of auto-rooting malware that came to light last November and had already infected a large number of devices." -- source: http://arstechnica.com/security/2016/07/virulent-auto-rooting-malware-takes… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of systemd In Debian
by Lawrence D'Oliveiro 07 Jul '16

07 Jul '16

Presentation from DebConf, slides and video <http://phoronix.com/scan.php?page=news_item&px=Debian-systemd-Status-2016>.

1 1

Yet Another Next-Generation Filesystem
by Lawrence D'Oliveiro 06 Jul '16

06 Jul '16

As if btrfs and ZFS aren’t enough, here’s another next-generation filesystem being developed for Linux: <http://phoronix.com/scan.php?page=news_item&px=Bcachefs-Still-Rolling>. It apparently originated from “Bcache”, which was a filesystem developed for use on SSDs.

1 0

32 bit
by Ian Young 06 Jul '16

06 Jul '16

See also Linux Mint 18 in 32-bit version, and Bodhi complete with Enlightenment. NOW WHAT ABOUT TRIMMING THOSE POSTS!!! OTHERWISE I MAY BE FORCED TO DIG OUT SOME ARCHAIC INTERNET ETIQUETTE FAQ AND POST IT IN FULL ALL IN CAPS. Just joshing people. But puhleeze???! A word for Michelle and the quest for perfection. Sometimes in this life there is a dichotomy between what we wish for and what we can actually accomplish. Maybe near enough is good enough. Is there actually such a thing as complete security on the internet? Possibly, but probably not for the average citizen. "You have zero privacy anyway. Get over it." Scott McNealy, formerly of Sun Microsystems. Sad but probably true.

8 14

puppy or qubes
by Michelle 06 Jul '16

06 Jul '16

Well, I give up. I have tried for months and invested dozens of hours to get a machine that runs qubes and it hasn't happened. So would somebody be willing to go into say pb tech with different live puppy's on stick (or DVD) and finding what computers run it. Puppy was the distro I was wanting to run on my brand new computer I bought last year. I have been told that it is hard to find a new computer that won't rtun puppy. My new computer didn't. Hopefully it is just a freak. So if you are prepared to do that, could you then let me know at least two of those computers that should be able to run qubes according to the hardware specifications at the qubes website. If nobody is prepared to do that it is more than fine. I will just buy a computer that runs a windows legacy os.

5 11

post trimming
by Ian Young 06 Jul '16

06 Jul '16

Oh dear, it's a storm of my making, albeit in a teacup. Much of the time posts on wlug are brief and often evoke no responses. As it happens of late there have been some of greater length which have had replies including the full body of all the foregoing, This has lead to my occasional ire as I scroll on ever downwards through the screeds of text previously seen looking for some gem of wisdom only to finally find the dreaded "Me too" or something equally unmemorable. Call me a grinchy grouch but is this sort of thing effective communication? Lies back on the couch .... Let me tell you about my days on dialup when every word cost 10 cents ... have i mentioned my Scottish ancestry? OMG, apologies to all Scots. If you can't say anything nice then say nothing as my old dad (from Glasgow) was wont to say. ~ ttfn Ian Y

1 0

Why Dotfiles Need To Die
by Lawrence D'Oliveiro 06 Jul '16

06 Jul '16

“Hidden” files and directories are outnumbering non-hidden ones 6:1 in my home directory: ldo(a)theon:~> ls -A ~/ | grep -c '^\.' 215 ldo(a)theon:~> ls -A ~/ | grep -vc '^\.' 35 ldo(a)theon:~> ls -A ~/ | wc -l 250 Quite a few applications are starting to adopt the XDG Base Directory Spec <https://specifications.freedesktop.org/basedir-spec/latest/>, but it just can’t happen fast enough...

1 0

Any Old Machines Going Spare?
by Lawrence D'Oliveiro 06 Jul '16

06 Jul '16

Te Whare O Te Ata (the Fairfield community centre) has a group of four public-access machines that are not getting any younger. Does anybody have any machines they don’t need any more, that they could donate as (slightly) newer replacements? I think all of us who volunteer there are on this list, so I think you might as well respond to the list, at least to begin with. Then we can take it from there. Thanks for any help.

3 3