- wlug - list.wlug.org.nz

Google quietly corrects previously submitted disclosure for critical webp 0-day
by Peter Reutemann 27 Sep '23

27 Sep '23

'Google has quietly resubmitted a disclosure of a critical code-execution vulnerability affecting thousands of individual apps and software frameworks after its previous submission left readers with the mistaken impression that the threat affected only the Chrome browser. The vulnerability originates in the libwebp code library, which Google created in 2010 for rendering images in webp, a then new format that resulted in files that were up to 26 percent smaller as compared to PNG images. Libwebp is incorporated into just about every app, operating system, or other code library that renders webp images, most notably the Electron framework used in Chrome and many other apps that run on both desktop and mobile devices. Two weeks ago, Google issued a security advisory for what it said was a heap buffer overflow in WebP in Chrome. Google’s formal description, tracked as CVE-2023-4863, scoped the affected vendor as “Google” and the software affected as “Chrome,” even though any code that used libwebp was vulnerable. Critics warned that Google’s failure to note that thousands of other pieces of code were also vulnerable would result in unnecessary delays in patching the vulnerability, which allows attackers to execute malicious code when users do nothing more than view a booby-trapped webp image. On Monday, Google submitted a new disclosure that’s tracked as CVE-2023-5129. The new entry correctly lists libwebp as the affected vendor and affected software. It also bumps up the severity rating of the vulnerability, from 8.8 out of a possible 10 to 10.' -- source: https://arstechnica.com/security/2023/09/google-quietly-corrects-previously… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GPUs From All Major Suppliers Are Vulnerable To New Pixel-Stealing Attack
by Peter Reutemann 27 Sep '23

27 Sep '23

'Ars Technica: GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper (PDF) published Tuesday. The cross-origin attack allows a malicious website from one domain -- say, example.com -- to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains. [...] GPU.zip works only when the malicious attacker website is loaded into Chrome or Edge. The reason: For the attack to work, the browser must: 1. allow cross-origin iframes to be loaded with cookies 2. allow rendering SVG filters on iframes and 3. delegate rendering tasks to the GPU For now, GPU.zip is more of a curiosity than a real threat, but that assumes that Web developers properly restrict sensitive pages from being embedded by cross-origin websites. End users who want to check if a page has such restrictions in place should look for the X-Frame-Options or Content-Security-Policy headers in the source. "This is impactful research on how hardware works," a Google representative said in a statement. "Widely adopted headers can prevent sites from being embedded, which prevents this attack, and sites using the default SameSite=Lax cookie behavior receive significant mitigation against personalized data being leaked. These protections, along with the difficulty and time required to exploit this behavior, significantly mitigate the threat to everyday users. We are in communication and are actively engaging with the reporting researchers. We are always looking to further improve protections for Chrome users." An Intel representative, meanwhile, said that the chipmaker has "assessed the researcher findings that were provided and determined the root cause is not in our GPUs but in third-party software." A Qualcomm representative said "the issue isn't in our threat model as it more directly affects the browser and can be resolved by the browser application if warranted, so no changes are currently planned." Apple, Nvidia, AMD, and ARM didn't comment on the findings. ' -- source: https://it.slashdot.org/story/23/09/26/2031222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux's Multi-Grain Timestamps Short-Lived: Removed From The Kernel After A Few Weeks
by Peter Reutemann 26 Sep '23

26 Sep '23

'Phoronix: One of the new features merged for the Linux 6.6 kernel was multi-grained timestamps for the VFS layer and wiring it up for the EXT4, Btrfs, XFS, and Tmpfs file-systems. This alternative though to coarse-grained timestamps ended up exposing some problems and this week ahead of Linux 6.6-rc3, the feature has been stripped entirely from the kernel. Multi-grain timestamps were intended for addressing cases where the current coarse-grained timestamps can be ineffective for updating creation/modification times with a lot of I/O potentially happening within the once per jiffy timestamp... Multi-grained timestamps though were only to be selectively enabled to avoid the performance overhead. Christian Brauner of Microsoft who originally submitted the feature for Linux 6.6 went ahead and submitted the pull request, which has already been honored, for dropping the short-lived kernel feature... "As there are multiple solutions discussed the honest thing to do here is not to fix this up or disable it but to cleanly revert. The general infrastructure will probably come back but there is no reason to keep this code in mainline." ' -- source: https://linux.slashdot.org/story/23/09/25/009244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Creates 'Dark Style' GNOME Extension for Ubuntu 23.10
by Peter Reutemann 25 Sep '23

25 Sep '23

'In GNOME Shell there's a dark background for the Quick Settings menu, the calendar applet, and desktop notification-- but in Ubuntu 23.10, "the default Yaru theme uses a light style for GNOME Shell elements," according to the blog OMG Ubuntu. "But there's a new GNOME extension that lets you change this without affecting the rest of your desktop..." You can make GNOME Shell dark in Ubuntu by turning the 'Dark Style' toggle on but that also makes apps use a dark theme too. Not everyone wants that; they want a 'mixed' look... [I]f you would like to use dark GNOME Shell elements in Ubuntu 23.10 without using the dark mode preference (which, as said, will turn your apps dark too) then the Dark Style GNOME extension is exactly what you need. It only works with Ubuntu 23.10 and GNOME 45.' -- source: https://tech.slashdot.org/story/23/09/24/2317206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android phones get PC webcam capabilities in the latest beta
by Peter Reutemann 25 Sep '23

25 Sep '23

'Here's a fun new use for your Android phone: A PC webcam! In the latest Android beta, plugging a phone into a PC will reveal a new option in the USB Preferences menu for webcam functionality. Just pick that option instead of the default "file transfer," and the phone camera will register itself as a webcam. Then you can fire up Zoom and start video calling. The Android build with this feature is "Android 14 QPR1 Beta 1." Android's getting confusing with all these overlapping betas, but the current stable version is still Android 13. Android 14, currently on its 10th beta/developer preview, will most likely be out alongside the Pixel 8 in October. Android 14 QPR1 is the quarterly release after the first stable build of Android 14, and it should be out around December. (QPR stands for quarterly platform release.) These happen between major releases, often marketed as "feature drops." Right now, Android 13 is technically "Android 13 QPR3."' -- source: https://arstechnica.com/gadgets/2023/09/android-phones-get-pc-webcam-capabi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Behind the Scenes at 'Have I Been Pwned'
by Peter Reutemann 25 Sep '23

25 Sep '23

'The founder of the data-breach notification site Have I Been Pwned manages "the largest known repository of stolen data on the planet," reports Australia's public broadcaster ABC, including over 6 billion email address. Yet with no employees, Troy Hunt manages all of the technical and operational aspects single-handedly, and "has ended up playing an oddly central role in global cybersecurity." Troy is very careful with how he handles what he finds. He only collects (and encrypts) the mobile numbers, emails and passwords that he finds in the breaches, discarding the victims' names, physical addresses, bank details and other sensitive information. The idea is to let users find out where their data has been leaked from, but without exposing them to further risk. Once he identifies where a data breach has occurred, Troy also contacts the organisation responsible to allow it to inform its users before he does. This, he says, is often the hardest step of the process because he has to convince them it's legitimate and not some kind of scam itself. He's not required to give organisations this opportunity, much less persist when they ignore his messages or accuse him of trying to shake them down for money. But there's evidence that this approach is working. Despite the legal grey area he has operated in for a decade now, he's avoided being sued by any of the organisations responsible for the 705 breaches that are now searchable on Have I Been Pwned. These days, major tech companies like Mozilla and 1Password use Have I Been Pwned, and Troy likes to point out that dozens of national governments and law enforcement agencies also partner with his service... "He's not a company that's audited. He's just a dude on the web," says Jane Andrew, an expert on data breaches at the University of Sydney. "I think it's so shocking that this is where we find out information about ourselves. She says governments and law enforcement have, in general, left it to individuals to deal with the fallout from data breaches... Without an effective global regulator, Professor Andrew says, a crucial part of the world's cybersecurity infrastructure is left to rely on the goodwill of this one man on the Gold Coast.' -- source: https://it.slashdot.org/story/23/09/24/201233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LMDE-5 download
by john 24 Sep '23

24 Sep '23

I recently decided to try LMDE-5 Mate version. I found all my usual download sources were returning a 404 error, Checked again at 9.35am https://blog.linuxmint.com/?p=4281 Has this been pulled for some reason??

2 1

Linux gives up on 6-year LTS kernels, says they’re too much work
by Peter Reutemann 21 Sep '23

21 Sep '23

'The LTS (long-term support) period for the Linux kernel is being cut down. In 2017, the kernel jumped from two years of support to six. Now, six years later, it turns out that's a lot of work. ZDNet reports that at the Open Source Summit Europe this week (videos will be out in a few weeks), Linux Weekly News executive editor Jonathan Corbet announced the Linux kernel will return to two years of LTS support. The plan to cut back down to two years isn't instant. The Linux community is still honoring the current end-of-life timelines, so 6.1, 5.15, 5.10, 5.4, 4.19, and 4.14 are still six years, but new kernels will only get two years. Even this six-year window was supposed to be an optional thing when it started, with the release page FAQ saying, "Each new longterm kernel usually starts with only a 2-year projected EOL that can be extended further if there is enough interest from the industry at large to help support it for a longer period of time." The reality was that everything received a six-year life span, and now that will no longer be the case. Corbet cited a mix of lack of use and a lack of support for why Linux is cutting back on LTS kernels. Corbet says, "There's really no point to maintaining [old kernels] for that long because people are not using them." The other big problem is the burnout from maintainers, which are often unpaid and could use a lot more support from the billion-dollar companies that benefit from using Linux.' -- source: https://arstechnica.com/gadgets/2023/09/linux-gives-up-on-6-year-lts-thats-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The Signal Protocol used by 1+ billion people is getting a post-quantum makeover
by Peter Reutemann 21 Sep '23

21 Sep '23

'The Signal Foundation, maker of the Signal Protocol that encrypts messages sent by more than a billion people, has rolled out an update designed to prepare for a very real prospect that’s never far from the thoughts of just about every security engineer on the planet: the catastrophic fall of cryptographic protocols that secure some of the most sensitive secrets today. The Signal Protocol is a key ingredient in the Signal, Google RCS, and WhatsApp messengers, which collectively have more than 1 billion users. It’s the engine that provides end-to-end encryption, meaning messages encrypted with the apps can be decrypted only by the recipients and no one else, including the platforms enabling the service. Until now, the Signal Protocol encrypted messages and voice calls with X3DH, a specification based on a form of cryptography known as Elliptic Curve Diffie-Hellman. [...] There is little disagreement, however, that there will come a day when many of the most widely used forms of encryption will die at the hands of quantum computing. To head off that doomsday eventuality, engineers and mathematicians have been developing a new class of PQC, short for post-quantum cryptography. The PQC added to the Signal Protocol on Monday is called PQXDH. It uses the same X3DH specification the Signal Protocol has always employed. On top, it adds an additional layer of encryption using Crystals-Kyber, one of four PQC algorithms the National Institute of Standards and Technology selected last year as a potential replacement to ECC and other quantum-vulnerable forms of encryption.' -- source: https://arstechnica.com/security/2023/09/signal-preps-its-encryption-engine… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Terraform Fork Gets Renamed OpenTofu, Joins Linux Foundation
by Peter Reutemann 21 Sep '23

21 Sep '23

'TechCrunch: When HashiCorp announced it was changing its Terraform license in August, it set off a firestorm in the open source community, and actually represented an existential threat to startups that were built on top of the popular open source project. The community went into action and within weeks they had written a manifesto, and soon after that launched an official fork called OpenTF. Today, that group went a step further when the Linux Foundation announced OpenTofu, the official name for the Terraform fork, which will live forever under the auspices of the foundation as an open source project. At the same time, the project announced it would be applying for entry into the Cloud Native Computing Foundation (CNCF). "OpenTofu is an open and community-driven response to Terraform's recently announced license change from a Mozilla Public License v2.0 (MPLv2) to a Business Source License v1.1 providing everyone with a reliable, open source alternative under a neutral governance model," the foundation said in a statement. The name is deliberately playful says Yevgeniy (Jim) Brikman from the OpenTofu founding team, who is also co-founder of Gruntwork. "I'm glad your reaction was to laugh. That's a good thing. We're trying to keep things a little more humorous," Brikman told TechCrunch, but the group is dead serious when it comes to building an open fork. [...] "The first thing was to get an alpha release out there. So you can go to the OpenTofu website and download OpenTofu and start using it and trying it out," he said. "Then the next thing is a stable release. That's coming in the very near future, but there's work to do. Once you have a stable release, people can start using it. Then we can start growing adoption, and once we start growing adoption, some of the big players will start stepping in when some of the big players start stepping in other big players will start stepping in as well."' -- source: https://linux.slashdot.org/story/23/09/20/1951214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0