- wlug - list.wlug.org.nz

manjaro
by Ian Young 15 Jun '14

15 Jun '14

This mesage coming to you from the Manjaro 0.8.10 Openbox desktop in live mode, actually the first time I've run it. I have followed Manjaro pretty well since it began, and could run through my experiences if people are interested. I believe Rod has really really used it, ie had it installed and installed updates as they became available, whereas I have mainly dabbled on the live side. Arch users expect their systems to be broken at some time or other if I understand things correctly, the price of the leading edge. There is at least one other prepackaged Arch version, ie Archbang. Remind me when is the next meeting? ~ Ian Y

2 1

Manjaro 0.8.10 released
by Peter Reutemann 12 Jun '14

12 Jun '14

"Manjaro is a user-friendly Linux distribution based on the independently developed Arch operating system. Within the Linux community, Arch itself is renowned for being an exceptionally fast, powerful, and lightweight distribution that provides access to the very latest cutting edge – and bleeding edge – software. However, Arch is also aimed at more experienced or technically-minded users. As such, it is generally considered to be beyond the reach of those who lack the technical expertise (or persistence) required to use it. For newcomers, a user-friendly installer is provided, and the system itself is designed to work fully ‘straight out of the box’ with features including: * Pre-installed desktop environments * Pre-installed graphical applications to easily install software and update your system, and * Pre-installed codecs to play multimedia files" -- source: http://manjaro.org/2014/06/09/manjaro-0-8-10-is-online/ Anybody feel like giving it a spin and report at the next meeting? Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 4

Ars tests Internet surveillance—by spying on an NPR reporter
by Peter Reutemann 12 Jun '14

12 Jun '14

"On a bright April morning in Menlo Park, California, I became an Internet spy. This was easier than it sounds because I had a willing target. I had partnered with National Public Radio (NPR) tech correspondent Steve Henn for an experiment in Internet surveillance. For one week, while Henn researched a story, he allowed himself to be watched—acting as a stand-in, in effect, for everyone who uses Internet-connected devices. How much of our lives do we really reveal simply by going online? Henn let me into his Silicon Valley home and ushered me into his office with a cup of coffee. Waiting for me there was the key tool of my new trade: a metal-and-plastic box that resembled nothing more threatening than an unlabeled Wi-Fi router. This was the PwnPlug R2, a piece of professional penetration testing gear designed by Pwnie Express CTO Dave Porcello and his team and on loan to us for this project." -- source: http://bit.ly/1qtDETw The "PwnPlug R2" device runs a custom Debian distro based on Kali Linux: https://www.pwnieexpress.com/penetration-testing-vulnerability-assessment-p… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Open source equivalent of Mail Marshall
by chris 11 Jun '14

11 Jun '14

Hi all, Is there an equivalent of 'Mail Marshall' for Linux/FOSS? I am aware of clamav and spamassasin but have never configured them. Anyone care to recommend a preconfigured server for a corporate network. Cheers, Chris

3 3

Fwd: Last chance to register: Public lecture: Gaps and Opportunities in Cyber Security R&D
by Eric Light 11 Jun '14

11 Jun '14

Hi everyone, For those interested in the security space: The Institute of IT Professionals, in collaboration with The University of Waikato's Computer Science department and Fulbright, are hosting two international security experts for a pair of talks this month. Below is the summary of the first talk, happening next week - if you're keen for this please register ASAP! You can see the second talk, happening on the 24th, here: http://www.iitp.org.nz/events/waikato/943-Public_lecture_Tackling_cyber-sec… Eric -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es ---------- Forwarded message ---------- From: IITP Events <hello(a)iitp.org.nz> Date: Tue, Jun 10, 2014 at 1:49 PM Subject: Last chance to register: Public lecture: Gaps and Opportunities in Cyber Security R&D To: Eric Light <eric(a)ericlight.com> [image: IITP Header] <http://www.iitp.org.nz> Hi Eric, you're invited to the following IITP event: Public lecture: Gaps and Opportunities in Cyber Security R&D *Date:*June 17, 2014 6:00 pm - 8:00 pm*Venue:*The University of Waikato, Room S.1.02 (S Block, Room 1.02), Hamilton (Map to Venue <http://www.waikato.ac.nz/contacts/map/>)[ *More Info and Registration* <http://www.iitp.org.nz/events/waikato/942-Public_lecture_Gaps_and_Opportuni…> ] *Swords against Atomic Bombs - Fundamental Gaps and Opportunities in Cyber Security Research and Development* It is becoming clear that the cyber security industry is losing the battle against the deluge and sophistication of attacks. In the face of these challenges, few have considered the fundamental reasons why the cyber security industry is losing this battle. Even fewer have proposed game-changing solutions that address the key security gaps. In this talk, we take stock of what's the problem with the current cyber security landscape, and what we must urgently do to address them. The talk also introduces the Cyber Security Researchers of Waikato (CROW) and 'blue ocean' opportunities for both researchers and practitioners. About The Speaker *Dr Ryan Ko* is Head of the Cyber Security Researchers of Waikato (CROW) and Senior Lecturer with the Faculty of Computing and Mathematical Sciences at the University of Waikato, New Zealand. He established New Zealand's first Master of Cyber Security programme and dedicated academic cyber security research lab. He is also Advisory Board and Affiliate Faculty Member Informatics Research Institute (IRI)/ National Information Assurance Training and Education Center (NIATEC) Idaho State University, USA. Prior to joining the faculty he was a lead computer scientist with Hewlett-Packard Labs; his data security and data tracking inventions are implemented globally in HP security products and HP customers including the US Treasury, Singapore's G-Cloud and data centres in China and France. He also serves as Cloud Security Alliance (CSA)'s Asia Pacific Research Advisor and has been active with CSA since its beginning years and founded the CSA Cloud Vulnerabilities Working Group and the CSA Data Governance Working group - the first research working group led by an Asia Pacific chapter. IITP Public Lecture series in association with the University of Waikato This presentation is part of a free public lecture series from IITP and the University of Waikato. [image: Waik_Word_RGB_H.jpeg][image: CROW_header_logo.png] [image: 50th%20logo%20full%20colour%20white%20background.jpeg] Registration Details: IITP members and non-members may register for this event online below. Please register for catering purposes and to secure your place. ------------------------------ *Attendance Cost:* EveryoneFREE [ *More Info and Registration* <http://www.iitp.org.nz/events/waikato/942-Public_lecture_Gaps_and_Opportuni…> ] *To Unsubscribe: *You've been invited to this event because you're subscribed to one or more of IITP's Events Mailing Lists. If you'd prefer not to receive these notices please click here <http://www.iitp.org.nz/members/unsubscribe?7bdfbddbd9936b84559578b8ed9d0911…> to unsubscribe. © Copyright 2013, Institute of IT Professionals NZ Inc

1 0

Red Hat Enterprise Linux 7 Released
by Peter Reutemann 10 Jun '14

10 Jun '14

"Today, Red Hat unveiled Red Hat Enterprise Linux 7, with new features designed to meet both modern datacenter and next-generation IT requirements for cloud, Linux Containers, and big data. The new version includes Linux containers (LXC), which let Linux users easily create and manage system or application containers, improved MS Active Directory / Identity Management (IdM) integration, XFS as the default file system, scaling to 500 TB (additional file system choices such as btrfs, ext{3,4} and others are available), a new and improved installation experience, managing Linux servers with OpenLMI, enhancements to both NFS and GFS2, optimized network management, bandwidth, the use of KVM Virtualization technology and more. See the complete list of features here (PDF). CentOS 7 shouldn't be lagging too far behind due to recent cooperation between Red Hat and CentOS project." -- source: http://linux.slashdot.org/story/14/06/10/1815208 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Mesa 10.2 Improves Linux's Open-Source Graphics Drivers
by Peter Reutemann 08 Jun '14

08 Jun '14

"Mesa 10.2 was introduced this week as the new shining example of what open source graphics (and open source projects in general) are capable of achieving. The latest release of this often underrepresented open source graphics driver project has many new OpenGL and driver features including a number of new OpenGL 4 extensions. The reverse-engineered Freedreno driver now poses serious competition to Qualcomm's Adreno driver, an OpenMAX implementation was added for Radeon video encoding support, Intel Broadwell support now works better, the software rasterizer supports OpenGL 3.3, and many other changes are present." -- source: http://tech.slashdot.org/story/14/06/07/2219247 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

New OpenSSL Man-in-the-Middle Flaw Affects All Clients
by Peter Reutemann 05 Jun '14

05 Jun '14

'There is a new, remotely exploitable vulnerability in OpenSSL that could enable an attacker to intercept and decrypt traffic between vulnerable clients and servers. The flaw affects all versions of the OpenSSL client and versions 1.0.1 and 1.0.2-beta1 of the server software. The new vulnerability could only be exploited to decrypt traffic between a vulnerable client and a vulnerable server, and the attacker would need to have a man-in-the-middle position on a network in order to do so. That's not an insignificant set of conditions that must be present for a successful attack, but in the current environment, where open wireless networks are everywhere and many users connect to them without a second thought, gaining a MITM position is not an insurmountable hurdle. Researchers who have looked at the vulnerable piece of code say that it appears to have existed, nearly unchanged, in the OpenSSL source since 1998.' -- source: http://it.slashdot.org/story/14/06/05/1359208 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Testing 65 Different GPUs On Linux With Open Source Drivers
by Peter Reutemann 04 Jun '14

04 Jun '14

"How good are open source graphics drivers in 2014 given all the Linux gaming and desktop attention? Phoronix has tested 65 different GPUs using the latest open source drivers covering Intel HD Graphics, NVIDIA GeForce, AMD Radeon, and AMD FirePro hardware. Of the 65 GPUs tested, only 50 of them had good enough open source driver support for running OpenGL games and benchmarks. Across the NVIDIA and AMD hardware were several pages of caveats with different driver issues encountered on Linux 3.15 and Mesa 10.3 loaded on Ubuntu 14.04. Intel graphics on Linux were reliable but slow while AMD's open-source Linux support was recommended over the NVIDIA support that doesn't currently allow for suitable graphics card re-clocking. Similar tests are now being done with the proprietary Linux drivers." -- source: http://linux.slashdot.org/story/14/06/04/1822203 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

GnuTLS Flaw Leaves Many Linux Users Open To Attacks
by Peter Reutemann 03 Jun '14

03 Jun '14

'A new flaw has been discovered in the GnuTLS cryptographic library that ships with several popular Linux distributions and hundreds of software implementations. According to the bug report, "A malicious server could use this flaw to send an excessively long session id value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code." A patch is currently available, but it will take time for all of the software maintainers to implement it. A lengthy technical analysis is available. "There don't appear to be any obvious signs that an attack is under way, making it possible to exploit the vulnerability in surreptitious "drive-by" attacks. There are no reports that the vulnerability is actively being exploited in the wild."' -- source: http://linux.slashdot.org/story/14/06/03/1829251 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0