- wlug - list.wlug.org.nz

Shellshock Vulnerability Spreads to NAS Devices
by Peter Reutemann 02 Oct '14

02 Oct '14

"Shellshock, the vulnerability in the Bourne Again Shell (Bash), is taking a new twist and is now being actively exploited in network-attached storage (NAS) devices, according to a new report from FireEye." - source: http://bit.ly/1pJCII3 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Hacking USB Firmware
by Peter Reutemann 02 Oct '14

02 Oct '14

'Now the NSA isn't the only one who can hack your USB firmware: "In a talk at the Derbycon hacker conference in Louisville, Kentucky last week, researchers Adam Caudill and Brandon Wilson showed that they've reverse engineered the same USB firmware as Nohl's SR Labs, reproducing some of Nohl's BadUSB tricks. And unlike Nohl, the hacker pair has also published the code for those attacks on Github, raising the stakes for USB makers to either fix the problem or leave hundreds of millions of users vulnerable." Personally, I always thought it was insane that USB drives don't come with physical write-protect switches to keep them from being infected by malware.' -- source: http://hardware.slashdot.org/story/14/10/02/2154204 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Arducorder, Next Open Source Science Tricorder-like Device, Nears Completion
by Peter Reutemann 02 Oct '14

02 Oct '14

"The Arducorder Mini, an Arduino-compatible pocket-sized handheld sensing tool and the next in line of open source science tricorder-like devices designed by Dr. Peter Jansen, is nearing completion. Where the previous models have included about a dozen sensors spanning atmospheric, electromagnetic, and spatial readings, an exciting video of the new prototype shows this model includes sensors for spectroscopy, low-resolution thermal imaging, and radiation sensing. The development is open with the project build logs and most recent source schematics, board layouts, and firmware available on github. This project is an entry in the Hack a Day Prize for a trip to space." -- source: http://build.slashdot.org/story/14/09/30/2227221 Packs an amazing amount of sensors in such a small form factor! Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Security bug in Xen may have exposed Amazon, other cloud services
by Peter Reutemann 01 Oct '14

01 Oct '14

"The Xen Project has published a security advisory that could affect millions of virtualized servers running in Amazon’s cloud and other public hosting services. A flaw in the Xen hypervisor could allow a malicious fully virtualized server to read data about other virtualized systems running on the same physical hardware or the hypervisor hosting the virtual machine. The malicious system could also potentially crash the server hosting the virtual machines. A patch, which was privately disclosed last week under embargo, has been issued to correct the issue." -- source: http://bit.ly/1sNg89a Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Secure Your Linux Desktop and SSH Login Using Two Factor Google Authenticator
by Peter Reutemann 01 Oct '14

01 Oct '14

"Two factor authentication is increasingly becoming a strongly recommended way of protecting user accounts in web applications from attackers by requiring a second method of authentication in addition to the standard username and password pair. Although two factor authentication can encompass a wide range of techniques like biometrics or smart cards, the most commonly deployed technique in web applications is the one time password. If you have used applications like Gmail, you are probably familiar with the one time password generated by the Google Authenticator app that's available on iOS or Android devices. The algorithm used for the one time password in the Google Authenticator app is known as the Time-based One-Time Password (TOTP) algorithm. The TOTP algorithm is a standard algorithm approved by the IETF in (RFC 6238) totp-rfc. It is a little known fact that you can use the TOTP algorithm to secure your user accounts in Linux systems. This article will walk you through the steps necessary. While the exact commands will be for Fedora 20, the TOTP algorithm can be deployed to any Linux distro with a little modification." -- source: http://bit.ly/10lMmvM Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linux Foundation Announces Major Network Functions Virtualization Project
by Peter Reutemann 30 Sep '14

30 Sep '14

"The Linux Foundation this morning announced the latest addition to its family of major hosted open source initiatives: the Open Platform for NFV Project (OPNFV). Its mission is to develop and maintain a carrier-grade, integrated, open source reference platform for the telecom industry. Importantly, the thirty-eight founding members include not only cloud and service infrastructure vendors, but telecom service providers, developers and end users as well. The announcement of OPNFV highlights three of the most significant trends in IT: virtualization (the NFV part of the name refers to network function virtualization), moving software and services to the cloud, and collaboratively developing complex open source platforms in order to accelerate deployment of new business models while enabling interoperability across a wide range of products and services. The project is also significant for reflecting a growing recognition that open source projects need to incorporate open standards planning into their work programs from the beginning, rather than as an afterthought." -- source: http://linux.slashdot.org/story/14/09/30/1820245 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Adobe Photoshop Is Coming To Linux, Through Chromebooks
by Peter Reutemann 30 Sep '14

30 Sep '14

"Adobe is bringing the king of all photo editing software, Photoshop, to Linux-based Chrome OS. Chrome OS-powered devices, such as Chromebooks and Chromeboxes, already have a decent line-up of 'applications' that can work offline and eliminate the need of a traditional desktop computer. So far it sounds like great news. The bad news is that the offering is in its beta stage and is available only to the customers of the Creative Cloud Education program residing in the U.S. I have a full subscription of Creative Cloud for Photographers, and LightRoom, but even I can't join the program at the moment." -- source: http://linux.slashdot.org/story/14/09/30/1430240 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

LibreSSL: More Than 30 Days Later
by Peter Reutemann 30 Sep '14

30 Sep '14

"Ted Unangst has posted an update on LibreSSL development. "Joel and I have been working on a replacement API for OpenSSL, appropriately entitled ressl. Reimagined SSL is how I think of it. Our goals are consistency and simplicity. In particular, we answer the question 'What would the user like to do?' and not 'What does the TLS protocol allow the user to do?'. You can make a secure connection to a server. You can host a secure server. You can read and write some data over that connection." -- source: http://www.linux.com/news/software/applications/789692 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Improved Patch Tackles New Shellshock Bash Bug Attack Vectors
by Peter Reutemann 30 Sep '14

30 Sep '14

"System administrators who spent last week making sure their computers are patched against Shellshock, a critical vulnerability in the Bash Unix command-line interpreter, will have to install a new patch that addresses additional attack vectors." -- source: http://www.linux.com/news/enterprise/systems-management/789720 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Ubuntu Phones to Arrive By Year's End
by Peter Reutemann 29 Sep '14

29 Sep '14

"Ubuntu Touch for phones is now at manufacturing status, a major milestone for many people who wondered if Ubuntu phones would ever become market realities. Several months ago, rumors swirled that the first Ubuntu phones were delayed and wouldn’t appear until 2015, if at all, but this week news broke that we're likely to see phones by year's end." -- source: http://ostatic.com/blog/ubuntu-phones-to-arrive-by-years-end Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0