- wlug - list.wlug.org.nz

CERT To Be Merged Into GCSB?
by Lawrence D'Oliveiro 10 Jul '23

10 Jul '23

Couple of local items here <https://www.theregister.com/2023/07/10/asia_tech_news_roundup/> that I hadn’t heard of before: Andrew Little is considering bringing CERT under the control of the Government Communications Security Bureau, and also Microsoft is raising cloud prices, though not those for on-prem products, in NZ.

1 0

Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking
by Peter Reutemann 10 Jul '23

10 Jul '23

'The maintainers of the open source software that powers the Mastodon social network published a security update on Thursday that patches a critical vulnerability making it possible for hackers to backdoor the servers that push content to individual users. Mastodon is based on a federated model. The federation comprises thousands of separate servers known as "instances." Individual users create an account with one of the instances, which in turn exchange content to and from users of other instances. To date, Mastodon has more than 12,000 instances and 14.5 million users, according to fedidb.org/, a site that tracks statistics related to Mastodon. A critical bug tracked as CVE-2023-36460 was one of two vulnerabilities rated as critical that were fixed on Thursday. In all, Mastodon on Thursday patched five vulnerabilities. So far, Mastodon gGmbH, the nonprofit that maintains the software instances uses to operate the social network, has released few details about CVE-2023-36460 other than to describe it as an “arbitrary file creation through media attachments” flaw. “Using carefully crafted media files, attackers can cause Mastodon's media processing code to create arbitrary files at any location," Mastodon said. "This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution.” In a Mastodon post, independent security researcher Kevin Beaumont went a step further, writing that exploiting the vulnerability allowed someone “to send a toot which makes a webshell on instances that process said toot.” He coined the name #TootRoot because user posts, known as toots, allowed hackers to potentially gain root access to instances.' -- source: https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-v… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discovered a New Linux Kernel 'StackRot' Privilege Escalation Vulnerability
by Peter Reutemann 10 Jul '23

10 Jul '23

'Wednesday Greg Kroah-Hartman announced the release of the 6.4.2 kernel. "All users of the 6.4 kernel series must upgrade." The Hacker News reports: Details have emerged about a newly identified security flaw in the Linux kernel that could allow a user to gain elevated privileges on a target host. Dubbed StackRot (CVE-2023-3269, CVSS score: 7.8), the flaw impacts Linux versions 6.1 through 6.4. There is no evidence that the shortcoming has been exploited in the wild to date. "As StackRot is a Linux kernel vulnerability found in the memory management subsystem, it affects almost all kernel configurations and requires minimal capabilities to trigger," Peking University security researcher Ruihan Li said. "However, it should be noted that maple nodes are freed using RCU callbacks, delaying the actual memory deallocation until after the RCU grace period. Consequently, exploiting this vulnerability is considered challenging." Following responsible disclosure on June 15, 2023, it has been addressed in stable versions 6.1.37, 6.3.11, and 6.4.1 as of July 1, 2023, after a two-week effort led by Linus Torvalds. A proof-of-concept (PoC) exploit and additional technical specifics about the bug are expected to be made public by the end of the month. ZDNet points out that Linux 6.4 "offers improved hardware enablement for ARM boards" and does a better job with the power demands of Steam Deck gaming devices. And "On the software side, the Linux 6.4 release includes more upstreamed Rust code. We're getting ever closer to full in-kernel Rust language support." The Register also notes that Linux 6.4 also includes "the beginnings of support for Apple's M2 processors," along with support for hibernation of RISC-V CPUs, "a likely presage to such silicon powering laptop computers."' -- source: https://linux.slashdot.org/story/23/07/09/0131210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Undocumented Raspberry Pi
by Lawrence D'Oliveiro 10 Jul '23

10 Jul '23

This little project <https://github.com/cariboulabs/cariboulite> for an SDR (Software-Defined Radio) addon card for a Raspberry Pi popped up on my feed. What caught my eye was that it made use of something called “SMI” (the “Secondary Memory Interface”) which exists on the GPIO connector but is not properly documented. There is a link to this blog post <https://iosoft.blog/2020/07/16/raspberry-pi-smi/> in which the writer reports some investigations into the details of this interface. Speed tests in that article give results of 25 16-bit samples per second or more, depending on the Raspberry Pi model; though note there are some odd glitches sometimes, as well as high bus contention (clearly pushing the Pi hardware to its limits). Maybe this is why the interface is not documented: because it is not considered production-ready ...

1 0

AMD CPU Use Among Linux Gamers Approaching 70% Marketshare
by Peter Reutemann 05 Jul '23

05 Jul '23

'The June Steam Survey results show that AMD CPUs have gained significant popularity among Linux gamers, with a market share of 67% -- a remarkable 7% increase from the previous month. Phoronix reports: In part that's due to the Steam Deck being powered by an AMD SoC but it's been a trend building for some time of AMD's increasing Ryzen CPU popularity among Linux users to their open-source driver work and continuing to build more good will with the community. In comparison, last June the AMD CPU Linux gaming marketshare came in at 45% while Intel was at 54%. Or at the start of 2023, AMD CPUs were at a 55% marketshare among Linux gamers. Or if going back six years, AMD CPU use among Linux gamers was a mere 18% during the early Ryzen days. It's also the direct opposite on the Windows side. When looking at the Steam Survey results for June limited to Windows, there Intel has a 68% marketshare to AMD at 32%. Beyond the Steam Deck, it's looking like AMD's efforts around open-source drivers, AMD expanding their Linux client (Ryzen) development efforts over the past two years, promises around OpenSIL, and other efforts commonly covered on Phoronix are paying off for AMD in wooing over their Linux gaming customer base.' -- source: https://hardware.slashdot.org/story/23/07/03/2233208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 115 Released
by Peter Reutemann 05 Jul '23

05 Jul '23

'Today, Mozilla released Firefox 115. Changes most visible to users include: * Hardware video decoding is now enabled for Intel GPUs on Linux.. * Migrating from another browser? Now you can bring over payment methods you've saved in Chrome-based browsers to Firefox. * The Tab Manager dropdown now features close buttons, so you can close tabs more quickly. * The Firefox for Android address bar's new search button allows you to easily switch between search engines and search your bookmarks and browsing history. * We've refreshed and streamlined the user interface for importing data in from other browsers. * Users without platform support for H264 video decoding can now fallback to Cisco's OpenH264 plugin for playback. But the most important feature is that this release is the new ESR. Why this is important? y'all ask, well: * Many a "downstream" project depends on Firefox ESR, for example the famous email client Thunderbird, or KaiOS (a mobile OS very popular in India, SE Asia, Africa and LatAm), so, for better or worse, whatever made it to (or is lacking from) this version of the browser, those projects have to use for the next year. * Firefox ESR is the default browser of many distros, like Debian and Kali Linux, so, whatever made it to this version will be there for next year, ditto to whatever is lacking. * If you are on old -- unsupported OSs, like Windows 7, 8-8.1 or MacOS 10.14 (Mojave, the last MacOS with support for 32 Bit Apps), 10.13 or 10.12 you will automatically be migrated to Firefox ESR, so this will be your browser until Sept. 2024.' -- source: https://news.slashdot.org/story/23/07/04/189258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation's Yocto Project Expands LTS to 4 Years
by Peter Reutemann 03 Jul '23

03 Jul '23

'Wikipedia defines the Yocto Project as "a Linux Foundation collaborative open source project whose goal is to produce tools and processes that enable the creation of Linux distributions for embedded and IoT software that are independent of the underlying architecture of the embedded hardware." This week the Linux Foundation shared an update on the 12-year-old Yocto Project: In an effort to support the community, The Yocto Project announced the first Long Term Support (LTS) release in October 2020. Today, we are delighted to announce that we are expanding the LTS release and extending the lifecycle from 2 to 4 years as standard. The continued growth of the Yocto Project coincides with the welcomed addition of Exein as a Platinum Member, joining AMD/Xilinx, Arm, AWS, BMW Group, Cisco, Comcast, Intel, Meta and WindRiver. As a Member, Exein brings its embedded security expertise across billions of devices to the core of the Yocto Project... "The Yocto Project has been at the forefront of OS technologies for over a decade," said Andrew Wafaa, Yocto Project Chairperson. "The adaptability and variety of the tooling provided are clearly making a difference to the community. We are delighted to welcome Exein as a member as their knowledge and experience in providing secure Yocto Project based builds to customers will enable us to adapt to the modern landscape being set by the US Digital Strategy and the EU Cyber Resilience Act." "We're extremely excited to become a Platinum Partner of the Yocto Project," said Gianni Cuozzo, founder and CEO of Exein. "The Yocto Project is the most important project in the embedded Linux space, powering billions of devices every year. We take great pride in contributing our extensive knowledge and expertise in embedded security to foster a future that is both enhanced and secure for Yocto-powered devices. We are dedicated to supporting the growth of the Yocto Project as a whole, aiming to improve its support for modern languages like Rust, and assist developers and OEMs in aligning with the goals outlined in the EU Cyber Resilience Act." ' -- source: https://linux.slashdot.org/story/23/07/01/0346241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave aims to curb practice of websites that port scan visitors
by Peter Reutemann 30 Jun '23

30 Jun '23

'The Brave browser will take action against websites that snoop on visitors by scanning their open Internet ports or accessing other network resources that can expose personal information. Starting in version 1.54, Brave will automatically block website port scanning, a practice that a surprisingly large number of sites were found engaging in a few years ago. According to this list compiled in 2021 by a researcher who goes by the handle G666g1e, 744 websites scanned visitors’ ports, most or all without providing notice or seeking permission in advance. eBay, Chick-fil-A, Best Buy, Kroger, and Macy's were among the offending websites.' -- source: https://arstechnica.com/security/2023/06/brave-will-soon-control-which-site… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Comprehensive Analysis of the GPL Issues With the Red Hat Enterprise Linux (RHEL) Business Mode
by Peter Reutemann 30 Jun '23

30 Jun '23

'For approximately twenty years, Red Hat (now a fully owned subsidiary of IBM) has experimented with building a business model for operating system deployment and distribution that looks, feels, and acts like a proprietary one, but nonetheless complies with the GPL and other standard copyleft terms. Software rights activists, including SFC, have spent decades talking to Red Hat and its attorneys about how the Red Hat Enterprise Linux (RHEL) business model courts disaster and is actively unfriendly to community-oriented Free and Open Source Software (FOSS). These pleadings, discussions, and encouragements have, as far as we can tell, been heard and seriously listened to by key members of Red Hat's legal and OSPO departments, and even by key C-level executives, but they have ultimately been rejected and ignored — sometimes even with a “fine, then sue us for GPL violations” attitude. Activists have found this discussion frustrating, but kept the nature and tenure of these discussions as an “open secret” until now because we all had hoped that Red Hat's behavior would improve. Recent events show that the behavior has simply gotten worse, and is likely to get even worse.' -- source: https://sfconservancy.org/blog/2023/jun/23/rhel-gpl-analysis/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Potted History Of 60 Years Of Computer Networking
by Lawrence D'Oliveiro 29 Jun '23

29 Jun '23

These guys, Larry Peterson and Bruce Davie, have done a whole series of open-source books all around the common theme of “A Systems Approach”. Here <https://www.theregister.com/2023/06/28/60_years_of_networking/> one of them offers a summary of the origins of the Internet, going back to the invention of packet switching and “best effort” delivery, and how that turned out to be such an important change from the traditional telephone network. He also takes the credit/blame for a long-standing myth about the Internet: I feel obligated to point out that there is no mention in this paper of the internet being designed to withstand nuclear attack. Unfortunately, I was responsible for perpetuating that misconception in an early edition of Computer Networks: A Systems Approach. Leiner et al debunk this myth and explain its origins in their paper, but it’s a remarkably persistent one. “[C]ontinue despite loss of networks or gateways” is as close as it gets. But now, cracks are starting to show in the trend toward centralization of popular Internet services. Not only is the “Fediverse” providing alternatives to Twitter and Facebook, but it is now also offering choices to those fed up with recent developments at Reddit, as well.

1 0