- wlug - list.wlug.org.nz

Linux Tries To Dump Windows' Notoriously Insecure RNDIS Protocol
by Peter Reutemann 05 Oct '23

05 Oct '23

'ZDNet: Microsoft's proprietary protocol, Remote Network Driver Interface Specification (RNDIS), started with a good idea. It would enable hardware vendors to add networking support to USB devices without having to build them from scratch. There was only one little problem. RNDIS has no security to speak of. As Greg Kroah-Hartman, the Linux Foundation fellow responsible for stable Linux kernel releases, wrote in November 2022 on the Linux Kernel Mailing List (LKML), "The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on any system that uses it with untrusted hosts or devices. Because the protocol is impossible to make secure, just disable all RNDIS drivers to prevent anyone from using them again." He added, in another message, "The protocol was never designed to be used with untrusted devices. It was created, and we implemented support for it, when we trusted USB devices that we plugged into our systems, AND we trusted the systems we plugged our USB devices into." That's no longer the case. Kroah-Hartman concluded, "Today, with untrusted hosts and devices, it's time just to retire this protocol. As I mentioned in the patch comments, Android disabled this many years ago in their devices, with no loss of functionality." [...] But now, sick and tired of having a built-in Windows security exploit in Linux, Kroah-Hartman has decided that enough was enough. He's disabled all the RNDIS protocol drivers in Linux's Git repository. That means that while the RNDIS code is still in the Linux kernel, if you try to build Linux using this new patch, all your RNDIS drivers will be broken and won't build. This is one step short of purging RNDIS from Linux.' -- source: https://tech.slashdot.org/story/23/10/04/2119243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerabilities in Supermicro BMCs could allow for unkillable server rootkits
by Peter Reutemann 05 Oct '23

05 Oct '23

'If your organization uses servers that are equipped with baseboard management controllers from Supermicro, it may be time, once again, to patch seven high-severity vulnerabilities that attackers could exploit to gain control of them. And sorry, but the fixes must be installed manually. Typically abbreviated as BMCs, baseboard management controllers are small chips that are soldered onto the motherboard of servers inside data centers. Administrators rely on these powerful controllers for various remote management capabilities, including installing updates, monitoring temperatures and setting fan speeds accordingly, and reflashing the UEFI system firmware that allows servers to load their operating systems during reboots. BMCs provide these capabilities and more, even when the servers they’re connected to are turned off. The potential for vulnerabilities in BMCs to be exploited and used to take control of servers hasn’t been lost on hackers. In 2021, hackers exploited a vulnerability in BMCs from HP Enterprise and installed a custom rootkit, researchers from Amnpardaz, a security firm in Iran, reported that year. ILObleed, as the researchers named the rootkit, hid inside the iLO, a module in HPE BMCs that’s short for Integrated Lights-Out. ILObleed was programmed to destroy data stored on disk. If admins reinstalled the operating system, iLObleed would remain intact and reactivate the disk-wiping attack repeatedly. The unknown attackers responsible took control of the BMCs by exploiting a vulnerability HPE had fixed four years earlier. In June, the National Security Agency urged admins to follow guidance to prevent such incidents.' -- source: https://arstechnica.com/security/2023/10/vulnerabilities-in-supermicro-bmcs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 14 officially releases for Pixel phones
by Peter Reutemann 05 Oct '23

05 Oct '23

'Android 14 is out today, along with a new Pixel phone. The OS is shipping to supported Pixel devices now, which means the Pixel 4a (5G) and every variant of the Pixel 5, 6, and 7, plus the Fold and Tablet. The big feature this year is a somewhat customizable home screen. You can pick from several different lock screen clock styles and customize the two bottom app shortcuts. This feels like a response to iOS 16's lock screen widgets (a feature Android used to have back in the 4.2 days) but not nearly as customizable. It's honestly hard to highlight a second Android 14 feature because this is one of the smallest Android releases ever. The first feature Google mentions in its blog post is a new wallpaper picker. On the Pixel 8, Android now has a built-in text-to-image AI wallpaper maker, presumably a feature that lets the Android team adhere to Google's "mandatory AI" company mandate. There's also a new monochrome theme if you're tired of all those "Material You" colors. Next up, we have... a redesigned battery charging indicator in the status bar? Updates to Android's runtime? You can make the screen and camera LED flash when a notification comes in. There's Ultra HDR image support, a sharable "Health Connect" data repository for fitness apps, and that phone-as-PC-webcam feature is launching.' -- source: https://arstechnica.com/gadgets/2023/10/android-14-officially-releases-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Shift Happens: The History Of The Typewriter/Computer Keyboard
by Lawrence D'Oliveiro 04 Oct '23

04 Oct '23

Everything you always wanted to know about typing keyboards, but were afraid to ask, has now been compiled into a two-volume work of over 1200 pages, which is available for preorder <https://arstechnica.com/culture/2023/10/shift-happens-is-a-beautifully-desi…>. Coincidentally or not, this year is also the 150th anniversary of the QWERTY keyboard layout. Did you know that, back in the latter 19th century, there was a battle over whether it was better to have fewer typing keys with more shift modifier keys, or to give more characters their own keys and use fewer shifts? The question was seemingly settled, not by any issue of technical superiority one way or the other, but just because models with fewer keys in total were popular in the marketplace for other reasons. But what was the significance of the key with the three dots on it on the first-ever typewriter with a proper QWERTY keyboard?

1 0

shellcheck
by Peter Reutemann 04 Oct '23

04 Oct '23

Hi everyone Something useful I came across the other day: https://www.shellcheck.net/ finds bugs in your shell scripts. You can cabal, apt, dnf, pkg or brew install it locally right now. The above website lets you paste and analyze scripts, if you want to give it a spin. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Lichee Pi 4A: Serious RISC-V Desktop Computing
by Lawrence D'Oliveiro 02 Oct '23

02 Oct '23

This video on Christopher Barnatt’s “Explaining Computers” channel <https://www.youtube.com/watch?v=1apoFXZ9ad8> just came across my feed. It’s an unboxing and initial review of a Sipeed Lichee Pi 4A, a RISC-V-based rival to the Raspberry Pi. Seems the RISC-V desktop ecosystem is approaching maturity rapidly; he was able to boot up the preinstalled Debian system and run included apps like LibreOffice, GIMP and Chromium just fine (albeit with some audio/video performance hiccups in the last one). He says in the video that he was going to spend a week trying to do all his computing on RISC-V machines, with a report on the results due out on Sunday UK time (I suppose Monday our time).

1 2

Vulnerabilities In Exim MTA
by Lawrence D'Oliveiro 30 Sep '23

30 Sep '23

This article <https://arstechnica.com/security/2023/09/critical-vulnerabilities-in-exim-t…> reports on six different security vulnerabilities in the Exim mail transfer agent (MTA), with uncertain status on their fixes. It seems like patches for three of them are available, but only in a private repo, with no clarification of who has access to this repo. Seems like there has been poor communication between Zero Day Initiative (the group that discovered the vulnerabilities) and the Exim project, going back over a year, on these issues. An MTA is the piece of software that receives mail from other machines for users on the local machine (or on other, related machines that it is responsible for), and also forwards mail sent from local users, destined for users on other machines. Exim is the default MTA you get on a Debian installation, if you don’t choose something else (e.g. Postfix). Not sure about Debian derivatives.

1 0

Raspberry Pi 5
by Lawrence D'Oliveiro 28 Sep '23

28 Sep '23

Just heard about the new-generation Raspberry Pi. Here’s a video about a prerelease unit <https://www.youtube.com/watch?v=9hYfQ7bRgZg> which I haven’t even watched yet.

1 0

Linux Interop Is Maturing Fast… Thanks To A Games Console
by Lawrence D'Oliveiro 28 Sep '23

28 Sep '23

Interesting report <https://www.theregister.com/2023/09/27/osseu_steam_os_3/> from the recent European Open Source Summit, about the work being done at Valve and others to improve the ability of the Linux-based Steam Deck handheld console to play games written for Microsoft Windows. And not just to have them playable, but to have them run well, with performance comparable to Microsoft Windows machines. The result, so far, is thousands of games that are usable on the Steam Deck. As a proportion of the total number of games, if I interpret the numbers on the protondb.com home page correctly, that’s 60%—or at least, 60% of games tried by those who submitted reports to the compatibility database. Which is a pretty respectable number. Not enough for world domination yet, but enough to keep the Steam Deck selling, by all accounts. Seems like issues with graphics APIs are not the main problem any more. Now there is a new one: thread/process communication/synchronization primitives. Windows doesn’t use the POSIX/Linux ones, it has a whole set of its own ones, with their own peculiar behaviours. The WINE folks have made a valiant effort to map these onto Linux APIs, but their compatibility layer cannot avoid becoming a performance bottleneck, and it appears this has become a problem for a lot of games. So now there are proposals to add new features to the Linux kernel specifically to make it easier to emulate these idiosyncratic Windows APIs.

1 0

Google quietly corrects previously submitted disclosure for critical webp 0-day
by Peter Reutemann 27 Sep '23

27 Sep '23

'Google has quietly resubmitted a disclosure of a critical code-execution vulnerability affecting thousands of individual apps and software frameworks after its previous submission left readers with the mistaken impression that the threat affected only the Chrome browser. The vulnerability originates in the libwebp code library, which Google created in 2010 for rendering images in webp, a then new format that resulted in files that were up to 26 percent smaller as compared to PNG images. Libwebp is incorporated into just about every app, operating system, or other code library that renders webp images, most notably the Electron framework used in Chrome and many other apps that run on both desktop and mobile devices. Two weeks ago, Google issued a security advisory for what it said was a heap buffer overflow in WebP in Chrome. Google’s formal description, tracked as CVE-2023-4863, scoped the affected vendor as “Google” and the software affected as “Chrome,” even though any code that used libwebp was vulnerable. Critics warned that Google’s failure to note that thousands of other pieces of code were also vulnerable would result in unnecessary delays in patching the vulnerability, which allows attackers to execute malicious code when users do nothing more than view a booby-trapped webp image. On Monday, Google submitted a new disclosure that’s tracked as CVE-2023-5129. The new entry correctly lists libwebp as the affected vendor and affected software. It also bumps up the severity rating of the vulnerability, from 8.8 out of a possible 10 to 10.' -- source: https://arstechnica.com/security/2023/09/google-quietly-corrects-previously… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0