- wlug - list.wlug.org.nz

Lenovo Driver Goof Poses Security Risk for Users of 25 Notebook Models
by Peter Reutemann 11 Nov '22

11 Nov '22

'More than two dozen Lenovo notebook models are vulnerable to malicious hacks that disable the UEFI secure-boot process and then run unsigned UEFI apps or load bootloaders that permanently backdoor a device, researchers warned on Wednesday. From a report: At the same time that researchers from security firm ESET disclosed the vulnerabilities, the notebook maker released security updates for 25 models, including ThinkPads, Yoga Slims, and IdeaPads. Vulnerabilities that undermine the UEFI secure boot can be serious because they make it possible for attackers to install malicious firmware that survives multiple operating system reinstallations. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer's device firmware with its operating system. As the first piece of code to run when virtually any modern machine is turned on, it's the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove. Typical measures such as wiping the hard drive and reinstalling the OS have no meaningful impact because the UEFI infection will simply reinfect the computer afterward. ESET said the vulnerabilities -- tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432 -- "allow disabling UEFI Secure Boot or restoring factory default Secure Boot databases (incl. dbx): all simply from an OS." Secure boot uses databases to allow and deny mechanisms. The DBX database, in particular, stores cryptographic hashes of denied keys. Disabling or restoring default values in the databases makes it possible for an attacker to remove restrictions that would normally be in place.' -- source: https://it.slashdot.org/story/22/11/10/1610252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SPARK: A Competitor To Rust?
by Lawrence D'Oliveiro 09 Nov '22

09 Nov '22

Here’s another contender for a modern language that is low-level yet emphasizes minimization of bugs, to compete with the likes of Rust: it’s called SPARK <https://devclass.com/2022/11/08/spark-as-good-as-rust-for-safer-coding-adac…>. It’s not a completely new language, since according to the report it is a subset of Ada. The original Ada language came about in the 1980s out of a competition organized by the US Department of Defense, to create a language specifically designed for programming embedded and safety-critical systems. The most high-profile application of it that I know of is that the life-support systems on the International Space Station are written in Ada, and run on ancient (but well-tested) Intel 386 processors. So I would say that’s a good pedigree to start from.

1 0

The Linux Kernel Has Been Forcing Different Behavior For Processes Starting With 'X'
by Peter Reutemann 09 Nov '22

09 Nov '22

'"An ugly hack within the Linux kernel that has been in mainline for over three years has been called out," writes Phoronix's Michael Larabel. "Due to a buggy X.Org Server / xf86-video-modesetting DDX, the Linux kernel has been imposing different behavior on whether a process starts with 'X' and in turn disable the atomic mode-setting support." Linux security researcher and WireGuard creator, Jason Donenfeld, discovered the 'ugly code' within the kernel and commented on it via the kernel mailing list. "The commit to this kernel with the 'X' first character check was made back in September 2019," notes Larabel. "The 'good' news is that since then on user-space side back in 2019 the xf86-video-modesetting code went ahead and disabled atomic support by default. So technically if running an updated X.Org stack within the past three years, this kernel hack isn't necessary anymore since user-space is just then avoiding the atomic API."' -- source: https://linux.slashdot.org/story/22/11/08/2211244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE: Stopping The Windows/Super Key From Popping Up The App Menu
by Lawrence D'Oliveiro 07 Nov '22

07 Nov '22

I thought I had this disabled before, but KDE Plasma has this feature where you just need to press and release the Super key (or “Windows” key, if your keyboard has the proprietary logo on it), and the application menu will appear. It seems there is no GUI setting to disable this, but you can turn it off according to this <https://superuser.com/questions/1156130/kde-disable-super-l-windows-key-key…>. First, make the described edit to your KWin config file, in ~/.config/kwinrc, which you can do conveniently with kwriteconfig5 --file kwinrc --group ModifierOnlyShortcuts --key Meta "" Then either log out your GUI session and log in again, or try just restarting your window manager with kwin_x11 --replace & in some convenient terminal window. The writeup above doesn’t mention putting the “&” on the end, so KWin remains attached to that terminal session, which means you can’t use it for anything else ...

1 0

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

New Hampshire Set To Pilot Voting Machines That Use Open-Source Software
by Peter Reutemann 04 Nov '22

04 Nov '22

'According to The Record, New Hampshire will pilot a new kind of voting machine that will use open-source software to tally the votes. The Record reports: The software that runs voting machines is typically distributed in a kind of black box -- like a car with its hood sealed shut. Because the election industry in the U.S. is dominated by three companies -- Dominion, Election Systems & Software and Hart InterCivic -- the software that runs their machines is private. The companies consider it their intellectual property and that has given rise to a roster of unfounded conspiracy theories about elections and their fairness. New Hampshire's experiment with open-source software is meant to address exactly that. The software by its very design allows you to pop the hood, modify the code, make suggestions for how to make it better, and work with other people to make it run more smoothly. The thinking is, if voting machines run on software anyone can audit and run, it is less likely to give rise to allegations of vote rigging. The effort to make voting machines more transparent is the work of a group called VotingWorks. [...] On November 8, VotingWorks machines will be used in a real election in real time. New Hampshire is the second state to use the open-source machines after Mississippi first did so in 2019. Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H. Anyone who cares to will be able to see if the new machines recorded the votes correctly. The idea is to make clear there is nothing to hide. If someone is worried that a voting machine is programmed to flip a vote to their opponent, they can simply hire a computer expert to examine it and see, in real time. ' -- source: https://politics.slashdot.org/story/22/11/03/2155238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

iproute2 Docs
by Lawrence D'Oliveiro 04 Nov '22

04 Nov '22

The “ip” command, aka the “iproute2” suite, offers a huge amount of functionality for managing the Linux network stack. The initial man page, “man ip”, gives an overview, and (at least on my current system) ends with references to more: SEE ALSO ip-address(8), ip-addrlabel(8), ip-ioam(8), ip-l2tp(8), ip-link(8), ip-maddress(8), ip-monitor(8), ip-mptcp(8), ip-mroute(8), ip-neighbour(8), ip-netns(8), ip-ntable(8), ip-route(8), ip-rule(8), ip-stats(8) ip-tcp_metrics(8), ip-token(8), ip-tunnel(8), ip-vrf(8), ip-xfrm(8) IP Command reference ip-cref.ps That “ip-cref.ps” file doesn’t seem to be included in any Debian packages I can see. However, when I look in the /usr/share/man/man8 directory, I find a few more man pages not mentioned in the above list: ip-nexthop.8.gz ip-fou.8.gz ip-macsec.8.gz ip-gue.8.gz (symlink to ip-fou.8.gz) ip-netconf.8.gz ip-sr.8.gz That “ip fou”/“ip gue” command lets you tunnel arbitrary IP protocols over a pair of UDP ports. The home page for online docs is at <https://wiki.linuxfoundation.org/networking/iproute2>. Among the links is this nice step-by-step intro to doing some useful things with it <https://lartc.org/howto/lartc.iproute2.html>.

1 0

The Godot Game Engine Now Has Its Own Foundation
by Peter Reutemann 04 Nov '22

04 Nov '22

'The Godot Engine now has its own foundation to continue funding themselves. Previously, they teamed up with the Software Freedom Conservancy to handle fiscal sponsorship duties. Phoronix reports: The Godot engine developers and Software Freedom Conservancy mutually agreed to move the open-source game engine project to its own foundation. The Godot Foundation has been setup in the Netherlands as its own organization modeled after the policies of the SFC. The Godot Foundation is to help this game engine achieve its next level of growth and project a stronger image for the project. "We have just started the process of moving to the Foundation," writes Godot Engine lead developer, Juan Linietsky, in a blog post. "For now all of Godot's funding and contractors are still managed by the SFC. The SFC will gradually reduce its work for Godot and the new foundation will slowly ramp up. Stay tuned for announcements in the future as we finalize the Foundation's organizational structure and officially begin operations." More details can be found via the Godot Engine blog.' -- source: https://news.slashdot.org/story/22/11/02/2045240 Anyone keen to showcase this engine at one of our meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Ad For GIMP.org Served Info-Stealing Malware Via Lookalike
by Peter Reutemann 03 Nov '22

03 Nov '22

'A report from BleepingComputer, written by Ax Sharma: Searching for 'GIMP' on Google as recently as last week would show visitors an ad for 'GIMP.org,' the official website of the well known graphics editor, GNU Image Manipulation Program. This ad would appear to be legitimate as it'd state 'GIMP.org' as the destination domain. But clicking on it drove visitors to a lookalike phishing website that provided them with a 700 MB executable disguised as GIMP which, in reality, was malware. Reddit user ZachIngram04 earlier shared the development stating that the ad previously took users to a Dropbox URL to serve malware, but was soon "replaced with an even more malicious one" which employed a fake replica website 'gilimp.org' to serve malware. BleepingCompuer observed another domain 'gimp.monster' related to this campaign. To pass off the trojanized executable as GIMP in a believable manner to the user, the threat actor artificially inflated the malware, that is otherwise under 5 MB in size, to 700 MB by a simple technique known as binary padding. It still isn't clear if this instance was a slip up caused by a potential bug in Google Ad Manager that allowed malvertising.' -- source: https://tech.slashdot.org/story/22/11/02/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mastodon Gained 70,000 Users After Musk's Twitter Takeover
by Peter Reutemann 03 Nov '22

03 Nov '22

'"More than 70,000 users joined Mastodon on the day after Musk's Twitter takeover announcement," writes Slashdot reader votsalo. "Mastodon is a six-year-old decentralized social media platform that uses 'federated' servers." The Guardian's Wilfred Chan writes: I joined Mastodon this week, and it took a few hours just to master its new vocabulary. Some of it is a little silly-sounding: instead of tweets, you have "toots". Things get trickier after that. Mastodon is not a single website but a network of thousands of websites called "instances", also called servers. These servers are "federated", which means they are run by different entities but can still communicate with each other without needing to go through a central system. And the space they all exist in is called the "fediverse," which some savvy tooters call "the Fedi." When you sign up for Mastodon, the first thing you do is choose a server. There are general-purpose ones, such as mastodon.social, as well as ones aimed at interest groups, such as kpop.social or linuxrocks.online. There are also joke servers like dolphin.town, where the only thing users are allowed to post is the letter "e". The server becomes part of your username (for example, wilfred(a)kpop.social), and the toots you see on your feed are toots from your server-mates, rather than from the entire fediverse. But you're also free to toot at people from other servers and even "boost" their public toots on to your feed. That's how Mastodon creates a unified global experience without being controlled by one entity, said Eugen Rochko, Mastodon's Germany-based founder and lead developer. "The servers are service providers, like Hotmail and Gmail are for email. It doesn't mean that the different servers are isolated from each other, like old school forums," he said. "Having just one account allows you to follow and interact with anyone in this global decentralized social network." But Mastodon's model comes with its own risks. If the server you join disappears, you could lose everything, just like if your email provider shut down. A Mastodon server admin also has ultimate control over everything you do: if for some reason the owner of kpop.social doesn't like that I boosted a toot from dolphin.town, they could remove it or even "defederate" the server, which would block all dolphin toots from the k-pop server completely. A server admin could also snoop on my private toots if they wanted to -- or delete my account for any reason. While Mastadon's 70,000 jump in users sounds impressive, it's "still a drop in a bucket compared with Twitter's reported 450 million daily active users," says Chan. The decentralized software also remains difficult for many people to use. According to TechCrunch, Mastadon says it has "gained 123,562 new users as of October 27, 2022 and now has 528,607 active users on the network as of October 31, 2022."' -- source: https://tech.slashdot.org/story/22/11/02/1958241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0