- wlug - University of Waikato Mail Lists

Scheme-Flooding Browser Attack
by Lawrence D'Oliveiro 15 May '21

15 May '21

A company that makes a browser-fingerprinting library (ostensibly for fraud prevention) claims to have found <https://www.theregister.com/2021/05/14/browser_fingerprinting_flaw/> a (admittedly fiddly and not entirely reliable) way to uniquely fingerprint your machine even though you might be using a range of different browsers. This is done by trying to access custom URL schemes as installed by various custom apps, since the presence of these apps is independent of which browser you might be using. So I tried their schemeflood.com proof-of-concept site, it churned away for a few seconds, with a little extra window flickering at the bottom, then I got a message saying “The clearkey plugin has crashed”. It also showed me the identifier it computed for me, which was “0FVVVV”, based on “0 applications you have installed ... out of 24 applications in our database”. Apparently that’s only been seen 1471 times out of 17496 tests so far, which makes it “91.59% unique”.

1 0

The Stats On Microsoft’s Azure Data Centre Switch Failures
by Lawrence D'Oliveiro 13 May '21

13 May '21

Microsoft has put out a paper <https://www.nextplatform.com/2021/05/12/microsoft-does-the-math-on-azure-da…> detailing its experiences with the reliability of various vendors’ switches within its Azure data centres. It has a total of over 180,000 switches, and many of them are running “SONiC”, which is a Microsoft-developed Linux variant as an alternative to the vendors’ own proprietary switch OSes. The adoption of SONiC made a major difference to the reliability of the switches: ... in the aggregate, the switches in the Azure network had a 98 percent uptime during those three months, and if Microsoft moved to SONiC on all of its machines, that would boost that to around 99 percent. And if Microsoft is not doing that, we suspect that SONiC has some scale and performance issues. In the future we may be writing about how Microsoft tossed out all other NOSes, but that is not what is happening now, and we suspect for good reasons.

2 1

Google Says Docs Will Now Use Canvas Based Rendering, Warns Impact on Some Chrome Extensions
by Peter Reutemann 13 May '21

13 May '21

'Google, making the announcement in a blog post: We're updating the way Google Docs renders documents. Over the course of the next several months, we'll be migrating the underlying technical implementation of Docs from the current HTML-based rendering approach to a canvas-based approach to improve performance and improve consistency in how content appears across different platforms. We don't expect this change to impact the functionality of the features in Docs. However, this may impact some Chrome extensions, where they may no longer work as intended. Some Chrome extensions rely on the way the backend of a Google Doc is structured or specific bits of HTML to function properly. By moving away from HTML-based rendering to a canvas-based rendering, some Chrome extensions may not function as intended on docs.google.com and may need to be updated. Admins should review the current extensions deployed in their organization. [...] If you are building your own integrations with Google Docs, we recommend using Google Workspace Add-ons framework, which uses the supported Workspace APIs and integration points. This will help ensure there will be less work in the future to support periodic UI implementation changes to Docs.' -- source: https://tech.slashdot.org/story/21/05/12/165216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft To Bring eBPF To Windows
by Lawrence D'Oliveiro 12 May '21

12 May '21

eBPF (Extended Berkeley Packet Filter) is a programmable, high-performance packet-filtering engine built into the Linux kernel, into which you can load custom programs for controlling and monitoring the behaviour of the network stack. Now Microsoft wants to bring some of the same networking goodness to Windows <https://www.theregister.com/2021/05/11/microsoft_linux_ebpf/>: Microsoft, having force fed Windows with Linux supplements in recent years, has moved on to embracing and extending Linux tooling. eBPF programs have proven useful on Linux for denial-of-service defense and system observability. And since there's been interest in adapting the technology to other operating systems, Microsoft has decided to give the software a shot at Windows. Fans of the well-known “Three Es” might note that the platform being embraced and extended here is Windows.

1 1

Quick, Patch Your Universal Turing Machines
by Lawrence D'Oliveiro 11 May '21

11 May '21

A researcher has found a security vulnerability in a Universal Turing Machine (UTM) design originally conceived by computer scientist Marvin Minsky in 1967. A UTM is a mathematical abstraction of a computer, designed for studying fundamental theoretical questions such as what sorts of problem are or are not computable. Nobody would ever implement a real machine that worked like a UTM. Or would they? The vuln has even been given its own CVE ID. Though the page does say NOTE: the discoverer states "this vulnerability has no real-world implications." <https://www.theregister.com/2021/05/11/turing_machine_0day_no_patch_availab…>

1 0

Linus Torvalds Weighs in on Commercial Users of Open Source Code
by Peter Reutemann 11 May '21

11 May '21

'This week Linus Torvalds continued a long email interview with Jeremy Andrews, founding partner/CEO of Tag1 (a global technology consulting firm and the second all-time leading contributor to Drupal). In the first part Torvalds had discussed everything from Apple's ARM64 chips and Rust drivers, to his own Fedora-based home work environment — and reflections on the early days of Linux. But the second part offers some deeper insight into the way Torvalds thinks, some personal insight, what he'd share with other project maintainers — and some thoughts on getting corporations to contribute to open source development: While open source has been hugely successful, many of the biggest users, for example corporations, do nothing or little to support or contribute back to the very open source projects they rely on. Even developers of surprisingly large and successful projects (if measured by number of users) can be lucky to earn enough to buy coffee for the week. Do you think this is something that can be solved? Is the open source model sustainable? Linus Torvalds: I really don't have an answer to this, and for some reason the kernel has always avoided the problem. Yes, there are companies that are pure "users" of Linux, but they still end up wanting support, so they then rely on contractors or Linux distributions, and those obviously then end up as one of the big sources of kernel developer jobs. And a fair number of big tech companies that use the kernel end up actively participating in the development process. Sometimes they end up doing a lot of internal work and not being great at feeding things back upstream (I won't name names, and some of them really are trying to do better), but it's actually very encouraging how many big companies are very openly involved with upstream kernel development, and are major parts of the community. So for some reason, the kernel development community has been pretty successful about integrating with all the commercial interests. Of course, some of that has been very much conscious: Linux has very much always been open to commercial users, and I very consciously avoided the whole anti-corporate mindset that you can most definitely find in some of the "Free Software" groups. I think the GPLv2 is a great license, but at the same time I've been very much against some of the more extreme forms of "Free Software", and I — and Linux — was very much part of the whole rebranding to use "Open Source". Because frankly, some of the almost religious overtones of rms and the FSF were just nutty, and a certain portion of the community was actively driving commercial use away. And I say that as somebody who has always been wary of being too tainted by commercial interests... I do think that some projects may have shot themselves in the foot by being a bit too anti-commercial, and made it really hard for companies to participate... But is it sustainable? Yes. I'm personally 100% convinced that not only is open source sustainable, but for complex technical issues you really need open source simply because the problem space ends up being too complex to manage inside one single company. Even a big and competent tech company. But it does require a certain openness on both sides. Not all companies will be good partners, and some developers don't necessarily want to work with big companies. In the interview Torvalds also thanks the generous education system in Finland, and describes what it was like moving from Finland to America. And as for how long he'll continue working on Linux, Torvalds says, "I do enjoy what I do, and as long as I feel I'm actually helping the project, I'll be around... "in the end, I really enjoy what I do. I'd be bored to tears without kernel development."' -- source: https://linux.slashdot.org/story/21/05/10/0148252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Security researcher successfully jailbreaks an Apple AirTag
by Peter Reutemann 11 May '21

11 May '21

'This weekend, German security researcher stacksmashing declared success at breaking into, dumping, and reflashing the microcontroller of Apple's new AirTag object-location product. Breaking into the microcontroller essentially meant being able both to research how the devices function (by analyzing the dumped firmware) and to reprogram them to do unexpected things. Stacksmashing demonstrated this by reprogramming an AirTag to pass a non-Apple URL while in Lost Mode.' -- source: https://arstechnica.com/information-technology/2021/05/security-researcher-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Tor Exit Nodes Attacked Cryptocurrency Users Over the Past Year
by Peter Reutemann 11 May '21

11 May '21

'For more than 16 months, a threat actor has been seen adding malicious servers to the Tor network in order to intercept traffic and perform SSL stripping attacks on users accessing cryptocurrency-related sites. From a report: The attacks, which began in January 2020, consisted of adding servers to the Tor network and marking them as "exit relays," which are the servers through which traffic leaves the Tor network to re-enter the public internet after being anonymized. But since January 2020, a threat actor has been inserting thousands of malicious servers into the Tor network to identify traffic heading to cryptocurrency mixing websites and perform an SSL stripping attack, which is when traffic is downgraded from an encrypted HTTPS connection to plaintext HTTP. The belief is that the attacker has been downgrading traffic to HTTP in order to replace cryptocurrency addresses with their own and hijack transactions for their own profit. The attacks are not new and were first documented and exposed last year, in August, by a security researcher and Tor node operator known as Nusenu. At the time, the researcher said the attacker managed to flood the Tor network with malicious Tor exit relays on three occasions, peaking their attack infrastructure at around 23% of the entire Tor network's exit capacity before being shut down by the Tor team on every occasion.' -- source: https://it.slashdot.org/story/21/05/10/1838213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Launches Open Source Agriculture Infrastructure Project
by Peter Reutemann 10 May '21

10 May '21

'"The Linux Foundation has lifted the lid on a new open source digital infrastructure project aimed at the agriculture industry," reports VentureBeat: The AgStack Foundation, as the new project will be known, is designed to foster collaboration among all key stakeholders in the global agriculture space, spanning private business, governments, and academia. As with just about every other industry in recent years, there has been a growing digital transformation across the agriculture sector that has ushered in new connected devices for farmers and myriad AI and automated tools to optimize crop growth and circumvent critical obstacles, such as labor shortages. Open source technologies bring the added benefit of data and tools that any party can reuse for free, lowering the barrier to entry and helping keep companies from getting locked into proprietary software operated by a handful of big players... The AgStack Foundation will be focused on supporting the creation and maintenance of free and sector-specific digital infrastructure for both applications and the associated data. It will lean on existing technologies and agricultural standards; public data and models; and other open source projects, such as Kubernetes, Hyperledger, Open Horizon, Postgres, and Django, according to a statement. "Current practices in AgTech are involved in building proprietary infrastructure and point-to-point connectivity in order to derive value from applications," AgStack executive director Sumer Johal told VentureBeat. "This is an unnecessarily costly use of human capital. Like an operating system, we aspire to reduce the time and effort required by companies to produce their own proprietary applications and for content consumers to consume this interoperably." ' -- source: https://linux.slashdot.org/story/21/05/09/0337240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Estimated 30% of All Smartphones Vulnerable To New Qualcomm Bug
by Peter Reutemann 07 May '21

07 May '21

'Around a third of all smartphones in the world are believed to be affected by a new vulnerability in a Qualcomm modem component that can grant attackers access to the device's call and SMS history and even audio conversations. From a report: The vulnerability -- tracked as CVE-2020-11292 -- resides in the Qualcomm mobile station modem (MSM), a chip that allows devices to connect to mobile networks. First designed in the early 90s, the chip has been updated across the years to support 2G, 3G, 4G, and 5G cellular communications and has slowly become one of the world's most ubiquitous technologies, especially with smartphone vendors. Devices that use Qualcomm MSM chips today include high-end smartphone models sold by Google, Samsung, LG, Xiaomi, and OnePlus, just to name a few. But in a report published today by Israeli security firm Check Point, the company said its researchers found a vulnerability in Qualcomm MSM Interface (QMI), the protocol that allows the chip to communicate with the smartphone's operating system. Researches said that malformed Type-Length-Value (TLV) packets received by the MSM component via the QMI interface could trigger a memory corruption (buffer overflow) that can allow attackers to run their own code.' -- source: https://tech.slashdot.org/story/21/05/06/1253235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0