- wlug - University of Waikato Mail Lists

'A Hacker Got All My Texts For $16'
by Peter Reutemann 15 Mar '21

15 Mar '21

'A report from Motherboard, written by Joseph Cox: I didn't expect it to be that quick. While I was on a Google Hangouts call with a colleague, the hacker sent me screenshots of my Bumble and Postmates accounts, which he had broken into. Then he showed he had received texts that were meant for me that he had intercepted. Later he took over my WhatsApp account, too, and texted a friend pretending to be me. Looking down at my phone, there was no sign it had been hacked. I still had reception; the phone said I was still connected to the T-Mobile network. Nothing was unusual there. But the hacker had swiftly, stealthily, and largely effortlessly redirected my text messages to themselves. And all for just $16. I hadn't been SIM swapped, where hackers trick or bribe telecom employees to port a target's phone number to their own SIM card. Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him. This overlooked attack vector shows not only how unregulated commercial SMS tools are but also how there are gaping holes in our telecommunications infrastructure, with a hacker sometimes just having to pinky swear they have the consent of the target. "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," said Lucky225, the pseudonymous hacker who carried out the attack, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers. In a statement to Motherboard, Senator Ron Wyden said: "Itâ(TM)s not hard to see the enormous threat to safety and security this kind of attack poses. The FCC must use its authority to force phone companies to secure their networks from hackers. Former Chairman Paiâ(TM)s approach of industry self-regulation clearly failed."' -- source: https://yro.slashdot.org/story/21/03/15/1950245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM's Patent Income Slips as Companies Resist 'Godfather' Deals
by Peter Reutemann 14 Mar '21

14 Mar '21

'"Even as IBM has sued an increasing number of companies, its IP income has shrunk," reports Bloomberg: Intellectual property rights historically brought in more than $1 billion a year, on average, helping offset massive research and development costs and shrinking revenue. Last year, IBM's income from intellectual property was $626 million, its lowest point since 1996, and 2019 wasn't much higher. While it continues to secure license deals, they are fewer and harder-won, with companies like Airbnb Inc. and Chewy Inc. waging battles in court... In February, online pet-food seller Chewy requested a court order to block a $36 million patent fee IBM is demanding. Chewy accused IBM of "seeking exorbitant licensing fees for early internet patents having no value." IBM's claims against Chewy include years-old inventions such as targeted advertising and content resizing based on cursor activity, both ubiquitous on the web. Chewy said IBM doesn't make or sell products covered by the vast majority of the thousands of patents it has received over the past 20 years, but instead just threatens to sue if companies don't agree to pay for licenses. IBM has not answered Chewy's complaint, and no trial date has been set. Companies that use their IP licensing aggressively as a way to make money are often referred to as patent trolls. However, IBM's position as the largest aggregator of U.S. intellectual property is more akin to being a patent godfather, says Robin Feldman, a law professor at the University of California, Hastings. With more than 38,000 active patents in its portfolio, and thousands of license agreements bolstering its legitimacy, IBM's demands have traditionally gone unchallenged, Feldman said. Such patent godfathers, with large portfolios, are "able to make offers that can't be refused." Even some of the most innovative technology giants have licensed IBM patents over the years. Alphabet Inc.'s Google, Amazon.com Inc. and LinkedIn are among countless companies that have had to pony up. IBM also has long served as a patent bank for young companies to jump-start their portfolios. Facebook Inc. was not yet public in 2012 when it bought 750 patents on software and networking from IBM. As Instacart Inc. prepares to go public, it purchased almost 300 IBM patents in January ranging from e-commerce to smart shopping bags. Noting a series of Supreme Court verdicts making it easier to invalidate a patent, Feldman, the law professor, told Bloomberg that "Being the godfather isn't what it used to be. It's not that patent aggregation as a business is over. You just make less money."' -- source: https://yro.slashdot.org/story/21/03/13/2120248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Decentralized Routing Protocol Aims To Replace BGP
by Peter Reutemann 14 Mar '21

14 Mar '21

'"The Border Gateway Protocol was first described in 1989...," according to Wikipedia, "and has been in use on the Internet since 1994." But now long-time Slashdot reader jovius reports that a startup named Syntropy "aims to replace BGP as the default routing method of the internet, by using nodes around the world to constantly gather data of the inefficiencies of the current network." The intelligence is then used to route data via the most efficient routes. Actual tests with hundreds of servers have proved that latencies can be reduced by tens to hundreds of milliseconds. The connections are by default encrypted, and jitter is also reduced. Eventually, the company-run servers are augmented with tens of thousands of nodes run by users/smart devices, who are rewarded for their work. The team was recently joined by former SVP at Verizon Shawn Hakl and former Chief Product Officer at AT&T Roman Pacewicz. One of the founders of Syntropy is the co-founder of Equinix and NANOG Bill Norton. Syntropy is an Oracle and Microsoft partner, and transforming into a foundation and DAO to govern the protocol work. Decentralised autonomous routing protocol (or DARP) has just been opened for community testing, and the system is live on https://darp.syntropystack.com/. ' -- source: https://tech.slashdot.org/story/21/03/14/1910257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Three Flaws in the Linux Kernel Since 2006 Could Grant Root Privileges
by Peter Reutemann 14 Mar '21

14 Mar '21

'"Three recently unearthed vulnerabilities in the Linux kernel, located in the iSCSI module used for accessing shared data storage facilities, could allow root privileges to anyone with a user account," reports SC Media: "If you already had execution on a box, either because you have a user account on the machine, or you've compromised some service that doesn't have repaired permissions, you can do whatever you want basically," said Adam Nichols, principal of the Software Security practice at GRIMM. While the vulnerabilities "are in code that is not remotely accessible, so this isn't like a remote exploit," said Nichols, they are still troublesome. They take "any existing threat that might be there. It just makes it that much worse," he explained. "And if you have users on the system that you don't really trust with root access it, it breaks them as well." Referring to the theory that 'many eyes make all bugs shallow,' Linux code "is not getting many eyes or the eyes are looking at it and saying that seems fine," said Nichols. "But, [the bugs] have been in there since the code was first written, and they haven't really changed over the last 15 years...." That the flaws slipped detection for so long has a lot to do with the sprawl of the the Linux kernel. It "has gotten so big" and "there's so much code there," said Nichols. "The real strategy is make sure you're loading as little code as possible." The bugs are in all Linux distributions, Nichols said, although the kernel driver is not loaded by default. Whether a normal user can load the vulnerable kernel module varies. They can, for instance, on all Red Hat based distros that GRIMM tested, he said. "Even though it's not loaded by default, you can get it loaded and then of course you can exploit it without any trouble...." The bugs have been patched in the following kernel releases: 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260, and 4.4.260. All older kernels are end-of- life and will not receive patches. ' -- source: https://linux.slashdot.org/story/21/03/13/0118217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Launches $4 Microcontroller With Custom Chip
by Peter Reutemann 14 Mar '21

14 Mar '21

'Meet the Raspberry Pi Pico, a tiny little microcontroller that lets you build hardware projects with some code running on the microcontroller. Even more interesting, the Raspberry Pi Foundation is using its own RP2040 chip, which means that the foundation is now making its own silicon. From a report: If you're not familiar with microcontrollers, those devices let you control other parts or other devices. You might think that you can already do this kind of stuff with a regular Raspberry Pi. But microcontrollers are specifically designed to interact with other things. They're cheap, they're small and they draw very little power. You can start developing your project with a breadboard to avoid soldering. You can pair it with a small battery and it can run for weeks or even months. Unlike computers, microcontrollers don't run traditional operating systems. Your code runs directly on the chip. Like other microcontrollers, the Raspberry Pi Pico has dozens of input and output pins on the sides of the device. Those pins are important as they act as the interface with other components. For instance, you can make your microcontroller interact with an LED light, get data from various sensors, show some information on a display, etc. The Raspberry Pi Pico uses the RP2040 chip. It has a dual-core Arm processor (running at 133MHz), 264KB of RAM, 26 GPIO pins including 3 analog inputs, a micro-USB port and a temperature sensor. It doesn't come with Wi-Fi or Bluetooth. And it costs $4.' -- source: https://hardware.slashdot.org/story/21/01/21/1258214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Critics fume after Github removes exploit code for Exchange vulnerabilities
by Peter Reutemann 13 Mar '21

13 Mar '21

'Github has ignited a firestorm after the Microsoft-owned code-sharing repository removed a proof-of-concept exploit for critical vulnerabilities in Microsoft Exchange that have led to as many as 100,000 server infections in recent weeks. ProxyLogon is the name that researchers have given both to the four Exchange vulnerabilities under attack in the wild and the code that exploits them. Researchers say that Hafnium, a state-sponsored hacking group based in China, started exploiting ProxyLogon in January, and within a few weeks, five other APTs—short for advanced persistent threat groups—followed suit. To date, no fewer than 10 APTs have used ProxyLogon to target servers around the Microsoft issued emergency patches last week, but as of Tuesday, an estimated 125,000 Exchange servers had yet to install it, security firm Palo Alto Networks said. The FBI and the Cybersecurity and Infrastructure Security Agency have warned that ProxyLogon poses a serious threat to businesses, nonprofits, and government agencies that remain vulnerable. On Wednesday, a researcher published what’s believed to be the first largely working proof-of-concept (PoC) exploit for the vulnerabilities. Based in Vietnam, the researcher also published a post on Medium describing how the exploit works. With a few tweaks, hackers would have most of what they needed to launch their own in-the-wild RCEs, security speak for remote code execution exploits. Publishing PoC exploits for patched vulnerabilities is a standard practice among security researchers. It helps them understand how the attacks work so that they can build better defenses. The open source Metasploit hacking framework provides all the tools needed to exploit tens of thousands of patched exploits and is used by black hats and white hats alike. Within hours of the PoC going live, however, Github removed it. By Thursday, some researchers were fuming about the takedown. Critics accused Microsoft of censoring content of vital interest to the security community because it harmed Microsoft interests. Some critics pledged to remove large bodies of their work on Github in response.' -- source: https://arstechnica.com/gadgets/2021/03/critics-fume-after-github-removes-e… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

7-Zip Developer Releases the First Official Linux Version
by Peter Reutemann 13 Mar '21

13 Mar '21

'An official version of the popular 7-zip archiving program has been released for Linux for the first time. Bleeping Computer reports: Linux already had support for the 7-zip archive file format through a POSIX port called p7zip but it was maintained by a different developer. As the p7zip developer has not maintained their project for 4-5 years, 7-Zip developer Igor Pavlov decided to create a new official Linux version based on the latest 7-Zip source code. Pavlov has released 7-Zip for Linux in AMD64, ARM64, x86, and armhf versions, which users can download [via their respective links]. "These new 7-Zip binaries for Linux were linked (compiled) by GCC without -static switch. And compiled 32-bit executables (x86 and armhf) didn't work on some arm64 and amd64 systems, probably because of missing of some required .so files." "Please write here, if you have some advices how to compile and link binaries that will work in most Linux systems," Pavlov stated on his release page. ' -- source: https://hardware.slashdot.org/story/21/03/12/2144238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

emergency mode
by thomas 11 Mar '21

11 Mar '21

Hello everybody hope all are well... but not me. This mail is from an old lappi with 12.04. because my current lap 18.04. is in emergency mode and I tried all advice from google and ubuntu to no success. Luckily I found you and hope you can help. I am not an IT expert just a normal user but this is business related and quite urgent. I am in Raglan and wheelchair bound but able to come to Hamilton any time and will pay any cost incurred. Thank you very much for your response Kind Regards Thomas Koppen

1 0

Up To 60,000 Computer Systems Exposed In Germany To Microsoft Flaw
by Peter Reutemann 11 Mar '21

11 Mar '21

'As many as 60,000 computer systems in Germany were exposed to a flaw that allows unauthorized users to access systems in Microsoft's email software, the head of its cybersecurity watchdog said on Wednesday. Reuters reports: More than half of the vulnerabilities were addressed following a warning last weekend by the Federal Office for Information Security (BSI), but around 25,000 systems still need to be fixed, BSI chief Arne Schoenbohm said. "The warning has worked. In Germany, many Exchange servers have been secured by downloading patches," Schoenbohm said in written comments to Reuters. "Every vulnerable system is one too many and can lead to harm." In a 14-page report on the Microsoft vulnerability, the BSI said the behavior of hackers exploiting it had changed sharply since it was publicly revealed. Initially, most targets had been think tanks, universities, non-governmental organizations, law firms and defense companies - mostly in the United States. "Now, these exploits are being deployed at mass scale against thousands of targets - apparently worldwide," the report said. At least 10 different hacking groups were using the latest flaw in Microsoft's mail server software to break into targets around the world, according to researchers at cybersecurity company ESET. In Germany, two federal authorities have been affected by the hack, the BSI said, declining to say which. ' -- source: https://it.slashdot.org/story/21/03/10/2230234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers access security cameras inside Cloudflare, jails, and hospitals
by Peter Reutemann 10 Mar '21

10 Mar '21

'Hackers say they broke into the network of Silicon Valley startup Verkada and gained access to live video feeds from more than 150,000 surveillance cameras the company manages for Cloudflare, Tesla, and a host of other organizations. The group published videos and images they said were taken from offices, warehouses, and factories of those companies as well as from jail cells, psychiatric wards, banks, and schools. Bloomberg News, which first reported the breach, said footage viewed by a reporter showed staffers at Florida hospital Halifax Health tackling a man and pinning him to a bed. Another video showed a handcuffed man in a police station in Stoughton, Massachusetts, being questioned by officers. “I don’t think the claim ‘we hacked the internet’ has ever been as accurate as now,” Tillie Kottmann, a member of a hacker collective calling itself APT 69420 Arson Cats, wrote on Twitter.' -- source: https://arstechnica.com/information-technology/2021/03/hackers-access-secur… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0