- wlug - University of Waikato Mail Lists

FireEye Releases Tool For Auditing Networks for Techniques Used by SolarWinds Hackers
by Peter Reutemann 19 Jan '21

19 Jan '21

'Cybersecurity firm FireEye has released today a report detailing the techniques used by the SolarWinds hackers inside the networks of companies they breached. From a report: Together with the report, FireEye researchers have also released a free tool on GitHub named Azure AD Investigator that they say can help companies determine if the SolarWinds hackers (also known as UNC2452) used any of these techniques inside their networks. Today's FireEye report comes as the security firm has spearheaded investigations into the SolarWinds supply chain compromise, together with Microsoft and CrowdStrike. The SolarWinds hack came to light on December 13, 2020, when FireEye and Microsoft confirmed that a threat actor broke into the network of IT software provider SolarWinds and poisoned updates for the Orion app with malware.' -- source: https://tech.slashdot.org/story/21/01/19/2023209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The NSA warns enterprises to beware of third-party DNS resolvers
by Peter Reutemann 19 Jan '21

19 Jan '21

'DNS over HTTPS is a new protocol that protects domain-lookup traffic from eavesdropping and manipulation by malicious parties. Rather than an end-user device communicating with a DNS server over a plaintext channel—as DNS has done for more than three decades—DoH, as DNS over HTTPS is known, encrypts requests and responses using the same encryption websites rely on to send and receive HTTPS traffic. Using DoH or a similar protocol known as DoT—short for DNS over TLS—is a no brainer in 2021, since DNS traffic can be every bit as sensitive as any other data sent over the Internet. On Thursday, however, the National Security Agency said in some cases Fortune 500 companies, large government agencies, and other enterprise users are better off not using it. The reason: the same encryption that thwarts malicious third parties can hamper engineers’ efforts to secure their networks. “DoH provides the benefit of encrypted DNS transactions, but it can also bring issues to enterprises, including a false sense of security, bypassing of DNS monitoring and protections, concerns for internal network configurations and information, and exploitation of upstream DNS traffic,” NSA officials wrote in published recommendations. “In some cases, individual client applications may enable DoH using external resolvers, causing some of these issues automatically.”' -- source: https://arstechnica.com/information-technology/2021/01/the-nsa-warns-enterp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocat Author Gets Insanely Fast Backing To Build P2P Tech For Social Media
by Peter Reutemann 19 Jan '21

19 Jan '21

'TechCrunch: The idea for Capsule started with a tweet about reinventing social media. A day later cryptography researcher, Nadim Kobeissi -- best known for authoring the open-source E2E-encrypted desktop chat app Cryptocat (now discontinued) -- had pulled in a pre-seed investment of $100,000 for his lightweight mesh-networked microservices concept, with support coming from angel investor and former Coinbase CTO Balaji Srinivasan, William J. Pulte and Wamda Capital. The nascent startup has a post-money valuation on paper of $10 million, according to Kobeissi, who is working on the prototype -- hoping to launch an MVP of Capsule in March (as a web app), after which he intends to raise a seed round (targeting $1 million-$1.5 million) to build out a team and start developing mobile apps. For now there's nothing to see beyond Capsule's landing page and a pitch deck (which he shared with TechCrunch for review). But Kobeissi says he was startled by the level of interest in the concept. "I posted that tweet and the expectation that I had was that basically 60 people max would retweet it and then maybe I'll set up a Kickstarter," he tells us. Instead the tweet "just completely exploded" and he found himself raising $100,000 "in a single day" -- with $50,000 paid in there and then. "I'm not a startup guy. I've been running a business based on consulting and based on academic R&D services," he continues. "But by the end of the day -- last Sunday, eight days ago -- I was running a Delaware corporation valued at $10 million with $100,000 in pre-seed funding, which is insane. Completely insane."' -- source: https://news.slashdot.org/story/21/01/18/2144252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenWRT Forum User Data Stolen In Weekend Data Breach
by Peter Reutemann 19 Jan '21

19 Jan '21

'The OpenWRT forum, a large community of enthusiasts of alternative, open-source operating systems for routers, announced a data breach over the weekend. Bleeping Computer reports: The attack occurred on Saturday, around 04:00 (GMT), when an unauthorized third party gained admin access to and copied a list with details about forum users and related statistical information. The intruder used the account of an OpenWRT administrator. Although the account had "a good password," additional security provided by two-factor authentication (2FA) was not active. Email addresses and handles of the forum users have been stolen, the moderators say. They add that they believe the attacker was not able to download the forum database, meaning that passwords should be safe. However, they reset all the passwords on the forum just to be on the safe side and invalidated all the API keys used for project development processes. Users have to set the new password manually from the login menu by providing their user name and following the "get a new password" instructions. Those logging in using GitHub credentials are advised to reset or refresh it. The OpenWRT forum credentials are separate from the Wiki. Currently, there is no suspicion that the Wiki credentials have been compromised in any way. OpenWRT forum administrators warn that since this breach exposed email addresses, users may become targets of credible phishing attempts. ' -- source: https://it.slashdot.org/story/21/01/18/2148210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Surpasses 100 Million Daily Search Queries For the First Time
by Peter Reutemann 18 Jan '21

18 Jan '21

'Privacy-focused search engine DuckDuckGo reached a major milestone in its 12-year-old history last week when it recorded on Monday its first-ever day with more than 100 million user search queries. From a report: The achievement comes after a period of sustained growth the company has been seeing for the past two years, and especially since August 2020, when the search engine began seeing more than 2 billion search queries a month on a regular basis. The numbers are small in comparison to Google's 5 billion daily search queries but it's a positive sign that users are looking for alternatives. DuckDuckGo's popularity comes after the search engine has expanded beyond its own site and now currently offers mobile apps for Android and iOS, but also a dedicated Chrome extension. More than 4 million users installed these apps and extension, the company said in a tweet in September 2020.' -- source: https://tech.slashdot.org/story/21/01/18/1450258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 17 Jan '21

17 Jan '21

Hi everyone Just a reminder that our AGM is coming up next week: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Tim Berners-Lee Will Fix the Internet
by Peter Reutemann 17 Jan '21

17 Jan '21

'"Sir Tim Berners-Lee, the British computer scientist who was knighted for inventing the internet navigation system known as the World Wide Web, wants to re-make cyberspace once again," reports Reuters: With a new startup called Inrupt, Berners-Lee aims to fix some of the problems that have handicapped the so-called open web in an age of huge, closed platforms such as Facebook. Building on ideas developed by an open-source software project called Solid, Inrupt promises a web where people can use a single sign-on for any service and personal data is stored in "pods," or personal online data stores, controlled by the user. "People are fed up with the lack of controls, the silos," said Berners-Lee, co-founder and chief technology officer of Inrupt, in an interview at the Reuters Next conference... John Bruce, a veteran technology executive who is CEO of Inrupt, said the company had signed up Britain's National Health Service, the BBC and the government of Flanders in Belgium as pilot customers, and hoped to announce many more by April... A key aim for Inrupt is to get software developers to write programs for the platform. Inrupt, like the original web, is at its core mostly a set of protocols for how machines talk to one another, meaning that specific applications bring it to life. "The use cases are so broad, it's like a do-over for the web," Berners-Lee said. In a video interview, Berners-Lee tells Reuters that what people are worried about isn't privacy per se but "the lack of empowerment" — for example, to collaborate with people. And then he acknowledges that the worldwide web does suffer from limited access control. "I wanted it to be a collaborative space, but in a way that was naive, because collaborative spaces you need to be private. You need to start off with just a limited sharing, and then you allow the sharing to increase." Social networks provided some features like a unique login and identity. But unfortunately, then "The large social networks will tend to get larger" — and ultimately without a single global signon, users then become trapped in separate silos.' -- source: https://tech.slashdot.org/story/21/01/16/2336244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Jamie Zawinski Calls Cinnamon Screensaver Lock-Bypass Bug 'Unconscionable'
by Peter Reutemann 17 Jan '21

17 Jan '21

'Legendary programmer Jamie Zawinski has worked on everything from the earliest releases of the Netscape Navigator browser to XEmacs, Mozilla, and, of course, the XScreenSaver project. Now Slashdot reader e432776 writes: JWZ continues to track issues with screensavers on Linux (since 2004!), and discusses a new bug in cinnamon-screensaver. Long-standing topics like X11, developer interaction, and code licensing all feature. Solutions to these long-standing issues remain elusive. Jamie titled his blog post "I told you so, 2021 edition": You will recall that in 2004 , which is now seventeen years ago, I wrote a document explaining why I made the design trade-offs that I did in XScreenSaver, and in that document I predicted this exact bug as my example of, "this is what will happen if you don't do it this way." And they went and made that happen. Repeatedly. Every time this bug is re-introduced, someone pipes up and says something like, "So what, it was a bug, they've fixed it." That's really missing the point. The point is not that such a bug existed, but that such a bug was even possible. The real bug here is that the design of the system even permits this class of bug. It is unconscionable that someone designing a critical piece of security infrastructure would design the system in such a way that it does not fail safe . Especially when I have given them nearly 30 years of prior art demonstrating how to do it right, and a two-decades-old document clearly explaining What Not To Do that coincidentally used this very bug as its illustrative strawman! These bugs are a shameful embarrassment of design -- as opposed to merely bad code... ZDNet reports that Linux Mint has issued a patch for Cinnamon that fixes the screensaver bug. But HotHardware notes that it was discovered when "one Dad let the kids play with the keyboard. This button-mashing actually crashed the machine's screensaver by sheer luck, allowing them onto the desktop, ultimately leading to the discovery of a high priority security vulnerability for the Linux Mint team." But that's not the only thing bothering Jamie Zawinski: Just to add insult to injury, it has recently come to my attention that not only are Gnome-screensaver, Mint-screensaver and Cinnamon-screensaver buggy and insecure dumpster fires, but they are also in violation of my license and infringing my copyright. XScreenSaver was released under the BSD license, one of the oldest and most permissive of the free software licenses. It turns out, the Gnome-screensaver authors copied large parts of XScreenSaver into their program, removed the BSD license and slapped a GPL license on my code instead -- and also removed my name. Rude... Mint-screensaver and Cinnamon-screensaver, being forks and descendants of Gnome-screensaver, have inherited this license violation and continue to perpetuate it. Every Linux distro is shipping this copyright- and license-infringing code. I eagerly await hearing how they're going to make this right.' -- source: https://tech.slashdot.org/story/21/01/17/0024243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With Jon “maddog” Hall
by Lawrence D'Oliveiro 17 Jan '21

17 Jan '21

Been watching this nearly-hour-long conversation <https://www.youtube.com/watch?v=EZMA3Ge144U> with Jon “maddog” Hall, who if you don’t know him, was very likely the inspiration for the famous Dilbert cartoon featuring the Unix-using neckbeard telling the corporate jobsworth to “get a better computer” <https://dilbert.com/strip/1995-06-24>. Seems that there were several round-number anniversaries related to Unix coming due in 2019 (the year after the video was made), including the 50th anniversary of its creation at Bell Labs. After an early career on IBM mainframe equipment, maddog got a job as a sysadmin at Bell Labs, where he was introduced to Unix. Then he did various different jobs over many years at DEC. At about the half-hour mark, he talks about how he met Linus Torvalds, and asked the latter about porting his still-only-32-bit x86-only fledgling Linux kernel onto the 64-bit Alpha architecture. Linus wanted to do this, but he couldn’t get an Alpha machine from the Helsinki DEC office. So maddog went to bat, pulled a few strings, and got one for him. And it took just 9 months to take Linux from being x86-only and 32-bit-only to being cross-platform and 64-bit-native.

1 0

Windows 10 Bug Corrupts Your Hard Drive On Seeing This File's Icon
by Peter Reutemann 15 Jan '21

15 Jan '21

'An unpatched zero-day in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command. Bleeping Computer reports: In August 2020, October 2020, and finally this week, infosec researcher Jonas L drew attention to an NTFS vulnerability impacting Windows 10 that has not been fixed. When exploited, this vulnerability can be triggered by a single-line command to instantly corrupt an NTFS-formatted hard drive, with Windows prompting the user to restart their computer to repair the corrupted disk records. The researcher told BleepingComputer that the flaw became exploitable starting around Windows 10 build 1803, the Windows 10 April 2018 Update, and continues to work in the latest version. What's worse is, the vulnerability can be triggered by standard and low privileged user accounts on Windows 10 systems. [...] It is unclear why accessing this attribute corrupts the drive, and Jonas told BleepingComputer that a Registry key that would help diagnose the issue doesn't work. One striking finding shared by Jonas with us was that a crafted Windows shortcut file (.url) that had its icon location set to C:\:$i30:$bitmap would trigger the vulnerability even if the user never opened the file! As observed by BleepingComputer, as soon as this shortcut file is downloaded on a Windows 10 PC, and the user views the folder it is present in, Windows Explorer will attempt to display the file's icon. To do this, Windows Explorer would attempt to access the crafted icon path inside the file in the background, thereby corrupting the NTFS hard drive in the process. Next, "restart to repair hard drive" notifications start popping up on the Windows PC -- all this without the user even having opened or double-clicked on the shortcut file. ' -- source: https://hardware.slashdot.org/story/21/01/14/232238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0