- wlug - University of Waikato Mail Lists

South Korea Finally Gets Rid Of ActiveX
by Lawrence D'Oliveiro 11 Dec '20

11 Dec '20

Being just about the first country in the world to introduce secure online banking (in 1999!) came at a cost to the Republic of Korea: because SSL/TLS wasn’t widespread at the time, they had to cobble together a solution based on Microsoft’s ActiveX technology. This made it specific to Windows. It worked OK for a while, but as computing platforms have continued to evolve, this dependency on a “legacy” technology has become increasingly annoying to just about everybody. Then in 2017, it actually became an election campaign promise to get rid of this. And finally, now, the promise is being fulfilled. <https://www.theregister.com/2020/12/10/south_korea_activex_certs_dead/>

1 0

Brave Browser-Maker Launches Privacy-Friendly News Reader
by Peter Reutemann 10 Dec '20

10 Dec '20

'Ars Technica: Brave Software, maker of the Brave Web browser, is introducing a news reader that's designed to protect user privacy by preventing parties -- both internal and third party -- from tracking the sites, articles, and story topics people view. Brave Today, as the service is called, is using technology that the company says sets it apart from news services offered by Google and Facebook. It's designed to deliver personalized news feeds in a way that leaves no trail for Brave, ISPs, and third parties to track. The new service is part of Brave's strategy of differentiating its browser as more privacy-friendly than its competitors'. Key to Brave Today is a new content delivery network the company is unveiling. Typically, news services use a single CDN to cache content and then serve it to users. This allows the CDN or the service using it to see both the IP address and news feed of each user, and over time, that data can help services build detailed profiles of a person's interests. The Brave Today CDN takes a different approach. It's designed in a way that separates a user's IP address from the content they request. One entity offers a load-balancing service that receives TLS-encrypted traffic from the user. The load balancer then passes the traffic on to the CDN that processes the request. The load balancer knows the user's IP address but, because the request is encrypted, has no visibility into the content the user is seeking. The CDN, meanwhile, sees only the request but has no way of knowing the IP address that's making it. Responses are delivered in reverse order. To prevent the data from being combined, Brave says that it will use one provider for load balancing and a different one for content delivery. To prevent the load-balancing provider from using the size of the requests and responses to infer the contents of the encrypted data, the service will also use a technique called padding, which adds characters to the plaintext before it's encrypted. The CDN uses several other techniques to preserve the anonymity of users. Among them: stripping out various headers that could be used to identify the person making the request. Furthermore, Brave is also taking steps to shield user information from its own employees. "... [T]he company has configured its account with the load-balancing provider to restrict access to its logging resources," reports Ars. "The load-balancing provider also doesn't provide the ability for customers to use the proxy protocol to inject the requester's IP address into outgoing requests. In case that changes, however, Brave has also entered into a contract with the load balancer that restricts access to logs or use of the protocol, even if Brave asks."' -- source: https://yro.slashdot.org/story/20/12/10/2151244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Exposes Adrozek, Malware That Hijacks Chrome, Edge, and Firefox
by Peter Reutemann 10 Dec '20

10 Dec '20

'Microsoft has raised the alarm today about a new malware strain that infects users' devices and then proceeds to modify browsers and their settings in order to inject ads into search results pages. From a report: Named Adrozek, the malware has been active since at least May 2020 and reached its absolute peak in August this year when it controlled more than 30,000 browsers each day. But in a report today, the Microsoft 365 Defender Research Team believes the number of infected users is much, much higher. Microsoft researchers said that between May and September 2020, they observed "hundreds of thousands" of Adrozek detections all over the globe. Based on internal telemetry, the highest concentration of victims appears to be located in Europe, followed by South and Southeast Asia. Microsoft says that, currently, the malware is distributed via classic drive-by download schemes. Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software. The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with the help of a registry key.' -- source: https://news.slashdot.org/story/20/12/10/1857222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

arch - low disk space on root partition
by Peter Reutemann 10 Dec '20

10 Dec '20

Hi everyone My experience with EndeavourOS has been really positive so far. However, this morning, after a big upgrade, I received the notification that I was running low on disk space on my root partition (only 1.9GB out of 37GB remaining!). After a bit of looking around the web, I settled on clearing my pacman cache: sudo pacman -Sc And I'm back to having 19GB free disk space. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

The Origins Of T he C Programming Language
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

This article <https://arstechnica.com/features/2020/12/a-damn-stupid-thing-to-do-the-orig…> goes a bit more in-depth into the precursors of the C programming language. The story begins with a computer scientist from a well-connected family named Christopher Strachey (I remember the name of his uncle Lytton as the author of a volume of short biographies in my parents’ library called “Eminent Victorians”), who led a group to create a language called “CPL”. CPL proved a bit too ambitious to implement at the time. And it didn’t help that its designers insisted on certain syntactical niceties that might be considered more literary than practical. (Reflecting a certain British public-school background, I suppose ...) But a cut-down subset of this was implemented, with the aim of using it as a “bootstrap” language for writing the compiler for the full language. This was BCPL, and it turned out to be useful for a range of programming projects. The group at AT&T Bell Labs got hold of this after the Labs pulled out of the MULTICS project, and implemented an even more cut-down version called “B”, which could run on the limited memory of the PDP-7 which was all they had at the time. Then a later enhancement of this was called “New B” or “NB”. Several attempts were made to rewrite the fledgling Unix operating system in NB, which didn’t work. After each attempt, the language was revised to add more features. Finally, after the addition of structured types, the result was a language sufficiently useful to write an OS, and sufficiently different to warrant a new name. So it was dubbed “C”.

1 0

Bye-Bye DB2, Bye-Bye Oracle, Hello Postgres
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

A report on how a couple of companies -- German IT outfit BG Phoenics and Indian one TransUnion CIBIL -- migrated their entire mass of internal company database deployments off proprietary DBMSes -- IBM DB2 in one case, Oracle in the other -- to Postgres EDB: <https://www.theregister.com/2020/12/08/leaving_ibm_db2_for_postgres/>. In both cases, a big factor was the licensing conditions, which made it very complicated to do any changes to database usage. The improvement in agility was major: Since going live, the user found the deployment of new instances in Postgres much faster than it had been in Db2, down from around 20 hours spread over two weeks to 40 to 60 minutes. Of course an Oracle advocate has to say “[Postgres] is not as scalable as a proprietary database like Oracle or SQL Server”. But I would suggest they think twice about such a pronouncement. Remember that Facebook runs its entire multi-billion-user operation on MySQL, and I’m sure Postgres can scale to that level as well. Where is there an Oracle or DB2 deployment of that size and throughput requirement? I don’t think such a thing exists.

1 0

Amazon, Amex To Fund Software Developers in New GitHub Program
by Peter Reutemann 08 Dec '20

08 Dec '20

'Amazon.com, American Express, Daimler AG and Stripe are among those joining a new GitHub program that will let companies directly fund open-source projects and software developers that are key to their businesses. From a report: It's an expansion of GitHub's Sponsors program, which previously let individuals support software projects and the millions of developers who use the digital platform to collaborate on, share and store code. GitHub, whose parent company Microsoft will also participate in the new service announced Tuesday, expects the change to dramatically increase the number of contributions. The year-old sponsors service has already generated enough money for some developers to rely on it as full-time work, said Devon Zuegel, GitHub's director of product for the communities department.' -- source: https://developers.slashdot.org/story/20/12/08/1821203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GE Puts Default Password In Radiology Devices, Leaving Healthcare Networks Exposed
by Peter Reutemann 08 Dec '20

08 Dec '20

'Ars Technica: Dozens of radiology products from GE Healthcare contain a critical vulnerability that threatens the networks of hospitals and other health providers that use the devices, officials from the US government and a private security firm said on Tuesday. The devices -- used for CT scans, MRIs, X-Rays, mammograms, ultrasounds, and positron emission tomography -- use a default password to receive regular maintenance. The passwords are available to anyone who knows where on the Internet to look. A lack of proper access restrictions allows the devices to connect to malicious servers rather than only those designated by GE Healthcare. Attackers can exploit these shortcomings by abusing the maintenance protocols to access the devices. From there, the attackers can execute malicious code or view or modify patient data stored on the device or the hospital or healthcare provider servers. Aggravating matters, customers can't fix the vulnerability themselves. Instead, they must request that the GE Healthcare support team change the credentials. Customers who don't make such a request will continue to rely on the default password. Eventually, the device manufacturer will provide patches and additional information. The flaw has a CVSS severity rating of 9.8 out of 10 because of the impact of the vulnerability combined with the ease of exploiting it. Security firm CyberMDX discovered the vulnerability and privately reported it to the manufacturer in May. The US Cyber Security and Infrastructure Security Agency is advising affected healthcare providers to take mitigation steps as soon as possible. In a statement, GE Healthcare officials wrote: "We are not aware of any unauthorized access to data or incident where this potential vulnerability has been exploited in a clinical situation. We have conducted a full risk assessment and concluded that there is no patient safety concern. Maintaining the safety, quality, and security of our devices is our highest priority. We are providing on-site assistance to ensure credentials are changed properly and confirm proper configuration of the product firewall. Additionally, we are advising the facilities where these devices are located to follow network management and security best practices." ' -- source: https://it.slashdot.org/story/20/12/08/2034217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye, a Top Cybersecurity Firm, Says It Was Hacked By a Nation-State
by Peter Reutemann 08 Dec '20

08 Dec '20

'The New York Times : For years, the cybersecurity firm FireEye has been the first call for government agencies and companies around the world who have been hacked by the most sophisticated attackers, or fear they might be. Now it looks like the hackers -- in this case, evidence points to Russia's intelligence agencies -- may be exacting their revenge. FireEye revealed on Tuesday that its own systems were pierced by what it called "a nation with top-tier offensive capabilities." The company said hackers used "novel techniques" to make off with its own tool kit, which could be useful in mounting new attacks around the world. It was a stunning theft, akin to bank robbers who, having cleaned out local vaults, then turned around and stole the F.B.I.'s investigative tools. In fact, FireEye said on Tuesday, moments after the stock market closed, that it had called in the F.B.I. The $3.5 billion company, which partly makes a living by identifying the culprits in some of the world's boldest breaches -- its clients have included Sony and Equifax -- declined to say explicitly who was responsible. But its description, and the fact that the F.B.I. has turned the case over to its Russia specialists, left little doubt who the lead suspects were and that they were after what the company calls "Red Team tools." These are essentially digital tools that replicate the most sophisticated hacking tools in the world. FireEye uses the tools — with the permission of a client company or government agency -- to look for vulnerabilities in their systems. Most of the tools are based in a digital vault that FireEye closely guards. The hack raises the possibility that Russian intelligence agencies saw an advantage in mounting the attack while American attention -- including FireEye's -- was focused on securing the presidential election system. At a moment that the nation's public and private intelligence systems were seeking out breaches of voter registration systems or voting machines, it may have a been a good time for those Russian agencies, which were involved in the 2016 election breaches, to turn their sights on other targets. The hack was the biggest known theft of cybersecurity tools since those of the National Security Agency were purloined in 2016 by a still-unidentified group that calls itself theShadowBrokers. [...] The N.S.A.'s tools were most likely more useful than FireEye's since the U.S. government builds purpose-made digital weapons. FireEye's Red Team tools are essentially built from malware that the company has seen used in a wide range of attacks. Still, the advantage of using stolen weapons is that nation-states can hide their own tracks when they launch attacks.' -- source: https://it.slashdot.org/story/20/12/08/2247219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Next Step In DNS Privacy
by Lawrence D'Oliveiro 08 Dec '20

08 Dec '20

We already have mechanisms called “DNS-over-HTTPS” (DoH) and “DNS-over-TLS” (DoT) to encrypt your DNS queries so intermediaries cannot eavesdrop on them. However, the DNS server you are querying still knows what you are asking for, and can tie that to the IP address that you are querying from. So the next step is called “Oblivious DNS” (“over HTTPS”?) or “ODoH” <https://arstechnica.com/information-technology/2020/12/cloudflare-apple-and…>. This one interposes a proxy to relay the encrypted query and response between the client machine and DNS server. The proxy cannot decrypt the communications, and its presence hides the client’s IP address from the server, further increasing your privacy. To recap: the DNS server knows what you are asking for, but not who is asking. The proxy knows who is asking, but not what they are asking for. Given the controversy from some parties over the existing mechanisms (remember when the British Internet Service Providers’ Association dubbed Mozilla a “villain” for implementing DoH <https://www.theregister.com/2019/07/10/ispa_clears_mozilla/>?), I wonder what kind of hoo-hah this further development will trigger...

1 0