- wlug - University of Waikato Mail Lists

The Internet is Now Rife With Places Where You Can Organize Zoom-bombing Raids
by Peter Reutemann 02 Apr '20

02 Apr '20

'The internet is rife with online communities where users can go and share Zoom conference codes and request that pranksters connect and hurl insults, play pornographic material, or make death threats against other participants -- in a practice called Zoom-bombing or a Zoom raid. From a report: ZDNet began tracking the tactic since mid-March when the term was first coined following a TechCrunch article. Ever since then, Zoom-bombing incidents have increased, as articles in major news outlets like the New York Times and the BBC have made the practice a favorite pastime for all the teenagers stuck in their homes during the current coronavirus (COVID-19) quarantines. From a niche prank that started on a derelict Discord channel, Zoom-bombing has now spread to enormous proportions -- being so rampant these days that the FBI sent a nationwide alert last week, urging companies, schools, and universities to take steps to secure their Zoom channels. But as Zoom-bombing became more popular, more pranksters wanted to join on the fun, and more users wanted their friends' Zoom meetings disrupted. And as the old saying goes; where there's a demand, there's always a supply. Over the course of the past week, the number of places on the public internet where you can request a zoom raid from a gang of bored teenagers has exploded.' -- source: https://yro.slashdot.org/story/20/04/02/1937229 How to secure Zoom: https://www.netsafe.org.nz/get-into-zoom/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

National Tells PM To Stop Using Zoom At Cabinet Meetings
by Lawrence D'Oliveiro 01 Apr '20

01 Apr '20

Security concerns are being raised about the Zoom videoconferencing service, which Jacinda Ardern and her cabinet have been using in their online meetings <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12321784>.

2 1

Linux Mint 20 is 64-bit Only, Based on Ubuntu 20.04, and Named 'Ulyana'
by Peter Reutemann 01 Apr '20

01 Apr '20

'Today, we learn some new details about the upcoming Linux Mint 20. While most of the newly revealed information is positive, there is one thing that is sure to upset many Linux Mint users. First things first, Linux Mint 20 will be based on the upcoming Ubuntu 20.04. This shouldn't come as a surprise, as Mint only uses Long Term Support versions of Ubuntu, and 20.04 will be an LTS. We also now know the name of Linux Mint 20. The Mint team always uses female names, and this time they chose "Ulyana." This is apparently a Russian name meaning "youthful." So far, all of the news is positive, so what exactly will upset some users? The Linux Mint developers are finally dropping 32-bit support and will only produce 64-bit ISOs.' -- source: https://linux.slashdot.org/story/20/03/31/1842216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

OpenWRT code-execution bug puts millions of devices at risk
by Peter Reutemann 01 Apr '20

01 Apr '20

'For almost three years, OpenWRT—the open source operating system that powers home routers and other types of embedded systems—has been vulnerable to remote code-execution attacks because updates were delivered over an unencrypted channel and digital signature verifications are easy to bypass, a researcher said. OpenWRT has a loyal base of users who use the freely available package as an alternative to the firmware that comes installed on their devices. Besides routers, OpenWRT runs on smartphones, pocket computers and even laptops and desktop PCs. Users generally find OpenWRT to be a more secure choice because it offers advanced functions and its source code is easy to audit. Security researcher Guido Vranken, however, recently found that updates and installation files were delivered over unencrypted HTTPs connections, which are open to attacks that allow adversaries to completely replace legitimate updates with malicious ones. The researcher also found that it was trivial for attackers with moderate experience to bypass digital-signature checks that verify a downloaded update as the legitimate one offered by OpenWTR maintainers. The combination of those two lapses makes it possible to send a malicious update that vulnerable devices will automatically install.' -- source: https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerabl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How The ESA Has Kept The Mars Express Probe Doing Useful Science For 16 Years
by Lawrence D'Oliveiro 01 Apr '20

01 Apr '20

Originally designed for a mission lasting one Martian year (about two Earth years), MEX <https://www.theregister.co.uk/2020/03/31/mars_express/> continues to operate even today, and looks likely to manage to stay in action for a few more years. Working around a wiring error that meant it only had 70% of the designed operating power, then dealing with unreliabilities cropping up in the Solid-State Mass Memory system, figuring out how to prolong the life of the maneouvring reaction wheels, actually having to write and upload new software written in Ada-83, where the original contractor was helpful, rather than obstructive for a change: While support had officially ended, ESA did set up a small contract with Airbus (who had acquired the original spacecraft manufacturer) in a role reversal that saw Airbus review the MEX team's work rather than the other way around. As it transpired, Airbus turned out to be hugely helpful, blowing dust off some testing tools, making suggestions and, effectively, "putting the band back together" as those who originally designed and built MEX (and had not yet shuffled off into retirement) were hauled back to offer assistance. All in all, the team operating MEX has done some amazing work so far. Bear in mind that launching probes into space is still a dicey business, prone to embarrassing failures. This is why they have to be over-engineered, then backed up with alternate recovery plans on top of alternate recovery plans.

1 0

Zoom Meetings Aren't End-to-End Encrypted, Despite Misleading Marketing
by Peter Reutemann 31 Mar '20

31 Mar '20

'Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. With millions of people around the world working from home in order to slow the spread of the coronavirus, business is booming for Zoom, bringing more attention on the company and its privacy practices, including a policy, later updated, that seemed to give the company permission to mine messages and files shared during meetings for the purpose of ad targeting. Still, Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using "computer audio" instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom's website, its security white paper, and the user interface within the app. But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption.' -- source: https://it.slashdot.org/story/20/03/31/1526250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom is Leaking Peoples' Email Addresses and Photos To Strangers
by Peter Reutemann 31 Mar '20

31 Mar '20

'Popular video-conferencing Zoom is leaking personal information of at least thousands of users, including their email address and photo, and giving strangers the ability to attempt to start a video call with them through Zoom. From a report: The issue lies in Zoom's "Company Directory" setting, which automatically adds other people to a user's lists of contacts if they signed up with an email address that shares the same domain. This can make it easier to find a specific colleague to call when the domain belongs to an individual company. But multiple Zoom users say they signed up with personal email addresses, and Zoom pooled them together with thousands of other people as if they all worked for the same company, exposing their personal information to one another.' -- source: https://yro.slashdot.org/story/20/03/31/201237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPE, Intel and Linux Foundation Team Up For Open Source Software for 5G Core
by Peter Reutemann 31 Mar '20

31 Mar '20

'HPE announced on Tuesday it's working with Intel and the Linux Foundation on a new open source software project to help automate the roll out of 5G across multiple sites. From a report: The new partnership, which will be under the Linux Foundation umbrella, is called the Open Distributed Infrastructure Management Framework. The partnership represents HPE's move into the 5G core network space as it branches out from its enterprise roots. Other partners for the open source project include AMI, Apstra, IBM's Red Hat, Tech Mahindra and World Wide Technology. HPE will also introduce an enterprise offering, the HPE Open Distributed Infrastructure Management Resource Aggregator.' -- source: https://news.slashdot.org/story/20/03/31/1947203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Keyring Concept in Ubuntu: What is It and How to Use it?
by Peter Reutemann 31 Mar '20

31 Mar '20

'f you use automatic login in Ubuntu or other Linux distributions, you might have come across a pop-up message of this sort: Enter password to unlock your login keyring The login keyring did not get unlocked when you logged into your computer. It keeps on popping up several times before disappearing if you keep on clicking cancel. You may wonder why do you keep seeing this keyring message all the time? Let me tell you something. It’s not an error. It’s a security feature. Surprised? Let me explain the keyring concept in Linux.' -- source: https://itsfoss.com/ubuntu-keyring/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Internet Pioneer Vint Cerf Tests Positive For Covid-19
by Peter Reutemann 31 Mar '20

31 Mar '20

'Tech pioneer Vint Cerf, one of the co-creators of the modern internet, has tested positive for covid-19, according to a tweet Cerf sent out Monday morning. The 76-year-old tweeted out a clip from HBO's Last Week Tonight with John Oliver about the U.S. response to the global pandemic. "I tested positive for COVID-19 and am recovering," Cerf tweeted. "Listen to what John Oliver has to say about our national response so far." Cerf helped create the modern internet in the 1970s while working at UCLA with other pioneers like Bob Kahn and Leonard Kleinrock. Cerf worked on packet switching for the APRANET under Kleinrock and TCP/IP protocols with ARPA (now DARPA), the plumbing that makes the internet function. DARPA tweeted its support of Cerf, telling him to get well soon.' -- source: https://science.slashdot.org/story/20/03/30/214250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2