- wlug - University of Waikato Mail Lists

NextCloud Linux Servers Targetted by NextCry Ransomware
by Peter Reutemann 25 Nov '19

25 Nov '19

'A new and particularly troublesome ransomware variant has been identified in the wild. Dubbed NextCry, this nasty strain of ransomware encrypts data on NextCloud Linux servers and has managed to evade the detection of public scanning platforms and antivirus engines. To make matters worse, there is currently no free decryption tool available for victims. Ransomware hunter and creator of ID Ransomware Michael Gillespie notes that the NextCry ransomware, which is a Python script compiled in a Linux ELF binary using pyInstaller, oddly uses Base64 to encode file names as well as the content of files which have already been encrypted. Gillespie has also confirmed that NextCry encrypts data using the AES algorithm with a 256-bit key. The ransom note that NextCry victims receive reads "READ_FOR_DECRYPT", and demands 0.025 BTC for a victim's files to be unlocked.' -- source: https://linux.slashdot.org/story/19/11/24/1845253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Tracking Prevention in Microsoft's Edge Will Hit Google the Hardest
by Peter Reutemann 25 Nov '19

25 Nov '19

'Microsoft's Edge browser is built on the same open source code as Google Chrome. But Ed Bott, writing for ZDNet, noticed something interesting: On January 15, 2020, Microsoft is scheduled to roll out a completely revamped Edge browser to the general public. That browser, which is available for beta testing now on all supported versions of Windows and MacOS, includes a feature called Tracking Prevention. If that name sounds familiar, you're not imagining things. Microsoft added a Tracking Protection feature to Internet Explorer 9, back in 2011; it used simple text files called Tracking Protection Lists (TPLs) to allow or block third-party requests from specific domains. That's the same general principle behind Tracking Prevention in the new Edge, but the implementation is more usable and more sophisticated, with multiple Trust Protection Lists taking the place of a single TPL. I've spent the past week looking closely at this feature... [A]lthough it's aimed at the online advertising and tracking industries in general, my tests suggest that its effects are likely to be felt most directly by one company: Google. Using the default Balanced setting, Tracking Prevention blocked a total of 2,318 trackers, or an average of 35 on each page. Of that total, 552 were from Google domains. That's a mind-boggling 23.8% of the total. To put that into perspective, the second entry on the list of blocked trackers was Facebook, which represented 3.8% of the total. Rather than an anti-Google conspiracy, the article suggests this is instead just a reflection of both Google's ubiquity and its business model. "Google Analytics and Google AdSense are embedded on a staggering number of web pages."' -- source: https://tech.slashdot.org/story/19/11/24/2055219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM tomorrow
by Peter Reutemann 24 Nov '19

24 Nov '19

Hi everyone Just a friendly reminder that our AGM is on tomorrow: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19.2
by tom butz 23 Nov '19

23 Nov '19

Re: Linux Mint 19.2 The latest update ('new' package-manager) seems to disable Bluetooth. That also happened to me when I updated from 19.1 to 19.2 WITHOUT a complete reinstall. There are two workarounds: EITHER: back-up the whole system every night, and restore it if Bluetooth disappears again (=no icon in the panel after an update) - skipping updates. OR: use another system such as SparkyLinux, e.g. on a bootable sdcard for Bluetooth-transfers and stick with Mint 19.2 for anything else. I use this 'veteran' Linux because it features OpenShot 1.4 - my (favourite) moviemaker. My Toshiba laptop has 128 GB of RAM-HD, so copying/restoring to/from an image-file doesn't take all that long. Tom Butz

2 1

Server Management Recommendations
by Stu Meads 22 Nov '19

22 Nov '19

Hi all, I'm setting up a new Ubuntu 19.04LTS LAMP server in the next few months, I normally do it all myself, manage all the security myself etc, but I'm finding I don't have time and am looking for a reputable person or company to help me with initial setup, making sure everything is really secure, and be available for upgrades, security audits etc. My preference is a New Zealand based company in the hope that I will get a better quality service, easier communication etc, but will go for whatever's best for my employer Any recommendations either privately or via this list welcome

3 3

The Ad Tracker Arms Race Continues
by Lawrence D'Oliveiro 22 Nov '19

22 Nov '19

Web advertisers are resorting to a new technique <https://www.theregister.co.uk/2019/11/21/ublock_origin_firefox_unblockable_…> to bypass restrictions on third-party cookies for tracking users’ browsing behaviour: use first-party cookies instead. A detailed example can be found in this GitHub issue <https://github.com/uBlockOrigin/uBlock-issues/issues/780>: the site www.liberation.fr includes links to f7ds.liberation.fr, which is notionally under the same domain. However, that is actually a CNAME (alias) for the third-party tracker site liberation.eulerian.net. So cookies that are supposed to be restricted to *.liberation.fr are passed to that site as well. Just to be clear, this is not a browser “bug” by any means; it’s just part of how the DNS is supposed to work. The good news is, Firefox offers an API that adblocker addons can use to detect this sort of thing going on and stop it.

1 0

System76 Will Start Designing and Building Its Own Linux Laptops Beginning January 2020
by Peter Reutemann 21 Nov '19

21 Nov '19

'Denver-based PC manufacturer and Pop!_OS Linux developer System76 plans to follow-up its custom Thelio desktop PC with an in-house laptop beginning next year, according to founder and CEO Carl Richell. During a recent interview, Richell was quick to emphasize that the entire process of designing, prototyping and iterating the final product could take two to three years. But the company is eager to break into this market and put the same signature "stamp" on its laptop hardware that graces its custom-built Thelio desktop. System76 sells an extensive lineup of laptops, but the machines are designed by the likes of Sager and Clevo. The company doesn't merely buy a chassis and slap Pop!_OS on it, but Richell tells me he's confident that with the experience gained from developing Thelio -- and the recent investment into a factory at the company's Denver headquarters -- System76 is capable of building a laptop from the ground up that meets market needs and carries a unique value proposition. Richell says the company's first priority is locking down the aesthetic of the laptop and how various materials look and feel. It will simultaneously begin working on the supply chain aspects and speaking with various display and component manufacturers. System76 will design and build a U-class laptop first (basically an Ultrabook form factor like the existing Darter and Galago) and then evaluate what it might do with higher-end gaming and workstation notebooks with dedicated graphics.' -- source: https://hardware.slashdot.org/story/19/11/20/2241223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Where the Wi-Fi sucks” is where a new wireless protocol does its magic
by Peter Reutemann 21 Nov '19

21 Nov '19

'Researchers at Brigham Young University have created a new RF protocol that runs on top of existing consumer Wi-Fi at significantly greater range. But before you get too excited, the protocol's bandwidth is extremely low—so much so that it makes LoRa look like an OC-24. The protocol, called ONPC—short for On-Off Noise Power Communication—currently only specifies a single bit per second. Although ONPC only conveys one bit per second of data, its range is 60m or more beyond Wi-Fi—and it runs in software alone, on unmodified Wi-Fi hardware. An ONPC device can connect to standard Wi-Fi when range permits, fall back to ONPC mode if the connection drops, and then re-connect to the Wi-Fi when it becomes available again.' -- source: https://arstechnica.com/gadgets/2019/11/where-the-wi-fi-sucks-is-where-a-ne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google outlines plans for mainline Linux kernel support in Android
by Peter Reutemann 20 Nov '19

20 Nov '19

'It seems like Google is working hard to update and upstream the Linux kernel that sits at the heart of every Android phone. The company was a big participant in this year's Linux Plumbers Conference, a yearly meeting of the top Linux developers, and Google spent a lot of time talking about getting Android to work with a generic Linux kernel instead of the highly-customized version it uses now. It even showed an Android phone running a mainline Linux kernel. But first, some background on Android's current kernel mess.Currently, three major forks happen in between the "mainline" Linux kernel and a shipping Android device (note that "mainline" here has no relation to Google's own "Project Mainline"). First, Google takes the an LTS (Long Term Support) Linux kernel and turns it into the "Android Common kernel"—the Linux kernel with all the Android OS-specific patches applied. Android Common is shipped to the SoC vendor (usually Qualcomm) where it gets its first round of hardware-specific additions, first focusing on a particular model of SoC. This "SoC Kernel" then gets sent to a device manufacturer for even more hardware-specific code that supports every other piece of hardware, like the display, camera, speakers, usb ports, and any extra hardware. This is the "Device Kernel," and it's what actually ships on a device.' -- source: https://arstechnica.com/gadgets/2019/11/google-outlines-plans-for-mainline-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google and Samsung Fix Android Spying Flaw. Other Makers May Still Be Vulnerable
by Peter Reutemann 20 Nov '19

20 Nov '19

'Until recently, weaknesses in Android camera apps from Google and Samsung made it possible for rogue apps to record video and audio and take images and then upload them to an attacker-controlled server -- without any permissions to do so. Camera apps from other manufacturers may still be susceptible. From a report: The weakness, which was discovered by researchers from security firm Checkmarx, represented a potential privacy risk to high-value targets, such as those preyed upon by nation-sponsored spies. Google carefully designed its Android operating system to bar apps from accessing cameras and microphones without explicit permission from end users. An investigation published Tuesday showed it was trivial to bypass those restrictions. The investigation found that an app needed no permissions at all to cause the camera to shoot pictures and record video and audio. To upload the images and video -- or any other image and video stored on the phone -- to an attacker-controlled server, an app needed only permission to access storage, which is among one of the most commonly given usage rights. The weakness, which is tracked as CVE-2019-2234, also allowed would-be attackers to track the physical location of the device, assuming GPS data was embedded into images or videos. Google closed the eavesdropping hole in its Pixel line of devices with a camera update that became available in July. Checkmarx said Samsung has also fixed the vulnerability, although it wasn't clear when that happened. Checkmarx said Google has indicated that Android phones from other manufacturers may also be vulnerable. The specific makers and models haven't been disclosed.' -- source: https://tech.slashdot.org/story/19/11/19/1737219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0