- wlug - University of Waikato Mail Lists

VLC player has a critical flaw – and there’s no patch yet
by Peter Reutemann 25 Jul '19

25 Jul '19

'On the flip side, there are currently no known cases of the vulnerability being exploited in the wild Germany’s national Computer Emergency Response Team (CERT-Bund) has issued a security advisory to alert users of VLC media player of a severe vulnerability affecting this extremely popular open-source software. “A remote, anonymous attacker can exploit the vulnerability in VLC to execute arbitrary code, cause a denial-of-service condition, exfiltrate information, or manipulate files,” said CERT-Bund, which also discovered the security loophole. The memory-corruption flaw is known to reside in the player’s latest release, 3.0.7.1, but may also be present in its earlier versions. It affects the program’s Windows, Linux and UNIX versions and has earned a score of 4 out of 5 on the German agency’s severity scale.' -- source: https://cybersafe.mcttrainingconsultant.com/?p=14585 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Advanced mobile surveillanceware, made in Russia, found in the wild
by Peter Reutemann 24 Jul '19

24 Jul '19

'Researchers have discovered some of the most advanced and full-featured mobile surveillanceware ever seen. Dubbed Monokle and used in the wild since at least March 2016, the Android-based application was developed by a Russian defense contractor that was sanctioned in 2016 for helping that country’s Main Intelligence Directorate meddle in the 2016 US presidential election. Monokle uses several novel tools, including the ability to modify the Android trusted-certificate store and a command-and-control network that can communicate over Internet TCP ports, email, text messages, or phone calls. The result: Monokle provides a host of surveillance capabilities that work even when an Internet connection is unavailable.' -- source: https://arstechnica.com/information-technology/2019/07/advanced-mobile-surv… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'The Raspberry Pi 4 Needs a Fan'
by Peter Reutemann 24 Jul '19

24 Jul '19

'Author and programmer Jeff Geerling explains in a blog post why the new Raspberry Pi 4 needs a fan. Unlike previous Pis that didn't require a fan or heatsink to avoid CPU throttling, the Pi 4 is a different beast and "pretty much demands a fan," writes Geerling. "Not only does the CPU get appreciably hot even under normal load, there are a number of other parts of the board that heat up to the point they are uncomfortable to touch." After 5 minutes at idle, he recorded the CPU/System-on-a-Chip (SoC) was around 60C, and it climbed to the 60-70C range when using the USB ports. "[I]magine if you're truly using the Pi 4 as a desktop replacement, with at least one external USB 3.0 hard drive attached, WiFi connected and transferring large amounts of data, a USB keyboard and mouse, a few browser windows open (the average website these days might as well be an AAA video game with how resource-intense it is), a text editor, and a music player," writes Geerling. "This amount of load is enough to cause the CPU to throttle in less than 10 minutes." So, Geerling did what any programmer and DIYer would do and decided to add a fan himself to the official case -- and in addition to the blog post describing the process, he made a 22-minute-long video showing you what he did. From the post: Without any ventilation, it's kind of a little plastic oven inside the Pi 4 case. A heat sink might help in some tiny way, but that heat has nowhere to go! So I decided to follow the lead of Redditor u/CarbyCarberson and put a fan in the top cover. [...] After installing the fan, I booted the Pi and ran "stress --cpu 4" and let it go for an hour. The entire time, the CPU's temperature stayed at or under 60C (140F), a full 20C lower than the throttling point. There are some other options which may be even easier than modifying the official case, like the Fan Shim from Pimoroni or purchasing a 3rd party case with a fan built in. But this option was easy enough and all I needed to complete the project was a $4 fan and a $7 hole saw drill bit (which I can use for other projects in the future). ' -- source: https://hardware.slashdot.org/story/19/07/17/2254204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Fortnite' Creator Epic Games Supports Blender Foundation With $1.2 Million
by Peter Reutemann 24 Jul '19

24 Jul '19

'Apparently having a lot of people playing Fortnite is good for the open source community too. Epic Games' MegaGrants program just awarded the Blender Foundation with $1.2 million over the next three years...to further the success of the free and open source 3D creation suite. It's part of the company's $100 million "MegaGrants" program, according to the announcement. "Open tools, libraries and platforms are critical to the future of the digital content ecosystem," said Tim Sweeney, founder and CEO of Epic Games. "Blender is an enduring resource within the artistic community, and we aim to ensure its advancement to the benefit of all creators."' -- source: https://games.slashdot.org/story/19/07/21/1551251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chances of destructive BlueKeep exploit rise with new explainer posted online
by Peter Reutemann 23 Jul '19

23 Jul '19

'A security researcher has published a detailed guide that shows how to execute malicious code on Windows computers still vulnerable to the critical BlueKeep vulnerability. The move significantly lowers the bar for writing exploits that wreak the kinds of destructive attacks not seen since the WannaCry and NotPetya attacks of 2017, researchers said. As of three weeks ago, more than 800,000 computers exposed to the Internet were vulnerable to the exploit, researchers from security firm BitSight said last week. Microsoft and a chorus of security professionals have warned of the potential for exploits to sow worldwide disruptions. The risk of the bug, found in Microsoft's implementation of the remote desktop protocol, stems from the ability for attacks to spread from one vulnerable computer to another with no interaction required of end users.' -- source: https://arstechnica.com/information-technology/2019/07/explainer-for-exploi… May you live in interesting times (as a Windows users)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cycling through windows of same application
by Peter Reutemann 23 Jul '19

23 Jul '19

Hi everyone Just learned something new by accident... ;-) Using "Alt+`" (the key above Tab), you can limit the cycling to the windows of that application, e.g., all Firefox or LibreOffice Writer/Calc windows in a workspace. Useful alternative to "Alt+Tab" which cycles through all Windows in a workspace. >From the looks of it, cycling through multiple terminal windows doesn't work. I presume, this is because they are different processes rather than child windows. Tested on Linux Mint 19.1 MATE desktop. -- source: https://askubuntu.com/questions/1160167 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

SUSE Names Melissa Di Donato New CEO
by Peter Reutemann 22 Jul '19

22 Jul '19

'Melissa Di Donato, SAP's former COO, has been named SUSE's new CEO. ZDNet reports: London-based Di Donato is a well-known technology leader. In particular, she has a proven track record in sales and business operations. Besides being SAP's COO, she was also the company's chief revenue officer. In SAP's latest quarter, SAP saw an increase of 11% year-over-year revenues. Much of that came from the cloud -- where SAP saw 40% year-over-year growth. SAP's cloud is built on SUSE's Linux servers and OpenStack cloud. Di Donato succeeds Nils Brauckmann. While officially Brauckmann is retiring, there seems to be more to the story. On LinkedIn, Brauckmann wrote: "I care very deeply for the SUSE business and its employees, and this difficult decision is based entirely on personal reasons. I am pleased to be handing over the reins to such a talented and accomplished leader as Melissa Di Donato." In his SUSE statement, Brauckman added: "She is a proven and dynamic change agent, and many of her achievements have occurred in subscription businesses that exist in high-growth cloud environments." In April, then-CEO Nils Brauchmann said his company would soon be the largest independent Linux company. This comes after Brauckmann delivered eight years of continuous expansion during his tenure, including record-breaking revenues in FY18, reports ZDNet. "Under Di Donato's leadership, SUSE will continue to focus on growth and expansion. What that means is she's expected to advance SUSE's core business and emerging technologies, both organically and through add-on acquisitions."' -- source: https://linux.slashdot.org/story/19/07/22/2038259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dropbox Brings Back Support For ZFS, XFS, Btrfs And eCryptFS On Linux
by Peter Reutemann 22 Jul '19

22 Jul '19

'Speaking of Dropbox, the online storage cloud service has enabled support for ZFS and XFS on 64-bit Linux systems, and eCryptFS and Btrfs on all Linux systems. The move comes after it recently pulled support for all file storage systems on Linux except Ext4. From a report: Dropbox stopped supporting folder syncing to drives with filesystems it deemed "uncommon", which on Linux meant anything but Ext4, upsetting quite a few users. The reason cited for this was that "a supported file system is required as Dropbox relies on extended attributes (X-attrs) to identify files in the Dropbox folder and keep them in sync", which doesn't really make sense since there are many filesystems that support xattr (extended attributes) on Linux. After this change was announced, various workarounds started to appear online, including one that I posted on Linux Uprising. There was even a new unofficial, open source Dropbox client developed for this reason (which is also much lighter than the official client by the way). But this didn't last long though, as last week, the Dropbox 77.3.127 beta changelog says that Dropbox has added back support for ZFS (on 64-bit systems only), XFS (on 64bit systems only), Btrfs and eCryptFS.' -- source: https://hardware.slashdot.org/story/19/07/22/1534200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This pixel tracking demo shows how easy it is to make a creepy surveillance tool
by Peter Reutemann 19 Jul '19

19 Jul '19

'The Superhuman controversy from earlier this month, in which a former Silicon Valley exec blew the lid off a series of controversial email surveillance tools offered by the up-and-coming startup, has prompted a bit of soul searching among those in the tech industry. But in twisted fashion, the public blasting of a company like Superhuman has been the tech equivalent of opening Pandora’s Box, unearthing all sorts of free and easily available tools that have done this for years and can be employed by anyone with just the tiniest shred of tech savvy. For instance, an open source, Python-based web tool called Supertracker has popped up on Github, courtesy of Delian Asparouhov, an investor with the venture capital firm Founder’s Fund. It lets anyone create their own tracking pixel, coyly disguised as either a transparent image, an image of the pokémon pikachu, or a not-so-subtle magnifying glass. Creating it is as easy as inputting a user name, picking a tracking pixel image, and hitting the enter key. From there, you can save the image, paste it in the body of any email, and send it off. Whoever opens it will have the when and even the where transmitted back to you. Of course, you can do similar styles of tracking with any number of available Superhuman competitors and browser extensions. But Asparouhov’s tool has the added benefit of walking you through the process step by step and laying out just how simple it is to siphon away this kind of sensitive info with a few simple lines of code. (He also outlines some good defenses against this type of surveillance.) ' -- source: https://www.theverge.com/2019/7/19/20700843 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China's Tech Giants Have a Second Job: Helping Beijing Spy on Its People
by Peter Reutemann 19 Jul '19

19 Jul '19

'Tencent and Alibaba are among the firms that assist authorities in hunting down criminal suspects, silencing dissent and creating surveillance cities. From a report: Alibaba Group's sprawling campus has collegial workspaces, laid-back coffee bars and, on the landscaped grounds, a police outpost. Employees use the office to report suspected crimes to the police, according to people familiar with the operation. Police also use it to request data from Alibaba for their own investigations, these people said, tapping into the trove of information the tech giant collects through its e-commerce and financial-payment networks. In one case, the police wanted to find out who had posted content related to terrorism, said a former Alibaba employee. "They came to me and asked me for the user ID and information," he recalled. He turned it over. The Chinese government is building one of the world's most sophisticated, high-tech systems to keep watch over its citizens, including surveillance cameras, facial-recognition technology and vast computers systems that comb through terabytes of data. Central to its efforts are the country's biggest technology companies, which are openly acting as the government's eyes and ears in cyberspace. Companies including Alibaba Group Holding, Tencent Holdings and Baidu, are required to help China's government hunt down criminal suspects and silence political dissent. Their technology is also being used to create cities wired for surveillance.' -- source: https://yro.slashdot.org/story/19/07/19/1443207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0