- wlug - University of Waikato Mail Lists

File-Storage App 4shared Caught Serving Invisible Ads and Making Purchases Without Consent
by Peter Reutemann 03 Jul '19

03 Jul '19

'With more than 100 million installs, file-sharing service 4shared is one of the most popular apps in the Android app store. But security researchers say the app is secretly displaying invisible ads and subscribes users to paid services, racking up charges without the user's knowledge -- or their permission -- collectively costing millions of dollars. From a report: "It all happens in the background... nothing appears on the screen," said Guy Krief, chief executive of London-based Upstream, which shared its research exclusively with TechCrunch. The researchers say the app contains suspicious third-party code that allowed the app to automate clicks and make fraudulent purchases. They said the component, built by Hong Kong-based Elephant Data, downloads code which is "directly responsible" for generating the automated clicks without the user's knowledge. The code also sets a cookie to determine if a device has previously been used to make a purchase, likely as a way to hide the activity.' -- source: https://it.slashdot.org/story/19/07/03/1738253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

D-Link To Undergo Security Audits For 10 Years as Part of FTC Settlement
by Peter Reutemann 03 Jul '19

03 Jul '19

'D-Link has agreed to a settlement with the US Federal Trade Commission in regards to a 2017 lawsuit in which the US government agency accused the Taiwanese hardware maker of misrepresenting the security of its devices and ignoring vulnerability reports. From a report: As part of the settlement, D-Link has promised to implement a new software security program for its routers and Internet-connected cameras. The company has also agreed to subject itself to ten years of biennial security audits from a third-party, independent auditor. The FTC gets to choose the auditor, while D-Link got to decide the certifications the auditor must obtain before allowing it to review its security program.' -- source: https://news.slashdot.org/story/19/07/03/1926220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Earth Ported To Browsers With WebAssembly
by Peter Reutemann 02 Jul '19

02 Jul '19

'The Google Earth team recently released a beta preview of a WebAssembly port of Google Earth. The new port runs in Chrome and other Chromium-based browsers, including Edge (Canary version) and Opera, as well as Firefox. From a report: The port thus brings cross-browser support to the existing Earth For Web version, which uses the native C++ codebase and Chrome's Native Client (NaCl) technology. Difference in multi-threading support between browsers leads to varying performance. Google Earth was released 14 years ago and allowed users to explore the earth through the comfort of their home. This original version of Google Earth was released as a native C++ based application intended for desktop install because rendering the whole world in real time required advanced technologies that weren't available in the browser. Google Earth was subsequently introduced for Android and iOS smartphones, leveraging the existing C++ codebase through technologies such as NDK and Objective-C++. In 2017, Google Earth was released for the Chrome browser, using Google's Native Client (NaCl) to compile the C++ code and run it in the browser.' -- source: https://tech.slashdot.org/story/19/07/02/1919251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mageia 7 Linux Distro Released
by Peter Reutemann 02 Jul '19

02 Jul '19

'If you're looking to try out a Linux distro that is not based on Ubuntu, Mageia 7 might be worth your consideration. It arrives two years after the release of Mageia 6 -- so unsurprisingly, the changelog is fairly long. The Mageia developers share the significant packages that have been updated below. Significant package updates include: kernel 5.1.14, rpm 4.14.2, dnf 4.2.6, Mesa 19.1, Plasma 5.15.4, GNOME 3.32, Xfce 4.14pre, Firefox 67, Chromium 73, and LibreOffice 6.2.3. Donald Stewart, Mageia developer, adds: There are lots of new features, exciting updates, and new versions of your favorite programs, as well as support for very recent hardware. There are classical installer images for both 32-bit and 64-bit architectures, as well as live DVDs for 64-bit Plasma, GNOME, Xfce, and 32-bit Xfce.' -- source: https://tech.slashdot.org/story/19/07/02/201232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Robots.txt Parser is Now Open Source
by Peter Reutemann 01 Jul '19

01 Jul '19

'For 25 years, the Robots Exclusion Protocol (REP) was only a de-facto standard. This had frustrating implications sometimes. On one hand, for webmasters, it meant uncertainty in corner cases, like when their text editor included BOM characters in their robots.txt files. On the other hand, for crawler and tool developers, it also brought uncertainty; for example, how should they deal with robots.txt files that are hundreds of megabytes large? Today, we announced that we're spearheading the effort to make the REP an internet standard. While this is an important step, it means extra work for developers who parse robots.txt files. We're here to help: we open sourced the C++ library that our production systems use for parsing and matching rules in robots.txt files. This library has been around for 20 years and it contains pieces of code that were written in the 90's. Since then, the library evolved; we learned a lot about how webmasters write robots.txt files and corner cases that we had to cover for, and added what we learned over the years also to the internet draft when it made sense.' -- source: https://search.slashdot.org/story/19/07/01/153253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nostalgia At Glastonbury ...
by Lawrence D'Oliveiro 01 Jul '19

01 Jul '19

From <https://www.theregister.co.uk/2019/07/01/microsoft_round_up/>, another sighting of Windows XP in mission-critical use: Unfortunate songstress Neneh Cherry was warbling through her set when the veteran OS finally gave up the ghost. Alas, XP was dealing with the stage back projection, meaning that the audience lurched from being vaguely surprised to learn that Cherry was still around to the horrifying realisation that so was XP.

1 0

The Infrastructure Mess Causing Countless Internet Outages
by Peter Reutemann 01 Jul '19

01 Jul '19

'Border Gateway Protocol has served the internet well for decades. But when it goes wrong, you notice it. From a report: In a weeks-long stretch in 2014, hackers stole thousands of dollars a day in cryptocurrency from owners. In 2017, internet outages cropped up around the United States for hours. Last year, Google Cloud suffered hours of disruptions. Earlier this month, a large swath of European mobile data was rerouted through the state-backed China Telecom. And on Monday, websites and services around the world -- including the internet infrastructure firm Cloudflare -- experienced hours of outages. These incidents may sound different, but they actually all resulted from problems -- some accidental, some malicious -- with a fundamental internet routing system called the Border Gateway Protocol. The web is distributed, but it's also interconnected. It needs to be so that data can move around worldwide without all being controlled by a single entity. So every time you load a website or send an email, BGP is the system responsible for optimizing the route that data takes across these sprawling, intertwined networks. And when it goes wrong, the whole internet feels it. Originally conceived in 1989 (on two napkins), the version of BGP used today remains largely unchanged since 1994. And though BGP has scaled surprisingly well, there's no denying that the internet is very different than it was 25 years ago. In fact, the way BGP was designed introduces risk of outages, manipulations, and data interception -- all of which have come to pass. The internet's backbone routers -- massive industrial nodes usually run by internet service providers, not the Linksys at your house -- each control a set of IP addresses and routes. ISPs and other large organizations use BGP to announce these routes to the world and calculate paths. Think of it like planning a cross-country drive: You need to know the different route options in each area, so you can stop at all the right corn mazes and the world's largest rocking chair without adding too much extra driving each day. But if your GPS is outdated, you could wind up at a dead end or on a new road that totally bypasses the salt flats.' -- source: https://tech.slashdot.org/story/19/07/01/1316206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Usage on Azure Has Surpassed Windows, Microsoft Developer Reveals
by Peter Reutemann 01 Jul '19

01 Jul '19

'Three and a half years ago, Mark Russinovich, Azure CTO, Microsoft's cloud, said, "One in four [Azure] instances are Linux." Next, in 2017, Microsoft revealed that 40% of Azure virtual machines (VM) were Linux-based. Then in the fall of 2018, Scott Guthrie, Microsoft's executive VP of the cloud and enterprise group, told me in an exclusive interview, "About half Azure VMs are Linux". Now, Sasha Levin, Microsoft Linux kernel developer, in a request that Microsoft be allowed to join a Linux security list, revealed that "the Linux usage on our cloud has surpassed Windows." Shocking you say? Not really. Linux is largely what runs enterprise computing both on in-house servers and on the cloud. Windows Server has been declining for years. In the most recent IDC Worldwide Operating Systems and Subsystems Market Shares report covering 2017, Linux had 68% of the market. Its share has only increased since then.' -- source: https://linux.slashdot.org/story/19/07/01/1333252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany to publish standard on modern secure browsers
by Peter Reutemann 01 Jul '19

01 Jul '19

'Germany's cyber-security agency is working on a set of minimum rules that modern web browsers must comply with in order to be considered secure. The new guidelines are currently being drafted by the German Federal Office for Information Security (or the Bundesamt für Sicherheit in der Informationstechnik -- BSI), and they'll be used to advise government agencies and companies from the private sector on what browsers are safe to use.' -- source: https://www.zdnet.com/article/germany-to-publish-standard-on-modern-secure-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ebooks Purchased From Microsoft Will Be Deleted This Month Because You Don't Really Own Anything Anymore
by Peter Reutemann 01 Jul '19

01 Jul '19

'Anyone who bought ebooks through the Microsoft Store is in for a rude shock in the coming days. The good news? You can get a refund. The bad news? All of your books are going to be deleted this month. Microsoft announced in April that it would stop selling ebooks and that any books the company already sold would stop working in early July because the DRM servers were being shut off. Yes, you read that correctly. Those books that you “bought” are going to disappear. Even the “free” books that you downloaded through Microsoft will be deleted.' -- source: https://gizmodo.com/ebooks-purchased-from-microsoft-will-be-deleted-this-mo… Possible solution to keep the books - remove the DRM: https://www.techradar.com/news/software/how-to-remove-ebook-drm-with-calibr… https://apprenticealf.wordpress.com/2012/09/10/drm-removal-tools-for-ebooks/ https://apprenticealf.wordpress.com/2011/01/13/ebooks-formats-drm-and-you-%… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1