- wlug - University of Waikato Mail Lists

Deleting Windows Server Child Folder Changes Parent Folder Permissions
by Lawrence D'Oliveiro 28 Nov '18

28 Nov '18

<https://www.theregister.co.uk/2018/11/28/microsoft_windows_10_server_2016_p…>: ... Microsoft's support team [said] initially that the behaviour was by design and introduced in Windows Server 2016. Interestingly, it only occurs when folders are deleted (or cut and pasted) using File Explorer. Using the command line makes things behave as one would expect. It also only occurred when using a local path. Deleting using a UNC path was fine.

1 0

Half of all Phishing Sites Now Have the Padlock
by Peter Reutemann 27 Nov '18

27 Nov '18

'You may have heard you should look for the padlock symbol at the top of a website before entering your password or credit card information into an online form. It's well-meaning advice, but new data shows it isn't enough to keep your sensitive information secure. From a report: Recent data from anti-phishing company PhishLabs shows that 49 percent of all phishing sites in the third quarter of 2018 bore the padlock security icon next to the phishing site domain name as displayed in a browser address bar. That's up from 25 percent just one year ago, and from 35 percent in the second quarter of 2018. This alarming shift is notable because a majority of Internet users have taken the age-old "look for the lock" advice to heart, and still associate the lock icon with legitimate sites. A PhishLabs survey conducted last year found more than 80% of respondents believed the green lock indicated a website was either legitimate and/or safe. In reality, the https:// part of the address (also called "Secure Sockets Layer" or SSL) merely signifies the data being transmitted back and forth between your browser and the site is encrypted and can't be read by third parties. The presence of the padlock does not mean the site is legitimate, nor is it any proof the site has been security-hardened against intrusion from hackers.' -- source: https://it.slashdot.org/story/18/11/27/1521240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 25 Nov '18

25 Nov '18

Hi everyone Just a friendly reminder that our AGM is next Monday: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ In order to be eligible to vote, "only those people who were paid members in the previous financial year and who have signed a membership form for the then-current financial year will be eligible to vote." (https://github.com/WLUG/charter/blob/master/rules_140120.pdf) See you next Monday! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Two Linux Kernels Revert Performance-Killing Spectre Patches
by Peter Reutemann 25 Nov '18

25 Nov '18

'Friday Greg Kroah-Hartman released stable point releases of Linux kernel 4.19.4, as well as 4.14.83 and 4.9.139. While they were basic maintenance updates, the 4.19.4 and 4.14.83 releases are significant because they also reverted the performance-killing Spectre patches (involving "Single Thread Indirect Branch Predictors", or STIBP) that had been back-ported from Linux 4.20, according to Phoronix: There is improved STIBP code on the way for Linux 4.20 that by default just applies STIBP to SECCOMP threads and processes requesting it via prctl() but otherwise is off by default (that behavior can also be changed via kernel parameters). Once that code is ready to go for Linux 4.20, we may see it then back-ported to these stable trees. Aside from reverting STIBP, these point releases just have various fixes in them as noted for 4.19.4, 4.14.83, and 4.9.139. Last Sunday Linus Torvalds complained that the performance impact of the STIPB code "was clearly way more expensive than people were told," according to ZDNet: "When performance goes down by 50 percent on some loads, people need to start asking themselves whether it was worth it. It's apparently better to just disable SMT entirely, which is what security-conscious people do anyway," wrote Torvalds. "So why do that STIBP slow-down by default when the people who *really* care already disabled SMT?"' -- source: https://linux.slashdot.org/story/18/11/24/2320228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Cybersecurity Group Touts Its New Open Source Private VPN
by Peter Reutemann 25 Nov '18

25 Nov '18

'Alphabet's cybersecurity division Jigsaw has designed a new open source private VPN aimed at journalists and the people sending them data. "Their work makes them more vulnerable to attack," said Santiago Andrigo, Jigsaw's product manager. "It can get really scary when they're outed and you're passing over information." Unscrupulous VPN providers can steal your identity, peek in on your data, inject their own ads on non-secure pages, or analyze your browsing habits and sell that information to advertisers, says one Jigsaw official. And you can't know for sure whether you can trust them, no matter what they say in the app store. "Journalists should be aware that their online activities might be subject to surveillance either by government agencies, their internet service providers or a hacker with malicious intent," said Laura Tich, technical evangelist for Code for Africa, a resource for African journalists. "As surveillance becomes ubiquitous in today's world, journalists face an increasing challenge in establishing secure communication in the digital space." The new private VPN, dubbed "Outline", is specifically designed to be resistant to censorship — because it's harder to detect as a VPN (and therefore is less likely to be blocked). Outline uses an encrypted socks5 proxy that looks like normal internet traffic. Once the user chooses a server location, Outline spins up a DigitalOcean server on Ubuntu, installs Docker, and imports an image of the actual server. It's been named Outline because in places where internet use may be restricted — it gives you a line out.' -- source: https://yro.slashdot.org/story/18/11/25/0117226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Gmail Bug Allows Sending Messages Anonymously
by Peter Reutemann 25 Nov '18

25 Nov '18

'Earlier this week software developer Tim Cotten discovered a serious glitch in Gmail. An anonymous reader quotes BleepingComputer: Tampering with the 'From:' header by replacing some text with an <object>, <script> or <img> tag causes the interface to show a blank space instead of the sender's address.... Opening the email does not help, either, as the sender's address continues to remain hidden and shows no info even when hovering on it, an action that typically reveals the details.... Trying to reply to the message is also of no help. Cotten attempted this thinking that Gmail would read the original email headers and determine the destination. "Wrong again! Gmail is at a complete loss at what to do!" Cotten writes in a blog post that details his new finding.... Using the Show Original option, which allows users with more experience to trace an email, the desired detail is still unavailable in the user-friendly view. Looking at the raw info, however, shows the source address buried at the end of the <img> tag Cotten used in his experiment. He didn't even have to spell correctly the data type to trigger the bug. Unfortunately, it is highly unlikely that the average Gmail user will be able to navigate to this area and determine who the apparently anonymous message is coming from. Due to this, for these users the risk of phishing is high. Cotten's bug report "relies on his previous discovery that proved how a malformed 'From:' header allows placing an arbitrary email address in the sender field," the article points out, also noting a third recently-reported Gmail bug that "allows fraudsters to create a 'mailto:' link that populates the destination field in the app with whatever address they want; the latter was reported about 19 months ago to Google and is still present in the Gmail app for Android." "According to the developer, one solution Google could implement to avoid forging the From field is to properly check the email headers and deny communication with an anomalous structure in the sender or recipient fields. Another method proposed by Cotten is Joran Greef's project Ronomon, which can trigger errors when email specifications are not followed." Threatpost reported Tuesday that Google "did not respond to a request for comment."' -- source: https://it.slashdot.org/story/18/11/25/1731238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Potentially disastrous Rowhammer bitflips can bypass ECC protections
by Peter Reutemann 21 Nov '18

21 Nov '18

'In early 2015, researchers unveiled Rowhammer, a cutting-edge hack that exploits unfixable physical weaknesses in the silicon of certain types of memory chips to transform data they stored. In the 42 months that have passed since then, an enhancement known as error-correcting code (or ECC) available in higher-end chips was believed to be an absolute defense against potentially disastrous bitflips that changed 0s to 1s and vice versa. Research published Wednesday has now shattered that assumption.' -- source: https://arstechnica.com/information-technology/2018/11/potentially-disastro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Have We Reached Peak Silicon Valley?
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121638…>: ... global smartphone sales saw their first year-on-year fall in history at the end of 2017. Apple seemed unaffected at the time, but its latest quarterly results now show falls in unit sales, as a result of which it will stop reporting them in future. From beginnings that we might date to around the mid-1970s, PC sales (and development) went on an uninterrupted upward curve right through the 1990s, only starting to stutter around about the 2000s. The smartphone revolution, even if it includes the Symbian era and not just Android and Apple, has not lasted quite as long. So what new information-processing technology will ignite the mass market next? If any?

2 1

Germany Proposes Rules For Home Router Security
by Lawrence D'Oliveiro 20 Nov '18

20 Nov '18

The federal German body responsible for information security has published some recommendations for how consumers’ internet routers should behave by default, including limiting the initially-enabled services, requiring firewall functionality, and mandating the deletion of all personal data on a factory reset <https://www.theregister.co.uk/2018/11/20/germany_versus_openwrt_ccc/>. This looks like a welcome first step, even if some argue it doesn’t go far enough.

1 0

Microsoft Azure Outage Fixed, Office 365 Still Broken
by Lawrence D'Oliveiro 19 Nov '18

19 Nov '18

They fixed Azure by turning the multi-factor authentication servers off and on again <https://www.theregister.co.uk/2018/11/19/microsoft_azure_office_outage_late…>. Lawrence “You Couldn’t Make This Up” D’Oliveiro

2 1