- wlug - University of Waikato Mail Lists

Found: New Android malware with never-before-seen spying capabilities
by Peter Reutemann 17 Jan '18

17 Jan '18

'Last year, researchers found what at the time was quite possibly the world's most sophisticated espionage app ever written for the Android mobile operating system. Now, in a discovery that underscores the growing arms race among competing malware developers, researchers have uncovered a new Android spying platform that includes location-based audio recording and other features that have never been seen in the wild before. According to a report published Tuesday by antivirus provider Kaspersky Lab, "Skygofree" is most likely an offensive security product sold by an Italy-based IT company that markets various surveillance wares. With 48 different commands in its latest version, the malware has undergone continuous development since its creation in late 2014. It relies on five separate exploits to gain privileged root access that allows it to bypass key Android security measures. Skygofree is capable of taking pictures, capturing video, and seizing call records, text messages, geolocation data, calendar events, and business-related information stored in device memory. Skygofree also includes the ability to automatically record conversations and noise when an infected device enters a location specified by the person operating the malware. Another never-before-seen feature is the ability to steal WhatsApp messages by abusing the Android Accessibility Service that's designed to help users who have disabilities or who may temporarily be unable to fully interact with a device. A third new feature: the ability to connect infected devices to Wi-Fi networks controlled by attackers. Skygofree also includes other advanced features, including a reverse shell that gives malware operators better remote control of infected devices. The malware also comes with a variety of Windows components that provide among other things a reverse shell, a keylogger, and a mechanism for recording Skype conversations' -- source: https://arstechnica.com/information-technology/2018/01/found-new-android-ma… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Phrase Of The Week: “Foveated Rendering”
by Lawrence D'Oliveiro 16 Jan '18

16 Jan '18

<http://www.theregister.co.uk/2018/01/16/human_limits_of_vr_and_ar/>: By some estimates, given a field of view of 180 degrees, around 74 gigabytes of visual data are available to us each second, but only around 125 megabytes are ultimately processed ... Much of the rest is chucked away before it even gets to the optic nerve. But trying to minimize the rendering workload by concentrating on the fovea (the most detail-sensitive part of the eye, the little spot where the image falls when you “look at” something) is not so simple, given the quirks of how our visual perception actually works. Computer graphics doyen Alvy Ray Smith is reputed to have said “reality is 80 million polygons per second”. I think we can achieve that now, but the pixel rate considered acceptable on a conventional monitor is peanuts compared to that required for VR.

1 0

Fighting Ransomware
by Lawrence D'Oliveiro 15 Jan '18

15 Jan '18

No More Ransom <https://www.schneier.com/blog/archives/2018/01/fighting_ransom.html> is a joint project between Europol, the Dutch police, Kaspersky and McAfee to offer a central repository of bypasses for ransomware. Mainly good against older strains, but it should still help prevent lightening a few pocketbooks ...

1 0

20 Years Later, Has Open Source Changed the World?
by Peter Reutemann 15 Jan '18

15 Jan '18

'"Most code remains closed and proprietary, even though open source now dominates enterprise platforms," notes Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative). "How can that be?" he asks, in an essay noting it's been almost 20 years since the launch of the Open Source Initiative, arguing that so far open source "hasn't changed the world as promised." [T]he reason most software remains locked up within the four walls of enterprise firewalls is that it's too costly with too small of an ROI to justify open-sourcing it. At least, that's the perception. Such a perception is impossible to break without walking the open source path, which companies are unwilling to walk without upfront proof. See the problem? This chicken-and-egg conundrum is starting to resolve itself, thanks to the forward-looking efforts of Google, Facebook, Amazon, and other web giants that are demonstrating the value of open-sourcing code. Although it's unlikely that a State Farm or Chevron will ever participate in the same way as a Microsoft, we are starting to see companies like Bloomberg and Capital One get involved in open source in ways they never would have considered back when the term "open source" was coined in 1997, much less in 2007. It's a start. Let's also not forget that although we have seen companies use more open source code over the past 20 years, the biggest win for open source since its inception is how it has changed the narrative of how innovation happens in software. We're starting to believe, and for good reason, that the best, most innovative software is open source. The article strikes a hopeful note. "We're now comfortable with the idea that software can, and maybe should, be open source without the world ending. The actual opening of that source, however, is something to tackle in the next 20 years.' -- source: https://news.slashdot.org/story/18/01/14/1627207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meltdown and Spectre Patches Bricking Ubuntu 16.04 Computers
by Peter Reutemann 10 Jan '18

10 Jan '18

'Ubuntu Xenial 16.04 users who updated to receive the Meltdown and Spectre patches are reporting they are unable to boot their systems and have been forced to roll back to an earlier Linux kernel image. The issues were reported by a large number of users on the Ubuntu forums and Ubuntu's Launchpad bug tracker. Only Ubuntu users running the Xenial 16.04 series appear to be affected. All users who reported issues said they were unable to boot after upgrading to Ubuntu 16.04 with kernel image 4.4.0-108. Canonical, the company behind Ubuntu OS, deployed Linux kernel image 4.4.0-108 as part of a security update for Ubuntu Xenial 16.04 users, yesterday, on January 9. According to Ubuntu Security Notice USN-3522-1 and an Ubuntu Wiki page, this was the update that delivered the Meltdown and Spectre patches.' -- source: https://news.slashdot.org/story/18/01/10/1634215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany Ban On Online Hate Speech Triggers Debate
by Lawrence D'Oliveiro 10 Jan '18

10 Jan '18

A new law has come into effect in Germany whereby companies like Facebook and Twitter face multi-million-euro fines if they don’t block their users from expressing “hate speech” <http://www.aljazeera.com/news/2018/01/germany-ban-online-hate-speech-trigge…>. Trouble is, this law seems to be a bit of a blunt axe: on the one hand it led to the temporary suspension of the Twitter account of the deputy leader of the far-right AfD party, Beatrix von Storch. But also caught up in the net was the account of the satirical “Titanic” magazine, after it parodied a phrase used by von Storch. Then again, if you are seen to clamp down too hard on particular points of view, that gives political ammunition to those who claim they are being censored...

1 0

Re-Assembling Shredded Stasi Records
by Lawrence D'Oliveiro 09 Jan '18

09 Jan '18

During the last days of the German Democratic Republic (a.k.a. East Germany), the Stasi secret police tried to destroy the more incriminating records they had been keeping on their own citizens. They were only partially successful. And even then, there has been an ongoing project to reassemble those torn-up pieces of paper, by scanning them and doing pattern-recognition to match up the image pieces. Seems the easiest ones are fairly manageable, but now they are getting to smaller fragments, which are proving more of a challenge. <https://www.techdirt.com/articles/20180105/07120838936/stasis-tiny-torn-up-…>

1 0

Another Fork Takes Over The Original Project
by Lawrence D'Oliveiro 08 Jan '18

08 Jan '18

Open-source software projects can fork for various reasons. Sometimes a bunch of developers want to go in a different direction. Other times the original project appears to be languishing, but those in charge are reluctant to give up control. Sometimes the forks peter out, other times they coexist happily (or unhappily) with the original project, occasionally they even absorb the original project. This <http://www.theregister.co.uk/2018/01/08/lede_and_openwrt_merge/> seems to be one of the latter cases: the LEDE fork of OpenWRT is merging back in, but the merger will be “governed under the rules of the LEDE project”.

1 0

Can You Install Linux On a 1993 PC?
by Peter Reutemann 07 Jan '18

07 Jan '18

'The oldest x86 CPU that the Linux kernel supports today is theoretically the 486. However is this theory actually true in practice? I decided to put this theory to the test in my project. His site describes installing Gentoo Linux on an "ancient" IBM PS/1 Consultant 2133 19C (released in 1993), with 64MB SIMM-72 RAM. (Though to speed things up, he compiled that minimal version of Gentoo on a modern Thinkpad T430 released in 2012.) "Due to the age of the PC, the BIOS only supports booting from the floppy drive or internal HDD," so there was also some disk partitioning and kernel configuration. ("Must disable 64-bit kernel for obvious reasons!") A half-hour video shows that it takes almost 11 minutes just to boot up -- and five and a half minutes to shut down. "Despite the many roadblocks I faced, I was impressed by the level of support Linux has for ancient hardware like this." And there's one more added bonus. "Given the age of the 486 (1989 technology), it does not support branch prediction... Ironically this makes it safe from the Meltdown and Spectre attacks."' -- source: https://linux.slashdot.org/story/18/01/07/228222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can We Replace Intel x86 With an Open Source Chip?
by Peter Reutemann 07 Jan '18

07 Jan '18

'Perhaps the Meltdown and Spectre bugs are the impetus for making long-overdue changes to the core DNA of the semiconductor industry and how chip architectures are designed... Linux (and other related FOSS tech that forms the overall stack) is now a mainstream operating system that forms the basis of public cloud infrastructure and the foundational software technology in mobile and Internet of Things (IoT)... We need to develop a modern equivalent of an OpenSPARC that any processor foundry can build upon without licensing of IP, in order to drive down the costs of building microprocessors at immense scale for the cloud, for mobile and the IoT. It makes the $200 smartphone as well as hyperscale datacenter lifecycle management that much more viable and cost-effective. Just as Linux and open source transformed how we view operating systems and application software, we need the equivalent for microprocessors in order to move out of the private datacenter rife with these legacy issues and into the green field of the cloud... The fact that we have these software technologies that now enable us to easily abstract from the chip hardware enables us to correct and improve the chips through community efforts as needs arise... We need to stop thinking about microprocessor systems' architectures as these licensed things that are developed in secrecy by mega-companies like Intel or AMD or even ARM... The reality is that we now need to create something new, free from any legacy entities and baggage that has been driving the industry and dragging it down the past 40 years. Just as was done with Linux. The bigger question is which chip should take its place. "I don't see ARM donating its IP to this effort, and I think OpenSPARC may not be it either. Perhaps IBM OpenPOWER? It would certainly be a nice gesture of Big Blue to open their specification up further without any additional licensing, and it would help to maintain and establish the company's relevancy in the cloud going forward. "RISC-V, which is being developed by UC Berkeley, is completely Open Source."' -- source: https://news.slashdot.org/story/18/01/06/0424200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0