- wlug - University of Waikato Mail Lists

Mozilla Might Distrust Dutch Government Certs Over 'False Keys'
by Peter Reutemann 05 Nov '17

05 Nov '17

'Mozilla engineers are discussing plans to remove support for a state-operated Dutch TLS/HTTPS provider after the Dutch government has voted a new law that grants local authorities the power to intercept Internet communications using "false keys". If the plan is approved, Firefox will not trust certificates issued by the Staat der Nederlanden (State of the Netherlands) Certificate Authority (CA)... This new law gives Dutch authorities the powers to intercept and analyze Internet traffic. While other countries have similar laws, what makes this one special is that authorities will have authorization to carry out covert technical attacks to access encrypted traffic. Such covert technical capabilities include the use of "false keys," as mentioned in Article 45 1.b, a broad term that includes TLS certificates. "Fears arise of mass Dutch Internet surveillance," reads a subhead on the article, citing a bug report which notes, among other things, the potential for man-in-the-middle attacks and the fact that the Netherlands hosts a major internet transit point' -- source: https://tech.slashdot.org/story/17/11/05/1845240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CyberSquirrel1: Tracking Infrastructure Damage Caused By Wildlife
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Interesting Twitter account <https://twitter.com/CyberSquirrel1> including the following item from a couple of days ago: Bird trips power supply to 4000 http://gisborneherald.co.nz/localnews/3069802-135/bird-trips-power-supply-t… … - Te Hapara, New Zealand

1 0

OnionShare – A Tool To Share Any Size Of Files Securely And Anonymously
by Peter Reutemann 05 Nov '17

05 Nov '17

'When we wrote an article about file sharing utilities such as Magic Womhole & transfer.sh most of the users asked is it secure? and where the files are stored. So, we decided to bring one of the best utility that stores and share files securely over the Internet. When we dig on that, we came to know about OnionShare which fulfill all this requirements. How are you saying, it falls under this category? Yes, it’s true because most of us know about Tor Browser which allows users to browse securely, privately and anonymously by implementing Onion routing in the application layer. Onion routing is a technique for anonymous communication over a computer network. OnionShare also developed in the same manner and allows you to use the Tor network to send files anywhere in the world.' -- source: https://www.2daygeek.com/onionshare-secure-way-to-share-files-sharing-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Easy guide to secure VNC server with TLS encryption
by Peter Reutemann 05 Nov '17

05 Nov '17

'In this tutorial, we will learn to install VNC server & secure VNC server sessions with TLS encryption. This method has been tested on CentOS 6 & 7 but should work on other versions/OS as well (RHEL, Scientific Linux etc).' -- source: http://linuxtechlab.com/secure-vnc-server-tls-encryption/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TorMoil Vulnerability Leaks Real IP Address From Tor Browser Users; Security Update Released
by Peter Reutemann 04 Nov '17

04 Nov '17

'The Tor Project has released a security update for the Tor Browser on Mac and Linux to fix a vulnerability that leaks users' real IP addresses. The vulnerability was spotted by Filippo Cavallarin, CEO of We Are Segment, an Italian company specialized in cyber-security and ethical hacking. Cavallarin privately reported the issue -- which he codenamed TorMoil -- to the Tor Project last week. Tor Project developers worked with the Firefox team (Tor Browser is based on the Firefox browser) to release a fix. Today, the Tor team released version 7.0.9 to address the vulnerability. Tor Browser 7.0.9 is only available for Mac and Linux users. Tor Browser on Windows is not affected.' -- source: https://it.slashdot.org/story/17/11/03/2127235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lots Of Digitally-Signed Malware Out There
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

One of the security weaknesses exploited by the “Stuxnet” worm that sabotaged Iran’s nuclear enrichment program was that it had a valid digital signature from a recognized issuer of certificates for Windows software. Of course, the issuer would never knowingly have validated a piece of malware, but the certificate had been compromised so it could be used without their permission. Turns out this sort of thing is not only quite common, there is a further problem in that anti-malware software, which is supposed to pick up revoked certificates and reject signatures that use them, frequently has bugs in their implementation of the signature-checking protocol, so they can let these bad signatures through. <https://arstechnica.com/information-technology/2017/11/evasive-code-signed-…>

1 0

The Patent That Just Wouldn’t Die
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

A holding company called Personal Audio claims to have a patent covering the entire idea of podcasting. Over the years, it has succeeded in winning some lucrative payouts, including $8 million from Apple and $1.3 million from CBS. All without making a single item of product itself. In other words, Personal Audio is what lawyers politely refer to as a “Non-Practising Entity” (NPE), or, in more common parlance, a patent troll. However, the Electronic Frontier Foundation has succeeded, with the help of a crowdfunding campaign, in invalidating this patent, using a system introduced at the USPTO called “inter partes review” (IPR). Of course, Personal Audio has not taken this lying down. It has come up with a truly imaginative series of legal counterarguments: * IPR violates the 7th Amendment of the US Constitution (right to trial by jury in a lawsuit). * IPR encourages “collective efforts to invalidate patents” which “severely tilts the playing field in favor of the party or parties seeking invalidation”. * the EFF has been working together with defendants in their litigation. Fortunately, the Court of Appeals for the Federal Circuit (CAFC) -- the same appeals court that overruled Judge William Alsup in his verdict (in Oracle vs Google) that APIs were not copyrightable -- seems to be a bit less uncritically pro-“Intellectual Property” these days (something to do with being slapped down by the Supreme Court?), and has rejected these arguments. Imagine if all this creativity had gone into producing actual useful products, instead of legal arguments ... <https://arstechnica.com/tech-policy/2017/11/eff-destroys-the-podcasting-pat…>

1 0

Microsoft Quietly Announces End of Last Free Windows 10 Upgrade Offer
by Peter Reutemann 03 Nov '17

03 Nov '17

'If you've been waiting to claim your free Windows 10 upgrade using the "assistive technologies" exception, you need to act soon. In a quiet change to an obscure web page, Microsoft announced this week that those exceptions will end on December 31, 2017. On July 29, 2016, Microsoft officially ended the Get Windows 10 program, which offered free Windows 10 upgrades to anyone currently running a supported earlier version of Windows. But the company left a giant loophole in a separate announcement at the same time. Under the terms of that announcement, individuals who use "assistive technologies" received an automatic extension of the free upgrade offer. Sometime in the past week, Microsoft quietly edited that page, to add "The accessibility upgrade offer expires on December 31, 2017."' -- source: https://tech.slashdot.org/story/17/11/03/1737219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Oreo Bug Sends Thousands of Phones Into Infinite Boot Loops
by Peter Reutemann 02 Nov '17

02 Nov '17

'A bug in the new "Adaptive Icons" feature introduced in Android Oreo has sent thousands of phones into infinite boot loops, forcing some users to reset their devices to factory settings, causing users to lose data along the way. The bug was discovered by Jcbsera, the developer of the Swipe for Facebook Android app (energy-efficient Facebook wrapper app), and does not affect Android Oreo (8.0) in its default state. The bug occurs only with apps that use adaptive icons -- a new feature introduced in Android Oreo that allows icons to change shape and size based on the device they're viewed on, or the type of launcher the user is using on his Android device. For example, adaptive icons will appear in square, rounded, or circle containers depending on the theme or launcher the user is using. The style of adaptive icons is defined a local XML file. The bug first manifested itself when the developer of the Swipe for Facebook Android app accidentally renamed the foreground image of his adaptive icon with the same name as this XML file (ic_launcher_main.png and ic_launcher_main.xml). This naming scheme sends Android Oreo in an infinite loop that regularly crashes the device. At one point, Android detects something is wrong and prompts the user to reset the device to factory settings. Users don't have to open an app, and the crashes still happen just by having an app with malformed adaptive icons artifacts on your phone. Google said it will fix the issue in Android Oreo 8.1.' -- source: https://tech.slashdot.org/story/17/11/01/1550256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 Best Lightweight Linux Distributions For Older Computers In 2017
by Peter Reutemann 31 Oct '17

31 Oct '17

Quick overview: 10. Peppermint 9. Lubuntu 8. Linux Lite 7. LXLE 6. CrunchBang++ 5. Bodhi Linux 4. antiX Linux 3. SparkyLinux 2. Puppy Linux 1. Tiny Core See here for full details: https://itsfoss.com/lightweight-linux-beginners/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0