- wlug - University of Waikato Mail Lists

BlueBorne Vulnerabilities Impact Over 5 Billion Bluetooth-Enabled Devices
by Peter Reutemann 13 Sep '17

13 Sep '17

'Security researchers have discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. Researchers say the vulnerabilities are undetectable and unstoppable by traditional security solutions. No user interaction is needed for an attacker to use the BleuBorne flaws, nor does the attacker need to pair with a target device. They affect the Bluetooth implementations in Android, iOS, Microsoft, and Linux, impacting almost all Bluetooth device types, from smartphones to laptops, and from IoT devices to smart cars. Furthermore, the vulnerabilities can be concocted into a self-spreading BlueTooth worm that could wreak havoc inside a company's network or even across the world. "These vulnerabilities are the most serious Bluetooth vulnerabilities identified to date," an Armis spokesperson told Bleeping Computer via email. "Previously identified flaws found in Bluetooth were primarily at the protocol level," he added. "These new vulnerabilities are at the implementation level, bypassing the various authentication mechanisms, and enabling a complete takeover of the target device." Consumers are recommended to disable Bluetooth unless you need to use it, but then turn it off immediately. When a patch or update is issued and installed on your device, you should be able to turn Bluetooth back on and leave it on safely. The BlueBorne Android App on the Google Play Store will be able to determine if a user's Android device is vulnerable. A technical report on the BlueBorne flaws is available here (PDF).' -- source: https://mobile.slashdot.org/story/17/09/12/2030213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Eric Light 13 Sep '17

13 Sep '17

Let's keep it on the list, thanks gb. noun: snark; 1. snide and sharply critical comments. I called out your behaviour for what it was, and I would have done so in-person too. I'm not singling you out, either - I did the same with someone else in July. The entire community suffers when that type of behaviour goes unaddressed - and it's the community's job to speak up if we want to protect the high standards we've enjoyed for the last fifteen years. E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es On Wed, 13 Sep 2017, at 10:59, gb wrote: > On the contrary, I was merely pointing out that insulting people on a > public forum is not something you would do to their faces. > > On Tue, 2017-09-12 at 15:02 +1200, Eric Light wrote: > > Did.... You actually just threaten me? > > > > E > > > > -------------------------------------------- > > Q: Why is this email five sentences or less? > > A: http://five.sentenc.es > > > > On Tue, 12 Sep 2017, at 14:39, gb wrote: > > > > > > "snark" ... "being a dick" ... would you like to say that to my face? > > > > > > > > > On Tue, 2017-09-12 at 14:04 +1200, Eric Light wrote: > > > > Is that snark really necessary, gb? I'm not sure about the rest of us, > > > > but I'm in this group for interesting news, tips, guidance, etc. > > > > > > > > The diversity of information here is one of the reasons that I've been > > > > on the list for almost a decade. I'm sure a full 30% of Peter's posts > > > > aren't Linux-specific, for example. That only adds to the benefit that > > > > we get as a group. > > > > > > > > Lawrence's post is fascinating, and could be the starting point for an > > > > interesting discussion if we could go ahead and not be dicks - either to > > > > the poster, or about the content. > > > > > > > > E > > > > > > > > -------------------------------------------- > > > > Q: Why is this email five sentences or less? > > > > A: http://five.sentenc.es > > > > > > > > On Tue, 12 Sep 2017, at 12:51, gb wrote: > > > > > Well that's got zero to do with linux, or Waikato ... unless someone > > > > > owns a Tesla in Waikato? (I doubt it). > > > > > > > > > > I've got some cool anecdotes on crappy things banks do with our money > > > > > supply, shall I share them here too? > > > > > > > > > > On Tue, 2017-09-12 at 12:02 +1200, Lawrence D'Oliveiro wrote: > > > > > > Tesla sometimes sells cars with more hardware battery capacity than > > > > > > is initially available for use by customers, offering the > > > > > > additional capacity as a subsequent software update. > > > > > > > > > > > > ... > > > > > > > > > > > > But last week, Tesla decided to temporarily make this extra > > > > > > capacity available even to Floridians who hadn't paid for the > > > > > > upgrade to ensure they had enough range to get out of Florida ahead > > > > > > of Hurricane Irma. > > > > > > > > > > > > ... > > > > > > > > > > > > Presumably, their vehicles will get a downgrade once hurricane > > > > > > season is over. > > > > > > > > > > > > <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…> > > > > > > _______________________________________________ > > > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > > > > > > > _______________________________________________ > > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > _______________________________________________ > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > > > > . > > _______________________________________________ > > wlug mailing list | wlug(a)list.waikato.ac.nz > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > .

1 0

“Mr Inkscape” Explains How To Pronounce His Name
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

In the comments to an article on an “Inkscape hackfest” from earlier this year, I asked, and he answered <http://libregraphicsworld.org/blog/entry/inkscape-hackfest-planned-for-late…>.

1 0

Bruce Schneier On Securing A Raspberry π
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Make magazine has an article about securing it. Reading it, I am struck by how much work it is to secure. I fear that this is beyond the capabilities of most tinkerers, and the result will be even more insecure IoT devices. <https://www.schneier.com/blog/archives/2017/09/securing_a_rasp.html>

1 0

mailing list etiquette
by Peter Reutemann 12 Sep '17

12 Sep '17

Hi everyone In light of recent events, a little refresher on the mailing list etiquette seems to be appropriate. You can find it here: https://list.waikato.ac.nz/mailman/listinfo/wlug Yes, there are topics which can kick off a flame war (vi/emacs, systemd). Some things are like politics or religion and cannot be discussed objectively. But calling other people names and/or posting snide, demeaning or threatening comments (on- or off-list) is below this list. I usually have a very hands-off approach to moderation, considering that we are all (or at least most of us are) adults and should know what is considered acceptable social behavior. However, if inciting behavior should continue, I reserve my right to ban people from this list. Last but not least: if you don't like the actual content being posted here, no one forces you to be a member of this mailing list. Simply unsubscribe. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Eric Light 12 Sep '17

12 Sep '17

Did.... You actually just threaten me? E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es On Tue, 12 Sep 2017, at 14:39, gb wrote: > > "snark" ... "being a dick" ... would you like to say that to my face? > > > On Tue, 2017-09-12 at 14:04 +1200, Eric Light wrote: > > Is that snark really necessary, gb? I'm not sure about the rest of us, > > but I'm in this group for interesting news, tips, guidance, etc. > > > > The diversity of information here is one of the reasons that I've been > > on the list for almost a decade. I'm sure a full 30% of Peter's posts > > aren't Linux-specific, for example. That only adds to the benefit that > > we get as a group. > > > > Lawrence's post is fascinating, and could be the starting point for an > > interesting discussion if we could go ahead and not be dicks - either to > > the poster, or about the content. > > > > E > > > > -------------------------------------------- > > Q: Why is this email five sentences or less? > > A: http://five.sentenc.es > > > > On Tue, 12 Sep 2017, at 12:51, gb wrote: > > > Well that's got zero to do with linux, or Waikato ... unless someone > > > owns a Tesla in Waikato? (I doubt it). > > > > > > I've got some cool anecdotes on crappy things banks do with our money > > > supply, shall I share them here too? > > > > > > On Tue, 2017-09-12 at 12:02 +1200, Lawrence D'Oliveiro wrote: > > > > Tesla sometimes sells cars with more hardware battery capacity than > > > > is initially available for use by customers, offering the > > > > additional capacity as a subsequent software update. > > > > > > > > ... > > > > > > > > But last week, Tesla decided to temporarily make this extra > > > > capacity available even to Floridians who hadn't paid for the > > > > upgrade to ensure they had enough range to get out of Florida ahead > > > > of Hurricane Irma. > > > > > > > > ... > > > > > > > > Presumably, their vehicles will get a downgrade once hurricane > > > > season is over. > > > > > > > > <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…> > > > > _______________________________________________ > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > _______________________________________________ > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > _______________________________________________ > > wlug mailing list | wlug(a)list.waikato.ac.nz > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > .

1 0

Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Tesla sometimes sells cars with more hardware battery capacity than is initially available for use by customers, offering the additional capacity as a subsequent software update. ... But last week, Tesla decided to temporarily make this extra capacity available even to Floridians who hadn't paid for the upgrade to ensure they had enough range to get out of Florida ahead of Hurricane Irma. ... Presumably, their vehicles will get a downgrade once hurricane season is over. <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…>

3 2

Google Chrome Will Soon Detect Man-in-the-Middle Attacks
by Peter Reutemann 10 Sep '17

10 Sep '17

'Google Chrome 63 will include a new security feature that will detect when third-party software is performing a Man-in-the-Middle (MitM) attack that hijacks the user's Internet connection.... Most MitM toolkits fail to correctly rewrite the user's encrypted connections, causing SSL errors that Chrome will detect. The new Chrome 63 feature is in the form of a new warning screen. This new error will appear whenever Chrome detects a large number of SSL connection errors in a short timespan, a sign that someone is trying -- and failing -- to intercept the user's web traffic. This includes both malware and legitimate applications, such as antivirus and firewall applications. The new Chrome error won't show up for all antivirus and firewall software, but only for those that do not rewrite SSL connections in a proper way, resulting in SSL errors. Chrome 63 is set for release on December 5, but users can already test it by enabling it in the Google Chrome dev branch' -- source: https://it.slashdot.org/story/17/09/10/1928232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OBS Studio – Record and Live Stream Videos from Linux Desktop
by Peter Reutemann 10 Sep '17

10 Sep '17

'OBS Studio is a free and open source cross-platform app with which you can create video records of your desktop screen and also live stream directly. You can use it to conveniently share your gaming, art, entertainment activities with Twitch.tv, YouTube, Hitbox.tv, DailyMotion, Connectcast.tv, CyberGame.tv, CashPlay.tv along with custom streaming servers free of charge! It comes with many in-house features that allow you to produce professional videos e.g. Studio Mode lets you live preview and adjust your scenes and sources before making them available for public viewing; you can choose to set any combo of hotkeys to start/stop streams or recordings, switch between scenes, mute audio sources, e.t.c.' -- source: https://www.fossmint.com/obs-studio-record-and-live-stream-videos-from-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Document Liberation Project Announces Initial QuarkXPress Support
by Lawrence D'Oliveiro 10 Sep '17

10 Sep '17

Libre Graphics World may not update very often, but its articles are usually worth reading. Like this one <http://libregraphicsworld.org/blog/entry/document-liberation-project-announ…>: Initially, Scribus was pretty much modeled after QuarkXPress, and the two projects still share some similarities. Early in the history of Scribus, it made a lot of sense to introduce support for QXP files. Users got mad with Quark's continuous quirks and bad user support, they would jump ship at the very next opportunity. Paul Johnson, former Scribus contributor, actually started working on support for QXP files in 2004. But after he had posted to a public mailing list about his progress, he reportedly received a cease and desist letter from Quark. Scribus was nowhere near its current fame at the time, and even now it would not be able to handle legal expenses (save for a theoretical FSF intervention). Back then Paul just stopped working on that project. The good news is, Quark no longer seems to be in a position to be such a bully.

1 0