- wlug - University of Waikato Mail Lists

Vulnerabilities Discovered In Mobile Bootloaders of Major Vendors
by Peter Reutemann 05 Sep '17

05 Sep '17

'Android bootloader components from five major chipset vendors are affected by vulnerabilities that break the CoT (Chain of Trust) during the Android OS boot-up sequence, opening devices to attacks. The vulnerabilities were discovered with a new tool called BootStomp, developed by nine computer scientists from the University of California, Santa Barbara. Researchers analyzed five bootloaders from four vendors (NVIDIA, Qualcomm, MediaTek, and Huawei/HiSilicon). Using BootStomp, researchers identified seven security flaws, six new and one previously known (CVE-2014-9798). Of the six new flaws, bootloader vendors already acknowledged five and are working on a fix. "Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks," the research team said (PDF). "Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT."' -- source: https://mobile.slashdot.org/story/17/09/05/0257221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android One Is Anything But Dead, Google Reaffirms With Xiaomi Mi A1
by Peter Reutemann 05 Sep '17

05 Sep '17

'Google executives shared the stage with Xiaomi chiefs at a media event in New Delhi on Tuesday as the Chinese phone maker unveiled its "new flagship" Mi A1 smartphone. Google's presence at the event was essential. Xiaomi's Mi A1 is the latest phone to be launched under Google's Android One program, a three-year-old initiative from Google, which in the past year has been presumed dead by many. It's anything but that, Google executives said. The Xiaomi Mi A1 smartphone features a 5.5-inch full-HD (1080x1920 pixels) display. It also offers a duo of 12-megapixel rear cameras, one with telephoto capability and 2X optical zoom feature. On the front, for the selfie enthusiasts is a 5-megapixel shooter. The dual-SIM capable Mi A1 smartphone houses a Snapdragon 625 octa-core SoC, 4GB of RAM, 64GB internal storage, IR blaster, a 3080mAh battery, a fingerprint scanner, modems for 4G LTE bands in its gold- and black-coloured thin, full-metal unibody form factor. It is priced at $235, and will be available in dozens of markets including Mexico, India, Indonesia, Russia, and Singapore.' -- source: https://tech.slashdot.org/story/17/09/05/1014235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With Android Oreo, Google Is Introducing Linux Kernel Requirements
by Peter Reutemann 04 Sep '17

04 Sep '17

'As is easy to tell by comparing versions of Android from different handset manufacturers, developers are -- broadly speaking -- free to do whatever they want with Android, but with Oreo, one aspect of this is changing. Google is introducing a new requirement that OEMs must meet certain requirements when choosing the Linux kernel they use. Until now, as pointed out by XDA Developers, OEMs have been free to use whatever Linux kernel they wanted to create their own version of Android. Of course, their builds still had to pass Google's other tests, but the kernel number itself was not an issue. Moving forward, Android devices running Oreo must use at least kernel 3.18, but there are more specific requirements to meet as well. Google explains on the Android Source page: "Android O mandates a minimum kernel version and kernel configuration and checks them both in VTS as well as during an OTA. Android device kernels must enable the kernel .config support along with the option to read the kernel configuration at runtime through procfs."' -- source: https://linux.slashdot.org/story/17/09/03/1653227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

78 Open Source Replacements for Expensive Applications
by Peter Reutemann 03 Sep '17

03 Sep '17

'Back when Datamation first started making lists of open source software that could replace expensive proprietary applications, most commercial software came in a box and required a flat fee for purchase. These days, with the advent of cloud computing and software as a service, most applications require a regular monthly or yearly subscription. Those subscriptions make it seem like software has become more affordable. After all, $10 or $20 a month doesn't seem like a lot. But when you add up those repeating fees, users often pay more under the new subscription plans than they did under the old flat-fee arrangements. If you use a lot of different applications, those fees can quickly add up. And it can be particularly hard to justify the expense for a piece of software that you only use once in a while. Open source software offers an alternative to paying those high fees. And in many cases, the open source options are as good as or better than the comparable commercial, proprietary solutions. In fact, in the most recent BlackDuck Future of Open Source Survey, the top reasons why people said they use open source software were because of the features, freedom from vendor lock-in and the quality of the solutions. Price and total cost of ownership weren't even on the list. In other words, people are using open source because the software is so good, and the fact that it is free is just a side benefit. The list below includes a variety of open source software for home users, SMBs and large enterprises. All of these applications can replace commercial products that can carry high prices. Even if buyers choose to purchase support or other services for their open source software, the open source options are generally much more affordable than the comparable proprietary solutions.' -- source: http://www.datamation.com/open-source/78-open-source-replacements-for-expen… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost-OT: Linux Comic
by Lawrence D'Oliveiro 01 Sep '17

01 Sep '17

There is this peculiar subgenre of art featuring characters called “OS-tans”. These are personifications of operating systems. I’m not sure how their characters and adventures relate to the OSes for which they are named, but anyway here is one about a character named Linux: <https://bellacielo.deviantart.com/gallery/33067628/Linux-Comic-Complete>.

1 0

The Most Epic Tech-Support Call In History
by Lawrence D'Oliveiro 01 Sep '17

01 Sep '17

Scott Manley tells the story <https://www.youtube.com/watch?v=wSSmNUl9Snw> of how the Apollo 14 mission was saved by a truly remarkable bit of computer hacking. You might be thinking: “Have you tried turning it off and on again?” Apollo 10 did that. And there were the computer crashes (“1202 alarm” and “1201 alarm”) during the Apollo 11 landing. But 14 was being stymied by an intermittently-shorting abort switch: if that triggered at the wrong time, the mission was over. And the software couldn’t be reprogrammed, since it was all woven (literally) into ROM. So a bright young guy named Don Eyles was woken up in the middle of the night, and over the space of a couple of hours he put together a sequence of manual patches to the writable memory to temporarily disable the abort switch at crucial moments, with further patches necessary to deal with the consequences of this elsewhere in the code. The astronauts had to follow the instructions and key in the numbers exactly as given. (Upload? What upload?) This included having to manually crank the descent engine up to full thrust at the right time, because the automatic program for doing so would not be working. Anyway, as history records, they successfully made it down to the lunar surface, and back home again. Mission accomplished.

1 0

711 million email addresses ensnared in "largest" spambot
by Peter Reutemann 29 Aug '17

29 Aug '17

'A huge spambot ensnaring 711 million email accounts has been uncovered. A Paris-based security researcher, who goes by the pseudonymous handle Benkow, discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam. Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.' -- source: http://www.zdnet.com/article/onliner-spambot-largest-ever-malware-campaign-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

scrollbars: click to scroll
by Peter Reutemann 29 Aug '17

29 Aug '17

Hi everyone Here's one for us old-fogies that don't like the new fandangled behavior of scrollbars, moving to where you click instead of scrolling (drives me nuts when scrolling through posts). For GTK do the following: - Create ~/.config/gtk-3.0/settings.ini - add the following content [Settings] gtk-primary-button-warps-slider = false --source: https://unix.stackexchange.com/a/306340 For Firefox itself do this: - go to about:config - right-click and select "New" of type "Integer" - use "ui.scrollToClick" as name and enter value "0" -- source: https://unix.stackexchange.com/a/276016 And, if you want your top/bottom buttons on the scrollbar back, have a look here: https://linuxnorth.wordpress.com/2014/06/01/vertical-scroll-bars-in-linux-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

On Internet Privacy, Be Very Afraid
by Peter Reutemann 29 Aug '17

29 Aug '17

'Cybersecurity expert and Berkman Klein fellow Bruce Schneier talked to the Gazette about what consumers can do to protect themselves from government and corporate surveillance. From the interview: GAZETTE: After whistleblower Edward Snowden's revelations concerning the National Security Agency's (NSA) mass surveillance operation in 2013, how much has the government landscape in this field changed? SCHNEIER: Snowden's revelations made people aware of what was happening, but little changed as a result. The USA Freedom Act resulted in some minor changes in one particular government data-collection program. The NSA's data collection hasn't changed; the laws limiting what the NSA can do haven't changed; the technology that permits them to do it hasn't changed. It's pretty much the same. GAZETTE: Should consumers be alarmed by this? SCHNEIER: People should be alarmed, both as consumers and as citizens. But today, what we care about is very dependent on what is in the news at the moment, and right now surveillance is not in the news. It was not an issue in the 2016 election, and by and large isn't something that legislators are willing to make a stand on. Snowden told his story, Congress passed a new law in response, and people moved on. GAZETTE: What about corporate surveillance? How pervasive is it? SCHNEIER: Surveillance is the business model of the internet. Everyone is under constant surveillance by many companies, ranging from social networks like Facebook to cellphone providers. This data is collected, compiled, analyzed, and used to try to sell us stuff. Personalized advertising is how these companies make money, and is why so much of the internet is free to users. We're the product, not the customer.' -- source: https://yro.slashdot.org/story/17/08/29/1725246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Ryzen Running Stable On Linux, Threadripper Builds Kernel In 36 Seconds
by Peter Reutemann 29 Aug '17

29 Aug '17

'After AMD confirmed the a "performance marginality problem" affecting some Ryzen Linux users, RMAs are being issued and replacement Ryzen processors arriving for affected opensource fans. Phoronix has been able to confirm that the new Ryzen CPUs are running stable without the segmentation fault problem that would occur under very heavy workloads. They have also been able to test now the Ryzen Threadripper 1950X. The Threadripper 1950X on Linux is unaffected by any issues unless you count the lack of a thermal reporting driver. With the 32 threads under Linux they have been able to build the Linux kernel in just about a half minute.' -- source: https://linux.slashdot.org/story/17/08/29/184243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0