- wlug - University of Waikato Mail Lists

BadKernel Vulnerability Affects One In 16 Android Smartphones
by Peter Reutemann 05 Oct '16

05 Oct '16

'A security bug in Google's V8 JavaScript engine is indirectly affecting around one in 16 Android devices, impacting smartphone models from all major vendors, such as LG, Samsung, Motorola, and Huawei. Despite this bug being public for more than a year, only in August 2016 have Chinese security researchers discovered that the V8 issue also affected a whole range of Android-related products where the older V8 engine versions had been deployed. Affected products included Google Chrome Mobile, Opera Mobile, apps that use the WebView component (Gmail, Facebook, Twitter, WeChat, etc.) and apps that deploy the Tencent X5.SDK (a bunch of Chinese apps). It is estimated that around one in 16 Android devices is vulnerable to this issue, nicknamed BadKernel. The flaw leads to a RCE on Android devices, allowing attackers to take full control over one's smartphone. Despite BadKernel being discovered in August 2016, because all research was only published in Chinese, most E.U. and U.S. users have no clue they might be affected. One of the best ways to protect yourself, as noted in the report, is to keep your apps and operating system updated. You can view this list via Trustlook's website to see if your device is affected. There's also a dedicated BadKernel security scanner you can download from the Play Store to check for the vulnerability.' -- source: https://news.slashdot.org/story/16/10/05/033233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New Project Lets You Install Arch Linux In the Windows Subsystem For Linux
by Peter Reutemann 05 Oct '16

05 Oct '16

'Softpedia reports that there's a new project on GitHub, called alwsl, which promises to let you install the Arch Linux operating system on Windows 10's new WSL (Windows Subsystem for Linux) feature, which allows users to run native Linux command-line tools directly on the Windows operating system alongside their modern desktop and apps. For example, Canonical and Microsoft brought Bash on Ubuntu on Windows using the new WSL functionality. For now, the alwsl project, which is developed by a group of German developers that call themselves "Turbo Developers," offers a .bat file that you can use to install Arch Linux on a WSL (Windows Subsystem for Linux) host, but the software is in developer preview stage. The first stable release, alwsl 1.0 will be able not only to install Arch Linux on the Windows Subsystem for Linux host in Windows 10 editions that support it, but also to create and manage users and snapshots. Also, it looks like it will get rolling upgrades just like a normal Arch Linux installation gets. The final release is expected to launch on December 2016, and you can monitor its development progress on GitHub.' -- source: https://linux.slashdot.org/story/16/10/05/1510203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Encryption App Signal Wins Fight Against FBI Subpoena and Gag Order
by Peter Reutemann 04 Oct '16

04 Oct '16

'Signal, widely considered the gold standard of encrypted messaging apps, was put to the test earlier this year when a FBI subpoena and gag order that demanded a wide range of information on two users resulted in a federal grand jury investigation in Virginia. The makers of Signal, Open Whisper Systems, profoundly disappointed law enforcement. The app collects as little data as possible and therefore was unable to hand anything useful over to agents. "That's not because Signal chose not to provide logs of information," ACLU lawyer Brett Kaufman told the Associated Press. "It's just that it couldn't." "The Signal service was designed to minimize the data we retain," Moxie Marlinspike, the founder of Open Whisper Systems, told the New York Times. The subpoena came with a yearlong gag order that was successfully challenged by the American Civil Liberties Union. Signal's creators challenged the gag order as unconstitutional, "because it is not narrowly tailored to a compelling government interest." The challenge was successful. In addition to being popularly considered the best consumer encrypted messaging app available, Signal's technology is used by Facebook for Secret Conversations, WhatsApp for encrypted messages, and Google's Allo. Confronted with the subpoena, Marlinspike went to the ACLU for legal counsel. The ACLU responded with a letter saying that even though Signal did not have data the FBI sought, it still strenuously objected (PDF) to the fact the FBI wanted so much information.' -- source: https://tech.slashdot.org/story/16/10/04/2144202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple, Google, Microsoft: We Have No Government Email Scanning Program Like Yahoo's
by Peter Reutemann 04 Oct '16

04 Oct '16

'Apple, Google and Microsoft -- three of the largest technology companies in the U.S. -- have each said they don't scan all incoming messages for the U.S. government, which is exactly what Yahoo does. According to Reuters, Yahoo secretly built a custom software program last year to search all of its customers' incoming emails for specific information provided by U.S. intelligence officials. The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI. Vocativ reports: In a statement, a Microsoft spokesperson told Vocativ that "We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo." While Apple declined to give a statement on the record, a representative for the company did, in response to Vocativ's question, refer to CEO Tim Cook's official letter on consumer privacy, which reads in part: "I want to be absolutely clear that we have never worked with any government agency from any country to create a backdoor in any of our products or services. We have also never allowed access to our servers. And we never will." The fact that both the companies declined further statement means it's not yet known if the NSA or FBI approached them to request they build a program like Yahoo's. Meanwhile, a spokesperson from Alphabet's Google issued a statement to CNBC: "We've never received such a request, but if we did, our response would be simple: 'no way.'" [The spokesperson later clarified that the company has not received a "directive" or "order" to that effect, either, according to The Intercept.] But the question is whether or not you believe them. With Yahoo's case, only a handful of employees knew about the program. The same could be true with Apple, Google, Microsoft or any other large tech company. Edward Snowden tweeted not too long after Reuters' report surfaced: "Heads up: Any major email service not clearly, categorically denying this tomorrow -- without careful phrasing -- is as guilty as Yahoo."' -- source: https://yro.slashdot.org/story/16/10/04/2252242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.8 LTS Desktop Officially Released
by Peter Reutemann 04 Oct '16

04 Oct '16

'KDE will celebrate 20 years of activity on October 14, 2016, and they've just released the first LTS (Long Term Support) version of the KDE Plasma desktop environment. Prominent new features of KDE Plasma 5.8 LTS include support for desktop widgets, a new system-wide search functionality that promises to let users easily search their KDE desktops for everything they want, including apps, music, videos, files, folders, etc., a new tool to get hot new stuff for your KDE Plasma desktop, such as wallpapers, widgets, desktop effects, or window styles, and infinite customization possibilities. Moreover, KDE Plasma 5.8 LTS comes with a unified look for the default Breeze theme so that, no matter what type of application you're using (Qt4, GTK2, GTK3, or Qt5), it will look the same, mobile phone notifications, along with the ability to use your smartphone as a PC remote, transfer files or mute music during calls, all with the new KDE Connect plasmoid. There's also Right-to-Left (RTL) language support, simplified global shortcuts, improvements to many applets, and much better Wayland support. KDE Plasma 5.8 LTS will receive nine point releases until 2018. "Today KDE releases its first Long Term Support edition of its flagship desktop software, Plasma," reads the announcement. "This marks the point where the developers and designers are happy to recommend Plasma for the widest possible audience be they enterprise or non-techy home users. If you tried a KDE desktop previously and have moved away, now is the time to re-assess, Plasma is simple by default, powerful when needed."' -- source: https://linux.slashdot.org/story/16/10/04/1941237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 16.04 Available in Latest Insider Update To Windows 10
by Peter Reutemann 03 Oct '16

03 Oct '16

'The latest Windows 10 Insider preview -- build 14936 -- features Ubuntu 16.04 LTS. When a user enables the 'Bash on Ubuntu on Windows' feature for the first time, OMGUbuntu reports, Windows 10 now installs an Ubuntu 16.04 (Xenial Xerus) image instead of Ubuntu 14.04 (Trusty Tahr). From the report: The updated version of Ubuntu in the WSL only affects new instances, i.e., those created by running lxrun.exe /install or on the very first run of the bash.exe setup. It is possible to upgrade WSL instances from Ubuntu 14.04 to Ubuntu 16.04 manually by running the do-release-upgrade command. Other changes in the WSL in Build 14936 include support for chroot system call, epoll support for /dev/null and the ability for bash -c to redirect to a file.' -- source: https://linux.slashdot.org/story/16/10/03/198222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Design: Stop Trying To Fix The User
by Lawrence D'Oliveiro 03 Oct '16

03 Oct '16

<https://www.schneier.com/blog/archives/2016/10/security_design.html>: The problem isn't the users: it's that we've designed our computer systems' security so badly that we demand the user do all of these counterintuitive things. Why can't users choose easy-to-remember passwords? Why can't they click on links in emails with wild abandon? Why can't they plug a USB stick into a computer without facing a myriad of viruses? Why are we trying to fix the user instead of solving the underlying security problem?

2 1

Linux Should Soon Start Receiving "Make WiFi Fast" Improvements
by Lawrence D'Oliveiro 03 Oct '16

03 Oct '16

Some improvements coming for Linux Wi-Fi code <http://phoronix.com/scan.php?page=news_item&px=Linux-Getting-Make-WiFi-Fast>. Not sure what the connection is to the Bufferbloat project: that is an attempt to reduce overall network latency by cutting down on excessively-large buffers inside various network components.

1 0

Linux Mint Unveils New 'Mintbox Mini Pro' Desktop
by rowan schischka 02 Oct '16

02 Oct '16

Does anyone have a mintbox? I'm quite interested in these small silent devices. Iv seen some bad reviews of devices from aliexpress, there are significant reviews that complain the gigabit ethernet ports cant achieve advertised speeds. If you do have one, specifically a high power (i5/i7) one; can you please share some benchmarking results. Id like to see how CPU thermal throttling under load affects performance. Im thinking theres going to be a limit in CPU frequency, i.e. you wouldn't pay for for the high frequency, high power CPU if it throttles down to a cheaper CPU's performance -- Kind Regards Rowan Schischka

1 0

Multiple Linux Distributions Affected By Crippling Bug In Systemd
by Peter Reutemann 01 Oct '16

01 Oct '16

'System administrator Andrew Ayer has discovered a potentially critical bug in systemd which can bring a vulnerable Linux server to its knees with one command. "After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system." According to the bug report, Debian, Ubuntu, and CentOS are among the distros susceptible to various levels of resource exhaustion. The bug, which has existed for more than two years, does not require root access to exploit.' -- source: https://linux.slashdot.org/story/16/10/01/2155209 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2