- wlug - University of Waikato Mail Lists

When man-db goes thug ... help?
by Eric Light 12 Jul '16

12 Jul '16

Hi guys Never seen this before, need a hand. Fairly fresh Debian 8 install, fully updated, running as root. root@ROOTCA:~/ca# man opensslroot@ROOTCA:~/ca# man -kroot@ROOTCA:~/ca# which man/usr/bin/manroot@ROOTCA:~/ca# man --helproot@ROOTCA:~/ca# ... When I execute man, it doesn't give me anything, and just returns me to the command prompt. Not even man --help will return a response. I've purged and reinstalled man-db, ensured that ncurses-base is installed, even checked the size of man (106912 bytes), and checked dmesg for any segfaults... there's just nothing I can find anywhere. Any ideas? Thanks in advance. E-- Securely sent with Tutanota. It's good, you should try it: https://tutanota.com

2 3

Bye-Bye 32 Bits
by Lawrence D'Oliveiro 12 Jul '16

12 Jul '16

Seems like nobody wants to offer 32-bit Linux builds any more... <http://www.theregister.co.uk/2016/07/05/linux_letting_go_32bit_builds_on_th…>

4 4

MIT Says Their Anonymity Network Is More Secure Than Tor
by Peter Reutemann 12 Jul '16

12 Jul '16

'Following the recent vulnerabilities in Tor, researchers at MIT's Computer Science and Artificial Intelligence Laboratory and the Ecole Polytechnique Federale de Lausanne have been working on a new anonymity network that they say is more secure than Tor. While the researchers are planning to present their new system, dubbed Riffle, at the Privacy Enhancing Technologies Symposium later this month, they did say the system uses existing cryptographic techniques, but in new ways. A series of servers are what make up Riffle, each of which "permutes the order in which it receives messages before passing them on to the next," according to a news release. "For instance, messages from senders Alice, Bob, and Carol reach the first server in the order A, B, C, that server would send them to the second server in a different order -- say C, B, A. The second server would permute them before sending them to the third, and so on." Nobody would know which was which by the time they exited the last server. Both Tor and MIT's anonymity network use onion encryption. Riffle uses a technique called verifiable shuffle in addition to onion encryption to thwart tampering and prevent adversaries from infiltrating servers with their own code. Last but not least, it uses authentication encryption to verify the authenticity of an encrypted message. The researchers say their system provides strong security while using bandwidth much more efficiently than similar solutions.' -- source: https://news.slashdot.org/story/16/07/11/2041203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ODF Versus OOXML
by Lawrence D'Oliveiro 11 Jul '16

11 Jul '16

A summary of links comparing ODF (the file format native to LibreOffice and OpenOffice) with OOXML (as used in Microsoft’s Office suite): <http://courseweb.ischool.illinois.edu/~stanley8/LIS590DPL/standards/docform…>. Another reason why saving LibreOffice documents in MS Office format may cause formatting trouble (besides the usual inconsistencies that happen with MS Office formatting anyway) is that OOXML cannot actually represent all ODF information correctly.

1 0

GNU Nano Fork
by Lawrence D'Oliveiro 11 Jul '16

11 Jul '16

Some ructions over GNU Nano have led to the creation of yet another tiny text editor <http://www.theregister.co.uk/2016/07/11/in_mourning_for_nano_chap_crafts_1k…>. With regard to this: “Benno also did not want to assign copyright to the FSF for his contributions.” it’s not clear why outfits like the FSF and Ubuntu want you to assign your copyrights to them. The Linux kernel project, for example, doesn’t require it <https://lwn.net/Articles/592503/>.

1 0

HTTPS crypto’s days are numbered. Here’s how Google wants to save it
by Peter Reutemann 09 Jul '16

09 Jul '16

'Like many forms of encryption in use today, HTTPS protections are on the brink of a collapse that could bring down the world as we know it. Hanging in the balance are most encrypted communications sent over the last several decades. On Thursday, Google unveiled an experiment designed to head off, or at least lessen, the catastrophe. In the coming months, Google servers will add a new, experimental cryptographic algorithm to the more established elliptic curve algorithm it has been using for the past few years to help encrypt HTTPS communications. The algorithm—which goes by the wonky name "Ring Learning With Errors"—is a method of exchanging cryptographic keys that's currently considered one of the great new hopes in the age of quantum computing. Like other forms of public key encryption, it allows two parties who have never met to encrypt their communications, making it ideal for Internet usage.' -- source: http://arstechnica.com/security/2016/07/https-crypto-is-on-the-brink-of-col… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mesa 12.0 Released With OpenGL 4.3 Support, Intel Vulkan and More
by Peter Reutemann 09 Jul '16

09 Jul '16

'Mesa3D developers have announced the release of Mesa 12.0. Mesa 12 notably adds open-source OpenGL 4.3 drivers for Intel, Radeon, and NVIDIA on Linux, and it also integrates the previously open-sourced Intel Vulkan graphics API driver. From the Phoronix analysis, "Mesa 12.0 is easily one of the biggest updates to this important open-source user-space OpenGL driver stack in quite some time and will offer much better support and features especially for Intel, Radeon, and NVIDIA open-source Linux desktop users/gamers."' -- source: https://linux.slashdot.org/story/16/07/08/2135213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services
by Peter Reutemann 08 Jul '16

08 Jul '16

'Two researchers have discovered over 100 Tor nodes that are spying on hidden services. Cory Doctorow from Boing Boing reports: "These nodes -- ordinary nodes, not exit nodes -- sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over. The researchers used 'honeypot' .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions' existence. They didn't advertise the honions' existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits. No one knows who is running the spying nodes: they could be run by criminals, governments, private suppliers of 'infowar' weapons to governments, independent researchers, or other scholars (though scholarly research would not normally include attempts to hack the servers once they were discovered)." The Tor project is aware of the attack and is working to redesign its system to try and block it.' -- source: https://yro.slashdot.org/story/16/07/08/2034209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Antivirus Software Is 'Increasingly Useless' and May Make Your Computer Less Safe
by Peter Reutemann 08 Jul '16

08 Jul '16

'Is your antivirus protecting your computer or making it more hackable? Internet security experts are warning that anti-malware technology is becoming less and less effective at protecting your data and devices, and there's evidence that security software can sometimes even make your computer more vulnerable to security breaches. This week, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) issued a warning about popular antivirus software made by Symantec, some of it under the Norton brand, after security researchers with Google's Project Zero found critical vulnerabilities. "These vulnerabilities are as bad as it gets. They don't require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible," wrote Google researcher Tavis Ormandy in a blog post. Symantec said it had verified and addressed the issues in updates that users are advised to install. It's not the only instance of security software potentially making your computer less safe. Concordia University professor Mohammad Mannan and his PhD student Xavier de Carne de Carnavalet recently presented research on antivirus and parental control software packages, including popular brands like AVG, Kaspersky and BitDefender, that bypass some security features built into internet browsers to verify whether sites are safe or not in order to be able to scan encrypted connections for potential threats. In theory, they should make up for it with their own content verification systems. But Mannan's research, presented at the Network and Distributed System Security Symposium in California earlier this year, found they didn't do a very good job. "We were surprised at how bad they were," he said in an interview. "Some of them, they did not even make it secure in any sense."' -- source: https://it.slashdot.org/story/16/07/08/145245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android KeyStore Encryption Scheme Broken
by Peter Reutemann 08 Jul '16

08 Jul '16

'The default implementation for KeyStore, the system in Android designed to store user credentials and cryptographic keys, is broken, researchers say.>In an academic paper published this week, researchers argue that the particular encryption scheme that KeyStore uses fails to protect the integrity of keys and could be exploited to allow an attacker to modify stored keys through a forgery attack. KeyStore, which performs key-specific actions through the OpenSSL library, allows Android apps to store and generate their own cryptographic keys. By storing keys in a container, KeyStore makes it more difficult to remove them from the device. Mohamed Sabt and Jacques Traore, two researchers with the French telecom Orange Labs, claim the scheme associated with the system is "non-provably secure," and could have "severe consequences." The two point out in their paper "Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore," that it's the hash-then-encrypt (HtE) authenticated encryption (AE) scheme in cipher block chaining mode (CBC) in KeyStore that fails to guarantee the integrity of keys.' -- source: https://tech.slashdot.org/story/16/07/07/1819233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0