- wlug - University of Waikato Mail Lists

'Logjam' Vulnerability Threatens Encrypted Connections
by Peter Reutemann 22 May '15

22 May '15

'A team of security researchers has revealed a new encryption vulnerability called 'Logjam,' which is the result of a flaw in the TLS protocol used to create encrypted connections. It affects servers supporting the Diffie-Hellman key exchange, and it's caused by export restrictions mandated by the U.S. government during the Clinton administration. "Attackers with the ability to monitor the connection between an end user and a Diffie-Hellman-enabled server that supports the export cipher can inject a special payload into the traffic that downgrades encrypted connections to use extremely weak 512-bit key material. Using precomputed data prepared ahead of time, the attackers can then deduce the encryption key negotiated between the two parties." Internet Explorer is the only browser yet updated to block such an attack — patches for Chrome, Firefox, and Safari are expected soon. The researchers add, "Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains. A second prime would allow passive decryption of connections to 66% of VPN servers and 26% of SSH servers. A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break." Here is their full technical report (PDF).' -- source: http://it.slashdot.org/story/15/05/20/1258251 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

2 1

Linux 4.0 Has a File-System Corruption Problem, RAID Users Warned
by Peter Reutemann 21 May '15

21 May '15

'For the past few days kernel developers and Linux users have been investigating an EXT4 file-system corruption issue affecting the latest stable kernel series (Linux 4.0) and the current development code (Linux 4.1). It turns out that Linux users running the EXT4 file-system on a RAID0 configuration can easily destroy their file-system with this newest "stable" kernel. The cause and fix have materialized but it hasn't yet worked its way out into the mainline kernel, thus users should be warned before quickly upgrading to the new kernel on systems with EXT4 and RAID0.' -- source: http://hardware.slashdot.org/story/15/05/21/1324229 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

theregister.co.uk - Inkscape 0.91 review
by William Mckee 21 May '15

21 May '15

A very positive review of Inkscape 0.91 release. http://www.theregister.co.uk/2015/05/19/inkscape_review/?page=1 Most notable they talk about the speed and performance in the new release. I'm a heavy GIMP user but have been using Inkscape recently for website logos. Like the reviewer - I have been impressed with the improvements. Cheers, William.

1 0

FirefoxOS TV sets
by Ian Young 20 May '15

20 May '15

Currently available at retail outlets in Hamilton starting at $700 or so. Panasonic brand.

1 0

First Smart TVs Powered By Firefox OS On Sale In Europe, Worldwide Soon
by Peter Reutemann 18 May '15

18 May '15

'The first smart TVs powered by Firefox OS have gone on sale in Europe. Panasonic's line of Viera smart TVs includes six that are powered by Firefox OS — CR850, CR730, CX800, CX750, CX700 and CX680 — including their first curved LED LCD TV. The full global launch of the TVs is expected “in the coming months.” From the Mozilla blog: "We’re happy to partner with Panasonic to bring the first Smart TVs powered by Firefox OS to the world,” said Andreas Gal, Mozilla CTO. “With Firefox and Firefox OS powered devices, users can enjoy a custom and connected Web experience and take their favorite content (apps, videos, photos, websites) across devices without being locked into one proprietary ecosystem or brand.”' -- source: http://news.slashdot.org/story/15/05/18/0213238 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Venom VM bug called “perfect” for NSA, or for stealing bitcoins and passwords
by Peter Reutemann 13 May '15

13 May '15

"The just-patched critical vulnerability in widely used virtualization software is an ideal exploitation target for state-sponsored spies and criminals alike fishing for passwords, cryptography keys, or bitcoins, a researcher who has dissected one of the fixes said. The bug, which is known to affect the Xen, KVM, and native QEMU virtual machine platforms and appliances, makes it possible for attackers to break out of protected guest environments and take full control of the operating system hosting them, security researchers warned Wednesday. In the hours following Wednesday morning's disclosure of the vulnerability, many security professionals have publicly said its severity is being exaggerated. The critics have rightly pointed out that it can't be remotely exploited and can't be exploited on large numbers of machines in a single stroke, as is the case with most serious security bugs." -- source: http://arstechnica.com/security/2015/05/venom-vm-bug-called-perfect-for-nsa… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Tails 1.4 released
by Peter Reutemann 13 May '15

13 May '15

'Tails, The Amnesic Incognito Live System, version 1.4, has been released. The new version of the Debian-based live disc offers users a number of new features, including an updated copy of the Tor Browser and the Tor anonymity software has been upgraded to version 0.2.6.7. Tails 1.4 also ships with Paperkey, a program which allows users to print physical copies of their security keys. "Tor Browser 4.5 now has a security slider that you can use to disable browser features, such as JavaScript, as a trade-off between security and usability. The security slider is set to low by default to provide the same level of security as previous versions and the most usable experience. We disabled in Tails the new circuit view of Tor Browser 4.5 for security reasons. You can still use the network map of Vidalia to inspect your circuits. Tails OpenPGP Applet now has a shortcut to the gedit text editor, thanks to Ivan Bliminse. Paperkey lets you print a backup of your OpenPGP secret keys on paper."' -- source: http://distrowatch.com/?newsid=08941 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Ubuntu Core Drone Is the First Drone That Has Apps
by Peter Reutemann 11 May '15

11 May '15

"The Erle-Copter was presented a couple of weeks ago, but now its makers have returned with more details about this amazing piece of technology. This is not the average drone you can get at your mall and that can do basically three things, fly, crash into walls, and break. It's what you might call a smart drone, and it's powered by Ubuntu core." -- source: http://news.softpedia.com/news/Ubuntu-Core-Drone-Is-the-First-Drone-That-Ha… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Meet Lakka, a Linux OS that Turns any PC Into a Retro Game Console
by Peter Reutemann 11 May '15

11 May '15

"Lakka is a lightweight distribution of GNU/Linux that has been designed to transform any computer into a full-blown retro game console. It is derived from the well-known OpenELEC project and built on top of the well-known RetroArch retro game emulator tool. The Lakka Linux distribution is capable of emulating a wide variety of hardware. Additionally, it includes attractive features like video streaming, joypad hotplug, and Braid-like rewinding." -- source: http://www.linuxtoday.com/infrastructure/meet-lakka-a-linux-os-that-turns-a… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Ubuntu jumps into Internet of Things with Acer, GE, and Microsoft
by Peter Reutemann 11 May '15

11 May '15

"Old enemies are becoming new allies as technology shifts from the PC/desktop model to first mobile computing and now the Internet of Things (IoT). Canonical, Ubuntu Linux's parent company, is partnering with Acer, DataArt, and Microsoft." -- source: http://www.zdnet.com/article/ubuntu-jumps-into-internet-of-things-with-acer… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0