- wlug - University of Waikato Mail Lists

Pulling Remote Word Documents from RAM using Kali Linux
by Peter Reutemann 05 Mar '15

05 Mar '15

With the Kali demo at last month's meeting in mind, I just came across this post here and I thought people might be interested in this: "In this tutorial we will see how to pull a Word document from a remote machine’s memory, parse it for text and view it in Kali Linux." -- sources: http://www.linuxtoday.com/security/pulling-remote-word-documents-from-ram-u… https://cyberarms.wordpress.com/2015/03/01/pulling-remote-word-documents-fr… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

FREAK Attack Threatens SSL Clients
by Peter Reutemann 03 Mar '15

03 Mar '15

"For the nth time in the last couple of years, security experts are warning about a new Internet-scale vulnerability, this time in some popular SSL clients. The flaw allows an attacker to force clients to downgrade to weakened ciphers and break their supposedly encrypted communications through a man-in-the-middle attack. Researchers recently discovered that some SSL clients, including OpenSSL, will accept weak RSA keys–known as export-grade keys–without asking for those keys. Export-grade refers to 512-bit RSA keys, the key strength that was approved by the United States government for export overseas. This was an artifact from decades ago and it was thought that most servers and clients had long ago abandoned such weak ciphers. The vulnerability affects a variety of clients, most notably Apple's Safari browser." -- source: http://it.slashdot.org/story/15/03/03/2036241 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Linux and Multiple Internet Uplinks: a New Tool
by Peter Reutemann 03 Mar '15

03 Mar '15

"Linux has been able do multipath routing for a long time: it means being able to have routes with multiple gateways and to use them in a (weighted) round-robin fashion. But Linux is missing a tool to actively monitor the state of internet uplinks and change the routing accordingly. Without it, from a LAN perspective, it's like having a RAID-0: just one uplink goes down and all of your LAN-to-WAN traffic goes down too. Documentation and examples on the subject are lacking; existing solutions are few and deeply integrated in firewall/routing specific distributions. To address these issues, a new standalone tool was just released: Fault Tolerant Router. It also includes a complete (iptables + ip policy routing) configuration generator." -- source: http://linux.slashdot.org/story/15/03/03/1910206 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

A Tale Of Two Standards
by Lawrence D'Oliveiro 02 Mar '15

02 Mar '15

Came across this article from a decade ago <https://www.samba.org/samba/news/articles/low_point/tale_two_stds_os2.html> about the evolution of the POSIX and Win32 standards from the viewpoint of a veteran who earned his scars in the trenches. While POSIX got one or two things spectacularly wrong (e.g. the disaster that is file locking), it got a lot of things right (e.g. abstracting data types for file offsets/sizes, timestamps etc). Wonder why WINE has taken so long to get to where it is? It’s because nobody can be quite sure they have flushed out every last wrinkle of the behaviour of every Win32 API call.

1 0

Xfce 4.12 Released
by Peter Reutemann 01 Mar '15

01 Mar '15

"After two years of hard work (and much to the dismay of naysayers who worried the project has been abandoned), the Xfce team has announced the release of Xfce 4.12. Highlights include improvements to the window switcher dialog, intelligent hiding of the panel, new wallpaper settings, better multi-monitor support, improved power settings, additions to the file manager, and a revamped task manager. Here is a quick tour, the full changelog, and the download page. I have been running it since Xubuntu 15.04 beta 1 was released two days ago. It is much improved over 4.10, and the new additions are great." -- source: http://linux.slashdot.org/story/15/03/01/0558259 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Android-x86 -- the story continues
by Ian Young 23 Feb '15

23 Feb '15

Who knew? Android doesn't play nicely with a 2nd display. However investigation continues. Some say the internal display should be turned off, before the outside screen will go. Watch this space. Meanwhile some may like to read an interview with English as not the primary language featuring Chih-Wei Huang, main man of Android-x86. Snip > Why Android-x86? Runs on PC(x86). Original Android runs on ARM. Android - Teoreticaly could run on every present and future device, PS4 and Xbox one included (in pure theory). Is everytime better develop for only one OS (even with some platform differences), that for bunch of them. Mac OS or iOS are too closed and fixed on Apple device and its unlikely to change it. Linux market is realy fragmented and its development is relatively slow. Android - is without doubt OS with faster development speed and it counts. Android is open and free. Today, when i can buy good living room pc for 200$ i realy dont wan to pay next 100 bucks to Microsoft for crippled OEM licence, or 200$ for retail (HW independed licence) .... > How many of users know you think that tried Android-x86, at least through live distro and how many installed it into physical computer? Do you have some stats about usage? I don't have the stats and I don't really care about that. Just checked. The 4.4-RC1 release has 584,441 downloads and the 4.3-test release has 1,365,182 downloads. > Are you in contact with Google? Do you know why Google isn't developing Android-x86 for desktops itself? Is affair of Microsoft or something else? ChromeOS looks like duplicity. I have no official contact window of Google. But I have many friends in Google including the android team. I'll also contact Google android engineers directly for issues clarification or patches submission. I don't know Google's plan. But as you said, ChromeOS is probably the right one for its desktop roadmap. This is a common guess. < stop snipping http://www.gamasutra.com/blogs/RuthanielVandenNaar/20140612/219170/Current_…

1 0

Debian’s Reproducible Binary Project Reaches 83% Mark
by Lawrence D'Oliveiro 23 Feb '15

23 Feb '15

For a while now, Debian has been running a project to try to allow anyone to independently confirm that a particular Debian package was indeed built from a particular set of sources, by being able to reproduce the exact build steps themselves. (The security rationale for wanting to do so should be obvious.) As you can imagine, this is seriously non-trivial to achieve, since the least little difference in the version of your compilers or libraries can cause the binaries to differ, maybe not in any important way, but the idea is to end up with no differences at all. The Register has a report on the status of the project here <http://www.theregister.co.uk/2015/02/23/debian_project/>. More background here <https://lists.debian.org/debian-devel-announce/2015/02/msg00007.html>.

1 0

Linus Torvalds Debuts First Linux 4 Release Candidate
by Paul Wilson 23 Feb '15

23 Feb '15

"The Linux 3.x kernel family is no more. Long Live Linux 4! The Linux 3.x kernel family first officially debuted <http://www.datamation.com/open-source/linux-3.0-debuts-with-xen-integration…>on July 22, 2011. Linux 3.0 was the first major version change for Linux since the 2.6 kernel debuted in December of 2003. While Linux 2.6 was a major milestone that signified a break with the past, Linux 3.0 really was just the renumbered Linux 2.6.40 kernel. In the same manner the Linux 4.0 kernel is the continuation of Linux 3.x and is the renamed Linux 3.20."

1 0

How I upgraded my garden’s ugly drip system with a sexy OpenSprinkler
by Peter Reutemann 22 Feb '15

22 Feb '15

"After a few hours of work alongside an electrical engineering buddy this week, my home garden drip system became powered by a Raspberry Pi. I can control the entire thing locally from my iPhone and, to be frank, it’s pretty flippin’ cool." -- source: http://goo.gl/sDPGsr Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

“SSL hijacker” behind Superfish debacle imperils large number of users
by Peter Reutemann 21 Feb '15

21 Feb '15

I know, this is not strictly Linux related, but scary nonetheless and worthy of sharing, IMHO: "Thursday's revelations that Lenovo PCs ship with adware that intercepts sensitive HTTPS-protected traffic have focused intense scrutiny on Superfish, the company that markets the intrusive software. But lost in the furor is the central role a company called Komodia plays in needlessly exposing the passwords and other sensitive data of not just Lenovo customers but also a much larger base of PC users." -- source: http://goo.gl/KhA4KT Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0