- wlug - University of Waikato Mail Lists

Google Ad For GIMP.org Served Info-Stealing Malware Via Lookalike
by Peter Reutemann 03 Nov '22

03 Nov '22

'A report from BleepingComputer, written by Ax Sharma: Searching for 'GIMP' on Google as recently as last week would show visitors an ad for 'GIMP.org,' the official website of the well known graphics editor, GNU Image Manipulation Program. This ad would appear to be legitimate as it'd state 'GIMP.org' as the destination domain. But clicking on it drove visitors to a lookalike phishing website that provided them with a 700 MB executable disguised as GIMP which, in reality, was malware. Reddit user ZachIngram04 earlier shared the development stating that the ad previously took users to a Dropbox URL to serve malware, but was soon "replaced with an even more malicious one" which employed a fake replica website 'gilimp.org' to serve malware. BleepingCompuer observed another domain 'gimp.monster' related to this campaign. To pass off the trojanized executable as GIMP in a believable manner to the user, the threat actor artificially inflated the malware, that is otherwise under 5 MB in size, to 700 MB by a simple technique known as binary padding. It still isn't clear if this instance was a slip up caused by a potential bug in Google Ad Manager that allowed malvertising.' -- source: https://tech.slashdot.org/story/22/11/02/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mastodon Gained 70,000 Users After Musk's Twitter Takeover
by Peter Reutemann 03 Nov '22

03 Nov '22

'"More than 70,000 users joined Mastodon on the day after Musk's Twitter takeover announcement," writes Slashdot reader votsalo. "Mastodon is a six-year-old decentralized social media platform that uses 'federated' servers." The Guardian's Wilfred Chan writes: I joined Mastodon this week, and it took a few hours just to master its new vocabulary. Some of it is a little silly-sounding: instead of tweets, you have "toots". Things get trickier after that. Mastodon is not a single website but a network of thousands of websites called "instances", also called servers. These servers are "federated", which means they are run by different entities but can still communicate with each other without needing to go through a central system. And the space they all exist in is called the "fediverse," which some savvy tooters call "the Fedi." When you sign up for Mastodon, the first thing you do is choose a server. There are general-purpose ones, such as mastodon.social, as well as ones aimed at interest groups, such as kpop.social or linuxrocks.online. There are also joke servers like dolphin.town, where the only thing users are allowed to post is the letter "e". The server becomes part of your username (for example, wilfred(a)kpop.social), and the toots you see on your feed are toots from your server-mates, rather than from the entire fediverse. But you're also free to toot at people from other servers and even "boost" their public toots on to your feed. That's how Mastodon creates a unified global experience without being controlled by one entity, said Eugen Rochko, Mastodon's Germany-based founder and lead developer. "The servers are service providers, like Hotmail and Gmail are for email. It doesn't mean that the different servers are isolated from each other, like old school forums," he said. "Having just one account allows you to follow and interact with anyone in this global decentralized social network." But Mastodon's model comes with its own risks. If the server you join disappears, you could lose everything, just like if your email provider shut down. A Mastodon server admin also has ultimate control over everything you do: if for some reason the owner of kpop.social doesn't like that I boosted a toot from dolphin.town, they could remove it or even "defederate" the server, which would block all dolphin toots from the k-pop server completely. A server admin could also snoop on my private toots if they wanted to -- or delete my account for any reason. While Mastadon's 70,000 jump in users sounds impressive, it's "still a drop in a bucket compared with Twitter's reported 450 million daily active users," says Chan. The decentralized software also remains difficult for many people to use. According to TechCrunch, Mastadon says it has "gained 123,562 new users as of October 27, 2022 and now has 528,607 active users on the network as of October 31, 2022."' -- source: https://tech.slashdot.org/story/22/11/02/1958241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze: Buying Cheaper, Less Reliable Drives Can Be Worth It
by Lawrence D'Oliveiro 02 Nov '22

02 Nov '22

Backup company Backblaze has put out another juicy status report on the reliability of its massive collection of hard drives <https://blocksandfiles.com/2022/11/01/backblaze-disk-drives/>. This one has some interesting numbers on the cost of dealing with drive failures -- it seems the hardware cost of these to the company is zero, as the failed drives get sent back to the vendors for full credit or replacement. (I guess if you buy a few thousand units at a time, you get special deals like this.) Since the company is in the business of providing sufficient redundancy that the impact of a drive failure on data integrity is essentially zero, the main cost of a failure becomes the labour cost of putting in a new drive, which comes to $300. Looked at this way, looking at the table which compares three models of drive, with unit costs ranging from $225 up to $275, and corresponding annualized failure rates of 1.5% down to 0.5%, it turns out the cheaper, flakier drive is the better deal -- amortized over a five-year service lifetime, the increased labour cost of replacing failed drives is easily outweighed by the savings in buying the drives in the first place.

1 0

OpenSSL 3 patch, once Heartbleed-level “critical,” arrives as a lesser “high”
by Peter Reutemann 02 Nov '22

02 Nov '22

'An OpenSSL vulnerability once signaled as the first critical-level patch since the Internet-reshaping Heartbleed bug has just been patched. It ultimately arrived as a "high" security fix for a buffer overflow, one that affects all OpenSSL 3.x installations, but is unlikely to lead to remote code execution. OpenSSL version 3.0.7 was announced last week as a critical security fix release. The specific vulnerabilities (now CVE-2022-37786 and CVE-2022-3602) had been largely unknown until today, but analysts and businesses in the web security field hinted there could be notable problems and maintenance pain. Some Linux distributions, including Fedora, held up releases until the patch was available. Distribution giant Akamai noted before the patch that half of their monitored networks had at least one machine with a vulnerable OpenSSL 3.x instance, and among those networks, between 0.2 and 33 percent of machines were vulnerable. But the specific vulnerabilities—limited-circumstance, client-side overflows that are mitigated by the stack layout on most modern platforms—are now patched, and rated as "High." And with OpenSSL 1.1.1 still in its long-term support phase, OpenSSL 3.x is not nearly as widespread.' -- source: https://arstechnica.com/information-technology/2022/11/openssl-3-patch-once… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LineageOS flashing
by Peter Reutemann 01 Nov '22

01 Nov '22

Hi everyone Since I've talked about flashing LineageOS on Android phones before... In the past, I've always used TWRP (https://twrp.me/) as recovery tool on the phones. However, the tools has been lagging behind with Android 12 support and the 3.7.0 release (which in theory added Android 12 support) failed on my old Galaxy S7 (I'm using custom ROMs supplied by Ivan Meier). Unfortunately, OrangeFox Recovery, which seems a popular alternative to TWRP, didn't support my Galaxy S7. However, I found a little workaround for that dilemma: though I used TWRP to install Android 11, during the setup process I then ticked the box to also update the recovery tool with LineageOS recovery with the every subsequent update. After updating the phone to the latest Android 11, I had LineageOS recovery on there which has (working) support for Android 12 and I managed to upgrade successfully to 12. Just in case somebody runs into a similar problem... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vanilla OS: More Than Just Vanilla GNOME With Ubuntu
by Peter Reutemann 31 Oct '22

31 Oct '22

'Slashdot reader Soul_Predator writes: Vanilla OS is Ubuntu on stock GNOME, with on-demand immutability and package selection freedom. It is currently a beta project, with a stable release planned for the next month. "The first-time setup process is a breeze to experience," writes It's FOSS News, applauding how it lets uses choose and enable Flatpak/Snap/AppImage. Overall, a package manager that installs applications utilizing a container, getting the ability to choose your package managers, on-demand immutability, and vanilla GNOME make it seem like a good deal to keep an eye on... I'd say it is a project that I believe a lot of users will appreciate. You can download the ISO by joining its Discord channel for now. The ISO is not yet publicly available to all. Take a look at its documentation if you are curious. However, as per the roadmap, they plan to have a release candidate soon enough. ' -- source: https://tech.slashdot.org/story/22/10/29/1953233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Teaching The Kids To Be Safe Online
by Lawrence D'Oliveiro 30 Oct '22

30 Oct '22

A program is being introduced into schools to give students a better appreciation for how to keep themselves safe online <https://www.stuff.co.nz/national/education/130292250/students-urged-to-be-l…>. It covers things like spotting phishing attacks, and avoiding making personal information public that you might regret later: Naenae College principal Nic Richards said while students were experts in social media, parents and teachers were aware that “the decisions made now can exist online forever.” “Experts” in putting information up and interacting with other users, not so savvy perhaps in understanding the consequences of doing so. And maybe some of what they learn will rub off on others in their family ... including their parents?

1 0

“You must enable DRM to play some audio or video on this page.”
by Lawrence D'Oliveiro 28 Oct '22

28 Oct '22

I have seen Firefox give me this message that I need to “enable DRM” (i.e. install support for Encrypted Media Extensions) when I visit certain pages. One site that is currently triggering this for me is Metservice <https://www.metservice.com/towns-cities/locations/hamilton>. Yet I can’t see anything on that page that I might be blocked from playing. There is a Video Forecast clip, but I seem to be able to play that OK. Anybody else get this message?

3 2

'Old/Weird Laptops' Sought To Help Test Linux Kernel Backlight Drivers
by Peter Reutemann 28 Oct '22

28 Oct '22

'Do you have a laptop that's either "pretty old" or "weird in some other way"? Did it ship without Windows from the factory, or did you flash its firmware with coreboot? You could help the Linux kernel move its backlight code forward without abandoning quirky gear like yours. ArsTechnica: Hans de Goede, a longtime Linux developer and principal engineer at Red Hat, writes on his Livejournal about the need to test "a special group of laptops" to prevent their backlight controls from disappearing in Linux kernel 6.1. Old laptop tests are needed because de Goede is initiating some major changes to user-space backlight controls, something he has been working on since 2014. As detailed at Linux blog Phoronix, there are multiple issues with how Linux tries to address the wide variety of backlight schemes in displays, which de Goede laid out at the recent Linux Plumbers Conference. There can be multiple backlight devices operating a single display, leaving high-level controls to "guess which one will work." Brightness control requires root permissions at the moment. And "0" passed along as a backlight value remains a conundrum, as the engineer pointed out in 2014: Is that entirely off, or as low as the display can be lit?' -- source: https://linux.slashdot.org/story/22/10/27/1920206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Systemd Supremo Proposes Tightening up Linux Boot Process
by Peter Reutemann 27 Oct '22

27 Oct '22

'Lennart Poettering's latest blog post proposes moving the Linux boot process into a "Brave New Trusted Boot World" of cryptographically signed Unified Kernel Images. From a report: Agent Poettering offers a mechanism for tightening up the security of the system startup process on Linux machines, using TPM 2.0 hardware. In brief, what he sees as the problem is that on hardware with Secure Boot enabled, while the boot process up to and including the kernel is signed, the next step, loading the initrd, is not. That's what he wants to fix. ' -- source: https://it.slashdot.org/story/22/10/26/1743234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0