- wlug - University of Waikato Mail Lists

Mozilla Is Ending Support For Its Firefox Password Manager Sync App
by Peter Reutemann 24 Nov '21

24 Nov '21

'Mozilla announced last week via a support article that its Firefox Lockwise password manager app will reach end-of-life on December 13th. The final release versions are 1.8.1 (iOS) and 4.0.3 (Android) and will no longer be available to download or reinstall after that date. The Verge reports: What started in 2018 as a small experimental mobile app called Lockbox ended up bringing a way to access saved passwords and perform autofills on iOS, Android, and desktop devices to a small but enthusiastic following of Firefox fans. The app was also later adapted as a Firefox extension. It seemed like it was apt to stick around for the long run. The support article recommends that users continue accessing passwords using the native Firefox browsers on desktop and mobile. In an added note on the support site, Mozilla suggests that later in December, the Firefox iOS app will gain the ability to manage Firefox passwords systemwide. The note alludes to Mozilla adopting the features of Lockwise and eventually integrating them into the Firefox browser apps natively on all platforms. ' -- source: https://tech.slashdot.org/story/21/11/23/2157244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trying To Reclaim The Word “Crypto”
by Lawrence D'Oliveiro 24 Nov '21

24 Nov '21

For decades, the word “crypto” has been synonymous with “cryptography”. But increasingly now, some are using it to mean “cryptocurrency” instead. Naturally this is annoying some who have been working in the crypto field for years, and they are demanding that this new (mis)usage be stopped. What do you think? <https://www.theregister.com/2021/11/23/crypto_graphy_or_currency/>

2 2

Attackers Don't Bother Brute-forcing Long Passwords, Microsoft Engineer Says
by Peter Reutemann 23 Nov '21

23 Nov '21

'According to data collected by Microsoft's network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters. From a report: "I analysed the credentials entered from over -- million brute force attacks against SSH. This is around 30 days of data in Microsoft's sensor network," said Ross Bevington, a security researcher at Microsoft. "77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases," said Bevington, who works as Head of Deception at Microsoft, a position in which he's tasked with creating legitimate-looking honeypot systems in order to study attacker trends.' -- source: https://it.slashdot.org/story/21/11/22/2036243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

GoDaddy Security Breach Exposes WordPress Users' Data
by Peter Reutemann 23 Nov '21

23 Nov '21

'Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access. From a report: The company said the incident was discovered on Sept. 6 and the third-party accessed the system using a compromised password.' -- source: https://it.slashdot.org/story/21/11/22/1523234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A German State is Switching Its 25,000 Computers From Windows to Linux
by Peter Reutemann 22 Nov '21

22 Nov '21

'The north-German state of Schleswig-Holstein plans to switch to open source software..." reports Mike Saunders from LibreOffice. "By the end of 2026, Microsoft Office is to be replaced by LibreOffice on all 25,000 computers used by civil servants and employees (including teachers), and the Windows operating system is to be replaced by GNU/Linux." The tech site Foss Force writes: This seems to be a done deal, as the steps for the transition from proprietary to open have already been codified by the Schleswig-Holstein state parliament, and explained in plain language in an interview with Jan Philipp Albrecht, the state's digital minister, that was published in c't, a German language computer magazine (Google Translate version here). In the interview, Albrecht said that part of the transition to open source is already in the works, and pointed out that 90% of state administration conferencing is conducted using the open source video conferencing platform Jitsi. "We have been testing LibreOffice in our IT department for two years, and our experience is clear: it works," he said. "This also applies, for example, when editing Microsoft Word documents with comments... No Linux distribution has been chosen yet to use as a standard, although Albrecht said they're currently looking at five distributions that suit their purposes.' -- source: https://linux.slashdot.org/story/21/11/21/0231218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Firefox Users Accidentally Commit Login Cookies On GitHub
by Peter Reutemann 19 Nov '21

19 Nov '21

'Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions. The Register reports: These cookies.sqlite databases normally reside in the Firefox profiles folder. They're used to store cookies between browsing sessions. And they're findable by searching GitHub with specific query parameters, what's known as a search "dork." Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that "credentials exposed by our users are not in scope for our Bug Bounty program." Marlin then asked whether he could make his findings public and was told he's free to do so. "I'm frustrated that GitHub isn't taking its users' security and privacy seriously," Marlin told The Register in an email. "The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they'd done, they'd s*** their pants." Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well," he said, adding that he's alerted the UK Information Commissioner's Office because personal information is at stake. Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory. "I imagine in most of the cases, the individuals aren't aware that they've uploaded their cookie databases," he explained. "A common reason users do this is for a common environment across multiple machines."' -- source: https://news.slashdot.org/story/21/11/18/2227206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has a Serious Security Problem That Once Again Enables DNS Cache Poisoning
by Peter Reutemann 18 Nov '21

18 Nov '21

'As much as 38 percent of the Internet's domain name lookup servers are vulnerable to a new attack that allows hackers to send victims to maliciously spoofed addresses masquerading as legitimate domains, like bankofamerica.com or gmail.com. The exploit, unveiled in research presented today, revives the DNS cache-poisoning attack that researcher Dan Kaminsky disclosed in 2008. He showed that, by masquerading as an authoritative DNS server and using it to flood a DNS resolver with fake lookup results for a trusted domain, an attacker could poison the resolver cache with the spoofed IP address. From then on, anyone relying on the same resolver would be diverted to the same imposter site. The sleight of hand worked because DNS at the time relied on a transaction ID to prove the IP number returned came from an authoritative server rather than an imposter server attempting to send people to a malicious site. The transaction number had only 16 bits, which meant that there were only 65,536 possible transaction IDs. Kaminsky realized that hackers could exploit the lack of entropy by bombarding a DNS resolver with off-path responses that included each possible ID. Once the resolver received a response with the correct ID, the server would accept the malicious IP and store the result in cache so that everyone else using the same resolver -- which typically belongs to a corporation, organization, or ISP -- would also be sent to the same malicious server.' -- source: https://linux.slashdot.org/story/21/11/17/1856235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 18 Nov '21

18 Nov '21

Hi everyone We have a WLUG meeting next week on Monday: 'For the last meeting of the year, let's have general get-together. Ian Stewart will demo the latest Ubuntu 21.10 and Peter Reutemann will try to show what you can use the frp fast reverse proxy for (https://github.com/fatedier/frp). And of course, general Linux related troubleshooting and questions answered.' -- source: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861098/ This is once again an online event, so make sure to RSVP on meetup to get the link (you only need a browser). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Latency Numbers Every Programmer Should Know
by Lawrence D'Oliveiro 17 Nov '21

17 Nov '21

Somebody did a nice chart a while back <https://gist.github.com/hellerbarde/2843375> of the time it takes to perform many common data transfer operations on contemporary hardware. And note the multi-part figure, where the basic unit in each block is a bit more than an order of magnitude greater than the one in the previous block. And if the figure isn’t dramatic enough, a commenter has said “let’s multiply all the numbers by a billion” (just to bring them into more human-comprehensible scales), and then liken them to common things that people do, from making a cup of coffee, all the way up to completing a bachelor’s degree.

2 5

Scientists Send Data Using Nuclear Radiation
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

A research group has used fast neutrons <https://www.theregister.com/2021/11/15/wireless_information_transfer_with_f…> as a communication channel, to send legible data between a transmitter and a receiver. Their proof of concept is very low-bandwidth and requires a lot of complicated equipment, but at least it does show (safety issues aside) that it is theoretically possible. The issue with high-energy subatomic particles is, how do you turn them on and off at will -- i.e. modulate the intensity of the beam to convey information? This group used some kind of shutter system (“neutron chopper”) in conjunction with some quantity of radioactive californium-252 as their neutron source. But they mention that someone else has come up with a device that is basically a particle accelerator on a chip, able to produce a stream of neutrons from non-radioactive starting components on demand.

1 0