Does Wi-Fi Security Really Matter?
by Lawrence D'Oliveiro
Seems the Wi-Fi Alliance is having yet another crack at coming up with
a really secure protocol, this time to be called WPA3
<http://www.theregister.co.uk/2018/01/09/wi_fi_wpa3/>.
Does anybody care? Remember that on the Internet, security is
implemented between the endpoints, the protocols are designed not to
care that everything in-between might be pawed through by
eavesdroppers, or even active attackers trying to inject fake data.
1 year, 1 month
Devuan.org Now Points To 'Pwned' Page With Gopher URLs
by Peter Reutemann
'"DEVUAN.ORG HAS BEEN PWNED" reads a new message at the home page for
Devuan (a fork of Debian without systemd) -- which re-redirects to a
new page named pwned.html, reports Slashdot reader DevNull127:
In all capital letters, its carefully-indented message (complete with
an ascii-art logo) now informs visitors that "the web sucks --
JavaScript sucks -- browsers suck." Posting the URLs to several gopher
sites, it adds that "Gopher is the way -- gopher is the future."
"Kiss port 80 goodbye. Join the revolution on port 70."
The attackers identify themselves as "Green Hat Hackers," a term
generally understood to mean ambitious newbie hackers who want to
improve their skills. "Stop the madness," continues their message,
which appeared just hours before the first day of April.
"Get yourself a gopher client."'
-- source: https://idle.slashdot.org/story/19/03/31/212227
Cheers, Peter
--
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
1 year, 2 months
Fwd: File-transfer between Android amd Linux using rsync
by tom butz
HOW TO TRANSFER FILES FROM ANDROID-PDA TO LINUX-LAPTOP
======================================================
I'm running Android 7.1 on an OPPO A73 phone/PDA, and sometimes
need to transfer photos and other files to a laptop running Linux Mint 19.1.
Steps required on the PDA:
1) install termux from Android PlayStore
2) install rsync (in termux, type: pkg install rsync)
3) install perl (in termux, type: pkg install perl)
4) in termux, type: termux-setup-storage (also automatically creates links)
5) in termux, type: cd storage, then type: ls to see the following directories:
dcim: photos/videos taken with the PDA
downloads: stuff you downloaded
movies:
music:
pictures:
shared: everything (includes the above directories)
In the following examples we will use /dcim/ and /downloads/:
oppopictures.prl
================
In termux, type: perl system "rsync -av /sdcard/DCIM/
username_on_laptop\@1.2.3.4:/oppo_pictures/"
This will transfer photos (*.jpg) and videos (*.mp4) to /oppo_pictures/Camera/,
and screenshots to /oppo_pictures/Screenshots/. Directory
/oppo/pictures/ must exist on
the laptop and grant world-access (chmod 777). Ignore rsync
error-messages regarding
file-attributes.
oppodownloads.prl
=================
In termux, type: perl system "rsync -av /storage/downloads/
username_on_laptop\@1.2.3.4:/oppo_downloads/"
This will transfer files to /oppo_downloads/. Directory /oppo_downloads/
must exist on laptop and grant world-access (chmod 777). Ignore rsync
error-messages
regarding file-attributes.
NOTE: REPLACE the numbers 1.2.3.4 in the above examples with your laptop's
IP-address (as provided by your IP-router). Get them using ifconfig.
Theoretically you could do the above using the /shared/ directory to
get a copy of Android-files.
1 year, 2 months
Researchers Find 36 New Security Flaws In LTE Protocol
by Peter Reutemann
'A group of academics from South Korea have identified 36 new
vulnerabilities in the Long-Term Evolution (LTE) standard used by
thousands of mobile networks and hundreds of millions of users across
the world. The vulnerabilities allow attackers to disrupt mobile base
stations, block incoming calls to a device, disconnect users from a
mobile network, send spoofed SMS messages, and eavesdrop and
manipulate user data traffic. They were discovered by a four-person
research team from the Korea Advanced Institute of Science and
Technology Constitution (KAIST), and documented in a research paper
they intend to present at the IEEE Symposium on Security and Privacy
in late May 2019.
The Korean researchers said they found 51 LTE vulnerabilities, of
which 36 are new, and 15 have been first identified by other research
groups in the past. They discovered this sheer number of flaws by
using a technique known as fuzzing --a code testing method that inputs
a large quantity of random data into an application and analyzes the
output for abnormalities, which, in turn, give developers a hint about
the presence of possible bugs. The resulting vulnerabilities, see
image below or this Google Docs sheet, were located in both the design
and implementation of the LTE standard among the different carriers
and device vendors. The KAIST team said it notified both the 3GPP
(industry body behind LTE standard) and the GSMA (industry body that
represents mobile operators), but also the corresponding baseband
chipset vendors and network equipment vendors on whose hardware they
performed the LTEFuzz tests.'
-- source: https://it.slashdot.org/story/19/03/28/2035257
Cheers, Peter
--
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
1 year, 2 months
ASUS Releases Fix For ShadowHammer Malware Attack
by Peter Reutemann
'ASUS may have inadvertently pushed malware to some of its computers
through its update tool, but it at least it has a fix ready to go. The
PC maker has released a new version of its Live Update software for
laptops that addresses the ShadowHammer backdoor attack. It also
promised "multiple security verification mechanisms" to reduce the
chances of further attacks, and started using an "enhanced end-to-end
encryption mechanism." There are upgrades to the behind-the-scenes
server system to prevent future attacks, ASUS added.
The company simultaneously reiterated the narrow scope of
ShadowHammer, noting that the malware targeted a "very small and
specific user group." It's believed to be an Advanced Persistent
Threat -- that is, a state-backed assault against organizations rather
than everyday users. Other ASUS devices weren't affected, according to
a notice. While the fix is reassuring, it also raises questions as to
why the systems weren't locked down earlier. Update tools are prime
targets for hackers precisely because they're both trusted and have
deep access to the operating system -- tight security is necessary to
prevent an intruder from hijacking the process.'
-- source: https://hardware.slashdot.org/story/19/03/26/2025229
Cheers, Peter
--
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
1 year, 2 months
Firefox Lockbox Comes To Android To Ease Password Pain
by Peter Reutemann
'If you're a Firefox true believer, or even just a Firefox user, your
password struggles just got a little easier with the release of
Firefox Lockbox for Android devices. From a report:
The password manager, based on login information already in Firefox,
makes it easier to sign into apps as well. It integrates with login
autocomplete systems in both Apple's iOS and Google's Android
software, Mozilla said. It's not as fancy as password managers like
LastPass, BitWarden, 1Password and Dashlane, and the only browser it
works with is Firefox. On the other hand, if you're already in the
Firefox world, it's basically already set up for you. There's no
migration process as with dedicated password managers.'
-- source: https://news.slashdot.org/story/19/03/26/1559243
Cheers, Peter
--
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
1 year, 2 months
Google Makes Emails More Dynamic With AMP For Email
by Peter Reutemann
'Google today officially launched AMP for Email, its effort to turn
emails from static documents into dynamic, web page-like experiences.
>From a report:
AMP for Email is coming to Gmail, but other major email providers like
Yahoo Mail, Outlook and Mail.ru will also support AMP emails. It's
been more than a year since Google first announced this initiative.
Even by Google standards, that's a long incubation phase, though
there's also plenty of backend work necessary to make this feature
work.
The promise of AMP for Email is that it'll turn basic messages into a
surface for actually getting things done. "Over the past decade, our
web experiences have changed enormously -- evolving from static flat
content to interactive apps -- yet email has largely stayed the same
with static messages that eventually go out of date or are merely a
springboard to accomplishing a more complex task," Gmail product
manager Aakash Sahney writes. "If you want to take action, you usually
have to click on a link, open a new tab, and visit another website."
With AMP for Email, those messages become interactive. That means
you'll be able to RSVP to an event right from the message, fill out a
questionnaire, browse through a store's inventory or respond to a
comment -- all without leaving your web-based email client.'
-- source: https://tech.slashdot.org/story/19/03/26/1838254
Cheers, Peter
--
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
1 year, 2 months
Android Users' Security and Privacy At Risk From Shadowy Ecosystem of Pre-Installed Software, Study Warns
by Peter Reutemann
'Researchers behind a large-scale independent study of pre-installed
Android apps "unearthed a complex ecosystem of players with a primary
focus on advertising and 'data-driven services' -- which they argue
the average Android user is likely to be unaware of (while also likely
lacking the ability to uninstall/evade the baked in software's
privileged access to data and resources themselves)," reports
TechCrunch. From the report:
The study, which was carried out by researchers at the Universidad
Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in
collaboration with the International Computer Science Institute (ICSI)
at Berkeley (USA) and Stony Brook University of New York (US),
encompassed more than 82,000 pre-installed Android apps across more
than 1,700 devices manufactured by 214 brands, according to the IMDEA
institute. "The study shows, on the one hand, that the permission
model on the Android operating system and its apps allow a large
number of actors to track and obtain personal user information," it
writes. "At the same time, it reveals that the end user is not aware
of these actors in the Android terminals or of the implications that
this practice could have on their privacy. Furthermore, the presence
of this privileged software in the system makes it difficult to
eliminate it if one is not an expert user."
In all 1,200 developers were identified behind the pre-installed
software they found in the data-set they examined, as well as more
than 11,000 third party libraries (SDKs). Many of the preloaded apps
were found to display what the researchers dub potentially dangerous
or undesired behavior. The data-set underpinning their analysis was
collected via crowd-sourcing methods -- using a purpose-built app
(called Firmware Scanner), and pulling data from the Lumen Privacy
Monitor app. The latter provided the researchers with visibility on
mobile traffic flow -- via anonymized network flow metadata obtained
from its users. They also crawled the Google Play Store to compare
their findings on pre-installed apps with publicly available apps --
and found that just 9% of the package names in their dataset were
publicly indexed on Play. Another concerning finding relates to
permissions. In addition to standard permissions defined in Android
(i.e. which can be controlled by the user) the researchers say they
identified more than 4,845 owner or "personalized" permissions by
different actors in the manufacture and distribution of devices. So
that means they found systematic user permissions workarounds being
enabled by scores of commercial deals cut in a non-transparency
data-driven background Android software ecosystem.
The researchers address the lack of transparency and accountability in
the Android ecosystem by suggesting the introduction and use of
certificates signed by globally-trusted certificate authorities, or a
certificate transparency repository "dedicated to providing details
and attribution for certificates used to sign various Android apps,
including pre-installed apps, even if self-signed." They also suggest
Android devices should be required to document all pre-installed apps,
plus their purpose, and name the entity responsible for each piece of
software -- and do so in a manner that is "accessible and
understandable to users."'
-- source: https://tech.slashdot.org/story/19/03/25/2058215
Cheers, Peter
--
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
1 year, 2 months
