WhatsApp – Jupiter Broadcasting

LineageOS 15.1 is finally here — We’ve been working hard these months to get this new version available; the changes that were done in upstream (AOSP) are huge: Project Treble changed the way hardware is managed in Android, so all the OEM-abandoned platforms that are supported by Lineage had to be adapted for the new platform.
XDA article
Unity 8 running on 18.04
Ubuntu metrics collection will be opt-in when upgrading to 18.04 — “Upgrading users would need to purposely “opt-in” to this behaviour, as that wasn’t
explicitly asked in the past.
Collecting user data while protecting user privacy — The technique varies a lot in exactly how it’s applied, but the basic concept is that for any question, there’s a random chance that the answerer should lie in their response.
Signal Foundation is born thanks to $50M from WhatsApp co-founder — Today, we are launching the Signal Foundation, an emerging 501(c)(3) nonprofit created and made possible by Brian Acton, the co-founder of WhatsApp, to support, accelerate, and broaden Signal’s mission of making private communication accessible and ubiquitous.
First RISC-V board available to pre-order —
HiFive Unleashed is the ultimate RISC-V developer board. Featuring the world’s first and only Linux-capable, multi-core, RISC-V processor — the Freedom U540 — the HiFive Unleashed ushers in a brand new era for RISC-V.
HiFive Unleashed launch FOSDEM 2018 Video
Tech Talk Today is back — Elon Musk bet the future of SpaceX on the Falcon Heavy launch. On Thursday SpaceX launched a pair of prototype satellites intended to form the basis for Starlink, a constellation of satellites that are designed to beam broadband internet down to Earth.

The post Linux Action News 42 first appeared on Jupiter Broadcasting.

A Farewell to Dan | TechSNAP 347

chris — Wed, 29 Nov 2017 01:27:32 +0000

RSS Feeds:

HD Video Feed | MP3 Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Imgur’s blog post Re: notice of data breach

Contrast Imgur’s breach handling wth that of DJI

developers had left the private keys for both the “wildcard” certificate for all the company’s Web domains and the keys to cloud storage accounts on Amazon Web Services exposed publicly in code posted to GitHub
Findings of developer: Why I walked away from
$30,000 of DJI bounty money – PDF
But as Finisterre worked to document the bug with the company, he got increasing pushback—including a threat of charges under the Computer Fraud and Abuse Act (CFAA).
“At one point… DJI even offered to hire me directly to consult with them on their security,” Finisterre wrote.
Ultimately, Finisterre received an e-mail containing an agreement contract that he said “did not offer researchers any sort of protection. For me personally, the wording put my right to work at risk, and posed a direct conflict of interest to many things including my freedom of speech.” It seemed clear to Finisterre that “the entire ‘Bug Bounty’ program was rushed based on this alone,” he wrote.

how can I prevent myself from getting hacked?

not everyone agrees with Motherboard so see also Basic security precautions for non-profits and journalists in the United States, mid-2017. but to be fair, Bruce say’s it’s pretty good
see also other Motherboard guides
Do you want to stop criminals from getting into your Gmail or Facebook account? Are you worried about the cops spying on you? We have all the answers on how to protect yourself.
The Electronic Frontier Foundation guide to Assessing Your Risks
… if you come away with one lesson from this guide is: update, update, update, or patch, patch, patch.
Use a password manager
Two factor authentication: You should, if the website allows it, use another 2FA option that isn’t SMS-based, such as an authentication app on your smartphone (for example, Google Authenticator, DUO Mobile, or Authy), or a physical token. If that option is available to you, it’s great idea to use it.
use an ad blocker (e.g. uBlock Origin). Why? A great deal of malware comes through ads.
Get an iPhone and don’t jailbreak it
Use Signal instead of WhatsApp
Even if you keep your privacy settings on lockdown, social media companies are subject to subpoenas, court orders, and data requests for your information. And often times, they’ll fork over the information without ever notifying the user that it’s happening. For the purposes of social media, assume that everything you post is public. This doesn’t mean you should stop using social media, it just means you have to be mindful of how you use it.

Feedback

Tape Drives and Jails – FreeNAS jails
From Samir, based on question from Episode 346 : Linux Containers vs Virtual Machines
Jonathan Davis mentioned Schrodingers Backup Mug
I will Miss you Mr. Dan
Reverse SSH as Poor-Man’s VPN

Round Up:

Potential impact of the Intel ME vulnerability
Mostly for ZFS: Policy-driven snapshot management and replication tools. & see also zfstools : OpenSolaris-compatible auto snapshotting for ZFS
The strongest KASLR, ever?
Better Random Number Generation for OpenSSL, libc, and Linux Mainline – But what’s really exciting for us is that, in the course of working on libc, we were also able to get traction on another important change, in Linux itself. Last year, we suggested a new madvise() option for the Linux kernel. Based on OpenBSD’s MINHERIT_ZERO, the option marks memory regions as WIPEONFORK, which means that those regions are zeroed in a child process immediately after a fork() call.
How a single PostgreSQL config change improved slow query performance by 50x
Troy Hunt testifies before Congress and you should be able to watch it live here
A minimalist guide to tmux
Top SSL Issuers

The post A Farewell to Dan | TechSNAP 347 first appeared on Jupiter Broadcasting.

Careless but Not Criminal | Unfilter 195

chris — Wed, 13 Jul 2016 21:02:11 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

By our estimate Hillary Clinton won the 2016 election since our last episode, we’ll run down the last two amazing weeks for her. Why NATO’s military moves are creating a ticking time bomb & the latest cyber threat powered by encryption.

Direct Download:

Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

Become an Unfilter supporter on Patreon:

— Show Notes —

Episode Links

The post Careless but Not Criminal | Unfilter 195 first appeared on Jupiter Broadcasting.

Alert Fatigue | Tech Talk Today 115

chris — Tue, 13 Jan 2015 11:25:11 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Amber alerts in your feed, UK encryption crackdown, MacBooks selling like crazy, AI warnings & Drone journalism takes flight.

Direct Download:

RSS Feeds:

Become a supporter on Patreon

Show Notes:

Introducing AMBER Alerts on Facebook

With more than 725 children recovered as a direct result of AMBER Alerts since the program launched in 1996, we know the system works. We hope our new delivery mechanism will help increase that number and reunite even more families.

British Prime Minister Suggests Banning Some Online Messaging Apps

That was the message delivered on Monday by Prime Minister David Cameron, who said he would pursue banning encrypted messaging services if Britain’s intelligence services were not given access to the communications.

Apple Maintains Mac Sales Momentum in Holiday Quarter

With its 11.7 percent share of the market, Apple is the third largest PC vendor in the United States, behind HP and Dell, which captured 29.2 and 22.6 percent of the market, respectively. Lenovo and ASUS came in behind Apple, with 10.2 and 6.8 percent of the market, respectively.

Artificial intelligence experts sign open letter to protect mankind from machines

Famed physicist Stephen Hawking and Tesla Motors CEO Elon Musk have also voiced their concerns about allowing artificial intelligence to run amok. “One can imagine such technology outsmarting financial markets, out-inventing human researchers, out-manipulating human leaders, and developing weapons we cannot even understand,” Hawking said in an article he co-wrote in May for The Independent. “Whereas the short-term impact of AI depends on who controls it, the long-term impact depends on whether it can be controlled at all.”

Google launches Chrome Remote Desktop for iOS | VentureBeat

Google today launched its Chrome Remote Desktop app for iOS, some nine months after releasing the tool on its own mobile platform. Like its Android counterpart, the iOS version lets you remotely control your computer using your smartphone or tablet. You can download the new app from Apple’s App Store

CNN’s Drone Journalism Is Just the Beginning – NationalJournal.com

“Our aim is to get beyond hobby-grade equipment and to establish what options are available and workable to produce high-quality video journalism using various types of UAVs and camera setups,” CNN Senior Vice President David Vigilante, said in a press release.

The development is significant because currently the FAA does not allow Unmanned Aerial Vehicles for commercial use, save for a few exceptions for the entertainment industry and agriculture. This loosening of the rules could pave the way not just for aerial news-gathering but also for Amazon’s proposed air delivery service.

My first day with my drone – YouTube

The post Alert Fatigue | Tech Talk Today 115 first appeared on Jupiter Broadcasting.

Behind the Masq | BSD Now 58

chris — Thu, 09 Oct 2014 10:28:57 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Coming up this week on the show, we’ll be talking to Matt Ranney and George Kola about how they use FreeBSD at Voxer, and how to get more companies to switch over. After that, we’ll show you how to filter website ads at the gateway level, using DNSMasq. All this week’s news and answers to your emails, on BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

NetBSD’s EuroBSDCon report

This year’s EuroBSDCon had the record number of NetBSD developers attending
The NetBSD guys had a small devsummit as well, and this blog post details some of their activities
Pierre Pronchery also talked about EdgeBSD there (also see our interview if you haven’t already)
Hopefully this trend continues, and NetBSD starts to have even more of a presence at the conferences

Upcoming features in OpenBSD 5.6

OpenBSD 5.6 is to be released in just under a month from now, and one of the developers wrote a blog post about some of the new features
The post is mostly a collection of various links, many of which we’ve discussed before
It’ll be the first version with LibreSSL and many other cool things
We will, of course, have all the details on the day of release
There are some good comments on hacker news about 5.6 as well

FreeBSD ARMv8-based implementation

The FreeBSD foundation is sponsoring some work to port FreeBSD to the new ThunderX ARM CPU family
With the potential to have up to 48 cores, this type of CPU might make ARM-based servers a more appealing option
Cavium, the company involved with this deal, seems to have lots of BSD fans
This collaboration is expected to result in Tier 1 recognition of the ARMv8 architecture

Updating orphaned OpenBSD ports

We discussed OpenBSD porting over portscout from FreeBSD a while back
Their ports team is making full use of it now, and they’re also looking for people to help update some unmaintained ports
A new subdomain, portroach.openbsd.org, will let you view all the ports information easily
If you’re interested in learning to port software, or just want to help update a port you use, this is a good chance to get involved

Interview – Matt Ranney & George Kola – mjr@ranney.com & george.kola@voxer.com

BSD at Voxer, companies switching from Linux, community interaction

Tutorial

Adblocking with DNSMasq & Pixelserv

News Roundup

GhostBSD 4.0 released

The 4.0 branch of GhostBSD has finally been released, based on FreeBSD 10
With it come all the big 10.0 changes: clang instead of gcc, pkgng by default, make replaced by bmake
Mate is now the default desktop, with different workstation styles to choose from

Reports from PF about banned IPs

If you run any kind of public-facing server, you’ve probably seen your logs fill up with unwanted traffic
This is especially true if you run SSH on port 22, which the author of this post seems to
A lot can be done with just PF and some brute force tables
He goes through some different options for blocking Chinese IPs and break-in attempts
It includes a useful script he wrote to get reports about the IPs being blocked via email

NetBSD 6.1.5 and 6.0.6 released

The 6.1 and 6.0 branches of NetBSD got some updates
They include a number of security and stability fixes – plenty of OpenSSL mentions
Various panics and other small bugs also got fixed

OpenSSH 6.7 released

After a long delay, OpenSSH 6.7 has finally been released
Major internal refactoring has been done to make part of OpenSSH usable as a library
SFTP transfers can now be resumed
Lots of bug fixes, a few more new features – check the release notes for all the details
This release disables some insecure ciphers by default, so keep that in mind if you connect to legacy devices that use Arcfour or CBC modes

Feedback/Questions

All the tutorials are posted in their entirety at bsdnow.tv
We want to give a special thanks to our viewer CJ for writing today’s tutorial
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv – we always love hearing from viewers, even if you don’t have a question
While it’s not directly related to BSD, the videos from illumos day 2014 are online, if you’re interested in that
The EuroBSDCon 2014 videos are being uploaded, we’ll have all the links to share (hopefully) soon
Watch live Wednesdays at 2:00PM Eastern (18:00 UTC)

The post Behind the Masq | BSD Now 58 first appeared on Jupiter Broadcasting.

Not Sharing The Secret | TechSNAP 156

chris — Thu, 03 Apr 2014 16:18:21 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Researchers develop a new way to protect your passwords after they’ve been stolen, the little credit card scam making big money…

Then it’s a great batch of your questions, a rockin round up, and much much more!

On this week’s TechSNAP.

Thanks to:

Direct Download:

RSS Feeds:

— Show Notes: —

Researchers are NYU develop PolyPassHash, hard to crack password store

PolyPassHash is designed to make it significantly harder to crack users’ passwords in the event the password database is leaked
The system uses SSSS (Shamir’s Secret Sharing Scheme ) which is a system for dividing a secret key (in this case used to encrypt the password database) into many pieces, and requiring only a specific number of those pieces to be combined to return the key
In the wikipedia example, the secret key is divided into 6 parts and the algorithm defined such that 3 of the parts must be combined in order to return the secret
The SSSS algorithm is extensible, it allows the number of pieces that the secret is divided into to grow as long as the threshold (the number of pieces required to decrypt) is key fixed
The SSSS algorithm is also flexible, allowing for some people (say the system administrator) to have more than 1 share
In the Python reference implementation the threshold is set to 10
This means that 10 pieces of the secret are required in order to decrypt the password file
Each regular user’s password is 1 share of the secret, so when that user provides the correct password, 1 share is available
In the reference implementation, there are 3 administrator users, each of who’s password is 5 shares of the secret, meaning the correct passwords for any 2 of the administrators will be able to decrypt the password database
Currently PolyPassHash uses just the SHA256 of the users’ password and a random salt, rather than using sha256crypt() which does more than 1 SHA256 round on the password, and uses different mixes of the password and salt
The drawback with PolyPassHash is that after a reboot, it is not possible for anyone to login until a sufficient number of users have entered the correct password to return the required number (the threshold) of shares to decrypt the password hashes
There is a proposed solution to this, involving shortening the SSSS key such that some of the hash (the last few bytes) are not encrypted, and using that to authenticate the first few users until sufficient users have successfully logged in to decrypt the password database
This compromises the security of the passwords because part of the plain hash is leaked, and it also means that an incorrect password could allow a user to login after a reboot before the threshold has been met
PolyPassHash also has support for thresholdless accounts (accounts that do not have any shares), in order to protect larger systems (like Facebook or Gmail) where an attack may have compromised enough accounts to have sufficient shares to decrypt the entire database. In this case, only administrator (or maybe power user) accounts would have shares
PolyPassHash also has support for other authentication systems, including things like biometrics, ssh keys, and smart cards, but also external systems like OAuth or OpenID (thresholdless accounts)
In the case of SSH keys, instead of a password, the share of the SSSS is encrypted with the public key, and the user uses their SSH private key to decrypt the share
New users cannot be added until the threshold has been reached, since the secret is required to generate a new share of the secret
Research Paper

Who is behind sub-$15 credit card scam

A service called ‘BLS Web Learn’ has been identified as being behind a scam that charged numerous credit and debit cards small fees of less than $15
The scam centers around small charges that appear on your credit card bill, usually for small random amounts such as $9.84, $10.37, or $12.96
The line item includes a toll free number (as most charges do), and you are encouraged by your bank to call this number and try to identify the charge and resolve any issues with the seller directly, rather than filing a chargeback
In this case, since the card holder never ordered anything or authorized the charge, the service refunds the small amount
They make their money off all of the people who don’t notice the small charge
Unlike many scams, because they maintain the assertion that they are a legitimate business, and refund the charge when a cardholder complains, they do not rack up a large number of chargebacks, and their account with the credit card processor is not red flagged or shut down
Krebs have investigated a similar case before, which appeared to be based in Malta
The name of the ‘online learning’ company, and the credit card processor are different, but the scam seems very much the same
The payment processor, BlueSnap, lists its offices in Massachusetts, California, Israel, Malta and London. Interestingly, the payment network used by the previous scam, Credorax, also lists offices in Massachusetts, Israel, London and Malta

Feedback:

Who should play Allan Jude in Allan Jude: The Movie
XP Fail
Picture of the XP mess
Checksum your SaaS
Ubuntu Manpage: debsums – check the MD5 sums of installed Debian packages
Mulitple Domain Names pointing to same IP address
The debate continues re: ZFS and ECC
- ECC is not required, but using non-ECC increases the risk of data loss. Using ECC RAM is the cheapest way to increase the uptime and reliability of the system
Metal_Geek Needs help: I need help recovering data from a LUKS encrypted partition.

Round-Up:

The post Not Sharing The Secret | TechSNAP 156 first appeared on Jupiter Broadcasting.

Adobe’s Leaky Source | TechSNAP 131

chris — Thu, 10 Oct 2013 16:22:06 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Adobe blows it. A treasure trove of customer information and source code has been found, we’ll share the details.

The DNS hijacking hijinks continue, after several big sites are brought offline. Then its a huge batch of your questions, our answers, and much much more!

Thanks to:

Direct Download:

RSS Feeds:

Adobe hacked, 3 million customer records leaked

Adobe’s servers was compromised sometime between July 31 and Aug. 15, but the attack was not discovered until Sept. 17
The source code for “numerous” products was stolen, including Adobe Acrobat, Publisher, ColdFusion, and ColdFusion Builder
The source code leak could allow the attackers to much more easily generate a slew of 0-day attacks against Adobe products, resulting in exploits against which there is no defense
Sensitive information on people with Adobe accounts was also taken, including names, encrypted credit numbers, expiration dates, order history and more
“At this time, we do not believe the attackers removed decrypted credit or debit card numbers from our systems” said Adobe chief security officer Brad Arkin
“Krebs also saw a list of 1.2 million potential .org domains running ColdFusion that the attackers could use as targets stored among the stolen data”
“Holden and Krebs discovered a 40 GB file of stolen data, Krebs reported yesterday, on the same server hosting data stolen from brokers LexisNexis, Dun & Bradstreet and Kroll.”
Additional companies were also compromised
Additional Coverage – Threatpost
Additional Coverage – ZDNet
Adobe Blog – Illegal Access to Adobe Source Code
Adobe – Important Customer Security Announcement
Adobe – Customer Security Alert

WhatsApp, AVG, Avira, Alexa websites hacked in apparent DNS hijack

Network Solutions is investigating an attack by a pro-Palestinian hacking group that redirected websites belonging to several companies.
A group calling itself the KDMS Team claimed responsibility on Twitter.
KDMS posted several screenshots on Twitter, including one that affected WhatsApp\’s domain. + The message asserted that the region known as Palestine has been stolen, and that prisoners should be released from Israeli jails.
The websites affected included those of the security companies AVG and Avira; the messaging platform WhatsApp; a pornography site, RedTube; and Web metrics company Alexa.
Stated on the company’s blog:
> \”It appears that our account used to manage the DNS records registered at Network Solutions has received a fake password-reset request which was honored by the provider.\”
> \”Using the new credentials, the cybercriminals have been able to change the entries to point to their DNS servers.\”
Additional Coverage:
- WhatsApp Web site hijacked, shows pro-Palestinian message
- DNS-Based Attack Brings Down New Victim: WhatsApp

Feedback:

vBSDCon Oct 25-27

[asa]0399160450[/asa]

Threat Vector Audiobook | Tom Clancy, Mark Greaney | Audible.com

Round Up:

The post Adobe's Leaky Source | TechSNAP 131 first appeared on Jupiter Broadcasting.