Friday Finale

I'm sad to say this is my last post.
For the week.


There is a patch for Outlook for Android for a recent vulnerability which could result in take over for a system.

Now I want you to be honest with me.... do you or anybody you know run Outlook on your android? It's almost as silly as Outlook for linux. It makes my head hurt. I know an iDevice user who runs it, but we agreed not to talk about it.



Also a BIND advisory, affecting multiple versions. It could be caused to cause a DDOS condition.



T-Mobile was hacked. The hackers got access to the data of prepaid customers.
Hackers insisted it be spelled TMobile.



AMD just released a $49 mainstream processor. Yes, for the normals out there, $49 will get you a nice processor. It's unlocked, so you can jack up the clock speed, which normals don't do anyway.



Perennial favorite Google wants to move android back to the mainline linux kernel.  No word yet on how they plan to get linux to phone home.



Pissed because people keep blocking ads, the ad industry came up with an 'unblockable' web tracker. It violates the GDPR out of the box. At this time, only Firefox with the uBlock Origin addon can stop it.  There are some fascinating bits in this article on ad tech and how majors are reacting.



Don't use Startpage for searches anymore. It was sold to a behavioral ad company.



No, IT blogs aren't that difficult.
Yes, using a spell-checker on IT topics is.

Backdoor Fixed?

Ddoor - cross platform backdoor using DNS txt records.
It's ok - it's a lightweight backdoor.


Google and Samsung fix android spying flaw.
So only the rest of the phones are vulnerable.


Microsoft denies bluekeep ransomware is theirs.
No, MS Teams and Bluekeep (RDP) are not responsible.
But publicly flog themselves over RDP.



GPS manipulation in Shanghai is probably NOT the Chinese military
Like IoT, GPS is one of those technologies that just begs for problems. If you're steering a ship or piloting a plane, you better have a reliable backup.. if there are problems, GPS will be the first thing to go.



NSA advisory addressing encrypted traffic inspection risks
Yeah, we think you just shouldn't encrypt anything... it's for the children...
No, seriously, read it.


Running linux commands with timeout



Speaking of linux, I was initially taken aback when I saw 'mpd'. Turns out it doesn't stand for Multiple Personality Disorder.

If You Think We're Gonna Fix That, We're Laughing at You

In case you needed another reason not to buy anything that says D-Link on it, more of their routers were discovered to have critical RCE bugs, and they won't be fixed. D-Link's 'out' is that they're end of life. This should be fun for the people who sadly purchased one of their products.


uBlock is having trouble with 1st party tracker blocking.


How the most damaging ransomware evades IT security - by Sophos



Linux

Wanna try out Monero digital coin?
I'd avoid it. The coin stealer found in the 64 bit CLI official binaries eats up too many cpu cycles and bandwidth.


How to recall forgotten linux commands
[apropos + history]



Security and Privacy

These 2 are Sadly Related Required Reading. There IS no privacy, but you need to know why....

How Knightscope's security robots surveil the public

The fantasy of opting out

It Goes Both Ways

Multi-platform "ACBackdoor" attacks Win + Lin by executing arbitrary code.

Ok: goes both ways, backdoor. I think we know where this is going.
Linux has zero detection rate, Win obviously has more. This is a new one, folks.



And it's Ransomware!

It's a bad day to be in Louisiana, especially if you're in state IT or need to access (some) state servers. Office of Technical Services (OTS) said some, but not all servers are infected. "Similar" to the ones that have attacked a swath of the US recently.

For some strange reason, the state had backups and is restoring them as we type.



Android camera app bug lets apps record video without permission.
The app's storage permission allows the camera to record video.
Nice job, Googs.
You should use a different camera app anyway. You can't turn off the bloody noise on mine.



Fresh from two straight days of talking about it with others, it looks like the Deepin linux distro is getting some sort of AI voice assistant. Even without reading the (ad-blocker hostile) article, we know it doesn't send everything you say to Google. Now, let's get that bay boy over to Ubuntu, and we're golden.



Macy's done got card details skimmed as part of another Magecart breach.
In further strange news, it was discovered a week after it happened.
It was reported to the relevant card brands and vicitms get 12 months of Experian identity protection service. I challenge you... pick out the oxymoron.

If you said Experian protection, you're right! You win a solid year of Experian protection!

Another Day at the Office- Google Lies to Congress

The Goog is in trouble. Read the article for only minor horrors about how the Fair and Balanced search engine works, and how many fingers are on the results you see. Yet another reason to use Duckduckgo. You can tell goog is important because they've already lied to Congress.


Researchers found 146 vulnerabilities in various android firmwares....
Plus the updates your carrier 'forgot' to send you....


Yippee! The PinePhone is now available for pre-order!
This version is for early adopters. $149 is so tempting....
You should also research your intended linux phone distro.


Manipulating text with grep
Go grep yourself.


Malware attack drops double remote access trojan in Windows to steal Chrome and Firefox browser data.

Amazon Sucks Eggs

To my horror, somebody in my family, who isn't me, was gifted an Amazon tablet. This is not a privacy-friendly device, to put it mildly. Even though it's android, you have to go through Amazon to get apps, which spy as badly as the ones on Google Play. If you've got any tips or tricks, please forward in the comments.



Speaking of linux, TecMint has the top 15 security-centric linux distros of 2019. Interesting to note how many are based on Debian. Or you could just route some or all through Tor (don't forget to contribute, financially or by hosting a node).



The aforementioned PineBook is mentioned and partially reviewed by a Vivaldi browser developer.



How the linux kernel balances the risks of public bug disclosure.



Impeachment hearing reveals White House phone security fail.

The Secret Life of Cardboard

Life of a wi-fi security researcher.
The only security presenter  at a wi-fi conference.



In smaller news, 125 new flaws were found in routers and NAS devices from popular brands.  Read em and weep.



Google is getting even more exciting than Faceyspaces these days, if only for sheer amount of time in the news, being evil. This time it's calendars, specifically thousands of them, possibly leaking private information online... there are over 8,000 of them, searchable via Google search.

Long ago, coworkers and friends wanted to use Google calendars because they were convenient. I made that 'you want me to kill babies?' face and they laughed at me because I was a tin foil loon. Besides - Google was huge - they'd protect your data. I told them that people who are serious about privacy don't post their personal information online. They laughed again. And again, I was right. Why doesn't anyone ever call me to tell me I was right, again?




Qualcomm chipsets, largely in android phones and tablets, are vulnerable to potentially serious flaws. The flaws could allow an attacker to steal sensitive information stored where they normally cannot get at it.  YOU KIDS GET OUT OF MY QUALCOMM SECURE WORLD!




First Microsoft put a linux subsystem in Windows. Now there's a PowerShell for linux.  We are living in the end times.



InfoTrax Systems was hacked more than 20 times from 2014 to 2016.
They failed to detect this (even though every display in the place said YOU'RE HACKED upon login). Finally, their very sophisticated detection system kicked in. And when I say sophisticated detection system, I mean the hack caused them to run out of disk space.

These ne'er do wells have been sued by the FTC for losing full names, social security numbers, email addresses, phone numbers, usernames and passwords. And some payment card information.  I can't even begin to tell you...this is a technology company!



A security breach at Hostinger might have affected 14 million customers. Cuz if you're a big hosting company, you want to make big mistakes.

I guess it's a pipe dream to ask people to take their business elsewhere, when a breach is discovered. They won't even read the news. Let the market decide.




With the PineBook and PinePhone becoming available, you'll be thrilled to get a Pocket P.C.  This guy is the electronics of a phone, with a linux OS, 1080p display and longer battery life. It ships with Debian 10. The display is 4.95" 1080p with touch. there are 2 models, $199 and $299, the latter which you can use for developing LoRa apps. They are powered by a 1.2GHz quad-core ARM Cortex-A53 cpu.  Target is May 2020.




There's a new app comin' around the mountain (and over it). If you have a smart phone, you can monitor drones in the area.  All sorts of information is available, surprisingly.  Although we're the target market, I can see this being very popular in the middle east.




Last, an actual helpful link: how to find temperature and fan speed in linux for CPU and GPU.
Some of the instructions are a bit funky. I like the xfce panel plugin.