Social Items



Mobian OS is an open-source project that aims to bring Debian GNU/Linux to mobile devices, including the PINE64 devices, PinePhone and PineTab.

While Debian GNU/Linux is among the oldest Linux-based operating systems which boasts of rock-solid stability, and a very large community support; but you can't install pure Debian directly on smartphones or tablets, as it requires hardware-specific customizations to run smoothly on such devices.

Now, Mobian OS has been ported to run on PINE64 devices, including PinePhone and PineTab, as the Mobian team announced that along with PinePhone, they have started to build images for Linux-based tablet, PineTab.

What are the features of Mobian OS?



Mobian OS is an open-source project that aims to bring Debian GNU/Linux on modern mobile devices, featuring the Phosh (Phone shell) user interface developed by Purism for its Linux phone Librem 5.



Its base system uses pure Debian 11 ‘Bulleye’ built for ARM64-based devices, and it uses a powerful tool, called debos, to create a custom Debian image, with Mobian packs standard Dеbіаn расkаgеs and ѕоmе GNОМЕ аррlісаtіоnѕ to carry out specific tasks. You can For a check out this GitLab package repository for full list of supported applications.

Mobian OS is currently targeted at Linux-based PinePhone and PineTab to provide a fully-functional mobile devices with open source and powerful Debian Linux, albeit, Mobian in the near future can also aim to port to other mobile devices and tablets.

How to Download & Install Mobian OS?



Mobian OS is currently available for PinePhone and therefore, if you own any edition of PinePhone and wish to give it a try, you can download the prebuilt images and follow the Mobian installation guides for PinePhone available here to get started.

And if you’re a developer and wish to build custom Debian images for your device, you can check out the repo. Also note that Mobian maintains mobian-recipes repository with debos recipes to generate Debian-based images for all supported mobile phones.

Mobian OS: Brings Debian GNU/Linux to PINE64 devices, PinePhone and PineTab

Quantum computing is a relatively new field which has algorithms built from wiring up logic gates; including vector and matrix mathematics, Dirac notation, Pauli measurements, quantum circuits and the qubit.

While the likes of Microsoft, IBM, and Google have all made major investments in building their own quantum computing software or hardware; Amazon until recently, has been fairly silent about its stance on quantum computing, but that has changed with the announcement of Amazon Braket.

Braket is Amazon's inroad into making quantum computers developed by other vendors available to its cloud users via AWS, with the service currently supporting three quantum computing services, namely: Rigetti, IonQ, and D-Wave.

What's Amazon Braket all About?



Braket is a fully-managed service to help Amazon users to easily get involved with quantum computing, which includes three modules: Build, Test, and Run. With the Build module centering around managed Jupyter Notebooks which are pre-configured with sample algorithms, and developer tools, such as the Amazon Braket SDK.

Amazon Braket


The Test module, on the other hand, provides access to high-performance, and managed quantum circuit simulators. While the Run module offers on-demand access to different types of quantum computers (QPUs), including gate-based quantum computers from Rigetti and IonQ, and quantum annealer from D-Wave.

Albeit, the tasks may not run on the QPU immediately, as the QPUs can only execute tasks during the execution windows.

How to enable Amazon Braket with Notebooks



Amazon Braket is perhaps the easiest way to get into the quantum computing and simulators waters, but as the Noisy Intermediate Scale Quantum (NISQ) phase of quantum computing still persists, you don’t really need to expect much useful results from Braket.

In order to use Braket, you'll need to first enable it in your AWS account, and then you have to create a notebook instance. While noting that such Notebooks use Amazon SageMaker. Once you open the notebook, you'll need to enter new code or use one of Amazon’s examples.

And you'll need to check the status of the QPU devices, as they are not always available. Braket’s current QPU offerings are quite modest, with the 2048-qubit D-Wave annealer as mostly useful for optimization problems, which is about half the size of D-Wave’s latest-generation annealer and the 30-qubit Rigetti Aspen-8 is too small.

The 11-qubit IonQ QPU, has relatively long coherence times, which is way too small to implement the algorithms for quantum computers that should possess useful quantum supremacy, like Shor’s algorithm for finding the prime factors of an integer and Grover’s algorithm for finding the inverse of a function.

Definitely, we’ll still need more qubits, less noise, and longer coherence times, all of which are being actively researched to get any meaningful result with Braket.

Amazon Braket: Brings Quantum Computing to its Cloud users via Amazon Web Services

Zorin OS is a Linux-based operating system designed for users who are new to the Linux platforms, with built-in features that allows them to change the UI to resemble the familiar Microsoft Windows or MacOS system.

While Zorin OS is becoming popular with the Zorin OS 15 series haven received over 1.7 million downloads since its first debut in June 2019. Now, the Zorin team has announced new point version, Zorin OS 15.3 which is the third iteration of the Zorin OS 15 series, and the most advanced and popular release ever.

It will further enhance the Zorin OS stronghold by bringing updated software, for better security and hardware compatibility.

What’s New Zorin OS 15.3 Release?



Zorin OS 15.3 is based on the recently released Ubuntu 18.04.5 LTS, which offers better support for modern hardware, and promises software updates and security patches until April 2023.



And as a further improvement to its hardware compatibility, Zorin OS 15.2 has upgraded core Linux Kernel version from 5.3 to 5.4, which brings support for more hardware like the Intel 11th generation Core processors, and upcoming AMD CPUs/GPUs. Additionally, Zorin OS 15.3 has added improvements to the Zorin Connect app for Android, with such features as auto search for devices on trusted Wi-Fi networks, and quick buttons to send files.

Zorin OS also includes the newest stable LibreOffice 6.4.6, which brings better compatibility with Microsoft Office, better performance boosts, and more utility features.

How to Upgrade to Zorin OS 15.3



For a fresh installation, all available editions of Zorin OS including Lite, Core, Ultimate, and Education can be downloaded here, with the exception of the “Ultimate” variant, which comes at a cost of $39, while all the other editions are free.

If you are an exisiting user of Zorin OS 15 series, you can update your system to reach the new point version Zorin 15.3 by using the Software Updater or running the following command:

sudo apt update
sudo apt full-upgrade
sudo reboot


And for those who are using a Zorin series other than the Zorin OS 15, there is an official upgrade guide available here to help them upgrade to the new point version Zorin 15.3 release.

Zorin OS 15.3 Release: Brings Update to the core apps for faster and better experience



A group of researchers at ETH Zurich have disclosed an authentication flaw in Visa's EMV enabled payment cards that could allow cybercriminals to defraud cardholders as well as merchants by obtain funds illegitimately.

According to the researchers, the flaw is a PIN bypass attack that allows the hackers to leverage a stolen or lost credit card for authorizing high-value purchases without the knowledge of the card's PIN, and also trick a point of sale (PoS) terminal into an unauthenticated offline card transaction.

The flaw affects all contactless cards that use the Visa protocol, including Visa Debit and Credit cards, Visa Electron, and V Pay cards, and the researchers also tied it to the EMV protocols implemented by UnionPay and Discover cards as well. While MasterCard, and American Express, are not impacted by the vulnerability.

How ETH Zurich researchers exploited the flaw to mount a man-in-the-middle (MitM) attack



The international protocol standard for smartcard payment, EMV (short for Europay, MasterCard, and Visa), mandates that all larger amounts of money can only be debited from credit cards using a PIN code.

However, the process devised by the researchers exploits the flaw in the protocol to mount a man-in-the-middle (MitM) attack using an app that "instructs the terminal that PIN verification is not required because the cardholder verification was performed on the device" to gain access.



And the fact that the Cardholder verification method (CVM), which is employed in verifying if an individual that's attempting a transaction with a credit/debit card is the legitimate cardholder, isn't protected cryptographically from modification makes the attack possible.

How to Mitigate against PIN bypass attacks



The attack scenario proves that the PIN is actually useless for security in Visa contactless transactions, and the differences between the contactless payment protocols of MasterCard meant that MasterCard is more secure.

And as the flaw violates fundamental security properties such as authentication and guarantees on accepted transactions, the researchers have proposed three software fixes to the protocol to prevent PIN verification bypass attacks, including using Dynamic Data Authentication (DDA) in securing high-value online transactions and the use of online cryptogram in all PoS terminals, allowing offline transactions to be processed online.

PIN Verification Bypass Flaw affecting all contactless Cards on the Visa protocol



EndeavourOS is an Arch-based Linux distribution that offers almost vanilla and terminal-centric Arch experience, with the first stable version released on July 15, 2019, bringing a friendly GUI-based offline and online installer.

Now, the team has announced a new project that offers EndeavourOS for ARM computers, which is quite similar to the collaboration for EndeavourOS x86_64 and Arch Linux; the EndeavorOS ARM aims to provide same experience on devices running ARM (Acorn RISC Machine) based processors.

Albeit, EndeavourOS isn't the first Linux distribution to offer support for ARM processor architecture, as Linux distros such as Ubuntu, Arch Linux, and Manjaro, already provide images for ARM devices.

What to expect in EndeavourOS ARM Linux Distribution?



Although, there are no official information about the upcoming EndeavourOS ARM Linux Distribution, other than the announcement that the ARM distro will be launching on September 19, 2020.

However, the sneak peak that was shared by team members for the first Odroid-N2+ running EndeavourOS ARM (EOSARM) Linux Distribution, shows what it feels like running the OS on the ODROID-N2 which is a $79 hexa-core computer that uses the Amlogic S922X 12nm SoC, offering a quad-core ARM Cortex-A73 cluster and a dual-core ARM Cortex-A53 cluster with 4GB of 1320MHz DDR4 RAM.



And you will only be able to download EndeavourOS ARM images starting on September 19, 2020 from the new official website.

If you are a developer and would like to host a mirror, there are more information available here, and the guides that will help you with package and software development in Arch Linux ARM can be found here.

EndeavourOS ARM Version: What to expect in the upcoming Linux Distribution?

Evilnum hackers



Evilnum is a hacker group that has been targeting fintech companies, mostly those located in the United Kingdom and EU countries, with the goal of spying on targets and stealing financial information, including login details, bank documents, and email credentials, among others.

According to researchers at Cybereason, the Evilnum group has tweaked its infection chain and also deployed a Python RAT called "PyVil RAT," which possesses the abilities to gather personal information via screenshots, capturing keystrokes, and opening of an SSH shell to deploy new tools.

Since the first discovery of the group in 2018 till today, the group's tactics, techniques and procedures (TTPs) have evolved with the different available tools, but the group hasn't deviated from their initial focus on fintech targets.

How Evilnum targets companies with spear-phishing emails



Formerly, the hacker group targeted companies with spear-phishing emails containing a link to a ZIP file hosted on Google Drive, in order to steal customer credit card information, software licenses, and investments and trading documents.

But now, the infection procedure has undergone a major shift, albeit their modus operandi of gaining an initial foothold in a compromised system has remained the same. And by using spear-phishing emails that mimics know your customer (KYC) documents to trick employees of the fintech industry to click the bait into triggering the malware, the attacks have evolved from using Trojans with backdoor capabilities to bare-bones JavaScript dropper which delivers malicious payloads.

These Trojans are hidden in modified versions of legitimate executables which is an attempt to escape detection. And the first phase in this new infection chain, culminates into the delivery of the payload, with a Python written RAT compiled with py2exe that the security researchers dubbed, PyVil RAT.

The Evilnum group avoided using domains in communications with the C2 on previous their campaigns, rather they employed IP addresses, though the C2 IP address changes every few weeks, but the list of domains associated with the IP address is ever growing.

Now, the multi-process delivery procedure, unpacks shellcode to establish communication with an attacker-controlled server upon execution, and receive a second encrypted executable ("fplayer.exe") that serves as the next phase downloader to fetch the Python RAT.

How to Mitigate against the Evilnum attacks



The Evilnum group's TTPs continue to evolve, therefore it's recommended that businesses should be vigilant security-wise and employees should exercise caution when opening emails and attachments, especially from unknown senders, and monitor their emails for phishing attempts.

Evilnum's origins still remain unclear, but there is enough evidence about their constant improvisation of TTPs which has helped them remain under the radar.

PyVil RAT: Python-based remote access Trojan deployed by Evilnum hackers

Kotlin


Kotlin Multiplatform Mobile (KMM) is an SDK which enables developers to share code for both Android and iOS mobile app developments.

While the KMM which is developed by JetBrains draws on the mulitiplatform capabilities already available in Kotlin to streamline the experience of building truly cross-platform mobile applications. And the SDK is bundled as a preview of KMM plug-in for the Android Studio IDE that allows developers to write, run, and debug code in the same IDE.

According to JetBrains, both Android and iOS versions of an application have a lot in common, but also, there are significant differences, particularly in the UI. These differences can range from subtle variations in scrolling behavior to divergent navigation logic.

How KMM will offer flexibility by retaining native programming benefits



Since application business logic includes data management, analytics, and authentication, which can be pretty identical, it’s natural to share parts of an application across platforms while keeping the other parts separate.

Therefore, KMM offers the flexibility while also retaining native programming benefits, so that a single codebase can be used for business logic with platform-specific logic written only when necessary, whether for native UI or working with platform-specific APIs.

The shared code written in Kotlin is compiled to JVM bytecode with Kotlin/JVM and to native binaries via Kotlin/Native.

How to integrating KMM into Your existing projects



KMM business modules can be used like every other mobile library, and developers don't need to switch IDEs or have Apple’s Xcode running to make sure that code works properly using the plug-in.

JetBrains has set up a Kotlin Multiplatform Mobile developer portal and published an extensive guide on integrating KMM into existing projects.

Kotlin Multiplatform Mobile (KMM): SDK to share code across iOS and Android platforms

Deepfakes Technology


Microsoft has announced a new deepfake detection tool, known as Microsoft Video Authenticator to help in spotting synthetic images and videos that are AI-generated on the internet.

While Deepfake technology is extensively employed in the swapping of people’s faces in videos to make them utter things that was never said by such people, and often used by scammers. Albeit, the technology also has its positive sides, as the development of deep generative models brings new possibilities in healthcare, with the growing concerns about protecting the privacy of patients.

Using the deepfake technology, a hospital with adequate computational power could recreate an entirely imaginary population of its virtual patients, thus eliminating the need to share the data of real patients.

How Microsoft Video Authenticator Deepfake Detection works?



Microsoft Video Authenticator is developed by Microsoft Research, in collaboration with the Responsible AI team and AETHER committee. It analyzes any given image or video to come up with what the company calls "confidence score", which is a percentage score that shows whether the particular media content has been manipulated.

Microsoft Video Authenticator


The tool works by detecting the actual boundary of the deepfake and subtle fading or greyscale elements which might not have been easily detectable by the human eye.

And it integrates with the Microsoft Azure cloud service and allows content publishers to add digital hashes and certificates to their content, which data is then made readable by a browser extension (reader) to verify the authenticity of the content.

Some other complimenting Deepfake detection efforts



Google released a large dataset of visual deepfakes in late 2019, in collaboration with Jigsaw, which has been incorporated into the Technical University of Munich and University Federico II of Naples’ new FaceForensics benchmark, with the aim of directly complimenting deepfake detection efforts.

Moreover, as Deepfake technology is getting more advanced, and thus becoming harder to detect even by the experts; it then becomes pertinent to pitch AI against AI in an attempt to help in the spotting of deepfakes.

Microsoft Video Authenticator: Deepfake Detection Tool Using Confidence Score

SSL Certificates


The validity period of new TLS certificates have been shortened to 398 days (a little over a year), from the previous maximum certificate lifespan of 825 days (2 years and 3 months).

While the Certification Authority Browser Forum (CA/Browser Forum), which is a consortium of certification authorities and browser vendors, had initially imposed a limit of five years in 2011, resulting the reduction of certificate validity period from 8 to 10 years; and subsequently, it was reduced further to three years and two years in 2015/2018 respectively.

Now, the new move to shortened it to 398 days is meant to boost internet security, with Apple, Google, and Mozilla now set to reject public digital certificates in their respective web browsers once its 398 days from their original creation date.

Why Capping Certificate validity improve security?



Generally, the capping of certificate validity period helps to improve website security as it minimizes the chances of compromised or bogus sites exploiting such certificates to carry out malware attacks.

And especially for web development, it is now ideal to implement a certificate automation using tools like EFF's CertBot or Let's Encrypt, which makes it easy to set up, renew, and replace SSL certificates without any manual intervention. Also, as Chrome and Firefox mobile versions don't automatically check for certificate status because of performance constraints, it causes websites with revoked certificates to continue to load without any warning to users.

However, those certificates that were issued before the date of enforcement won't be impacted, or those that have already been issued from administrator-added or user-added Root certificate authorities (CAs).

How the Browser vendors are gearing up for the Enforcement



Google has planned to begin the treat certificates that violate the validity clause as misissued, and accompanied with error message "ERR_CERT_VALIDITY_TOO_LONG". And some SSL certificate providers like Sectigo and Digicert have stopped issuing certificates with two-year validity.

Apple, on its part, recommends that certificates should be issued with a maximum validity of 397 days, and that connections to TLS servers violating the new requirements will fail, thus causing network and app failures and prevent sites from loading.

New SSL/TLS Certificates Lifespan: Why Capping Certificate validity improve security?

Manjaro Linux PinePhone


PINE64 has announced its next PinePhone CE edition that will officially feature Arch-based Manjaro Linux operating system, with two hardware variants, namely: Regular and Convergence Package.

While PinePhone Community Edition (CE) will also include the same PCB (Printed Circuit Board) version 1.2, as the earlier released Community Edition (CE) of Linux-based PinePhone with Ubuntu Touch and postmarketOS.

As Manjaro supports almost all of PINE64 Single-board computers (SBCs) and mobile devices such as PinePhone, Pinebook Pro and PineTab, also PinePhone CE will come bundled with the user-friendly Arch-based Manjaro ARM rolling distribution.

How Manjaro will work on PinePhone Community Edition



The Manjaro team are already working to provide out-of-the-box support for the following mobile user interfaces, namely: Purism’s Phosh, UBport’s Lomiri, and KDE-based Plasma mobile. And expectedly, they will announce which one of these UIs will be bundled with the PinePhone CE.

Albeit, the latest alpha build includes a new mobile user interface, known as Manjaro ARM wallpaper, and a couple of applications; also there is a new layout using extlinux.conf partition as a configuration file.

The new Manjaro ARM alpha images are based on unstable branch of Manjaro Linux and runs the latest Linux 5.5 kernel from PINE64. And PinePhone with Manjaro will be arriving in a custom box designed by Manjaro’s team and also with a Manjaro brand logo at the back cover.

When the PinePhone Manjaro CE will become Available



The pre-orders of Arch-based Manjaro PinePhone CE will commence in mid-September, and then, you can be able to place an order for the PinePhone Community Edition from the official PINE Store.

PinePhone CE will be available in two hardware configurations, and priced as follows: $149 — 2GB RAM; 16GB eMMC, and $199 — 3GB RAM; 32GB eMMC (including a bundled USB-C dock). So if you're a Linux fan and PinePhone user, you would definitely want to try out the latest device with Manjaro ARM build.

Arch-based Manjaro Linux comes pre-installed on PinePhone Community Edition

Subscribe to: Posts (Atom)