- KICTANet - KICTANet

Securing the Internet, Open Source and Other Easter Stories : CVE-2024-3094
by Lawrence Muchilwa 31 Mar '24

31 Mar '24

Dear listers, Once in a while, we are reminded of how the internet is fragile and how securing it is even more fragile. Someone or a team managed to add a backdoor to software that's used by approximately 80% of the internet. This backdoor would have allowed unauthorized remote access to any affected system. This was detected by sheer luck and is being tracked as CVE-2024-3094; see attached. This attack is suspected to be the work of a nation-state actor and might have started in 2022. It shows the threat posed by supply chain attacks and open-source software. It also highlights the challenges involved in maintaining open-source software and how a malicious threat actor can exploit these challenges to their advantage. Organizations should invest in processes and tools that maintain a software bill of materials (SBOM). This ensures that attacks like this can be detected faster and improves organizational mean time to detect (MTTD). Security is a layered approach. As much as CVE-2024-3094 would have gone unnoticed, a reduced threat surface would have reduced the possibility of the threat. -- with kind regards Muchilwa Lawrence https://overwatch.or.ke www.testmyids.ke

1 0

(Urgent!) Potential Backdoor in a Compression Package used in Linux Distributions [CVE-2024-3094]
by Jacinta Wothaya 31 Mar '24

31 Mar '24

Dear Listeners, A critical security vulnerability [*CVE-2024-3094]* has been discovered in XZ Utils versions *XZ 5.6.0* (released Feb. 24) and *XZ 5.6.1* (released March 9). This backdoor could potentially allow a malicious actor to compromise sshd authentication, granting unauthorised access to the entire system remotely. Andres Freund, a security researcher working as a PostgreSQL developer at Microsoft discovered the vulnerability and reported it to OpenWall on March 29, 2024. The XZ Utils is a FOSS software suite that provides tools for data compression and decompression. It is commonly used due to its high compression ratio and efficiency. It also contains the liblzma library, which developers can integrate into their applications. XZ utils is widely used in the FOSS, especially in many Linux distributions hence, the vulnerability threatens the entire Linux ecosystem. As a result, Red Hat, Inc. has issued it a *CVSS Score of 10*, the highest possible score for any vulnerability. Specifically, the backdoor: - Can allow an attacker to access the system from anywhere. - Doesn't require any privileges to exploit. - Works silently without requiring user interaction. - Can allow the attacker to change objects outside the affected component. - Can affect the confidentiality, integrity, and availability of the entire system. The Open source community and government agencies are monitoring the issue and will provide advice as investigations continue. So far it has been confirmed that testing, unstable, and experimental distros of *Fedora 41, Fedora Rawhide, and Debian *contain the vulnerable XZ versions. It was also included in *Tumbleweed and MicroOS distros of openSUSE*. Users of these Linux systems are advised to check the version of XZ Utils installed and immediately update their systems using the advisory provided by their distribution’s website. Several artifacts of a stable release of *Arch Linux* (NOT used in production systems) are also affected. These mirrors have been removed and users are advised to update to the latest version. In addition, a technical steering committee member for Homebrew confirmed that they downgraded the untrustworthy versions of XZ 5.6x. *Homebrew* is an open-source package manager that *installs* *UNIX tools for macOS systems*. Further information about *CVE-2024-3094* can be found on the following websites: 1. National Institute of Standards and Technology’s National Vulnerability Database <https://nvd.nist.gov/vuln/detail/CVE-2024-3094> 2. The US Cybersecurity and Infrastructure Security Agency <https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-co…> 3. Red Hat <https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-…> 4. Kali Linux <https://www.kali.org/blog/about-the-xz-backdoor/> 5. Openwall <https://www.openwall.com/lists/oss-security/2024/03/29/4> 6. Arch Linux <https://archlinux.org/news/the-xz-package-has-been-backdoored/> 7. OpenSUSE <https://news.opensuse.org/2024/03/29/xz-backdoor/> 8. Tenable gives a summary of the affected systems <https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-suppl…> *On a more interesting note*, I did some digging and here is what I have so far: Andres <https://mastodon.social/@AndresFreundTec> is one of the leading contributors to the Postgres community. He was testing a Debian unstable release for possible portability problems with Postgres when he noticed a series of coincidences including a 500ms latency on many failed sshd processes using wrong usernames. He then discovered the liblzma package was the one draining the CPU. He also recalled seeing an odd complaint a few weeks before in automated testing of Postgres using a Linux tool called Valgrind. Upon further investigation, Adres realised that the XZ repository and the XZ tarballs had been backdoored. What is concerning is that the compromise was not injected into released Debian packages but was introduced by a community maintainer of the XZ package through the source code uploaded to the GitHub repository. The Github commits were performed over several weeks by the account ‘Jia Tan <https://github.com/JiaT75>’ whose owner remains unknown. However, it was created in 2021 and made its first commit to the XZ repository on 2022/02/06. They have made changes to XZ between 2022 and 2024 and the most recent commit was on 2024/03/09. Alone, these commits may not be suspicious, however, Jia Tan's changes are what caused the Valgrind errors in configurations that didn't meet the updated code’s expectations. Several conversations emerged in different open-source communities about what could be causing the valgrind errors and possible solutions. The persona Jia Tan participated in these conversations and claimed that the errors were due to versions of XZ earlier than 5.6x. They then contacted Fedora to push for an update of XZ to 5.6x versions in stable distributions of Linux and continued to push for this update in other open-source communities. There are also messages from other anonymous accounts pushing for the original XZ maintainer to add a new maintainer right after Jia Tan started helping with the project. This high-interest vulnerability will spark conversations about the integrity of Free and Open Source Software, especially for critical libraries like XZ. I am keen to follow the discussion and will compile a timeline of the attack to update interested listeners. Regards, Jacinta Wothaya

1 0

China bans American foreign microchips and software
by Mwendwa Kivuva 30 Mar '24

30 Mar '24

After Donald Trump banned Chinese companies from using American-made microchips, it appears that the law of unintended consequences is working against America. Over the past four years, China has significantly increased its computer chip production. This growth has led to Huawei becoming the second-largest mobile phone brand in China, marking a remarkable turnaround. The rapid advancement of China in producing high-end microchips, such as the level 7nm chip powering the Huawei Mate 60 and iPhone XS, has surprised the US intelligence network. This is in contrast to the more advanced 5nm chip in the iPhone 13 and the 3nm chip in the iPhone 15 produced by Western companies. China has taken a further step by implementing measures to replace US-based operating systems (Microsoft), database products, and microprocessors (Intel and AMD) with locally developed Chinese alternatives in government offices. This will have a spillover effect across the Chinese business sector. The Chinese government has cited "safety and reliability" as the primary reasons for this shift, mirroring the security concerns raised by the US regarding Chinese-based systems. In 2023, China accounted for 27% of Intel's $54 billion and 15% of AMD's $23 billion revenue. The implications of these actions are significant, and the future actions of the US under the current Biden administration or any future administration will be closely watched. The broader question raised by these developments is who benefits when superpowers engage in such conflicts. While the competition may lead to advancements in technology, the aggressive pursuit of dominance in microprocessor technology raises concerns about the impact on global innovation and collaboration. Chris Miller, author of Chip War, aptly summarizes the situation by stating, "If you import most of your chips, you're not a manufacturing superpower; you're just assembling high-value components produced elsewhere." The US-China tech war has escalated into a multifaceted conflict encompassing technology, economic dominance, national security, and global influence. This battle for technological supremacy between the two superpowers has reshaped global alliances, trade relationships, and the trajectory of technological innovation. Taiwan and Malaysia's pivotal role in semiconductor production has positioned the Asian countries as key players in this tech war, underscoring the intricate interplay between geopolitics and technology. The unintended consequences of Donald Trump's ban on Chinese companies using American-made microchips have catalyzed China's rapid advancement in computer chip production. This growth has propelled Huawei to become a major player in the mobile phone market, showcasing China's technological prowess. China's strategic measures to replace US-based technology with domestic alternatives in critical sectors like government offices reflect a broader trend of self-reliance and security concerns driving national policies. The implications of these actions, with China accounting for a significant portion of Intel and AMD's sales, highlight the profound impact of the US-China tech war on global tech markets. The competition between the US and China in microprocessor technology raises questions about the balance between technological advancement, market dynamics, and national interests. The conflict not only shapes the tech industry but also influences broader international relations and the future trajectory of global technological development. As the US and China navigate this complex tech war, the broader question of who benefits from such conflicts remains pertinent, with implications for global innovation, collaboration, and the evolving geopolitical landscape. Interesting times ahead. I would love to see what retaliatory or olive branch the US will use under the current Biden administration or the incoming one. And where does Africa, and the Global Majority sit in the global scale of things? Great heading here: China blocks use of Intel and AMD chips in government computers, FT reports https://www.reuters.com/world/china/china-blocks-use-intel-amd-chips-govern… US-China tech war: Is Huawei's new chip a threat? https://amp.dw.com/en/us-china-tech-war-is-huaweis-new-chip-a-threat/a-6691… Rough politics: How Huawei surprised the US with a cutting-edge chip made in China https://www.ft.com/content/327414d2-fe13-438e-9767-333cdb94c7e1 Sources Retrieved on 28 March 2024. Best Regards ______________________ Mwendwa Kivuva https://www.linkedin.com/in/mwendwa-kivuva

2 1

KICTANet Working Groups Deliver Recommendations to the the ICT Task Force
by David Indeje 27 Mar '24

27 Mar '24

Dear Listers, The KICTANet Working Groups explored challenges and opportunities in our digital landscape. Stakeholders offered valuable contributions to draft recommendations for an inclusive and equitable ICT ecosystem, which were presented to the ICT Task Force on March 13, 2024. This report outlines a roadmap towards a vibrant digital ecosystem. https://tinyurl.com/3vmt3tn5 -- *Kind Regards,* *David Indeje* *KICTANet Communications *_____________________________________ +254 (0) 711 385 945 | +254 (0) 734 024 856 KICTANet portals KICTANet.or.ke <https://kictanet.or.ke/> | Twitter <https://twitter.com/kictanet> | LinkedIn <https://www.linkedin.com/company/18428106/admin/> | Facebook <https://www.facebook.com/KICTANet/>

1 0

Nigerian Court Ruling on Truecaller Raises Privacy Concerns
by David Indeje 26 Mar '24

26 Mar '24

Dear Listers, A recent Nigerian court ruling has sparked debate on the balance between technological advancements and individual privacy rights. The case centred around Truecaller, a mobile app for caller identification, and allegations of data privacy breaches. For more details https://tinyurl.com/yf29xber -- *Kind Regards,* *David Indeje* *KICTANet Communications *_____________________________________ +254 (0) 711 385 945 | +254 (0) 734 024 856 KICTANet portals KICTANet.or.ke <https://kictanet.or.ke/> | Twitter <https://twitter.com/kictanet> | LinkedIn <https://www.linkedin.com/company/18428106/admin/> | Facebook <https://www.facebook.com/KICTANet/>

1 0

Worldcoin tokens (WLD)
by Lydia gachungi 21 Mar '24

21 Mar '24

What is this Worldcoin tokens (WLD)? Are Issues of privacy, data protection taken into account as Kenyans flock to be registered? I am lost on what the objective is and the benefits Lydia

21 33

FCC Officially Raises Minimum Broadband Metric From 25Mbps to 100Mbps
by Josphat Karanja 20 Mar '24

20 Mar '24

New developments. Impact on our national Broadband Policy? https://www.pcmag.com/news/fcc-officially-raises-minimum-broadband-metric-f… Regards ........................................................... Josphat Karanja, *PMP®* *"We who cut mere stones must always be envisioning cathedrals"**. The Pragmatic Programmer*

4 5

Language & Digital Policies
by mnyanchama＠aganoconsulting.com 18 Mar '24

18 Mar '24

This article might be of interest to many here, particularly on the matter of language and policies in the digital space. How much, for instance, is Kiswahili (our national language) at the centre of policies in Kenya? Tanzania? Etc. https://techreg.org/article/view/13965/20854 ---------------------------------------------------------------------------- ------------------------------ Matunda Nyanchama, PhD, CISSP; Director & Managing Consultant, <mailto:mnyanchama@aganoconsulting.com> mnyanchama(a)aganoconsulting.com; Phone: +254 101 915 260 Agano Consulting Inc.; <http://www.aganoconsulting.com/> www.aganoconsulting.com; Twitter: <http://twitter.com/#%21/nmatunda> nmatunda; Skype: okiambe ---------------------------------------------------------------------------- ------------------------------- Manage your ICT risks! We are the experts you need! The trusted partners you deserve! Call: +254 101 915 260 (Kenya) or <mailto:info@aganoconsulting.com> info(a)aganoconsulting.com Licensed by the Communications Authority of Kenya (CA) -- This email has been checked for viruses by Avast antivirus software. www.avast.com

1 0

Join the Conversation: X-Space Dialogue on Online Gender-Based Violence
by David Indeje 15 Mar '24

15 Mar '24

Dear Listers, KICTANet, in partnership with Article 19 Eastern Africa, is pleased to invite you to an X-Space dialogue <https://twitter.com/i/spaces/1OwxWYnbzjDGQ?s=20> on the effectiveness of X's (formerly Twitter) content moderation in curbing online gender-based violence (OGBV). *Date: Friday, 15 March 2024 at 8:00 pm – 9:30 pm* As you know, the rise of OGBV online has become a critical issue, with cases spilling over into the real world and causing devastating consequences for women. This X-Space dialogue <https://twitter.com/i/spaces/1OwxWYnbzjDGQ?s=20> aims to tackle this issue head-on by exploring the effectiveness of reporting mechanisms, content moderation challenges, and platforms' responsibility in combating OGBV. We encourage you to join this important conversation and share your insights. Your participation will be invaluable in identifying gaps in current practices, recommending improvements, and strengthening collaboration among stakeholders to support victims and advocate for change. *Click here to join the X-Space dialogue. <https://twitter.com/i/spaces/1OwxWYnbzjDGQ?s=20>* Following the discussion, we will publish a blog post summarizing the key challenges and recommendations. -- *Kind Regards,* *David Indeje* *KICTANet Communications *_____________________________________ +254 (0) 711 385 945 | +254 (0) 734 024 856 KICTANet portals KICTANet.or.ke <https://kictanet.or.ke/> | Twitter <https://twitter.com/kictanet> | LinkedIn <https://www.linkedin.com/company/18428106/admin/> | Facebook <https://www.facebook.com/KICTANet/>

1 0

Call for MAG Volunteers
by Rosemary Kimwatu 15 Mar '24

15 Mar '24

Good morning listers, KICTANet wishes to invite volunteers from the different stakeholder groups to assist in the preparation of the Kenya Internet Governance Forum (KIGF) 2024. The Kenya Internet Governance Forum (KIGF) is an annual meeting that brings together various stakeholder groups to dialogue on ICT and Internet policy. The Steering Team otherwise known as the Multistakeholder Advisory Group (MAG) role is to assist in convening the Kenya IGF by preparing the programme and schedule and to improve the IGF process through community consultations, outreach and stakeholder engagement. MAG members volunteer and serve in their personal capacity, and are expected to have established linkages with their respective stakeholder groups. Please review the MAG TORs <https://docs.google.com/document/d/1Kqbd7qX1DaojqhN2g9NkrAweTfrefynrUUGsVCf…> To express interest, please send an email to nkakusu(a)kictanet.or.ke <mwaragichanga(a)kictanet.or.ke> with the subject line "Kenya IGF 2024 MAG" indicating your stakeholder group, expertise and why you are interested in joining the steering committee of KIGF 2020 by Thursday, 21st of March, 2024. Membership to the steering team is voluntary and all materials produced by KICTANet are published under creative commons licenses <https://creativecommons.org/licenses/>. Organisations from various stakeholder groups are encouraged to nominate representatives. For more information or clarification, feel free to get in touch. Best regards, Rosemary Koech-Kimwatu, Chairperson, 2024 KeIGF MAG Committee.

1 0