Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Filed under
  • Hidden For 6 Years, ‘Slingshot’ Malware Hacks Your PC Through Your Router
  • Security updates for Tuesday
  • Microsoft Admits It Incorrectly Upgraded Some Windows 10 Users to v1709 [Ed: Windows Update is technically (not a joke) a botnet. It takes over people's PCs and hands them over for Microsoft to use up their CPU and bandwidth. Microsoft has ignored users' "update" settings since at least Windows XP days.]

    Microsoft admitted last week that it incorrectly updated some Windows 10 users to the latest version of the Windows 10 operating system —version 1709— despite users having specifically paused update operations in their OS settings.

    The admission came in a knowledge base article updated last week. Not all users of older Windows versions were forcibly updated, but only those of Windows 10 v1703 (Creators Update).

    This is the version where Microsoft added special controls to the Windows Update setting section that allow users to pause OS updates in case they have driver or other hardware issues with the latest OS version.

  • We Still Need More HTTPS: Government Middleboxes Caught Injecting Spyware, Ads, and Cryptocurrency Miners

    Last week, researchers at Citizen Lab discovered that Sandvine's PacketLogic devices were being used to hijack users' unencrypted internet connections, making yet another case for encrypting the web with HTTPS. In Turkey and Syria, users who were trying to download legitimate applications were instead served malicious software intending to spy on them. In Egypt, these devices injected money-making content into users' web traffic, including advertisements and cryptocurrency mining scripts.

    These are all standard machine-in-the-middle attacks, where a computer on the path between your browser and a legitimate web server is able to intercept and modify your traffic data. This can happen if your web connections use HTTP, since data sent over HTTP is unencrypted and can be modified or read by anyone on the network.

    The Sandvine middleboxes were doing exactly this. On Türk Telekom’s network, it was reported that when a user attempted to download legitimate applications over HTTP, these devices injected fake "redirect" messages which caused the user’s browser to fetch the file from a different, malicious, site. Users downloading common applications like Avast Antivirus, 7-Zip, Opera, CCleaner, and programs from had their downloads silently redirected. Telecom Egypt’s Sandvine devices, Citizen Lab noted, were using similar methods to inject money-making content into HTTP connections, by redirecting existing ad links to affiliate advertisements and legitimate javascript files to cryptocurrency mining scripts.

  • Let’s Encrypt takes free “wildcard” certificates live
  • GuardiCore Upgrades Infection Monkey Open Source Cyber Security Testing Tool
  • A Guide To Securing Docker and Kubernetes Containers With a Firewall
  • How IBM Helps Organizations to Improve Security with Incident Response

    Protecting organizations against cyber-security threats isn't just about prevention, it's also about incident response. There are many different organizations that provide these security capabilities, including IBM X-Force Incident Response and Intelligence Services (IRIS), which is led by Wendi Whitmore.

    In the attached video interview Whitmore explains how incident response works and how she helps organizations to define a winning strategy. Succeeding at incident response in Whitmore's view, shouldn't be focused just on prevention but on building a resilient environment.

More in Tux Machines

Linux Foundation: Microsoft Openwashing,, OCP, Kernel Commits Statistics

  • More Tips for Managing a Fast-Growing Open Source Project [Ed: Microsoft has infiltrated the Linux Foundation so deeply and severely that the Foundation now regularly issues openwashing pieces for the company that attacks Linux]
  • improves Kubernetes networking in sixth software release, one of Linux Foundation’s open source projects, has introduced its 18.01 software release with a focus on improving Kubernetes Networking, Istio and cloud native NFV.
  • Bolsters Kubernetes, NFV, and Istio Support With Latest Release
    The Fast Data Project ( released its sixth update since its inception within the Linux Foundation two years ago. While the update list is extensive, most are focused on Kubernetes networking, cloud native network functions virtualization (NFV), and Istio.
  • Linux Foundation, OCP collaborate on open sourcing hardware and software
    The virtualization of network functions has resulted in a disaggregation of hardware and software, increasing interest in open source projects for both layers in return. To feed this interest, the Linux Foundation and Open Compute Project (OCP) recently announced a joint initiative to advance the development of software and hardware-based open source networking. Both organizations have something to offer the other through the collaboration. The Linux Foundation’s OPNFV project integrates OCP as well as other open source software projects into relevant network functions virtualization (NFV) reference architectures. At the same time, OCP offers an open source option for the hardware layer.
  • Kernel Commits with "Fixes" tag
    Over the past 5 years there has been a steady increase in the number of kernel bug fix commits that use the "Fixes" tag.  Kernel developers use this annotation on a commit to reference an older commit that originally introduced the bug, which is obviously very useful for bug tracking purposes. What is interesting is that there has been a steady take-up of developers using this annotation:

today's howtos

Positive Red Hat Results Expected Next Week

Fedora: Fedora 28 Beta Delay, Mindshare Monthly Report and More

  • Fedora 28 release dates and schedule
    With the release of Fedora 27, the Fedora 28 release schedule is falling into place. As of now, the current Fedora 28 release schedule is as follows.
  • Fedora 28 Beta Has Been Delayed
    It's time for the Fedora 28 release dance and to place your bets if F28 will be released on time or is another Fedora release challenged by release delays. Fedora 28 Beta had been due for release next week but has now been set by its first delay. Fortunately, a buffer was already built into the release schedule so for now is not impacting the final release of Fedora 28 due out in May.
  • Fedora 28 Beta status is NO-GO
    Release status of the Fedora 28 Beta is NO-GO. Due to missing RC for the F28 Beta release and presence of blocker bugs, the decision is “No Go”. The Beta release slips for one week to “Target #1” date (April 3rd). We are not going to slip the Final GA yet.
  • Mindshare Monthly Report – FAD and First Actions
  • Digitizing VHS with Fedora
    I have a dozen or so movies on VHS that we still watch. To be honest, I'm not that concerned about the commercial movies; those are easy enough to replace. But what about our home movies? My high school cross country team videos and my wife's marching band videos, among others—you won't find those on Netflix anytime soon. So I decided it was time to get serious about something I'd been meaning to do for a long time: Digitize my VHS tapes. In this article, I'll describe how I set up my Fedora desktop to convert my VHS tapes into 1s and 0s. Previously, Don Watkins described a different setup for VHS conversion.
  • Fedora 27 : The LibreOffice the 6.0.2 and versions.