Language Selection

English French German Italian Portuguese Spanish

Security: Updates, WordPress 5.1.1 in Debian, Threats in Devices and Facebook Downtime

Filed under
Security
  • Security updates for Thursday
  • WordPress 5.1.1

    The Debian packages for WordPress version 5.1.1 are being updated as I write this. This is a security fix for WordPress that stops comments causing a cross-site scripting bug. It’s an important one to update.

  • 25 Most Common IoT Security Threats in an Increasingly Connected World

    The Internet of Things (IoT) is growing rapidly. IoT is the connectivity of devices over the internet. It’s like a social network or an email service, but instead of connecting people, IoT actually connects smart devices which include, but not limited to your computers, smartphones, smart home appliances, automation tools, and more.

    However, similar to all types of technologies out there, IoT is a double-edged sword as well. It has its upsides, but there are serious threats that accompany this technology. As manufacturers are racing against each other to bring the latest device in the market, not many of them are thinking about the security issues associated with their IoT devices.

  • Facebook Suffers Global Outage, Claims DDoS Not the Cause

    Facebook users around the world had a singular question for much of March 13: Is Facebook down?

    As it turns out, the global social media giant and its related Instagram and WhatsApp services were in fact unavailable and down for much of the day. Some service was restored by March 14, though full global availability across all Facebook services is still intermittent. With Facebook down, the company ironically had to resort to using rival social media service Twitter to keep many of its users informed.

    "We’re aware that some people are currently having trouble accessing the Facebook family of apps," Facebook wrote in a Twitter message. "We’re working to resolve the issue as soon as possible."

    Facebook also provided minimal updates via its platform status dashboard for developers, with the first indication of trouble reported at 10:32 a.m. PT on March 13.

    "We are currently experiencing issues that may cause some API requests to take longer or fail unexpectedly," the status page reports. "We are investigating the issue and working on a resolution."

More in Tux Machines

Fedora 30 Workstation review - Smarter, faster and buggier

Fedora 30 is definitely one of the more interesting releases of this family in a long-time. It brings significant changes, including solid improvements in the desktop performance and responsiveness. Over the years, Fedora went from no proprietary stuff whatsoever to slowly acknowledging the modern needs of computing, so now it gives you MP3 codecs and you can install graphics drivers and such. Reasonable looks, plus good functionality across the board. However, there were tons of issues, too. Printing to Samba, video screenshot bug, installer cropped-image slides, package management complications, mouse cursor lag, oopses, average battery life, and inadequate usability out of the box. You need to change the defaults to have a desktop that can be used in a quick, efficient way without remembering a dozen nerdy keyboard shortcuts. All in all, I like the freshness. In general, it would seem the Linux desktop is seeing a cautious revival, and Fedora's definitely a happy player. But there are too many rough edges. Well, we got performance tweaks after so many years, and codecs, we might get window buttons and desktop icons one day back, too. Something like 6/10, and definitely worth exploring. I am happy enough to do two more tests. I will run an in-vivo upgrade on the F29 instance on this same box, and then also test the distro on an old Nvidia-powered laptop, which will showcase both the support for proprietary graphics (didn't work the last time) and performance improvements, if they scale for old hardware, too. That's all for now. Read more

Events: Automotive at LF, Linux Clusters Institute, Linux Plumbers Conference (LPC)

  • Automotive Linux Summit and Open Source Summit Japan Keynote Speakers and Schedule Announced
    The Linux Foundation, the nonprofit organization enabling mass innovation through open source has announced the speaker line up for Open Source Summit Japan and Automotive Linux Summit. One registration provides access to all content at both events, which will be held July 17-19 at the Toranomon Hills Forum in Tokyo. Open Source Summit Japan (OSSJ) and Automotive Linux Summit (ALS) will bring together top talent from companies on the leading edge of innovation including Toyota Motor Corporation, Uber, Intel, Sony, Google, Microsoft and more. Talks will cover a range of topics, with ALS talks on everything from infrastructure and hardware to compliance and security; and OSSJ sessions on AI, Linux systems, cloud infrastructure, cloud native applications, open networking, edge computing, safety and security and open source best practices.
  • Register Now for the 2019 Introductory Linux Clusters Institute Workshop
    Registration is now open for the 2019 Linux Clusters Institute (LCI) Introductory Workshop,which will be held August 19-23, 2019 at the Rutgers University Inn & Conference Center in New Brunswick, NJ. This workshop will cover the fundamentals of setting up and administering a high-performance computing (HPC) cluster and will be led by leading HPC experts.
  • Additional early bird slots available for LPC 2019
    The Linux Plumbers Conference (LPC) registration web site has been showing “sold out” recently because the cap on early bird registrations was reached. We are happy to report that we have reviewed the registration numbers for this year’s conference and were able to open more early bird registration slots. Beyond that, regular registration will open July 1st. Please note that speakers and microconference runners get free passes to LPC, as do some microconference presenters, so that may be another way to attend the conference. Time is running out for new refereed-track and microconference proposals, so visit the CFP page soon. Topics for accepted microconferences are welcome as well.

Security Leftovers

  • Security updates for Wednesday
  • Illumos-Powered OmniOS Gets Updated Against MDS / ZombieLoad Vulnerabilities
    While it was just earlier this month that the OpenSolaris/Illumos-based OmniOS saw a big LTS release, it's already been succeeded by a new release given the recent Intel MDS / Zombieload CPU vulnerabilities coming to light. There are new spins of OmniOS for all supported releases. These new OmniOS Community Edition releases mitigate against the Multiarchitectural Data Sampling (MDS) vulnerabilities and also bundle in the updated Intel CPU microcode.
  • Hackers Hack A Forum For Hacked Accounts: Here’s How
    A group of hackers failed to deploy security mechanisms to secure the storage where they store hacked accounts and another hacker group hacked it. The story is indeed funny and real. Infamous forum named OGUSERS which is popular amongst hackers for obtaining “OG” Instagram, Twitter usernames, hacked accounts of Domino’s Pizza, Steam, PlayStation Network, and other online accounts was hacked by a hacker group and its data was published in another hacker forum.
  • Security Announcement: Disabling SMT by default on affected Intel processors
    This is an important announcement with an upcoming change in the next Core Update of IPFire. Because of the recent vulnerabilities in Intel processors, the IPFire team has decided, that - to keep systems as secure as possible - Simultaneous Multi-Processing (SMT) is automatically disabled if the processor is vulnerable to one of the attacks. SMT is also called Intel(R) Hyper-Threading Technology and simulates more virtual cores than the system has. This allows to perform faster processing when applications benefit from it. Unfortunately with networking, we benefit from that. Therefore the effect of disabling SMT will be a very signifiant performance impact of around 30% or more. Applications that will be affected in IPFire are the firewall throughput itself as well as other CPU and memory-bound tasks like the web proxy and the Intrusion Prevention System. On systems that are not vulnerable for this attack, SMT is being left enabled. If you still want to disable it, please do so in the BIOS of your firewall.

Android Leftovers