Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Filed under
Security
  • 36C3: Open Source Is Insufficient To Solve Trust Problems In Hardware

    With open source software, we’ve grown accustomed to a certain level of trust that whatever we are running on our computers is what we expect it to actually be. Thanks to hashing and public key signatures in various parts in the development and deployment cycle, it’s hard for a third party to modify source code or executables without us being easily able to spot it, even if it travels through untrustworthy channels.

    Unfortunately, when it comes to open source hardware, the number of steps and parties involved that are out of our control until we have a final product — production, logistics, distribution, even the customer — makes it substantially more difficult to achieve the same peace of mind. To make things worse, to actually validate the hardware on chip level, you’d ultimately have to destroy it.

    On his talk this year at the 36C3, [bunnie] showed a detailed insight of several attack vectors we could face during manufacturing. Skipping the obvious ones like adding or substituting components, he’s focusing on highly ambitious and hard to detect modifications inside an IC’s package with wirebonded or through-silicon via (TSV) implants, down to modifying the netlist or mask of the integrated circuit itself. And these aren’t any theoretical or “what if” scenarios, but actual possible options — of course, some of them come with a certain price tag, but in the end, with the right motivation, money is only a detail.

  • Election security, ransomware dominate cyber concerns for 2020 [iophk: Windows TCO]

    Senate Democrats have repeatedly tried to force Senate Majority Leader Mitch McConnell (R-Ky.) to schedule votes on a raft of various election security bills. The House has passed three major pieces of election security legislation this year that have stalled amid Republican objections in the Senate.

  • There’s Money To Be Made In Taming Open Source Software Code

    “We’re trying to create order out of chaos,” said CEO Wayne Jackson of his company, Sonatype.

    [...]

    “We are building the world’s critical infrastructure on software somebody else wrote, a stranger with unknown skills, motivations and desires, but the desire to innovate is so high, we’re willing to accept the risk of using some random person’s software invention,” Jackson said.

    Sometimes developers understand the practical use of the open source code they’re creating, and sometimes they don’t, according to Jackson. 

  • Medley India Infosolution helps Indian Railways build crew management software system

    The system design is end-to-end UNIX and Linux thereby immunising the systems against malicious threats. The solution has with immense power to control the client locations from central location by way of maintenance tasks, time synchronisation, patch updates and variety of user access requirements thus speeding up the service request handling from a remote location. Service requests can be lodged into the CMS system and are automated through SMS call lodging and reminder mechanisms. At the client side the users are authenticated via a biometric device (thumb impression reader) for logging onto the applications via a kiosk which ensures an audit trail and logging of activities for transparency and accountability.

More in Tux Machines

KDE Plasma 5.18.4 LTS Desktop Environment Brings More Than 40 Fixes

Coming three weeks after the Plasma 5.18.3 point release, which introduced a bunch of Flatpak improvements and more than 60 fixes, the KDE Plasma 5.18.4 LTS release is here to add more than 40 bug fixes to various of the desktop environments core components. Among the changes, there’s improved support for the upcoming Qt 5.15 application framework for Breeze and libksysguard components and better support for the fwupd open-source daemon for installing firmware updates on devices in the Discover package manager. Flatpak support in Discover was also improved by fixing two issues. Moreover, XSettingsd was added as a runtime dependency to KDE GTK Config, kwallet-pam now works with pam_fscrypt, and KWin now allow the creation of more than one row on the “Virtual Desktops” settings page. Read more

Obarun – An Arch Based Linux Distro Without Systemd

Today’s Linux distribution review is not just for distro hoppers who love to try something new but it’s for people who have a specific purpose such as a Linux system without systemd. Systemd, as we all know, has always been criticized by a lot of developers and Linux users. Obarun is packed with enough utilities to install & start a vanilla Arch Linux without any trouble. I have written an article on how to install Arch step by step and it is a long article. But Obarun does the Arch installation in a very simple way. It comes with obarun-installer, a script that helps install Arch as easily as possible. Read more

40 Practical and Useful awk Command in Linux and BSD

AWK is a powerful data-driven programming language that dates its origin back to the early days of Unix. It was initially developed for writing ‘one-liner’ programs but has since evolved into a full-fledged programming language. AWK gets its name from the initials of its authors – Aho, Weinberger, and Kernighan. The awk command in Linux and other Unix systems invokes the interpreter that runs AWK scripts. Several implementations of awk exist in recent systems such as gawk (GNU awk), mawk (Minimal awk), and nawk (New awk), among others. Check out the below examples if you want to master awk. Read more

Android Leftovers