Language Selection

English French German Italian Portuguese Spanish

Security and Proprietary Software

Submitted by Roy Schestowitz on Sunday 24th of January 2021 06:08:02 AM Filed under
Security
  • diffoscope 165 released

    The diffoscope maintainers are pleased to announce the release of diffoscope version 165. This version includes the following changes:

    [ Dimitrios Apostolou ]
* Introduce the --no-acl and --no-xattr arguments [later collapsed to
  --extended-filesystem-attributes] to improve performance.
* Avoid calling the external stat command.

[ Chris Lamb ]
* Collapse --acl and --xattr into --extended-filesystem-attributes to cover
  all of these extended attributes, defaulting the new option to false (ie.
  to not check these very expensive external calls).

[ Mattia Rizzolo ]
* Override several lintian warnings regarding prebuilt binaries in the
* source.
* Add a pytest.ini file to explicitly use Junit's xunit2 format.
* Ignore the Python DeprecationWarning message regarding the `imp` module
  deprecation as it comes from a third-party library.
* debian/rules: filter the content of the d/*.substvars files

  • SonicWall hardware VPNs hit by worst-case 0-zero-day-exploit attacks

    “…have information about hacking of a well-known firewall vendor and other security products by this they are silent and do not release press releases for their clients who are under attack due to several 0 days in particular very large companies are vulnerable technology companies,” BleepingComputer was told via email.

  • Cyber Firm SonicWall Says It Was Victim of ‘Sophisticated’ Hack

    The Silicon Valley-based company said in a statement that the two products compromised provide users with remote access to internal resources.

    The attackers exploited so-called “zero days” -- a newly discovered software flaw -- on certain SonicWall remote access products, the company said in a statement.

  • Former manager of Microsoft Taiwan investigated for fraud

    A former manager at the Taiwanese branch of software giant Microsoft was questioned Friday (Jan. 22) about an alleged fraud scam directed against the company.

    In 2016 and 2017, Chang Ming-fang (張銘芳) allegedly colluded with managers of other companies to forge orders to obtain discounts and products at lower prices, UDN reported.

  • School laptops sent by government arrive loaded with malware [iophk: Windows TCO]

    A number of the devices were found to be infected with a "self-propagating network worm", according to the forum, and they also appeared to be contacting Russian servers, one teacher wrote. The Windows-based laptops were specifically infected with Gamarue.1, a worm Microsoft identified in 2012.

  • Ransomware provides the perfect cover

    Look at any list of security challenges that CISOs are most concerned about and you’ll consistently find ransomware on them. It’s no wonder: ransomware attacks cripple organizations due to the costs of downtime, recovery, regulatory penalties, and lost revenue. Unfortunately, cybercriminals have added an extra sting to these attacks: they are using ransomware as a smokescreen to divert security teams from other clandestine activities behind the scenes.

    Attackers are using the noise of ransomware to their advantage as it provides the perfect cover to distract attention so they can take aim at their real target: exfiltrating IP [sic], research, and other valuable data from the corporate network.

  • Global ransom DDoS extortionists are retargeting companies

    According to Radware, companies that received this letter also received threats in August and September 2020. Security researchers’ analysis of this new wave of ransom letters suggested that the same threat actors from the middle of 2020 are behind these malicious communications.

    When the DDoS extortion campaign started in August of 2020, a single Bitcoin was worth approximately $10,000. It’s now worth roughly $30,000. The attackers cited this in the latest round of ransom letters, and it represents the impact the rising price of Bitcoin is having on the threat landscape.

    A few hours after receiving the message, organizations were hit by DDoS attacks that exceeded 200 Gbps and lasted over nine hours without slowdown or interruption. A maximum attack size of 237 Gbps was reached with a total duration of nearly 10 hours, the alert warned.

  • Boeing 737 MAX is a reminder of the REAL problem with software | Stop at Zona-M

    And that problem almost never is software.

»

More in Tux Machines

Ubuntu: Unbreaking Unbootable Ubuntu, Snaps Shrunk and More

  • Unbreaking Unbootable Ubuntu

    I run Ubuntu Hirsute - the development release which will become 21.04 - on a bunch of systems. It’s a trade-off though, getting the latest crack each and every day. Being at the bleeding edge of new packages landing means I can experience brand new shiny bugs on my systems. Bugs like 1915579 which rendered my system unbootable.

  • Honey, I Shrunk the Snap! | Ubuntu

    The year is 1989. I bought a computer game called F-16: Combat Pilot, a flight simulator featuring free-flight, five types of single-player missions, a full campaign mode, serial-port multiplayer, and then some. Gloriously wrapped in four colors and magnetized on two single-density 5.25-inch floppy disks. Total size: 680 KB. Nowadays, it is not uncommon for individual applications to weigh dozens if not hundreds of megabytes. But it doesn’t have to be that way. In Linux, you can save some space by using libraries that are shared across multiple applications (hence their name, shared libraries). When it comes to self-contained application formats like snaps, the tables are turned once again, as snaps bundle all the necessary dependencies inside, and thus take more disk space. If you want to make your snapped applications as small and lean as possible, we have a few neat suggestions. [...] The final artifact of the snap build process is a compressed squashFS file, with the .snap suffix. Originally, snaps were compressed using the xz algorithm, for highest compatibility with the widest range of devices. More recently, in order to help speed us snap launch times, we also introduced the use of the lzo algorithm, which results in 2-3x application startup times improvements. The main reason for this is the lesser compression used in lzo compared to xz, meaning the system needs fewer CPU cycles, and thus less time, to uncompress the snap on the system. However, it also introduces size inflation. [...] Disk utilization matters less now than it did a decade or two ago, but you can still try to make your applications small and tidy. This also helps reduce bandwidth usage, improves portability, and if you’re using system backups, reduces the time needed to copy all the relevant data. With snaps, there are many ways you can trim down on the digital excess, including the use of extensions, sparing use of necessary runtime dependencies, and pruning the extras from the prime directory. Not only will your snaps be smaller in size, you will also ensure higher consistency, better system integration and improve the application startup time. All these are important, highly noticeable elements of the user experience. If you have any other suggestions or ideas on how to conserve space or optimize snap creation, please join our forum and share your thoughts.

  • Canonical keynote at Embedded World 2021: Bosch Rexroth achieves complete IoT automation with Ubuntu Core

    series that’s already being used in the current stable release, Ubuntu 20.10 (Groovy Gorilla). But that good news I want to share with you today is the fact that Ubuntu 21.04 will also offer several apps from the GNOME 40 stack.

  • Bad Voltage 3×24: Weaponised Rooster

    Stuart Langridge, Jono Bacon, and special guest star Alan Pope present Bad Voltage, in which we are large and in charge, there is ancient history about electricians and phones...

IBM/Red Hat: Kafka Monthly Digest, Red Hat Upselling, and Cockpit 239

  • Kafka Monthly Digest – February 2021

    This is the 37th edition of the Kafka Monthly Digest! In this edition, I’ll cover what happened in the Apache Kafka community in February 2021.

  • 5 ways Red Hat Insights can improve your sysadmin Life

    The way we do things is changing fast. This has become a necessity as our systems get more complex, our workloads evolve, and our deployments rapidly grow in size. Thanks to the innovations brought about by openness and collaboration, we can develop tools and services to cope with these quickly evolving times. For us to reap the benefits of these advancements, we should open ourselves to carefully exploring how various tools suit our requirements and fit into or change our norms. By doing so, we may simplify a lot of our mundane tasks, reduce overhead, and address the major pain points in our operations. Having worked as a sysadmin in the past, I've discovered many automation tools and services that have made my life easier. One of the most recent is Red Hat Insights. In this article, I share five ways this service that is included with your Red Hat Enterprise Linux (RHEL) subscription can improve your life as an admin.

  • Cockpit Project: Cockpit 239

    Cockpit is the modern Linux admin interface. We release regularly. Here are the release notes from Cockpit version 239.

LibreOffice 7.1.1 Community available for download

LibreOffice 7.1.1 Community, the first minor release of the LibreOffice 7.1 family, targeted at technology enthusiasts and power users, is available for download from https://www.libreoffice.org/download/. LibreOffice 7.1.1 includes over 90 bug fixes and improvements to document compatibility. For enterprise-class deployments, TDF strongly recommends the LibreOffice Enterprise family of applications from ecosystem partners, with long-term support options, professional assistance, custom features and Service Level Agreements: https://www.libreoffice.org/download/libreoffice-in-business/. LibreOffice Community and the LibreOffice Enterprise family of products are based on the LibreOffice Technology platform, the result of years of development efforts with the objective of providing a state of the art office suite not only for the desktop but also for mobile and the cloud. Products based on LibreOffice Technology are available for major desktop operating systems (Windows, macOS, Linux and Chrome OS), mobile platforms (Android and iOS) and the cloud. They may have a different name, according to each company brand strategy, but they share the same LibreOffice unique advantages, robustness and flexibility. Read more

croc Is A Tool For Resumable, Encrypted File And Folder Transfers Between Computers (Command Line)

croc is a free and open source command line tool for secure file transfers between computers. It uses relay-assisted peer-to-peer transactions and end-to-end encryption via password-authenticated key exchange. The program is written in Go and is available for Microsoft Windows, macOS, Linux and *BSD. The idea behind croc is being able to transfer files and folders between cross-platform computers securely, fast and easy. With support for resumable, peer-to-peer transfers. As a bonus feature, croc is also able to securely transfer a short text or URL directly. The data transfer is done using a relay, either using raw TCP sockets or websockets. When the sender and the receiver are on the same LAN, croc uses a local relay, otherwise a public relay is used. Thanks to this, croc can send files between computers in the same LAN, or over the Internet, without having port-forwarding enabled. The data going through the relay is encrypted using a PAKE-generated session key. For this, croc uses code phrases, a combination of three random words. By default, a code phrase can only be used once between two parties, so an attacker would have a chance of less than 1 in 4 billion to guess the code phrase correctly to steal the data. Read more

More on Tux Machines: About ● Gallery ● Forum ● Blogs ● Search ● News ● RSS Feed

Part of Bytes Media ● Sister sites below.

TechBytes Techrights button

Powered by Drupal, an open source content management system

Content available under CC-BY-SA CC

© by original authors

Powered by CentOS 6.5 (GNU/Linux), Varnish, and Drupal 6