Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Filed under
Security
  • Security updates for Wednesday

    Security updates have been issued by Debian (lrzip and puma), Fedora (plantuml and plib), Oracle (kernel and kernel-container), Red Hat (firefox, kernel, kpatch-patch, subversion:1.14, and thunderbird), Scientific Linux (firefox and thunderbird), SUSE (kernel-firmware, libxml2, pcre2, and postgresql13), and Ubuntu (accountsservice, postgresql-10, postgresql-12, postgresql-13, postgresql-14, and rsyslog).

  • The Linux Foundation's "security mobilization plan" [Ed: Making up numbers for a FUD campaign led by proprietary software companies that make back doors for the NSA]

    The Linux Foundation has posted an "Open Source Software Security Mobilization Plan" that aims to address a number of perceived security problems with the expenditure of nearly $140 million over two years.

  • Our build and release infrastructure, and upcoming updates | F-Droid - Free and Open Source Android App Repository

    Behind the scenes of F-Droid is a giant pile of automation to manage the process of building thousands of apps from source. This means checking out thousands of source repos, checking them all for updates, building and new releases, and securely signing them en masse. All builds are run in a fresh virtual machine guest instance known as the buildserver. All Gradle binaries and Android SDK packages are verified against our public logs of observed SHA-256 checksums. The transparency log processes also verify against upstream’s public checksums.

    Our setup runs on Debian almost exclusively. Debian is a leader in free software, rock solid servers, and reproducible builds. That makes it a natural home for F-Droid. We also work to ensure we maintain the packages we use, and build our processes on top of Debian packages. That means we share the maintenance with anything that uses Debian. It may seem like more work to give back, but our experience is that it pays off in the long run. The F-Droid community is able to maintain many things with a small team. Another example of this is this website itself: it is built using Jekyll packages that are all in Debian.

  • F-Droid: Our build and release infrastructure, and upcoming updates

    Here's an update from F-Droid regarding upcoming changes to its build and distribution infrastructure.

  • Tails 5.0 Linux users warned against using it "for sensitive information" [Ed: Microsoft-connected site shedding doubt on "Linux"]

    Tails developers have warned users to stop using the portable Debian-based Linux distro until the next release if they're entering or accessing sensitive information using the bundled Tor Browser application.

  • CISA Adds 34 Known Exploited Vulnerabilities to Catalog [Ed: Lots and lots of Microsoft. Actively exploited.]

    CISA has added 34 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow on the of the "Date Added to Catalog" column, which will sort by descending dates.

  • Google Releases Security Updates for Chrome

    Google has released Chrome version 102.0.5005.61 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system.

  • Stable Channel Update for Desktop
  • Google has been DDoSing SourceHut for over a year

    Just now, I took a look at the HTTP logs on git.sr.ht. Of the past 100,000 HTTP requests received by git.sr.ht (representing about 2½ hours of logs), 4,774 have been requested by GoModuleProxy — 5% of all traffic. And their requests are not cheap: every one is a complete git clone. They come in bursts, so every few minutes we get a big spike from Go, along with a constant murmur of Go traffic.

    This has been ongoing since around the release of Go 1.16, which came with some changes to how Go uses modules. Since this release, following a gradual ramp-up in traffic as the release was rolled out to users, git.sr.ht has had a constant floor of I/O and network load for which the majority can be attributed to Go.

    I started to suspect that something strange was going on when our I/O alarms started going off in February 2021 (we eventually had to tune these alarms up above the floor of I/O noise generated by Go), correlated with lots of activity from a Go user agent. I was able to narrow it down with some effort, but to the credit of the Go team they did change their User-Agent to make more apparent what was going on. Ultimately, this proved to be the end of the Go team’s helpfulness in this matter.

Molre FUD

  • New ‘Cheers’ Linux ransomware targets VMware ESXi servers [Ed: Well, ransomware is mostly a Windows issue and VMware is proprietary software, but then again, this is a Microsoft-connected site looking to alter or distort perceptions]

    A new ransomware named ‘Cheers’ has appeared in the cybercrime space and has started its operations by targeting vulnerable VMware ESXi servers.

    VMware ESXi is a virtualization platform commonly used by large organizations worldwide, so encrypting them typically causes severe disruption to a business’ operations.

Microsoft Windows TCO

  • Malware-Infested Smart Card Reader [Ed: Microsoft Windows TCO]

    Brian Krebs has an interesting story of a smart ID card reader with a malware-infested Windows driver, and US government employees who inadvertently buy and use them.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

Security Leftovers

  • odcast: Why there were 56 OT vulnerabilities this week

    This week we cover the Ericsson mobility report that offers some stats on cellular IoT connections, including the surprising nugget that we won’t see 4G/5G connections surpass 2G/3G connections until some time next year. Then we hit another report. This one is from NPR and covers the state of audio and smart speakers. It proves that growth is slowing for smart speakers and that we may not do as many things with voice as we think. In dystopian news we cover China using COVID tracking apps to lock down protesters, and Microsoft stopping sales of some facial recognition tools. In new product news we talk about the latest Philips Hue gear, a new material that could generate electricity for wearables, and new MCUs from NXP. We also address the closure of SmartDry and explain how Google’s update on the Nest Max Hub may break your Nest x Yale lock. We end by answering a listener question about more accurate motion sensors.

  • Cortex XSOAR Tips & Tricks – Creating indicator relationships in automations

    In Cortex XSOAR, indicators are a key part of the platform as they visualize the Indicators Of Compromise (IOC) of a security alert in the incident to the SOC analyst and can be used in automated analysis workflows to determine the incident outcome. If you have a Cortex XSOAR Threat Intelligence Management (TIM) license, it is possible to create predefined relationships between indicators to describe how they relate to each other. This enables the SOC analyst to do a more efficient incident analysis based on the indicators associated to the incident.

  • Social Engineering Kill–Chain: Predicting, Minimizing & Disrupting Attack Verticals

    It was a Friday afternoon when Bill was on his way back home from work when he received a call that made him take the next U-turn back to his office. It was one of these calls that he was dedicating all of his working hours to avoid. He was not given much detail through the phone, but it seems that Andre, someone working in the account payments department, had just fallen victim to a scam and had proceeded to a hefty payment. A scam? Bill recalled all the training videos he had put this department through. What went wrong?

  • Daycare apps are insecure surveillance dumpster-fires

    Apps are like software, only worse.

  • 12 best patch management software and tools for 2022

    These 12 tools approach patching from different perspectives. Understanding their various approaches can help you find the right product for your needs.

Windows vs Linux: What's the best operating system?

The way you utilise your PC can often depend on the operating system you use as well as your level of technical knowledge. Even though most people will turn to macOS or Windows when deciding on an OS, if you want something you can customise, there's nothing better than Linux. Despite the fact that it isn’t as popular as Windows, Linux offers far more avenues for customisation than any other OS as it's built on an open source foundation. It's certainly more intimidating to the average user as a result, but it can be incredibly powerful, and rewarding, if you possess the skills to fully take advantage of it. Obviously, there are advantages and disadvantages with both systems that are useful to know before making the decision on which is best for you. Read more

today's howtos

  • FreeBSD Quick Guide: Audio on FreeBSD

    Whether for music, communication, or notifications, audio is an important feature of many personal computer systems. In a new FreeBSD system, an audio card will need to be configured to process audio files and send them to the connected speakers. Our newest FreeBSD quick guide will walk through setting up and configuring audio, connecting a pair of headphones (including pairing Bluetooth models), and testing the system’s sound, all in under 10 minutes!

  • Speeding up autoconf with caching - Julio Merino (jmmv.dev)

    In the recent Remembering Buildtool post, I described how setting up a cache of configuration checks was an important step in Buildtool’s installation process. The goal was to avoid pointless repetitive work on every build by performing such common checks once. Episode 457 of BSD Now featured my post and Allan Jude wondered how much time would be saved in a bulk build of all FreeBSD packages if we could just do that same kind of caching with GNU Autoconf. And, you know what? It is indeed possible to do so. I had mentioned it en passing in my post but I guess I wasn’t clear enough, so let’s elaborate!

  • How To Put Linux On A Laptop

    Linux is an operating system that comes with different distributions like Ubuntu, Debian, and Arch Linux. Just like macOS and Windows, Linux is also a popular operating system that is installed on computers and laptops to manage the hardware of the respective machine and perform the different tasks requested by the users. In this guide, different ways of installing or putting the Linux operating system on a laptop have been discussed.

  • What Is cURL Command and How to Use It (With Examples)

    This article explains the curl command in Linux and how to use it with examples based on best practices.

Raspberry Pi and Raspberry Pi Pico Projects

  • Tiny Raspberry Pi Zero 2 W Robot Made For Robot Sumo | Tom's Hardware

    The Raspberry Pi in robotics is a smart mix—but what happens if the kit you ordered doesn’t support the Pi? You get creative like maker and developer WallComputer, of course! In this Raspberry Pi Zumo project, they've converted the classic Pololu Arduino Zumo kit to support the latest Raspberry Pi Zero 2 W. This tiny robot uses tank-like treads to get around, which provide the traction needed for Sumo robots designed to push each other around. Traditionally this type of robot is controlled by an Arduino Uno, but this version uses both a Raspberry Pi Zero 2 W and an STM32 microcontroller with a little help from a couple of custom PCBs. To see how much has been modified, take a look at the original product listing for the Zumo kit over at Pololu’s website. This modification was not only necessary to use the Pi, but also to add additional features like a rechargeable battery pack.

  • Best Raspberry Pi Deals 2022 | Tom's Hardware

    With more than 40 million units sold and a powerful community of makers and fans behind it, Raspberry Pi is more than a single-board computer; it's a huge platform with an even bigger ecosystem behind it. Whether you want to build your own robot, create an A.I.-powered security camera, or just set up a simple computer for programming and web surfing, the Pi is for you.

  • Raspberry Pi Pico Drives $10 Nintendo 64 Flash Cart | Tom's Hardware

    We love retro gaming on the Raspberry Pi but there’s nothing quite like retro gaming with a Raspberry Pi. Instead of running an emulator on a Pi, this Raspberry Pi Pico Nintendo 64 cart project, created by maker and developer Konrad Beckmann, is using the Raspberry Pi Pico to host a ROM that runs on the original Nintendo 64 console. I built a working Nintendo 64 flash cart with a Raspberry Pi Pico, a breakout board and some extra flash for less than $10.It boots Super Mario 64. Can't wait to optimize, improve and add more features to it!Lots of stuff left before it's ready for general users though. pic.twitter.com/C1qVaTTfHiJune 22, 2022

  • Raspberry Pi Pico Detects Gamma Rays in Open Spectroscopy Project | Tom's Hardware

    There are many useful things you can do with a Raspberry Pi Pico (opens in new tab), as our listing of the best Raspberry Pi Projects (opens in new tab) underlines. However, here’s one we admit we’d never thought of: detecting radiation. Physicist Matthias Rosezky, AKA Nuclear Phoenix (opens in new tab), whose work has also been covered by Hackaday (opens in new tab), has written up a detailed account of building a DIY gamma-ray spectrometer in IEEE Spectrum (opens in new tab).