Microsoft, FOSS FUD, and Openwashing

• GitHub devs warn Microsoft 'ditch that contract with ICE or lose us' [iophk: "at the end of the day, it is still the old Microsoft; the so-called developers didn't quit then and won't quit now"]

• GitHub users threaten exodus unless Microsoft cancels ICE contract

  Ninety-seven open-source developers have threatened to move their projects from the source code repository GitHub, which is now owned by Microsoft, unless the software behemoth ends its contract with the US Immigration and Customs Enforcement.

• Microsoft’s ICE involvement illustrates tech’s denial problem

  More than asking what kind of people would work in a tech capacity to provide technical solutions for genocide, it's interesting to wonder how they felt about it. Was the suffering of others an abstract, or were they more like former Trump campaign manager Corey Lewandowski, mocking and pointedly indifferent? Perhaps they felt like Microsoft employees, some of whom this week repudiated the company between news of the US government's human rights violations in regard to immigrants and asylum-seekers, and Microsoft's role in providing tech solutions for ICE (US Immigration and Customs Enforcement).

  [...]

  I get it. I really do. Yet when your hands are covered in blood, the time to stand around stuttering in disbelief hoping someone else will do something has long passed.

• Coders To Microsoft: “Break Ties With ICE Or Lose Us As GitHub Users”

• Open Source Software: Great for Engineers, Tougher for In-House Attorneys [Ed: The usual lawyers' FUD against FOSS as if proprietary software carries no legal risk/liability...]

• Open source: it's not the code, it's people [Ed: Malicious site Techradar (better not click, there are malicious scripts) now does puff pieces for Black Duck. This is like a Microsoft proxy, which was created -- by its own admission -- to attack the GPL/suppress adoption]

• New releases from Facebook and Google, CPTPP's potential open source impact, and more news

Intel Chaos Looming?

• OpenBSD disables Hyper-Threading over security concerns

  OpenBSD, the security-focused, BSD-based, open-source operating system, has announced that it is to disable Intel's Hyper-Threading (HT) technology in its latest release over concerns it could make exploitation of Spectre-style attacks easier. The discovery of side-channel attacks relating to speculative execution systems added to modern processors to boost performance, announced to the public earlier this year under the codenames Meltdown and Spectre, has caused the industry no small number of headaches. While current and next-generation silicon is known to still be vulnerable to at least some of the attack methods currently known, microcode and software patches have mitigated most of the threat - but now it looks like Intel's Hyper-Threading technology may undo that mitigation.

• httpd(8) Gains Simple Request Rewrites

• Intel Is Corporate America’s Biggest #MeToo Moment

• Intel now faces a fight for its future

• Intel chief Krzanich quits over affair with staffer

• Intel CEO Brian Krzanich resigns after company learns of 'employee relationship' [iophk: "bailing before the big security storm hits?"]

   

  Intel has named chief financial officer Bob Swan as interim chief effective, and he will take over from Krzanich immediately.

• Intel's Brian Krzanich is forced out as CEO after 'consensual relationship' with employee

   

  Krzanich's total compensation topped $21 million last year, and the company paid for his transportation and residential security, according to company filings.

Security: Apple, OpenVPN, Old Drupal Bugs and More

• Apple iOS "Erase data" bypass attack

  On IOS 12 you can only use this attack within the first hour, prior to IOS12 works great on IOS11 devices - use with rebirth to deploy an implant. More information, hacker.house

• A hacker figured out how to brute force iPhone passcodes

  A security researcher has figured out how to brute force a passcode on any up-to-date iPhone or iPad, bypassing the software's security mechanisms. Since iOS 8 rolled out in 2014, all iPhones and iPads have come with device encryption. Often protected by a four- or six-digit passcode, a hardware and software combination has made it nearly impossible to break into an iPhone or iPad without cooperation from the device owner. And if the wrong passcode is entered too many times, the device gets wiped. But Matthew Hickey, a security researcher and co-founder of cybersecurity firm Hacker House, found a way to bypass the 10-time limit and enter as many codes as he wants -- even on iOS 11.3.

• iPhone Brute Force Hack: Researcher Finds How To Bypass iPhone’s Passcode Limit

  Over the past years, Apple has been playing cat and mouse with the security researchers and hackers who keep trying to develop new ways to bypass the security of iPhone. Earlier this year, a new challenge came up in the form of an iPhone unlocking device named GrayKey being used by law enforcement agencies.

• Reverse Shell from an OpenVPN Configuration File

   

  Basically, the up command will execute any binary of script you point it to . If the victim is using a version of Bash that supports /dev/tcp then getting a reverse shell is trivial. The following ovpn file will background a reverse shell to 192.168.1.218:8181.

• Three-month-old Drupal vulnerability is being used to deploy cryptojacking malware

  Attackers are exploiting a three-month-old critical vulnerability in Drupal to compromise systems and secretly turn them into malicious cryptocurrency mining machines. Drupal's content management software is a popular tool for building websites, but this popularity, combined with the critical vulnerability (dubbed 'Drupalgeddon 2' by some), means that attackers have found a way to make a profit.

• Monero-mining Drupal malware targets network systems [Ed: Somewhat misleading headline. This targets sites that have not been patched for over 3 months.]

• Beware! Fake Fortnite APKs Having Malware Making Rounds on Internet

• Attacking Private Networks from the Internet with DNS Rebinding

• Hardened Azure, softened containers, force unlocking iOS 12, 11 iPhones – and more

Linux Networking Efforts Advances with New DPDK and OpenSwitch Releases

The OpenSwitch project joined the Linux Foundation two years ago in June 2016. The Open Switch effort originally got its start in October 2015 as a Hewlett Packard (HP) led effort. The new OPX 2.3 release provides feature enhancements for SNMP support and also adds support for Remote Authentication Dial-In User Service (RADIUS) as well as Terminal Access Controller Access-Control System Plus (TACACS+) . "The ability to install and operationalize individual protocol stacks as applications or micro-features facilitates the design of cost-conscious, composable networks (based on a mixture of best-of-breed hardware and software) that reduce failure domains and improve performance” Alley Hasan, OpenSwitch Project Governing Board chair, wrote in a statement. "The OpenSwitch community is committed to continue developing viable, turn-key solutions for data center operators, as well as for service provider edge and core architectures."