Language Selection

English French German Italian Portuguese Spanish

Security

Alpine 3.13.5, 3.10.9, 3.11.11 and 3.12.7

Filed under
GNU
Linux
Security
  • Alpine 3.13.5 released

    The Alpine Linux project is pleased to announce the immediate availability of version 3.13.5 of its Alpine Linux operating system.

    This release includes a fix for apk-tools CVE-2021-30139.

  • Alpine 3.10.9, 3.11.11 and 3.12.7 released

    The Alpine Linux project is pleased to announce the immediate availability of version 3.10.9, 3.11.11 and 3.12.7 of its Alpine Linux operating system.

    Those releases include fixes for apk-tools CVE-2021-30139.

Proprietary Software and Security Holes

Filed under
Security
  • Linux Client for Cisco Webex is Coming Next Month

    Webex is the video conferencing and online meeting tool from Cisco. At present, you can use Webex through a web browser in Linux but soon you would be able to install the Webex application on Linux.

    In a blog post, Cisco revealed the plan to release Webex Linux client in May. There is no set date, just the information that Webex application will have Linux support in May.

  • Microsoft Patch Tuesday, April 2021 Edition
  • Over half of ransomware victims pay the ransom, but only a quarter see their full data returned

    More than half (56%) of ransomware victims paid the ransom to restore access to their data last year, according to a global study of 15,000 consumers conducted by global security company Kaspersky. Yet for 17% of those, paying the ransom did not guarantee the return of stolen data. However, as public awareness of potential cyberthreats grows there is reason for optimism in the fight against ransomware.

  • Where are phishing emails more likely to originate from?

    The country where emails originate and the number of countries they are routed through on the way to their final destination offer important warning signs of phishing attacks.

    For the study, researchers at cloud-enabled security solutions provider Barracuda Networks teamed up with Columbia University researchers.

    They examined the geolocation and network infrastructure across more than two billion emails, including 218,000 phishing emails sent in the month of January 2020.

  • Print Friendly & PDF: Full compromise

    I looked into the Print Friendly & PDF browser extension while helping someone figure out an issue they were having. The issue turned out unrelated to the extension, but I already noticed something that looked very odd. A quick investigation later I could confirm a massive vulnerability affecting all of its users (close to 1 million of them). Any website could easily gain complete control of the extension.

Canonical Publishes New Ubuntu Linux Kernel Updates to Fix 20 Vulnerabilities

Filed under
Security

For Ubuntu 20.10 and Ubuntu 20.04 LTS systems running Linux kernel 5.8, the new kernel update fixes CVE-2021-20239, a flaw discovered by Ryota Shiga in Linux kernel’s sockopt BPF hooks that could allow a local attacker to exploit another kernel vulnerability, CVE-2021-20268, a flaw discovered in the BPF verifier, which could allow a local attacker to cause a denial of service (system crash) or possibly execute arbitrary code, and CVE-2021-3178, a flaw discovered in the NFS implementation, which could allow an attacker to bypass NFS access restrictions.

Read more

Security Leftovers

Filed under
Security

New Important Kernel Update Released for RHEL 7 and CentOS Linux 7 Systems

Filed under
Security

The new Linux kernel security update comes just three weeks after the previous one, which patched 11 flaws, to address three vulnerabilities affecting the Linux 3.10 kernel used in all supported Red Hat Enterprise Linux 7 and CentOS Linux 7 operating system series.

Two of these vulnerabilities are marked by the Red Hat Product Security team as “important.” These include CVE-2021-27365, a heap buffer overflow discovered in Linux kernel’s iSCSI subsystem that could allow a local, unprivileged user to cause a denial of service (system crash) or possibly execute arbitrary code, and CVE-2021-27364, an out-of-bounds read flaw discovered in the libiscsi module that could lead to reading kernel memory or a crash.

Read more

Is Linux A More Secure Option Than Windows For Businesses?

Filed under
GNU
Linux
Microsoft
Security

There are many factors to consider when choosing an OS, security being among one of the most critical. The general consensus among experts is that Linux is the most secure OS by design - an impressive feat that can be attributed to a variety of characteristics including its transparent open-source code, strict user privilege model, diversity, built-in kernel security defenses and the security of the applications that run on it.

The high level of security, customization, compatibility and cost-efficiency that Linux offers make it a popular choice among businesses and organizations looking to secure high-value data. Linux has already been adopted by governments and tech giants around the world including IBM, Google and Amazon, and currently powers 97% of the top one million domains in the world. All of today’s most popular programming languages were first developed on Linux and can now run on any OS. In this sense, we’re all using Linux - whether we know it or not!

This article will examine why Linux is arguably the best choice for businesses looking for a flexible, cost-efficient, exceptionally secure OS. To help you weigh your options, we’ll explore how Linux compares to Windows in the level of privacy and protection against vulnerabilities and attacks it is able to offer all businesses and organizations.

Read more

Proprietary Software and Security

Filed under
Security
  • Google’s Project Zero Finds a Nation-State Zero-Day Operation

    Google’s Project Zero discovered, and caused to be patched, eleven zero-day exploits against Chrome, Safari, Microsoft Windows, and iOS. This seems to have been exploited by “Western government operatives actively conducting a counterterrorism operation”: [...]

  • What if We Made Paying Ransoms Illegal?

    A lot of what I reacted to was the notion that this would be easy. “Disappear in a month”, he said. That’s hyperbole but I should have ignored it and focused on the argument.

    The part that most people latched on to, including me, was the notion that making something illegal can stop it from happening. As many pointed out, history has taught us that this doesn’t work many times. The war on drugs. Alcohol prohibition. The list goes on.

  • Setting up Starlink, SpaceX's Satellite Internet

    So I thought, why not let a cousin who lives out in a rural area try it out while I figure out what to do about mounting 'Dishy' (a common nickname for the Starlink satellite dish) on my own house?

    After all, my cousin Annie, who lives in Jonesburg, MO, currently pays for the maximum available DSL plan to her farm (Haarmann Farms), and gets a measly 5 Mbps down, and 0.46 Mbps up—on a good day: [...]

  • Facebook ‘knew about phone number data leak vulnerability two years before issue was fixed’, claims security researcher

    As Facebook defends its actions over a massive data leak, one researcher says he notified the company of the issue a full two years before the problem was fixed.

    Last week, Business Insider revealed that the personal data of more than 500 million Facebook users had been posted in a low-level hacking forum where phone numbers were being offered for sale.

    Facebook has defended itself in a lengthy blog post, pointing out that the data was obtained by scraping, rather than [cracking].

  • Facebook says [crackers] 'scraped' data of 533 million users in 2019 leak

    The data included phone numbers, birth dates, and email addresses, and some of the data appeared to be current, according to US media reports.

    The stolen [sic] data did not include passwords or financial data, according to Facebook.

    Scraping is a tactic that involves using automated software to gather up information shared publicly online.

Audiocasts/Shows: GNU World Order, Free Software Security Podcast, Linux Action News, Full Circle Weekly News

Filed under
GNU
Linux
Security

GnuPG 2.3.0 Is Released With New Default Public Key Algorithms, A New Key Daemon And More

Filed under
Software
Security

GnuPG is the de-facto standard for encrypted e-mail, and to some degree encrypted instant messages, within the free software world. Most FOSS e-mail software has built-in support or plugins for it. It is also used to sign software releases, ISO images for GNU/Linux distributions and a whole lot more. Nobody outside the FOSS community uses it or cares about it, which is a bit sad.

GnuPG 2.3.0 has quite a few improvements over previous versions. It now comes with a still experimental key database daemon that uses a SQLite database to store the keys. It can be enabled by adding use-keyboxd to $HOME/.gnupg/gpg.conf. There is a new separate configuration file for it called $HOME/.gnupg/gpgsm.conf. This daemon makes key look-ups much faster.

There's also a new tpm2d daemon for physically binding keys to a machine. You can read more about it in a blog post on gnupg.org titled Using a TPM with GnuPG 2.3. Most newer laptops in the upper price range come with a TPM module. Desktop computers tend to come with a empty motherboard header where one can be installed, so this is mostly useful if you have a fairly new high-end laptop or you are willing to buy a TPM module.

New GnuPG keys are now, by default, created with the ed25519/cv25519 public key algorithms. Similarly, AES is now the new last resort cipher preference instead of 3DES.

Read more

Security Leftovers

Filed under
Security
  • ClamAV 0.103.2 Is Released With Security Fixes For Four Vulnerabilities

    The free software anti-virus scanner ClamAV has, ironically, made a security release fixing four vulnerabilities. Two of them could cause it to crash, one could cause it to enter a endless loop and a Windows-specific vulnerability could lead to privilege escalation. ClamAV has 8,532,858 virus signatures it can scan for in its database.

  • Why the U.S. Shouldn’t Play Games With Cyberwarfare as Its Power Declines

    In the SolarWinds hack, a backdoor in one of the components was downloaded to the systems of 18,000 organizations, including the U.S. Treasury and Commerce departments, the Department of Homeland Security and the State Department.

    In the Microsoft Exchange Server hack, an estimated 250,000 machinesworldwide might have been affected by a vulnerability that allowed hackers to control the machines and even infect other systems in the internal network of the targeted companies. Four major vulnerabilities in Microsoft Exchange Server were reported to Microsoft in early January. Unfortunately, it wasn’t until early March that Microsoft released patches, according to ZDNet. These vulnerabilities were used by the hackers during the period that Microsoft had either not released the patches, or companies had not upgraded their systems and installed the patches.

  •  

  • LinkedIn denies data leak after two-thirds user base is compromised

                     

                       

    Personal data of 500 million LinkedIn users, two thirds of its user base, has been scraped and is for sale online, according to a report from Cyber News.

                       

    The data up for sale on a popular hacker platform includes account IDs, full names, email addresses, workplace information and links to social media accounts of users hosted on the platform.

  •                    

  • Linkedin data leak: Major breach exposes 500 million users on Microsoft platform [details]

                         

                           

    While people are yet to digest the huge Facebook data leak of 533 million users (including 6.1 million Indians), Microsoft-owned professional networking platform LinkedIn is now facing a massive data leak of 500 million users that is allegedly being sold online.

                           

    An archive with data purportedly scraped from 500 million LinkedIn profiles has been put for sale on a popular [cracker] forum, with another 2 million records leaked as a proof-of-concept sample by people behind the [crack].

Syndicate content

More in Tux Machines

Mozilla Leftovers

  • Firefox Nightly: These Weeks in Firefox: Issue 91
  • Phabricator Etiquette Part 1: The Reviewer

    In the next two posts we will examine the etiquette of using Phabricator. This post will examine tips from the reviewer’s perspective, and next week will focus on the author’s point of view. While the social aspects of etiquette are incredibly important, we should all be polite and considerate, these posts will focus more on the mechanics of using Phabricator. In other words, how to make the review process as smooth as possible without wasting anyone’s time.

  • Robert O'Callahan: Visualizing Control Flow In Pernosco

    In traditional debuggers, developers often single-step through the execution of a function to discover its control flow. One of Pernosco's main themes is avoiding single-stepping by visualizing state over time "all at once". Therefore, presenting control flow through a function "at a glance" is an important Pernosco feature and we've recently made significant improvements in this area. This is a surprisingly hard problem. Pernosco records control flow at the instruction level. Compiler-generated debuginfo maps instructions to source lines, but lacks other potentially useful information such as the static control flow graph. We think developers want to understand control flow in the context of their source code (so approaches taken by, e.g., reverse engineering tools are not optimal for Pernosco). However, mapping potentially complex control flow onto the simple top-to-bottom source code view is inherently lossy or confusing or both. For functions without loops there is a simple, obvious and good solution: highlight the lines executed, and let the user jump in time to that line's execution when clicked on. In the example below, we can see immediately where the function took an early exit.

  • Marco Castelluccio: On code coverage and regressions

    There are two schools of thought when it comes to code coverage: those who think it is a useless metric and those who think the opposite (OK, I’m a bit exaggerating, there are people in the middle…). I belong to the second “school”: I have always thought, intuitively, that patches without tests are more likely to cause postrelease regressions, and so having test coverage decreases risk. A few days ago, I set out to confirm this intuition, and I found this interesting study: Code Coverage and Postrelease Defects: A Large-Scale Study on Open Source Projects. The authors showed (on projects that are very different from Firefox, but still…) that there was no correlation between project coverage and the amount of bugs that are introduced in the project and, more importantly, there was no correlation between file coverage and the amount of bugs that are introduced in the file.

today's howtos

Nvidia GPU Passthrough To Windows VM From Linux Host

Nvidia has now officially enabled GPU passthrough support for Windows virtual machines on GeForce graphics cards. In other words, this effectively means it?s possible to run a Linux machine and then run a virtual Windows machine within it, and hand that unfettered access to a graphics card. This is a big win for those wanting to run Windows games from within a virtual machine on your Linux desktop. They will be able to play Windows-based games using a virtual machine with GPU passthrough enabled. Read more

IBM/Red Hat/Fedora Leftovers

  • Red Hat Satellite 6.8.6 has been released [Ed: They have unpublised this since.]

    We are pleased to announce that Red Hat Satellite 6.8.6 is generally available as of April 13, 2021.

  • A brief intro to Red Hat OpenShift for Node.js developers – IBM Developer

    Container-based deployment models are the modern way to develop and deliver your applications. The most common tool for building with containers is Kubernetes, an open-source container-orchestration system for automating computer application deployment, scaling, and management. Kubernetes has helped usher in a standardized way to deploy and manage applications at scale, but it can be a sprawling, difficult beast to manage when your application becomes more mature and more complex. A company will need to have a robust DevOps team to manage a full-fledged Kubernetes-based production system. [...] My colleague, JJ Asghar summed it up nicely: “OpenShift provides creature comforts to talk to the Kubernetes “API”—at the same level of robustness—as long as you’re willing to use the opinions OpenShift brings.” The good news? Those opinions are tried and tested, enterprise-ready choices with the backing and support of Red Hat. So, what do Node.js developers need to know about OpenShift deployment? This blog post covers the “what” and “how” of deploying your Node.js application in an OpenShift environment.

  • Fedora Community Blog: Community Blog monthly update: March 2021

    In March, we published 21 posts. The site had 5,520 visits from 3,652 unique viewers. 888 visits came from search engines, while 450 came from the WordPress Android app, and 386 came from Twitter and 208 from Reddit.

  • How Red Hat data scientists use and contribute to Open Data Hub

    Artificial intelligence (AI) and machine learning (ML) drive much of the world around us, from the apps on our phones to electric cars on the highway. Allowing such things to run as accurately as possible takes huge amounts of data to be collected and understood. At the helm of that critical information are data scientists. So, what’s a day on the job look like for data scientists at Red Hat? Don Chesworth, Principal Data Scientist, gives you a glimpse into his day-to-day in a short video (aptly named "A Day in the Life of a Red Hat Data Scientist") that’s now available on our website. Isabel Zimmerman, Data Science Intern, provides a look at some of the tools she uses on the job in "Using Open Data Hub as a Red Hat Data Scientist." We’ll cover some of the highlights in this post.

  • IBM Brings COBOL Capabilities to the Linux on x86 Environment

    IBM has announced COBOL for Linux on x86 1.1, bringing IBM's COBOL compilation technologies and capabilities to the Linux on x86 environment. According to the IBM announcement, COBOL for Linux on x86 can help modernize, integrate, and manage existing applications, data, and skill sets to ease an organization’s transformation into a more flexible business. To connect business components with suppliers, partners, employees, and clients, and to position organizations to quickly take advantage of opportunities and respond to challenges in real time, COBOL for Linux on x86 can help meet these challenges and enable use of existing COBOL code while upgrading applications with the newest technologies.

  • <./ul>