Language Selection

English French German Italian Portuguese Spanish

Security

Canonical and Proprietary Forums Software (Again Cracked)

Filed under
Security
Ubuntu

Security News

Filed under
Security
  • Ubuntu user forums hack leaks millions of user details [Ed: Canonical continued using proprietary software that had already been breached, now gives GNU/Linux a bad name again. Many journalists out there cannot tell the difference between operating system and forums software, never mind proprietary and Free software. How many so-called "technology" journalists still say "commercial" software instead of proprietary software, as if FOSS is non-commercial?]

    Attacker took advantage of unpatched software.

    Canonical, the parent company of popular Linux distribution Ubuntu, has disclosed that its user web forums have suffered a major data breach.

    Over the weekend, Canonical said that it had come across claims that a third party had a copy of the Ubuntu Forums database.

    The company was able to verify that a breach had taken place, with a database containing details of two million Ubuntu Forums users being leaked.

  • As Open Source Code Spreads, So Do Components with Security Flaws[Ef: Catalin Cimpanu's headline would have us believe that proprietary software has no "Security Flaws", only FOSS]

    The company that provides hosting services for the Maven Central Repository says that one in sixteen downloads is for a Java component that contains a known security flaw.

  • OpenSSH has user enumeration bug

    A bug in OpenSSH allows an attacker to check whether user names are valid on a 'net-facing server - because the Blowfish algorithm runs faster than SHA256/SHA512.

    The bug hasn't been fixed yet, but in his post to Full Disclosure, Verint developer Eddie Harari says OpenSSH developer Darren Tucker knows about the issue and is working to address it.

    If you send a user ID to an OpenSSH server with a long (but wrong) password – 10 kilobytes is what Harari mentions in his post – then the server will respond quickly for fake users, but slower for real users.

Security News

Filed under
Security
  • Microsoft’s Windows RT security patch also stops you from loading Linux

    It was big news when Microsoft announced it was working on a version of Windows that would run on tablets with ARM-based processors… but by the time Windows RT actually launched it was a lot less exciting. Devices like the Microsoft Surface and Surface 2 couldn’t run desktop Windows apps and weren’t significantly cheaper than Intel Atom-powered tablets running the full version of Windows, and they didn’t even get better battery life.

  • The sad state of Linux download security

    Installation images for many of the most popular Linux distributions are difficult or impossible to obtain securely via download.

  • Why we use the Linux kernel's TCP stack

    Let's start with a broader question - what is the point of running an operating system at all? If you planned on running a single application, having to use a kernel consisting of multiple million lines of code may sound like a burden.

    But in fact most of us decide to run some kind of OS and we do that for two reasons. Firstly, the OS layer adds hardware independence and easy to use APIs. With these we can focus on writing the code for any machine - not only the specialized hardware we have at the moment. Secondly, the OS adds a time sharing layer. This allows us to run more than one application at a time. Whether it's a second HTTP server or just a bash session, this ability to share resources between multiple processes is critical. All of the resources exposed by the kernel can be shared between multiple processes!

    [...]

    Having said that, at CloudFlare we do use kernel bypass. We are in the second group - we care about performance. More specifically we suffer from IRQ storms. The Linux networking stack has a limit on how many packets per second it can handle. When the limit is reached all CPUs become busy just receiving packets. In that case either the packets are dropped or the applications are starved of CPU. While we don't have to deal with IRQ storms during our normal operation, this does happen when we are the target of an L3 (layer 3 OSI) DDoS attack. This is a type of attack where the target is flooded with arbitrary packets not belonging to valid connections - typically spoofed packets.

Security Leftovers

Filed under
Security
  • Notice of security breach on Ubuntu Forums [Ed: this is proprietary software on top of proprietary software. Shame!]

    Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched.

  • Ubuntu Forums Hacked! Here Is What Hacker Stole?
  • ChaosKey

    The Linux Kernel, starting with version 4.1, includes source for this driver. It should be built by default in your distribution. If your using Linux + KVM to host other Linux instances, read the VirtualMachine page to see how you can configure the guests to share the host entropy source.

Security Leftovers

Filed under
Security
  • Friday's security updates
  • Room for Application Security Improvement

    Using open source components is a common software development process; just how common, however, may come as a surprise -- even a shock -- to some. The average organization uses 229,000 open source components a year, found research by Sonatype, a provider of software development lifecycle solutions that manages a Central Repository of these components for the Java development community.

    There were 31 billion requests for downloads from the repository in 2015, up from 17 billion in 2014, according to Sonatype.

    The number "blows people's minds," said Derek Weeks, a VP and DevOps advocate at Sonatype. "The perspective of the application security professional or DevOps security professional or open source governance professional is, 'This really changes the game. If it were 100, I could control that, but if it is 200,000 the world has changed."

  • Ubuntu Forums Suffer Data breach; Credit Goes to SQL Flaw

Ubuntu Forums Cracked. Again.

Filed under
Security
Ubuntu

Security Leftovers

Filed under
Security

Canonical Patches Linux Kernel Vulnerability in All Supported Ubuntu OSes

Filed under
Security
Ubuntu

Today, July 14, 2016, Canonical published multiple security notices to inform users of the Ubuntu 16.04 LTS (Xenial Xerus), Ubuntu 14.04 LTS (Trusty Tahr) and Ubuntu 15.10 (Wily Werewolf) operating systems about the availability of a new kernel update.

Read more

Changes in Tor

Filed under
OSS
Security

Security News

Filed under
Security
  • David A. Wheeler: Working to Prevent the Next Heartbleed

    The Heartbleed bug revealed that some important open source projects were so understaffed that they were unable to properly implement best security practices. The Linux Foundation’s Core Infrastructure Initiative , formed to help open source projects have the ability to adopt these practices, uses a lot of carrot and very little stick.

  • The First iPhone Hacker Shows How Easy It Is To Hack A Computer

    Viceland is known for its extensive security-focused coverage and videos. In the latest CYBERWAR series, it’s showing us different kinds of cyber threats present in the world around us. From the same series, recently, we covered the story of an ex-NSA spy that showed us how to hack a car.

    In another spooky addition to the series, we got to see how easily the famous iPhone hacker George Hotz hacked a computer.

    George Hotz, also known as geohot, is the American hacker known for unlocking the iPhone. He developed bootrom exploit and limera1n jailbreak tool for Apple’s iOS operating system. Recently, he even built his own self-driving car in his garage.

  • Beware; Adwind RAT infecting Windows, OS X, Linux and Android Devices

    Cyber criminals always develop malware filled with unbelievable features but hardly ever you will find something that targets different operating systems simultaneously. Now, researchers have discovered a malware based on Java infecting companies in Denmark but it’s only a matter of time before it will probably hit other countries.

  • 7 Computers Fighting Against Each Other To Become “The Perfect Hacker”

    Are automated “computer hackers” better than human hackers? DARPA is answering this question in positive and looking to prove its point with the help of its Cyber Grand Challenge. The contest finale will feature seven powerful computer fighting against each other. The winner of the contest will challenge human hackers at the annual DEF CON hacking conference.

Syndicate content

More in Tux Machines

CORD becomes a Linux Foundation project

Central Office Re-architected as a Data Center (CORD), an open source integrated solutions platform for service providers leveraging merchant silicon, white boxes, and open source platforms such as Open Network Operating System (ONOS), OpenStack, Docker, and the cloud operating system XOS, is now part of the Linux Foundation as a new independent project. The Linux foundation is already home to many open source networking projects, including OpenDaylight and ONOS, so CORD is a natural fit for the non-profit foundation. Read more

Google beefs Linux up kernel defenses in Android

Future versions of Android will be more resilient to exploits thanks to developers' efforts to integrate the latest Linux kernel defenses into the operating system. Android's security model relies heavily on the Linux kernel that sits at its core. As such, Android developers have always been interested in adding new security features that are intended to prevent potentially malicious code from reaching the kernel, which is the most privileged area of the operating system. Read more

Fork YOU! Sure, take the code. Then what?

There's an old adage in the open source world – if you don't like it, fork it. This advice, often given in a flippant manner, makes it seem like forking a piece of software is not a big deal. Indeed, forking a small project you find on GitHub is not a big deal. There's even a handy button to make it easy to fork it. Unlike many things in programming though, that interaction model, that simplicity of forking, does not scale. There is no button next to Debian that says Fork it! Thinking that all you need to do to make a project yours is to fork it is a fundamental misunderstanding of what large free/open source projects are – at their hearts, they are communities. One does not simply walk into Debian and fork it. One can, on the other hand, walk out of a project, bring all the other core developers along, and essentially leave the original an empty husk. This is what happened when LibreOffice forked away from the once-mighty OpenOffice; it's what happened when MariaDB split from MySQL; and it's what happened more recently when the core developers behind ownCloud left the company and forked the code to start their own project, Nextcloud. They also, thankfully, dropped the silly lowercase first letter thing. Nextcloud consists of the core developers who built ownCloud, but who were not, and, judging by the very public way this happened, had not been, in control of the direction of the product for some time. Read more

Proprietary and Microsoft Software