Language Selection

English French German Italian Portuguese Spanish

Security

In limiting open source efforts, the government takes a costly gamble

Filed under
OSS
Security

The vast majority of companies are now realizing the value of open sourcing their software and almost all have done so for at least certain projects. These days Google, Facebook, Microsoft, Apple and almost every major company is releasing code to the open source community at a constant rate.

As is the case with many cutting edge developments it’s taking governments a while to catch on and understand the value in going open source. But now governments around the world are beginning to take the view that as their software is funded by the public, it belongs to the public and should be open for public use and are starting to define codified policies for its release.

[...]

The vast majority of code is still not classified and therefore, much higher levels of open sourcing are possible. While a bigger embrace of open source may seem like a risk, the real danger lies in small, overly-cautious implementation which is costing taxpayers by the day and making us all less secure.

Read more

More Security Leftovers

Filed under
Security
  • Volkswagen Created A 'Backdoor' To Basically All Its Cars... And Now Hackers Can Open All Of Them

    In other words, VW created a backdoor, and assumed that it would remain hidden. But it did not.

    This is exactly the kind of point that we've been making about the problems of requiring any kind of backdoor and not enabling strong encryption. Using a single encryption key across every device is simply bad security. Forcing any kind of backdoor into any security system creates just these kinds of vulnerabilities -- and eventually someone's going to figure out how they work.

    On a related note, the article points out that the researchers who found this vulnerability are the same ones who also found another vulnerability a few years ago that allowed them to start the ignition of a bunch of VW vehicles. And VW's response... was to sue them and try to keep the vulnerability secret for nearly two years. Perhaps, rather than trying to sue these researchers, they should have thrown a bunch of money at them to continue their work, alert VW and help VW make their cars safer and better protected.

  • Software Freedom Doesn't Kill People, Your Security Through Obscurity Kills People

    The time has come that I must speak out against the inappropriate rhetoric used by those who (ostensibly) advocate for FLOSS usage in automotive applications.

    There was a catalyst that convinced me to finally speak up. I heard a talk today from a company representative of a software supplier for the automotive industry. He said during his talk: "putting GPLv3 software in cars will kill people" and "opening up the source code to cars will cause more harm than good". These statements are completely disingenuous. Most importantly, it ignores the fact that proprietary software in cars is at least equally, if not more, dangerous. At least one person has already been killed in a crash while using a proprietary software auto-control system. Volkswagen decided to take a different route; they decided to kill us all slowly (rather than quickly) by using proprietary software to lie about their emissions and illegally polluting our air.

    Meanwhile, there has been not a single example yet about use of GPLv3 software that has harmed anyone. If you have such an example, email it to me and I promise to add it right here to this blog post.

  • Linux Networking Flaw Allows Attacker To Trick Safety Mechanism

Security News

Filed under
Security
  • White House aims to secure open source government programs

    The White House unveils a new open source government policy and new research estimates the government's zero-day exploit stockpile to be smaller than expected.

  • How Governments Open Sourcing Code Helps Us Be More Secure

    The idea of governments releasing their proprietary code isn’t some pipe dream, it’s slowly becoming a reality in many countries and starting a much needed public discussion in others. Governments around the world are beginning to understand that their software is funded by the public, and therefore belongs to the public and should be accessible for their use. Bulgaria just passed a law which mandates that all code written for the government must be released as open source. Similarly, the United States is starting a 3-year pilot requiring all US agencies to release at least 20% of all federally-funded custom code as open source. France, Norway, Brazil and other countries have also initiated their own government open source programs to ensure more government funded code will be released as open source.

  • 2046 is the last year your CEO has a business major [Ed: says Juniper which put back doors in its software?]
  • DARPA's Machine Challenge Solves CrackAddr Puzzle

    Seven autonomous supercomputers faced off against each other in DARPA's Cyber Grand Challenge (CGC) event on the first day of the DEFCON security conference. In the end, a system known as 'Mayhem' won the $2 million grand prize and in the process helped solve a decade-old security challenge that revolved around detecting a particular type of vulnerability.

    Mike Walker, the DARPA program manager responsible for CGC, commented during a press conference that some bugs are so well known that they become famous. One such example is CrackAddr, the name of a function that can split up parts of an email address.

  • New Linux Malware Installs Bitcoin Mining Software on Infected Device

Security News

Filed under
Security
  • Security updates for Friday
  • Linux malware turns victim's machines into crypto-currency miners [Ed: Linux "malware exploits flaw in Redis NoSQL" is not correct. Not Linux problem, not a flaw either but misconfiguration]
  • Researchers announce Linux kernel “network snooping” bug
  • Microsoft's compromised Secure Boot implementation

    There's been a bunch of coverage of this attack on Microsoft's Secure Boot implementation, a lot of which has been somewhat confused or misleading. Here's my understanding of the situation.

    Windows RT devices were shipped without the ability to disable Secure Boot. Secure Boot is the root of trust for Microsoft's User Mode Code Integrity (UMCI) feature, which is what restricts Windows RT devices to running applications signed by Microsoft. This restriction is somewhat inconvenient for developers, so Microsoft added support in the bootloader to disable UMCI. If you were a member of the appropriate developer program, you could give your device's unique ID to Microsoft and receive a signed blob that disabled image validation. The bootloader would execute a (Microsoft-signed) utility that verified that the blob was appropriately signed and matched the device in question, and would then insert it into an EFI Boot Services variable[1]. On reboot, the boot loader reads the blob from that variable and integrates that policy, telling later stages to disable code integrity validation.

More Security News

Filed under
Security
  • FreeBSD devs ponder changes to security processes

    The developers of FreeBSD have announced they'll change the way they go about their business, after users queried why known vulnerabilities weren't being communicated to users.

    This story starts with an anonymous GitHub post detailing some vulnerabilities in the OS, specifically in freebsd-update, libarchive, bspatch and portsnap. Some of the problems in that post were verified and the FreeBSD devs started working on repairs.

  • Your Linux Distro Can Be Hacked In 60 Seconds Due To Serious TCP Flaw: Research [Ed: This headline is nonsense and shows that the author lacks technical understanding of it.]
  • Virtual Machine Introspection: A Security Innovation With New Commercial Applications

    A few weeks ago, Citrix and Bitdefender launched XenServer 7 and Bitdefender Hypervisor Introspection, which together compose the first commercial application of the Xen Project Hypervisor’s Virtual Machine Introspection (VMI) infrastructure. In this article, we will cover why this technology is revolutionary and how members of the Xen Project Community and open source projects that were early adopters of VMI (most notably LibVMI and DRAKVUF) collaborated to enable this technology.

  • 10 IoT Security Best Practices For IT Pros

    IT professionals have to treat internet of things (IoT) vulnerabilities as they would vulnerabilities in databases or web applications. Any flaw can bring unwelcome attention, for those making affected products and those using them. Any flaw may prove useful to compromise other systems on the network. When everything is connected, security is only as strong as the weakest node on the network.

  • Like The Rest Of The Internet Of Things, Most 'Smart' Locks Are Easily Hacked

    Smart refrigerators that leak your e-mail credentials. Smart TVs that collect but then fail to secure your living room conversations. Smart thermostats that can be loaded with ransomware. Smart vehicles that can be hacked and potentially kill you. This is the end result of "Internet of Things" evangelists and companies that for the last half-decade put hype and profit (the cart) well ahead of consumer privacy and security (the horse), in the process exposing us all to thousands of new attack vectors in homes and businesses around the world.

Security News

Filed under
Security

Security Leftovers

Filed under
Security
  • Security advisories for Wednesday
  • Google: QuadRooter Threat Blocked On Most Android Devices
  • Linux Distributions Vulnerable to Cyber-Attacks: Report
  • Windows 10 Attack Surface Grows with Linux Support in Anniversary Update [Ed: Does Kaspersky not know CrowdStrike is a Microsoft-connected firm that spreads Linux FUD?]
  • Web pages, Word docs, PDF files, fonts – behold your latest keys to infecting Windows PCs

    Microsoft has fixed 38 CVE-listed security vulnerabilities in Edge, Internet Explorer, and Office, as well as high-profile flaws that have allowed researchers to circumvent Windows boot protections.

    None of the programming blunders were publicly disclosed or actively exploited in the wild prior to today's patch release.

  • If census site was taken down after DDoS attack it wasn't prepared: expert

    The attack against the census website that resulted in it being taken down last night appears, at face value, to have been nothing more than the standard attack perpetrated against countless sites every day by everyone from children to malcontents with an axe to grind, an expert says.

    That the site was attacked is not in the least bit surprising, security adviser Troy Hunt told Fairfax Media, but it was unexpected that an attack of this kind would result in the site going down.

  • Census 2016: ABS needs to provide proof of DDoS

    Technical people like him are what we need to cut through all the bulldust. One person who is an expert in this art is Craig Sanders, a systems administrator of many decades, and one who can speak plainly. Many years ago, following a major distributed denial of service of attack on the Internet's root name servers, he was one who educated me on the phenomenon. This time was no different with Sanders; he calmly and clearly pointed me in the direction of the evidence that was needed.

    If the census website crashed due to foreign intervention — either through a denial of service or a distributed denial of service — how is it that none of the major security companies around the world did not notice it? You would need an attack of some magnitude to take down the ABS census site.

  • Researchers crack Microsoft feature, say encryption backdoors similarly crackable [Ed: by design]

    Researchers who uncovered a security key that protects Windows devices as they boot up say their discovery is proof that encryption backdoors do not work.

    The pair of researchers, credited by their hacker nicknames MY123 and Slipstream, found the cryptographic key protecting a feature called Secure Boot.

    They believe the discovery highlights a problem with requests law enforcement officials have made for technology companies to provide police with some form of access to otherwise virtually unbreakable encryption that might be used by criminals.

    “Microsoft implemented a ‘secure golden key’ system. And the golden keys got released from [Microsoft's] own stupidity,” wrote the researchers in their report, in a section addressed by name to the FBI.

    “Now, what happens if you tell everyone to make a ‘secure golden key’ system? Hopefully you can add 2+2.”

    Secure Boot is a built into the firmware of computer — software unique to different types of hardware that exists outside the operating system and is used to boot the OS.

Syndicate content

More in Tux Machines

KDevelop 5.0.0 release

Almost two years after the release of KDevelop 4.7, we are happy to announce the immediate availability of KDevelop 5.0. KDevelop is an integrated development environment focusing on support of the C++, Python, PHP and JavaScript/QML programming languages. Many important changes and refactorings were done for version 5.0, ensuring that KDevelop remains maintainable and easy to extend and improve over the next years. Highlights include much improved new C/C++ language support, as well as polishing for Python, PHP and QML/JS. Read more

CoreOS 1068.10.0 Released with Many systemd Fixes, Still Using Linux Kernel 4.6

Today, August 23, 2016, the development team behind the CoreOS security-oriented GNU/Linux operating system have released the CoreOS 1068.10.0 stable update, along with new ISO images for all supported platforms. Read more

SUSE Linux and openSUSE Leap to Offer Better Support for ARM Systems Using EFI

The YaST development team at openSUSE and SUSE is reporting on the latest improvements that should be available in the upcoming openSUSE Leap 42.2 and SUSE Linux Enterprise 12 Service Pack 2 operating systems. Read more

Create modular server-side Java apps direct from mvn modules with diet4j instead of an app server

In the latest release, the diet4j module framework for Java has learned to run modular Java apps using the Apache jsvc daemon (best known from running Tomcat on many Linux distros). If org.example.mydaemon is your top Maven project, all you do is specify it as the root module for your jsvc invocation, and diet4j figures out the dependencies when jsvc starts. An example systemd.service file is available.