Language Selection

English French German Italian Portuguese Spanish

Security

Security News

Filed under
Security
  • Security updates for Friday
  • Linux malware turns victim's machines into crypto-currency miners [Ed: Linux "malware exploits flaw in Redis NoSQL" is not correct. Not Linux problem, not a flaw either but misconfiguration]
  • Researchers announce Linux kernel “network snooping” bug
  • Microsoft's compromised Secure Boot implementation

    There's been a bunch of coverage of this attack on Microsoft's Secure Boot implementation, a lot of which has been somewhat confused or misleading. Here's my understanding of the situation.

    Windows RT devices were shipped without the ability to disable Secure Boot. Secure Boot is the root of trust for Microsoft's User Mode Code Integrity (UMCI) feature, which is what restricts Windows RT devices to running applications signed by Microsoft. This restriction is somewhat inconvenient for developers, so Microsoft added support in the bootloader to disable UMCI. If you were a member of the appropriate developer program, you could give your device's unique ID to Microsoft and receive a signed blob that disabled image validation. The bootloader would execute a (Microsoft-signed) utility that verified that the blob was appropriately signed and matched the device in question, and would then insert it into an EFI Boot Services variable[1]. On reboot, the boot loader reads the blob from that variable and integrates that policy, telling later stages to disable code integrity validation.

More Security News

Filed under
Security
  • FreeBSD devs ponder changes to security processes

    The developers of FreeBSD have announced they'll change the way they go about their business, after users queried why known vulnerabilities weren't being communicated to users.

    This story starts with an anonymous GitHub post detailing some vulnerabilities in the OS, specifically in freebsd-update, libarchive, bspatch and portsnap. Some of the problems in that post were verified and the FreeBSD devs started working on repairs.

  • Your Linux Distro Can Be Hacked In 60 Seconds Due To Serious TCP Flaw: Research [Ed: This headline is nonsense and shows that the author lacks technical understanding of it.]
  • Virtual Machine Introspection: A Security Innovation With New Commercial Applications

    A few weeks ago, Citrix and Bitdefender launched XenServer 7 and Bitdefender Hypervisor Introspection, which together compose the first commercial application of the Xen Project Hypervisor’s Virtual Machine Introspection (VMI) infrastructure. In this article, we will cover why this technology is revolutionary and how members of the Xen Project Community and open source projects that were early adopters of VMI (most notably LibVMI and DRAKVUF) collaborated to enable this technology.

  • 10 IoT Security Best Practices For IT Pros

    IT professionals have to treat internet of things (IoT) vulnerabilities as they would vulnerabilities in databases or web applications. Any flaw can bring unwelcome attention, for those making affected products and those using them. Any flaw may prove useful to compromise other systems on the network. When everything is connected, security is only as strong as the weakest node on the network.

  • Like The Rest Of The Internet Of Things, Most 'Smart' Locks Are Easily Hacked

    Smart refrigerators that leak your e-mail credentials. Smart TVs that collect but then fail to secure your living room conversations. Smart thermostats that can be loaded with ransomware. Smart vehicles that can be hacked and potentially kill you. This is the end result of "Internet of Things" evangelists and companies that for the last half-decade put hype and profit (the cart) well ahead of consumer privacy and security (the horse), in the process exposing us all to thousands of new attack vectors in homes and businesses around the world.

Security News

Filed under
Security

Security Leftovers

Filed under
Security
  • Security advisories for Wednesday
  • Google: QuadRooter Threat Blocked On Most Android Devices
  • Linux Distributions Vulnerable to Cyber-Attacks: Report
  • Windows 10 Attack Surface Grows with Linux Support in Anniversary Update [Ed: Does Kaspersky not know CrowdStrike is a Microsoft-connected firm that spreads Linux FUD?]
  • Web pages, Word docs, PDF files, fonts – behold your latest keys to infecting Windows PCs

    Microsoft has fixed 38 CVE-listed security vulnerabilities in Edge, Internet Explorer, and Office, as well as high-profile flaws that have allowed researchers to circumvent Windows boot protections.

    None of the programming blunders were publicly disclosed or actively exploited in the wild prior to today's patch release.

  • If census site was taken down after DDoS attack it wasn't prepared: expert

    The attack against the census website that resulted in it being taken down last night appears, at face value, to have been nothing more than the standard attack perpetrated against countless sites every day by everyone from children to malcontents with an axe to grind, an expert says.

    That the site was attacked is not in the least bit surprising, security adviser Troy Hunt told Fairfax Media, but it was unexpected that an attack of this kind would result in the site going down.

  • Census 2016: ABS needs to provide proof of DDoS

    Technical people like him are what we need to cut through all the bulldust. One person who is an expert in this art is Craig Sanders, a systems administrator of many decades, and one who can speak plainly. Many years ago, following a major distributed denial of service of attack on the Internet's root name servers, he was one who educated me on the phenomenon. This time was no different with Sanders; he calmly and clearly pointed me in the direction of the evidence that was needed.

    If the census website crashed due to foreign intervention — either through a denial of service or a distributed denial of service — how is it that none of the major security companies around the world did not notice it? You would need an attack of some magnitude to take down the ABS census site.

  • Researchers crack Microsoft feature, say encryption backdoors similarly crackable [Ed: by design]

    Researchers who uncovered a security key that protects Windows devices as they boot up say their discovery is proof that encryption backdoors do not work.

    The pair of researchers, credited by their hacker nicknames MY123 and Slipstream, found the cryptographic key protecting a feature called Secure Boot.

    They believe the discovery highlights a problem with requests law enforcement officials have made for technology companies to provide police with some form of access to otherwise virtually unbreakable encryption that might be used by criminals.

    “Microsoft implemented a ‘secure golden key’ system. And the golden keys got released from [Microsoft's] own stupidity,” wrote the researchers in their report, in a section addressed by name to the FBI.

    “Now, what happens if you tell everyone to make a ‘secure golden key’ system? Hopefully you can add 2+2.”

    Secure Boot is a built into the firmware of computer — software unique to different types of hardware that exists outside the operating system and is used to boot the OS.

Security News

Filed under
Security
  • Containerized Security: The Next Evolution of Virtualization?

    We in the security industry have gotten into a bad habit of focusing the majority of our attention and marketing dollars on raising awareness of the latest emerging threats and new technologies being developed to detect them. One just has to look at the headlines or spend fifteen minutes walking the show floor at a major security conference to see this trend. However, while we are focusing on what all the bad guys are doing, we’ve taken the eye off the ball of where our infrastructure business is going.

  • SDN Security Researchers State Their Case at Black Hat

    So say two of his grad students, Seungsoo Lee and Changhoon Yoon (left and right, respectively, in the photo above). But along with Shin, who’s now an assistant professor at the Korea Advanced Institute of Science and Technology (Kaist) and a research associate at the Open Networking Foundation (ONF), they’re hoping the industry is ready to start looking at the vulnerabilities that SDN introduces.

  • Widespread Linux Flaw Allows TCP Session Hijacking, Termination
  • Bungling Microsoft singlehandedly proves that golden backdoor keys are a terrible idea [Ed: Microsoft and backdoor should become synonymous. At every level, online and offline, Microsoft products booby-trapped with backdoors.]

    Microsoft leaked the golden keys that unlock Windows-powered tablets, phones and other devices sealed by Secure Boot – and is now scrambling to undo the blunder.

    These skeleton keys can be used to install non-Redmond operating systems on locked-down computers. In other words, on devices that do not allow you to disable Secure Boot even if you have administrator rights – such as ARM-based Windows RT tablets – it is now possible to sidestep this block and run, say, GNU/Linux or Android.

    What's more, it is believed it will be impossible for Microsoft to fully revoke the leaked keys.

    And perhaps most importantly: it is a reminder that demands by politicians and crimefighters for special keys, which can be used by investigators to unlock devices in criminal cases, will inevitably jeopardize the security of everyone.

    Microsoft's misstep was uncovered by two researchers, MY123 and Slipstream, who documented their findings here in a demoscene-themed writeup published on Tuesday. Slip believes Microsoft will find it impossible to undo its leak.

  • Microsoft Creates Backdoor In Windows, Accidentally Leaks UEFI Secure Boot Keys

    Two researchers reported that Microsoft accidentally compromised the golden keys to its UEFI Secure boot feature.

  • Can Copperhead OS fix Android's security problems?

Canonical Patches Multiple Kernel Vulnerabilities in All Supported Ubuntu OSes

Filed under
Security
Ubuntu

Today, August 10, 2016, Canonical published several security notices to inform Ubuntu Linux users about new kernel updates for their distributions, patching several vulnerabilities discovered recently.

Read more

Internet of Insecurity

Filed under
Security
  • Linux TCP flaw enables remote attacks

    Researchers at the University of California, Riverside, say they have found a weakness in the transmission control protocol (TCP) used by Linux since late 2012 which allows the remote hijacking of Internet communications.

  • Serious security threat to many Internet users highlighted
  • Your 'Smart' Thermostat Is Now Vulnerable To Ransomware

    We've noted time and time again how the much ballyhooed "internet of things" is a privacy and security dumpster fire, and the check is about to come due. Countless companies and "IoT" evangelists jumped head first into the profit party, few bothering to cast even a worried look over at the reality that basic security and privacy standards hadn't come along for the ride. The result has been an endless parade of not-so-smart devices and appliances that are busy either leaking your personal details or potentially putting your life at risk.

    Of course, the Internet of Things hype machine began with smart thermostats and the sexy, Apple-esque advertising of Nest. The fun and games didn't last however, especially after several botched firmware updates resulted in people being unable to heat or cool their homes (relatively essential for a thermostat).

Syndicate content

More in Tux Machines

Bodhi Updates, KaOS & Antergos Reviews, Another 25?

Today in Linux news, Jeff Hoogland posted a short update on the progress of Bodhi Linux 4.0 and reported on the updates to the project's donations page. In other news, An Everyday Linux User reviewed Arch-based Antergos Linux saying it was "decent" and Ubuntu-fan Jack Wallen reviewed "beautiful" KDE-centric KaOS. makeuseof.com has five reasons to switch to the Ubuntu phone and Brian Fagioli asked if Linux can survive another 25 years. Read more

Rise of the Forks: Nextcloud and LibreOffice

  • ownCloud-Forked Nextcloud 10 Now Available
  • Secure, Monitor and Control your data with Nextcloud 10 – get it now!
    Nextcloud 10 is now available with many new features for system administrators to control and direct the flow of data between users on a Nextcloud server. Rule based file tagging and responding to these tags as well as other triggers like physical location, user group, file properties and request type enables administrators to specifically deny access to, convert, delete or retain data following business or legal requirements. Monitoring, security, performance and usability improvements complement this release, enabling larger and more efficient Nextcloud installations. You can get it on our install page or read on for details.
  • What makes a great Open Source project?
    Recently the Document Foundation has published its annual report for the year 2015. You can download it as a pdf by following this link, and you can now even purchase a paper copy of the report. This publication gives me the opportunity to talk a bit about what I think makes a great FOSS project and what I understand may be a great community. If it is possible to see this topic as something many people already went over and over again, think again: Free & Open Source Software is seen as having kept and even increased its momentum these past few years, with many innovative companies developing and distributing software licensed under a Free & Open Source license from the very beginning. This trend indicates two important points: FOSS is no longer something you can automagically use as a nice tag slapped on a commodity software; and FOSS projects cannot really be treated as afterthoughts or “nice-to-haves”. Gone are the days where many vendors could claim to be sympathetic and even supportive to FOSS but only insofar as their double-digits forecasted new software solution would not be affected by a cumbersome “community of developers”. Innovation relies on, starts with, runs thanks to FOSS technologies and practices. One question is to wonder what comes next. Another one is to wonder why Open Source is still seen as a complex maze of concepts and practices by so many in the IT industry. This post will try to address one major difficulty of FOSS: why do some projects fail while others succeed.

Red Hat News

  • Red Hat Virtualisation 4 woos VMware faithful
    It is easy for a virtual machine user to feel left out these days, what with containers dominating the discussion of how to run applications at scale. But take heart, VM fans: Red Hat hasn’t forgotten about you. Red Hat Virtualisation (RHV) 4.0 refreshes Red Hat’s open source virtualisation platform with new technologies from the rest of Red Hat’s product line. It is a twofold strategy to consolidate Red Hat’s virtualisation efforts across its various products and to ramp up the company’s intention to woo VMware customers.
  • Forbes Names Red Hat One of the World's Most Innovative Companies
    Red Hat, Inc. (NYSE: RHT), the world's leading provider of open source solutions, today announced it has been named to Forbes' “World’s Most Innovative Companies” list. Red Hat was ranked as the 25th most innovative company in the world, marking the company's fourth appearance on the list (2012, 2014, 2015, 2016). Red Hat was named to Forbes' "World's Most Innovative Growth Companies" list in 2011.
  • Is this Large Market Cap Stock target price reasonable for Red Hat, Inc. (NYSE:RHT)?

GNU/Linux Leftovers

  • World Wide Web became what it is thanks to Linux
    Linux is used to power the largest websites on the Internet, including Google, Facebook, Amazon, eBay, and Wikipedia.
  • SFC's Kuhn in firing line as Linus Torvalds takes aim
    A few days after he mused that there had been no reason for him to blow his stack recently, Linux creator Linus Torvalds has directed a blast at the Software Freedom Conservancy and its distinguished technologist Bradley Kuhn over the question of enforcing compliance of the GNU General Public Licence. Torvalds' rant came on Friday, as usual on a mailing list and on a thread which was started by Software Freedom Conservancy head Karen Sandler on Wednesday last week. She suggested that Linuxcon in Toronto, held from Monday to Thursday, also include a session on GPL enforcement.
  • Linux at 25: A pictorial history
    Aug. 25 marks the 25th anniversary of Linux, the free and open source operating system that's used around the globe in smarphones, tablets, desktop PCs, servers, supercomputers, and more. Though its beginnings were humble, Linux has become the world’s largest and most pervasive open source software project in history. How did it get here? Read on for a look at some of the notable events along the way.