Language Selection

English French German Italian Portuguese Spanish


Major Cryptsetup Vulnerability Affects Some LUKS-Encrypted GNU/Linux Systems

Filed under

According to a recent security advisory published by Hector Marco and Ismael Ripoll as CVE-2016-4484 and entitled "Cryptsetup Initrd root Shell," it would appear that there's a major vulnerability in Cryptsetup affecting many GNU/Linux systems.

Read more

Security Leftovers

Filed under
  • Cryptsetup Vulnerability Allows Easily Getting To A Root Shell

    CVE-2016-4484 was disclosed on Monday as a Cryptsetup issue that allows users to easily gain access to a root initramfs shell on affected systems in a little over one minute of simply hitting the keyboard's enter key.

    This Cryptsetup vulnerability is widespread and easy to exploit, simply requiring a lot of invalid passwords before being dropped down a root shell. The data on the LUKS-encrypted volume is still protected, but you have root shell access. The CVE reads, "This vulnerability allows to obtain a root initramfs shell on affected systems. The vulnerability is very reliable because it doesn't depend on specific systems or configurations. Attackers can copy, modify or destroy the hard disc as well as set up the network to exflitrate data. This vulnerability is specially serious in environments like libraries, ATMs, airport machines, labs, etc, where the whole boot process is protect (password in BIOS and GRUB) and we only have a keyboard or/and a mouse."

  • CVE-2016-4484: Cryptsetup Initrd root Shell
  • Security updates for Tuesday
  • Super Mari-owned: Startling Nintendo-based vulnerability discovered in Ubuntu

Security News

Filed under
  • Boy, 17, admits TalkTalk hacking offences

    A 17-year-old boy has admitted hacking offences linked to a data breach at the communications firm TalkTalk.

    Norwich Youth Court was told he had used hacking tool software to identify vulnerabilities on target websites.

  • Upgrade for KDE neon Security Issue

    Last month we moved the neon archive to a new server so packages got built on our existing server then uploaded to the new server. Checking the config it seemed I’d made the nasty error of leaving it open to the world rather than requiring an ssh gateway to access the apt repository, so anyone scanning around could have uploaded packages. There’s no reason to think that happened but the default in security is to be paranoid for any possibility.

  • Security B-Sides conferences attract growing information security crowd

    The Security B-Sides DC conference is part of the B-Sides movement, which was created to provide a community framework to build events for and by information security practitioners. Alex Norman, the co-director of Security B-Sides DC, tells us how he wants to expand information security beyond security professionals, and to involve a larger, more diverse community.

Security News

Filed under
  • Security advisories for Monday
  • Major Linux security hole gapes open

    An old Linux security 'feature' script, which activates LUKS disk encryption, has been hiding a major security hole in plain sight.

  • How to Secure Your Ubuntu Network

    In 2016, keeping your Ubuntu network secure is more important than ever. Despite what some people might think, there's much more to this than merely putting up a router to protect a network. You must also configure each of your PCs properly to ensure you're operating within a secure Ubuntu network. This article will show you how.

  • Linux Foundation Back Reproducible Builds Effort for Secure Software

    Building software securely requires a verifiable method of reproduction and that is why the Linux Foundation's Core Infrastructure Initiative is supporting the Reproducible Builds Project.

    In an effort to help open-source software developers build more secure software, the Linux Foundation is doubling down on its efforts to help the reproducible builds project. Among the most basic and often most difficult aspects of software development is making sure that the software end-users get is the same software that developers actually built.

Security Leftovers

Filed under
  • Linux Foundation doubles down on support for tamper-free software

    The Linux Foundation’s Core Infrastructure Initiative (CII) is renewing its financial support for a project that ensures binaries produced from open source software projects are free of tampering.

    The Reproducible Builds Project provides tools and best practices to software projects to ensure that the binaries generated by a compilation process are identical each time and can be matched to the source code used to build them.

  • 3 encryption tools for Linux that will keep your data safe

    Encryption is an interesting thing. The first time I saw encryption in action was on a friend’s Gentoo Linux laptop that could only boot if the USB key with the boot partition and decryption key was inserted. Cool stuff, from a geek point-of-view.

    Fast forward, and revelations from Edward Snowden and ongoing concerns about government snooping are slowly bringing encryption and privacy tools into the mainstream. Even if you’re not worried about a Big Brother or some shady spy-versus-spy scenario, encryption can still protect your identity and privacy if your laptop is stolen. Think of all the things we keep on laptops: contact information, financial information, and client and company information. All of that data is worthy of protection. Luckily, Linux users have access to several tools for the affordable price of free.

    There are three main methods for protecting the data on your laptop, each with its own strengths and weaknesses.

  • The Network Standard Used in Cars Is Wide Open to Attack

    The networked electronics found under the hood of modern automobiles enable a great many useful and cool things, such as fuel-saving engine optimizations, parking assist mechanisms, collision avoidance systems, and myriad further applications most often involving sensing and the passing of data among vehicular systems and human drivers. As is pretty much always the case when electronics become networked, this connectivity also offers hackers new potential exploits.

    According to research presented last month at the ACM Conference on Computer and Communications Security in Vienna, courtesy of computer scientists at the University of Michigan (and Adrian Colyer's excellent The Morning Paper), the controller area network (CAN) protocol implemented by in-vehicle networks has a new and potentially quite dangerous vulnerability. The attack, known as a bus-off attack, exploits the CAN's built-in error handling facilities to potentially nuke both contemporary insecure CANs and future secured versions.

  • Top 5 Rootkit Threats and How to Root Them out

    Rootkits are much in the news lately. They were recently sighted in the Street Fighter V video game, critical infrastructure controls and even Yahoo email servers.

    In the case of Yahoo, the spying tool that the U.S. government ordered the company to install on its servers was a "buggy" rootkit that concealed itself on Yahoo's systems and provided the government with a backdoor into Yahoo emails, according to an article in Motherboard.

Security Leftovers

Filed under
  • Google Pixel Phone Hacked in 60 Seconds at PwnFest 2016

    The brand new Android smartphone launched by Google just a few months back has been hacked by Chinese hackers just in less than a minute.

    Yes, the Google's latest Pixel smartphone has been hacked by a team white-hat hackers from Qihoo 360, besides at the 2016 PwnFest hacking competition in Seoul.

  • Too Big to Fail Open-Source Software Needs Hacker Help

    The internet runs on free and open-source code. LAMP is shorthand for the basic stack of applications that makes the internet work. It stands for: Linux, Apache, MySQL and PHP. Together, those four pieces of software provide the foundation that lets us share both important data and elaborately filtered selfies all over the world. They are also all free and open-source projects, maintained by core teams of developers. These workers are the saints of the information age.

    Open-source has a tendency to be more stable than proprietary code, thanks in no small part to what’s called Linus’s Law: “given enough eyeballs, all bugs are shallow.” Because open-source projects invite anyone to contribute, the idea is that lots of developers and testers will find and fix all the problems. It’s worked well so far, but it’s a theory that gets a bit creakier with age, as we’ve begun to see.

  • Heimdall Open-Source PHP Ransomware Targets Web Servers
  • Infect to Protect

    I’m not one to jump on each and every bandwagon I see. Sometimes that’s a good decision, sometimes it’s better to just wait and see where they go before taking any action.

    Containers are one of those ideas that, while promising and intriguing, were quite clumsy in the beginning, so I ignored them for a good while. It’s sufficiently mature now; so much so that’s quite difficult to ignore them. Time to investigate them again.


    While the prototype I built isn’t practical and is of very limited use, I find the idea of sandboxed programs without the need for specialized runtimes very enticing.

    Programs can be still packaged the way they have been packaged in the past decades, without throwing away some of the sandboxing benefits that containers provide, all the while not introducing new concepts for users.

    Of course, something like this – even if properly implemented – won’t be a replacement for containers. Specially if one considers their role as packets ready for deployment, which have a lot of value for devops personnel.

    The code, as usual, is open source, and available from this Git repository.

Security Leftovers

Filed under

Canonical Patches Multiple Kernel Vulnerabilities in All Supported Ubuntu OSes

Filed under

Today, November 11, 2016, Canonical published several security advisories to inform users of the Ubuntu Linux operating system about new kernel updates that patch multiple vulnerabilities discovered lately.

Read more

The Future of IoT: Containers Aim to Solve Security Crisis

Filed under

Despite growing security threats, the Internet of Things hype shows no sign of abating. Feeling the FoMo, companies are busily rearranging their roadmaps for IoT. The transition to IoT runs even deeper and broader than the mobile revolution. Everything gets swallowed in the IoT maw, including smartphones, which are often our windows on the IoT world, and sometimes our hubs or sensor endpoints.

New IoT focused processors and embedded boards continue to reshape the tech landscape. Since our Linux and Open Source Hardware for IoT story in September, we’ve seen Intel Atom E3900 “Apollo Lake” SoCs aimed at IoT gateways, as well as new Samsung Artik modules, including a Linux-driven, 64-bit Artik7 COM for gateways and an RTOS-ready, Cortex-M4 Artik0. ARM announced Cortex-M23 and Cortex-M33 cores for IoT endpoints featuring ARMv8-M and TrustZone security.

Read more

Security Leftovers

Filed under
Syndicate content

More in Tux Machines

Development News

  • KDevelop 5.0.3 Open-Source IDE Improves GitHub Handling Authentication, More
    The development behind the open-source and cross-platform KDevelop IDE (Integrated Development Environment) was proud to announce on the first day of December the availability of the third point release for KDevelop 5.0 stable series. KDevelop 5.0.3 arrives one and a half months after the second maintenance update, but it's a small bugfix release that attempts to patch a total of nine issues reported by users since then. However, it's a recommended update for all users. "We are happy to announce the release of KDevelop 5.0.3, the third bugfix and stabilization release for KDevelop 5.0. An upgrade to 5.0.3 is strongly recommended to all users of 5.0.0, 5.0.1 or 5.0.2," reads the release announcement.
  • PHP 7.1.0
    The PHP development team announces the immediate availability of PHP 7.1.0.
  • PHP 7.1 Makes Its Debut
    This first major update to last year's huge PHP 7.0 release builds several new features on top. Introduced by PHP 7.1 is nullable types, a void return type, a iterable pseudo-type, class constant visibility modifiers, support for catching multiple exception types, and many other language enhancements plus more performance optimizations and other work.

Games for GNU/Linux

OSS Leftovers

SUSE Leftovers

  • openSUSE Tumbleweed – Review of the Week 2016/48
    After releasing daily snapshots without interruption for 17 days, Tumbleweed did slow down a bit during the last week. As already mentioned in my last review, 1124 had been canceled due to an issue with sddm installing strange branding configurations. And later on, we ‘broke’ our own staging setup and needed to bootstrap a few of them, making the throughput much lower than you were used to. So, we ended up with 3 snapshots since my last review: 1125, 1128 and 1129.
  • Highlights of YaST development sprint 28
    November is over, Santa Claus elves start to stress and the YaST team brings you one of the last reports of 2016. Let’s see what’s new in YaSTland.