Language Selection

English French German Italian Portuguese Spanish

Security

Tails 1.8.2 is out

Filed under
GNU
Linux
Security
Debian

This release fixes numerous security issues. All users must upgrade as soon as possible.

Read more

Also: Debian LTS Work December 2015

Security Leftovers

Filed under
Security
  • Friday's security updates
  • Hackers caused a major blackout for the first time

    Hackers were behind a cyber attack on Ukraine in December that had real offline consequences: A blackout that killed electricity to roughly 700,000 homes.

    On December 23, around half the homes in Ukraine's Ivano-Frankivsk region lost power for at least a few hours. Initially reported in Ukrainian media as being caused by hackers, cybersecurity experts have now confirmed that was the case, saying the power company was infected with malicious software.

  • Finland extradites Russian hacking suspect to US

    US authorities are to escort Maxim Senakh out of Finland within a month. They suspect him of stealing millions of dollars from infected computer servers in the US, Finland and elsewhere.

  • Linux Ransomware creators third time unlucky as researchers crack encryption again

    Researchers find Linux.Encoder 3 version still uses buggy encryption and allows file recovery

    Much to the delight of security researchers, a group of malware creators are currently having difficulty getting cryptographic implementations right in their ransomware. This has not happened once but thrice.

Security Leftovers

Filed under
Security
  • Security updates for Thursday
  • SHA-1 Deprecation: Pro, Con, or Extend?

    I read Ryan's article about why SHA-1 should be deprecated faster and why we should veto the proposed extensions. It is an excellent explanation of what's going on. I highly recommend it (and look forward to the complete series when he publishes it):

  • Legacy Verified: Legacy Solutions

    While the previous post explored the historical context in which the SHA-1 deprecation fits, and in the many failures to respond adequately to known risks, it didn’t really address the actual Legacy Verified proposal made by CloudFlare and Facebook, and subsequently endorsed by Twitter, nor how it attempts to mitigate the concerns with continuing SHA-1 allocation.

  • Let’s Encrypt Now Being Abused By Malvertisers

    Encrypting all HTTP traffic has long been considered a key security goal, but there have been two key obstacles to this. First, certificates are not free and many owners are unwilling to pay; secondly the certificates themselves are not always something that could be set up by a site owner.

  • Security Guide: How to Protect Your Infrastructure Against the Basic Attacker
  • Linux.Encoder Authors Couldn’t Correctly Disguise Encryption Key

    Renowned Security Software Company in Russia named Doctor Web happened to be first to detect as well as report one wholly working ransomware Trojan created to infect Linux computers. A sample named Linux.Encoder.1 recently showed quite resembling activity with the notorious CryptoWall ransomware. Fifty percent of the widely used AV engines of VirusTotal could not recognize the sample which broke new ground during the Linux domain. The malware chiefly concentrated on hijacking computers using Web servers as also encrypted critical folders utilized during Web-hosting as well as within Web-development ambience.

Security Leftovers

Filed under
Security
  • Twitter Community Helps Create Improved Linux Encoder Ransomware

    November 2015 saw the emergence of Linux.Encoder.1, the first piece of ransomware to target vulnerable Linux web servers. A programming flaw allowed Bitdefender researchers to obtain the decryption key and provide victims with a free recovery utility.

  • Plain cruelty: Boffins flay Linux ransomware for the third time

    Probably the world's most tragically determined blackhat developers have had their revitalised Linux.Encoder ransomware pwned again by meddling BitDefender whitehats.

    The third iteration of the Linux.Encoder ransomware was unleashed on the world, infecting a paltry 600 servers before a crack team of security analysts returned to rip it apart.

  • Windows and Linux Malware Linked to Chinese DDoS Tool

    Similar-looking malware targeting both Linux and Windows computers has been linked to a DDoSing toolkit sold by Chinese hackers via the ddos[.]tf service, Malware Must Die! reports.

    The malware, codenamed Linux/DDOSTF (or Linux/MrBlack) targets mainly Linux machines running Elasticsearch servers, but it also attacks and infects Windows systems, particularly older Windows XP and Windows 2003 Server instances.

  • Exploiting Silent Circle's Secure Blackphone

    The highly secure device could have been exploited, were it not for the responsible disclosure by a security researcher.

    Any modern device is made up of multiple hardware and software components, any one of which could represent a potential risk. That's a reality that secure mobile phone vendor Silent Circle has learned with its Blackphone, thanks to the responsible security disclosure from Tim Strazzere, director of mobile research at SentinelOne.

  • Severe Silent Circle Blackphone vulnerability lets hackers take over

    Researchers have revealed a severe vulnerability in Silent Circle's Blackphone which could allow attackers to take control of the device's functions.

    Silent Circle's Blackphone, born after former US National Security Agency (NSA) contractor Edward Snowden exposed the intelligence agency's spying practices on the global stage, is a phone peddled to the privacy-conscious. The Blackphone grants users complete control of app permissions and includes encrypted services such as Silent Phone and Silent Text, designed to prevent surveillance and eavesdropping.

    The device runs on PrivatOS, a custom Android build with a set of security-focused tools.

  • Security Notification and Linode Manager Password Reset

    The entire Linode team has been working around the clock to address both this issue and the ongoing DDoS attacks. We've retained a well-known third-party security firm to aid in our investigation. Multiple Federal law enforcement authorities are also investigating and have cases open for both issues. When the thorough investigation is complete, we will share an update on the findings.

  • How Hackers Invaded 30 Million Web Servers On The Internet With A Poem

    From an IP address associated with 32nd Chaos Communication Congress (32c3) taking place in Germany, some unknown hackers sent a poetic message to all the IPv4 addresses on the Internet who left with their web servers port open. Later, the hackers said that they didn’t mean to harm anybody and wished to remind the people the importance of keeping the Internet open and decentralised.

WordPress 4.4.1 Updates for XSS (and 52 other issues)

Filed under
OSS
Security
Web

The first WordPress update of 2016 is out and like many other incremental updates, it is being triggered by a security vulnerability. The single security issue being patched in WordPress 4.4.1 is a cross site scripting vulnerability that could have potentially enabled a site compromised.wordpress

From a general usability and bug perspective there are 52 bugs that WordPress developers are addressing in the 4.4.1 update that spans multiple area of the popular open-source content management system including.

Read more

Security Leftovers

Filed under
Security
  • Security updates for Wednesday
  • Third try is no charm for failed Linux ransomware creators

    Getting cryptographic implementations right is difficult. A group of malware creators is currently experiencing that hard truth, to the amusement of security researchers.

    For the past several months, a group of cybercriminals have been infecting Linux systems -- primarily Web servers -- with a file-encrypting ransomware program that the security industry has dubbed Linux.Encoder.

  • Indian Hackers Attack Pakistani Websites In Response To Pathankot Terror Attack

    An Indian hacking collective named Indian Black Hats has defaced multiple Pakistani websites. This Kerala-based group has dedicated the attack to the little daughter of a Pathankot terror attack martyr. The group told fossBytes, “Harming is not our aim..but if anyone pick their eyes on our mother India..we stand for it”.

OpenSSL’s teachable moment: Secure Shell key management in light of open source vulnerabilities

Filed under
OSS
Security

Imagine an Internet without encryption. Credit card numbers would flow in the clear from point to point. Social Security numbers and other personally identifiable information would be sitting ducks for any cyber criminal to make off with. And government secrets wouldn’t stay secret for long.

Read more

Canonical Patches New Vulnerability for Ubuntu 15.10's Desktop and Raspberry Pi 2 Kernels

Filed under
Security
Ubuntu

Just a few minutes ago, January 5, 2016, Canonical published several Ubuntu Security Notices to inform Ubuntu users about the availability of new Linux kernel versions for their operating systems.

Read more

Also: Xenial Xerus Alpha 1 released!

Security Leftovers

Filed under
Security
Syndicate content

More in Tux Machines

Leftovers: Software

  • A Quick Hands-On With Chatty, A Desktop Twitch Chat Client
    Chatty is a desktop Twitch Chat client for Windows, macOS and Linux written in Ja
  • HP Linux Imaging and Printing 3.16.8 Adds Support for Linux Mint 18, Fedora 24
    The open-source HP Linux Imaging and Printing (HPLIP) project has been updated on August 29, 2016, to version 3.16.8, a maintenance update that adds support for new printers and GNU/Linux operating systems. According to the release notes, HP Linux Imaging and Printing 3.16.8 adds support for new all-in-one HP printers, including HP OfficeJet Pro 6970, HP OfficeJet Pro 6960, HP OfficeJet 250 Mobile, HP DeskJet 3700, as well as HP DeskJet Ink Advantage 3700. Also new in the HPLIP 3.16.8 update is support for the recently released Linux Mint 18 "Sarah" Cinnamon, MATE, Xfce, and the upcoming KDE editions, the Fedora 24 Linux operating system, as well as the Debian GNU/Linux 8.5 "Jessie" distribution. So if you're using any of these OSes, you can now update to the latest HPLIP release.
  • MPlayer-Based MPV 0.20.0 Video Player Released with New Options and Commands
    The popular, open-source, and cross-platform MPV video player software received a new update, version 0.20.0, which comes only two weeks after the previous 0.19.0 maintenance release. MPV 0.20.0 is not a major update, and, according to the release notes, it only implements a couple of new options and commands, such as "--video-unscaled=downscale-big" for changing the aspect ratio. Additionally, the MPlayer-based video playback application also gets the "--image-display-duration" option for controlling the duration of image display, and a new "dcomposition" flag for controlling DirectComposition.
  • FFmpeg 3.1.3 "Laplace" Open-Source Multimedia Framework Now Available for Linux
    The major FFmpeg 3.1 "Laplace" open-source and cross-platform multimedia framework has received recently its third maintenance update, version 3.1.3, which brings updated components. FFmpeg 3.1 was announced two months ago, at the end of June, and it introduced a multitude of new features to make the popular multimedia backend even more reliable and handy to game and application developers. Dubbed Laplace, FFmpeg 3.1 is currently the most advanced FFmpeg release, cut from Git master on June 26, 2016.
  • GNU Scientific Library 2.2 released
    Version 2.2 of the GNU Scientific Library (GSL) is now available. GSL provides a large collection of routines for numerical computing in C. This release contains new linear algebra routines (Pivoted and Modified Cholesky, Complete Orthogonal Decomposition, matrix condition number estimation) as well as a completely rewritten nonlinear least squares module, including support for Levenberg-Marquardt, dogleg, double-dogleg, and Steihaug-Toint methods. The full NEWS file entry is appended below.

today's howtos

Leftovers: OSS

  • Report: If DOD Doesn't Embrace Open Source, It'll 'Be Left Behind'
    Unless the Defense Department and its military components levy increased importance on software development, they risk losing military technical superiority, according to a new report from the Center for a New American Security. In the report, the Washington, D.C.-based bipartisan think tank argues the Pentagon, which for years has relied heavily on proprietary software systems, “must actively embrace open source software” and buck the status quo. Currently, DOD uses open source software “infrequently and on an ad hoc basis,” unlike tech companies like Google, Amazon and Facebook that wouldn’t exist without open source software.
  • The Honey Trap of Copy/Pasting Open Source Code
    I couldn’t agree more with Bill Sourour’s article ‘Copy.Paste.Code?’ which says that copying and pasting code snippets from sources like Google and StackOverflow is fine as long as you understand how they work. However, the same logic can’t be applied to open source code. When I started open source coding at the tender age of fourteen, I was none the wiser to the pitfalls of copy/pasting open source code. I took it for granted that if a particular snippet performed my desired function, I could just insert it into my code, revelling in the fact that I'd just gotten one step closer to getting my software up and running. Yet, since then, through much trial and error, I’ve learned a thing or two about how to use open source code effectively.
  • Affordable, Open Source, 3D Printable CNC Machine is Now on Kickstarter
    The appeals of Kickstarter campaigns are many. There are the rewards for backers, frequently taking the form of either deep discounts on the final product or unusual items that can’t be found anywhere else. Pledging to support any crowdfunding campaign is a gamble, but it’s an exciting gamble; just browsing Kickstarter is pretty exciting, in fact, especially in the technological categories. Inventive individuals and startups offer new twists on machines like 3D printers and CNC machines – often for much less cost than others on the market.
  • Open Standards and Open Source
    Much has changed in the telecommunications industry in the years since Standards Development Organization (SDOs) such as 3GPP, ITU and OMA were formed. In the early days of telecom and the Internet, as fundamental technology was being invented, it was imperative for the growth of the new markets that standards were established prior to large-scale deployment of technology and related services. The process for development of these standards followed a traditional "waterfall" approach, which helped to harmonize (sometimes competing) pre-standard technical solutions to market needs.

Leftovers: BSD

  • The Voicemail Scammers Never Got Past Our OpenBSD Greylisting
    We usually don't see much of the scammy spam and malware. But that one time we went looking for them, we found a campaign where our OpenBSD greylisting setup was 100% effective in stopping the miscreants' messages. During August 23rd to August 24th 2016, a spam campaign was executed with what appears to have been a ransomware payload. I had not noticed anything particularly unusual about the bsdly.net and friends setup that morning, but then Xavier Mertens' post at isc.sans.edu Voice Message Notifications Deliver Ransomware caught my attention in the tweetstream, and I decided to have a look.
  • Why FreeBSD Doesn't Aim For OpenMP Support Out-Of-The-Box