Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security
  • Security updates for Monday
  • DHS CIO walks back staff comments on open source

    Some IT professionals at the Department of Homeland Security raised eyebrows over recent comments on GitHub that suggested a proposed federal open-source policy could result in the "mafia having a copy of all FBI system code" or could give terrorists "access to air traffic control software." The comments were attributed to the CIO's office.

    However, DHS CIO Luke McCormack has since filed his own official comments, noting that "prior comments do not represent DHS policy or views."

  • Microsoft PowerShell — Hackers’ New Favorite Tool For Coding Malware

    You might not know but PowerShell, the ubiquitous force running behind the Windows environment, is slowly becoming a secure way for the attackers to hide their malicious activities. Unfortunately, at the moment, there’s no technical method of distinguishing between malicious and good PowerShell source code.

  • MIT reveals AI platform which detects 85 percent of cyberattacks

    Today's cybersecurity professionals face daunting tasks: protecting enterprise networks from threats as best they can, damage limitation when data breaches occur, cyberforensics and documenting the evolution and spread of digital attacks and malware across the world.

Kali Linux Rolling Release — Best Features That Make It The Best OS For Ethical Hackers

Filed under
GNU
Linux
Security

Kali Linux, a hacker’s favorite operating system, is now available with first Rolling release. This release ensures that you are always using the latest and best tools for pen-testing purposes. The first Kali Linux Rolling release also brings a Kali Linux Package Tracker tool and changes the way VMware guest tools are installed. You can read more about the features below and use the links for downloading Kali Linux Rolling 2016.1 ISO files and torrents.

Read more

Security Leftovers

Filed under
Security
  • Flaw-finding Ruby on Rails bot steams past humans
  • Future of secure systems in the US

    Security and privacy are important to many people. Given the personal and financial importance of data stored in computers (traditional or mobile), users don’t want criminals to get a hold of it. Companies know this, which is why both Apple IOS and Google Android both encrypt their local file systems by default now. If a bill anything like what’s been proposed becomes law, users that care about security are going to go elsewhere. That may end up being non-US companies’ products or US companies may shift operations to localities more friendly to secure design. Either way, the US tech sector loses. A more accurate title would have been Technology Jobs Off-Shoring Act of 2016.

  • Software end of life matters!

    Anytime you work on a software project, the big events are always new releases. We love to get our update and see what sort of new and exciting things have been added. New versions are exciting, they're the result of months or years of hard work. Who doesn't love to talk about the new cool things going on?

  • JBOSS Backdoor opens 3 million servers at risk of attacks

Security Leftovers

Filed under
Security
  • Backdoor in JBoss Java Platform Puts 3.2 Million Servers at Risk
  • Let's Encrypt: threat or opportunity to other certificate authorities?

    Let's Encrypt is a certificate authority (CA) that just left beta stage, that provides domain name-validated (DV) X.509 certificates for free and in an automated way: users just have to run a piece of software on their server to get and install a certificate, resulting in a valid TLS setup.

  • Making it easier to deploy TPMTOTP on non-EFI systems

    On EFI systems you can handle this by sticking the secret in an EFI variable (there's some special-casing in the code to deal with the additional metadata on the front of things you read out of efivarfs). But that's not terribly useful if you're not on an EFI system. Thankfully, there's a way around this. TPMs have a small quantity of nvram built into them, so we can stick the secret there. If you pass the -n argument to sealdata, that'll happen. The unseal apps will attempt to pull the secret out of nvram before falling back to looking for a file, so things should just magically work.

  • Badlock Vulnerability Falls Flat Against Its Hype

    Weeks of anxiety and concern over the Badlock vulnerability ended today with an anticlimactic thud.

  • Samba 4.4.2, 4.3.8 and 4.2.11 Security Releases Available for Download
  • The Internet of bricks

    One of the promises of the "Internet of things" is that it gives us greater control over our homes, gadgets, and more. Free software also offers that sort of promise, along with the idea that, if necessary, we can support our own gadgetry when the manufacturer moves on to some new shiny object. The currently unfolding story of the Revolv hub shows that, in many cases, these promises are empty. The devices we depend on and think we own can, in fact, be turned into useless bricks at the manufacturer's whim.

    The Revolv "M1" home-automation hub was one of many products designed to bring home control to the Internet. It is able to control lights, heating, and more, all driven by smartphone-based applications. The product was sufficiently successful to catch the eye of the business-development folks at Nest, who acquired the company; Nest was acquired in turn by Google, and is now a separate company under the "Alphabet" umbrella.

  • Underwriters Labs refuses to share new IoT cybersecurity standard

    UL, the 122-year-old safety standards organisation whose various marks (UL, ENEC, etc.) certify minimum safety standards in fields as diverse as electrical wiring, cleaning products, and even dietary supplements, is now tackling the cybersecurity of Internet of Things (IoT) devices with its new UL 2900 certification. But there's a problem: UL's refusal to freely share the text of the new standard with security researchers leaves some experts wondering if UL knows what they're doing.

    When Ars requested a copy of the UL 2900 docs to take a closer look at the standard, UL (formerly known as Underwriters Laboratories) declined, indicating that if we wished to purchase a copy—retail price, around £600/$800 for the full set—we were welcome to do so. Independent security researchers are also, we must assume, welcome to become UL retail customers.

  • Combined malware threat is robbing banks of millions every day

    THE SECURITY attack dogs at IBM have uncovered two normally solo malware threats working together to rob banks in the US and Canada.

    IBM's X-Force division has dubbed the combined malware Stealma and Louise GozNym by merging the names of the individual, but now friendly, Gozi ISFB and Nymaim.

    "It appears that the operators of Nymaim have recompiled its source code with part of the Gozi ISFB source code, creating a combination that is being actively used in attacks against more than 24 US and Canadian banks, stealing millions of dollars so far," said IBM in a blog post.

Security Leftovers

Filed under
Security
  • Security updates for Thursday
  • Badlock: Samba Vulns & Patching your machines

    Unless you are living in a black hole aka SCIF, or otherwise totally disconnected from various news outlets, you have likely heard about the numerous vulns that dropped as a series of CVEs better known as ‘badlock’ Tuesday. Well, there is good news for those on Redhat based distros! Patches are already in the default repos for Fedora / RHEL / CentOS.

  • Gone In Six Characters: Short URLs Considered Harmful for Cloud Services

    TL;DR: short URLs produced by bit.ly, goo.gl, and similar services are so short that they can be scanned by brute force. Our scan discovered a large number of Microsoft OneDrive accounts with private documents. Many of these accounts are unlocked and allow anyone to inject malware that will be automatically downloaded to users’ devices. We also discovered many driving directions that reveal sensitive information for identifiable individuals, including their visits to specialized medical facilities, prisons, and adult establishments.

IPFire 2.19 - Core Update 100 released

Filed under
GNU
Linux
Security

It is a great moment to us and we are very proud to release the 100th Core Update today.

This update will bring you IPFire 2.19 which we release for 64 bit on Intel (x86_64) for the first time. This release was delayed by the various security vulnerabilities in openssl and glibc, but is packed with many improvements under the hood and various bug fixes.

Read more

Security Leftovers

Filed under
Security
  • Apple Bug Exposed Chat History With a Single Click

    IN THE MIDDLE of intense public debate over whether Apple should be forced to help the government decrypt iPhones for criminal investigations, the company quietly closed a six-month-old security vulnerability in its Messages app. Newly published details reveal just how severe that vulnerability was, allowing the exfiltration of chat history, including photos and videos, if the user could be tricked into clicking a single malicious link.

    The bug, which affected Apple’s laptop and desktop computers from September through March, highlights just how hard it is for companies like Apple to effectively secure sensitive data — even before those companies begin fielding requests from the government for special access. Tech companies like Apple are nearly unanimous in their agreement that creating “backdoors” through which the government may access protected data undermines even the most basic security measures, including those designed to protect against vulnerabilities like the Messages bug.

  • New Threat Can Auto-Brick Apple Devices

    If you use an Apple iPhone, iPad or other iDevice, now would be an excellent time to ensure that the machine is running the latest version of Apple’s mobile operating system — version 9.3.1. Failing to do so could expose your devices to automated threats capable of rendering them unresponsive and perhaps forever useless.

  • Execs: We’re not responsible for cybersecurity

    More than 90 percent of corporate executives said they cannot read a cybersecurity report and are not prepared to handle a major attack, according to a new survey.

    More distressing is that 40 percent of executives said they don't feel responsible for the repercussions of hackings, said Dave Damato, chief security officer at Tanium, which commissioned the survey with the Nasdaq.

    "I think the most shocking statistic was really the fact that the individuals at the top of an organization — executives like CEOs and CIOs, and even board members — didn't feel personally responsible for cybersecurity or protecting the customer data," Damato told CNBC's "Squawk Box" on Friday.

  • Brits suffer more than 2,000 ransomware attacks each day

    The security firm said that the enemy is now more organised than ever before, and that most groups have the same kind of resources, skills and support as nation-state hacker groups.

    "Advanced criminal attack groups now echo the skills of nation-state attackers. They have extensive resources and a highly skilled technical staff that operate with such efficiency that they maintain normal business hours and even take the weekends and holidays off," said Kevin Haley, director of Symantec Security Response.

    "We are even seeing low-level criminal attackers create call centre operations to increase the impact of their scams."

    These sophisticated hackers are often the first to embrace zero-day vulnerabilities, which increased by 125 percent in 2015 to 54.

Security Leftovers

Filed under
Security
  • Security advisories for Wednesday
  • Let's Encrypt free security certificate program leaves beta

    Let's Encrypt has announced that the free secure certificate program is leaving beta in its push to encrypt 100 percent of the web.

  • What happened with Badlock?

    Here's the thing though. It wasn't nearly as good as the hype claimed. It probably couldn't ever be as good as the hype claimed. This is like waiting for a new Star Wars movie. You have memories from being a child and watching the first few. They were like magic back then. Nothing that ever comes out again will be as good. Your brain has created ideas and memories that are too amazing to even describe. Nothing can ever beat the reality you built in your mind.

  • Microsoft rated 6 of 13 security updates as critical, Badlock bug fix rated important

    For April 2016 Patch Tuesday, Microsoft released 13 security bulletins, with six being rated as critical for remote code execution flaws and the patch for Badlock being among those rated only as important.

  • Open source runs the world and needs better security, claims Linux Foundation CTO

    Security is the biggest plague of open source software, and more people are needed to work together squashing bugs and plugging holes in the code on which much of the internet relies.

    That’s according to Nicko van Someren, chief technology officer at the Linux Foundation, who explained that huge swathes of the internet and companies with online business models rely on open source code, software and infrastructure.

Security Leftovers

Filed under
Linux
Security
  • Linux Foundation: The internet is crumbling

    The open source infrastructure of the internet is crumbling because of poor maintenance, the Linux Foundation warned today.

    Likening open source to the “roads and bridges of the internet”, Linux Foundation CTO Nicko van Someren said that underpaid developers are struggling to patch dangerous bugs and keep the open aspects of the web up to date.

  • Security is the biggest bug of open source, says Linux Foundation CTO

    CYBER SECURITY is the plague of open source software, and more people are needed to work together squashing bugs and plugging holes in the code on which much of the internet relies.

    That’s according to Nicko van Someren, chief technology officer at the Linux Foundation, who explained that huge swathes of the internet and companies with online business models rely on open source code, software and infrastructure.

    "Open source projects are the roads and bridges of the internet. Pretty much everything we do on the internet relies on open source," he said in a keynote speech at Cloud Expo in London.

  • Linux Computers Targeted by New Backdoor and DDoS Trojan

    After being bombarded with new malware towards the end of last year, the Linux ecosystem is rocked again by the discovery of a new trojan family, identified by security researchers as Linux.BackDoor.Xudp.

    The only detail that matters is that this new threat does not leverage automated scripts, vulnerabilities, or brute-force attacks to infect users and still relies on good ol' user stupidity in order to survive.

Syndicate content

More in Tux Machines

Android vs iPhone: 15 Reasons Android is Better

We’ll explain 15 reasons why Android is better than the iPhone with a new for 2016 Android vs iPhone comparison. Google is kicking up the competition with Android Marshmallow that is thankfully rolling out to more devices and showing off Android N and a handful of interesting apps that will come later this year. Apple continues to work on iOS 9 updates and is close to showing off iOS 10 this summer, which we hope will fix a number of issues and bring the iPhone on par with Android in key areas. The iPhone 6s and iPhone 6s Plus along with iOS 9 helped Apple users catch up in a number of ways, but there are still a lot of areas where Android is hands down better than the iPhone. Read more

3 open source alternatives to AutoCAD

The trick for deciding whether a replacement piece of software, whether open or closed, is a good choice for you is to tease out exactly what your needs are. The situation is no different than discovering that the person who insists that they "need" Photoshop is just using it to draw a few geometric shapes and remove red eye from photos; what they really need is a graphics editing tool that can replace those specific functions. Whether it has all of the bells and whistles of the original is irrelevant if those features sit paid for but unused. My personal journey through open source CAD programs was no different. I had worked with AutoCAD briefly in grad school, and so when I wanted to play with drawing three-dimensional plans for something, it was pretty much all I knew. But that alone didn't make AutoCAD the best choice. Read more

Manjaro Linux Budgie 16.06 Edition Promises a Clean Budgie Desktop Experience

As part of the upcoming Manjaro Linux 16.06 "Daniella" release, many of the community editions get Release Candidate (RC) builds to showcase what's coming later this year. Read more

DisplayLink USB 3.0 Driver Now Available for Ubuntu 16.04 LTS, Fedora Linux

DisplayLink has recently updated their DisplayLink USB 3.0 driver for the latest Ubuntu Linux operating system launched by Canonical in the last week of April 2016, Ubuntu 16.04 LTS. Read more