Language Selection

English French German Italian Portuguese Spanish

Security

Drupal Hardens Its Security in Response to Criticism

Filed under
OSS
Drupal
Security

The open-source Drupal content-management system (CMS) is talking steps to help protect against multiple potential risks that have been publicly revealed. On Jan. 6, security research vendor IOactive first disclosed the issues, which are focused on the Drupal update process. The Drupal project's security team is aware of the concerns and is fixing all the issues, though it is also downplaying the overall risk.

Read more

Security Leftovers

Filed under
Security
  • Security updates for Monday
  • Gmail and a Can of Spam

    I am still trying to figure out the events that led to this intrusion. I’ve read almost everything there is to read on Google’s Gmail pages, without finding much. Google seems adamant about not giving-out one-on-one help, but maybe I just didn’t look long enough. On my own, I’ve evoked two step verification on my main email addresses, so that’s settled. But still…I’d like to figure out when and how this breach took place. What magic sequence of events happened to allow this?

    Did I mention I’m a security idiot? Yeah…I thought I did.

    It feels strange to again delve into antivirus and malware protection. I’ve been a smug, self-assured dummy when it comes to online threats and Linux in general. And while what happened can’t really be blamed on Linux per se, it happened in a Linux neighborhood, so I am going to arm myself against any and all malware comers

    Although I’m not above paying for good software, trying to discern what software is good and which is shiny junk can be a daunting challenge, especially in the Linuxsphere. In the tests I’ve studied over the past four days, ClamAV seems to be an online favorite, but they lack the one thing I am going to need on our Reglue kid’s computers: a friendly, useful graphical interface. I’m not going to tell an 11-year-old to drop to the command line to do anything, even if they do need to learn that the blinking prompt can make magic things happen. In time, I will teach them, but for now…. ClamAV failed the initial tests.

  • 602 Gbps! This May Have Been the Largest DDoS Attack in History

    Cyber attacks are getting evil and worst nightmare for companies day-by-day, and the Distributed Denial of Service (DDoS) attack is one of the favorite weapon for hackers to temporarily suspend services of a host connected to the Internet.

    Until now, nearly every big website had been a victim of this attack, and the most recent one was conducted against the BBC's websites and Republican presidential candidate Donald Trump's main campaign website over this past holiday weekend.

  • How to Set up a Successful Bug Bounty Program [VIDEO]

    A bug bounty program is among the most impactful additions to a software security process. With a bug bounty program, security researchers submit reports on potential vulnerabilities, typically with the promise of a reward or "bounty" for their efforts.

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security
  • 602 Gbps DDoS Attack On BBC Proves That 2016 Isn’t Going To Be Any Different

    On New Year’s eve, the BBC website and iPlayer service went down due to a massive Distributed Denial of Service (DDoS) attack. The attack peaked up to 602 Gbps, according to the claims made by the New World Hacking group, who took the responsibility of the attack. In another recent attack, the Republican presidential candidate Donald Trump’s main campaign website was also targeted by the same group.

  • Fatally weak MD5 function torpedoes crypto protections in HTTPS and IPSEC

    If you thought MD5 was banished from HTTPS encryption, you'd be wrong. It turns out the fatally weak cryptographic hash function, along with its only slightly stronger SHA1 cousin, are still widely used in the transport layer security protocol that underpins HTTPS. Now, researchers have devised a series of attacks that exploit the weaknesses to break or degrade key protections provided not only by HTTPS but also other encryption protocols, including Internet Protocol Security and secure shell.

Ubuntu Touch to Support Encryption of User Data

Filed under
Security
Ubuntu

The Ubuntu Touch operating system is also going to provide support for encryption of user data; developers have revealed.

It wasn’t a secret that Ubuntu Touch will get encryption, but it’s also not listed as an upcoming feature. It’s buried in a wiki entry with plans for Ubuntu Touch, but it’s nice to see that it’s still being considered, even if it’s not going to arrive anytime soon.

Read more

Also: Ubuntu ‘Spyware’ Will Be Disabled In Ubuntu 16.04 LTS

Tails 1.8.2 is out

Filed under
GNU
Linux
Security
Debian

This release fixes numerous security issues. All users must upgrade as soon as possible.

Read more

Also: Debian LTS Work December 2015

Security Leftovers

Filed under
Security
  • Friday's security updates
  • Hackers caused a major blackout for the first time

    Hackers were behind a cyber attack on Ukraine in December that had real offline consequences: A blackout that killed electricity to roughly 700,000 homes.

    On December 23, around half the homes in Ukraine's Ivano-Frankivsk region lost power for at least a few hours. Initially reported in Ukrainian media as being caused by hackers, cybersecurity experts have now confirmed that was the case, saying the power company was infected with malicious software.

  • Finland extradites Russian hacking suspect to US

    US authorities are to escort Maxim Senakh out of Finland within a month. They suspect him of stealing millions of dollars from infected computer servers in the US, Finland and elsewhere.

  • Linux Ransomware creators third time unlucky as researchers crack encryption again

    Researchers find Linux.Encoder 3 version still uses buggy encryption and allows file recovery

    Much to the delight of security researchers, a group of malware creators are currently having difficulty getting cryptographic implementations right in their ransomware. This has not happened once but thrice.

Security Leftovers

Filed under
Security
  • Security updates for Thursday
  • SHA-1 Deprecation: Pro, Con, or Extend?

    I read Ryan's article about why SHA-1 should be deprecated faster and why we should veto the proposed extensions. It is an excellent explanation of what's going on. I highly recommend it (and look forward to the complete series when he publishes it):

  • Legacy Verified: Legacy Solutions

    While the previous post explored the historical context in which the SHA-1 deprecation fits, and in the many failures to respond adequately to known risks, it didn’t really address the actual Legacy Verified proposal made by CloudFlare and Facebook, and subsequently endorsed by Twitter, nor how it attempts to mitigate the concerns with continuing SHA-1 allocation.

  • Let’s Encrypt Now Being Abused By Malvertisers

    Encrypting all HTTP traffic has long been considered a key security goal, but there have been two key obstacles to this. First, certificates are not free and many owners are unwilling to pay; secondly the certificates themselves are not always something that could be set up by a site owner.

  • Security Guide: How to Protect Your Infrastructure Against the Basic Attacker
  • Linux.Encoder Authors Couldn’t Correctly Disguise Encryption Key

    Renowned Security Software Company in Russia named Doctor Web happened to be first to detect as well as report one wholly working ransomware Trojan created to infect Linux computers. A sample named Linux.Encoder.1 recently showed quite resembling activity with the notorious CryptoWall ransomware. Fifty percent of the widely used AV engines of VirusTotal could not recognize the sample which broke new ground during the Linux domain. The malware chiefly concentrated on hijacking computers using Web servers as also encrypted critical folders utilized during Web-hosting as well as within Web-development ambience.

Security Leftovers

Filed under
Security
  • Twitter Community Helps Create Improved Linux Encoder Ransomware

    November 2015 saw the emergence of Linux.Encoder.1, the first piece of ransomware to target vulnerable Linux web servers. A programming flaw allowed Bitdefender researchers to obtain the decryption key and provide victims with a free recovery utility.

  • Plain cruelty: Boffins flay Linux ransomware for the third time

    Probably the world's most tragically determined blackhat developers have had their revitalised Linux.Encoder ransomware pwned again by meddling BitDefender whitehats.

    The third iteration of the Linux.Encoder ransomware was unleashed on the world, infecting a paltry 600 servers before a crack team of security analysts returned to rip it apart.

  • Windows and Linux Malware Linked to Chinese DDoS Tool

    Similar-looking malware targeting both Linux and Windows computers has been linked to a DDoSing toolkit sold by Chinese hackers via the ddos[.]tf service, Malware Must Die! reports.

    The malware, codenamed Linux/DDOSTF (or Linux/MrBlack) targets mainly Linux machines running Elasticsearch servers, but it also attacks and infects Windows systems, particularly older Windows XP and Windows 2003 Server instances.

  • Exploiting Silent Circle's Secure Blackphone

    The highly secure device could have been exploited, were it not for the responsible disclosure by a security researcher.

    Any modern device is made up of multiple hardware and software components, any one of which could represent a potential risk. That's a reality that secure mobile phone vendor Silent Circle has learned with its Blackphone, thanks to the responsible security disclosure from Tim Strazzere, director of mobile research at SentinelOne.

  • Severe Silent Circle Blackphone vulnerability lets hackers take over

    Researchers have revealed a severe vulnerability in Silent Circle's Blackphone which could allow attackers to take control of the device's functions.

    Silent Circle's Blackphone, born after former US National Security Agency (NSA) contractor Edward Snowden exposed the intelligence agency's spying practices on the global stage, is a phone peddled to the privacy-conscious. The Blackphone grants users complete control of app permissions and includes encrypted services such as Silent Phone and Silent Text, designed to prevent surveillance and eavesdropping.

    The device runs on PrivatOS, a custom Android build with a set of security-focused tools.

  • Security Notification and Linode Manager Password Reset

    The entire Linode team has been working around the clock to address both this issue and the ongoing DDoS attacks. We've retained a well-known third-party security firm to aid in our investigation. Multiple Federal law enforcement authorities are also investigating and have cases open for both issues. When the thorough investigation is complete, we will share an update on the findings.

  • How Hackers Invaded 30 Million Web Servers On The Internet With A Poem

    From an IP address associated with 32nd Chaos Communication Congress (32c3) taking place in Germany, some unknown hackers sent a poetic message to all the IPv4 addresses on the Internet who left with their web servers port open. Later, the hackers said that they didn’t mean to harm anybody and wished to remind the people the importance of keeping the Internet open and decentralised.

Syndicate content

More in Tux Machines

Ubuntu Convergence

  • The Race to Convergence: Or is it a Marathon?
    This article, although it was smart to feature Ubuntu as a forerunner, it foolishly tried to give credit to Microsoft for ‘truly being the first’ to do convergence. First, did they? I had no idea. Nor do I care. Nor does anyone else I roll with. If the name has ‘Microsoft’ in it, we flee for the hills. Why? Because it’s compromised out of the box. It is dangerous.
  • Have We Converged Yet?
    Convergence is not about a unified computing experience across all your devices. Although that's an important goal, convergence is more about that point in time where your philosophy that technology should respect people converges with that of a group or company that believes the same.
  • Ubuntu.com Gets a New Look for the Tablet Section, Rest of Website to Follow
    With the new Ubuntu tablet out the door, Canonical also had to upgrade the website to reflect the changes accordingly, so now ubuntu.com has a really nice section dedicated to the BQ Aquaris M10. If we don't take Android into account, we can't really say that there are successful Linux-based tablet out there. It's not clear why that came to pass, but until this Ubuntu-powered tablet landed, there wasn't much competition. To be fair, there is not much competition right now, since Apple and Google pretty much dominate the market, but BQ Aquaris M10 is the only one that can double down as a regular PC.
  • BQ Ubuntu Tablet Has 64-bit CPU and Will Be Able to Run 32-bit ARM Apps
    The BQ Aquaris M10 Ubuntu tablet is powered by a 64-bit ARM processor, so the users have already started to ask around if they will be able to run the 32-bit apps from the phone on the tablet. The short answer is yes. The long answer is that it will take a little bit of work.
  • What the Ubuntu Convergence Means for Businesses, Consumers, OEMs, and Devs
    As you may well be aware, Canonical and BQ unveiled the world's first Ubuntu Tablet, the BQ Aquaris M10 Ubuntu Edition, which also happens to be the first Ubuntu converged device, which users can transform into a full-fledged PC.

CoreOS' Docker alternative reaches 1.0

Docker Images Are Moving From Ubuntu To Alpine Linux

Docker is reportedly going to be migrating all of their official images from an Ubuntu base to now using Alpine Linux. Alpine Linux is the lightweight distribution built atop musl libc and BusyBox while using a GrSecurity-enhanced Linux kernel. Alpine Linux uses OpenRC as its init system. If you are unfamiliar with this "Small. Simple. Secure." distribution, you can learn more via AlpineLinux.org. The image for Alpine is a mere 5MB. Read more Also: Docker Founders Hire Alpine Linux Developer to Move the Official Images to Ubuntu

Meaning of Convergence, Exploit Excludes Linux

The big news yesterday and even into today was the new Ubuntu tablet, which everyone including Canonical touted as "convergence delivered." Well, today Randall Ross scolds news sites for missing the "timely idea" that is convergence. In other news, security researchers have identified a new exploit that specifically avoids Linux. FOSS Force found that Linux users have no interest in anti-virus software and Phoronix reports on Ubuntu performance over the years. Read more