Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security

Security Updates and Intel's Latest Excuses

Filed under
Security
  • Security updates for Thursday
  • Misunderstood Intel Documentation Leads to Multivendor Vulnerability

    Major operating system vendors including Microsoft, Apple and Linux distributions somehow misinterpreted Intel documentation about a hardware debugging feature and ended up exposing users to potential risk. 

    The flaw, which has been identified as CVE-2018-8897, was publicly reported on May 8, though impacted vendors were notified on April 30 and have already released patches. The flaw could have enabled an unauthenticated user to read sensitive data in memory or control low-level operating system functions.

    "In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception," CERT warned in its advisory on the issue. "The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV to SS and POP to SS."

Accidental Back Doors and Intentional (Microsoft) Back Doors

Filed under
Security
  • Are you using Python module ‘SSH Decorator’? Newer versions include a backdoor

     

    Early this week, a developer noticed that multiple backdoored versions of the SSH Decorate module, the malicious code included in the library allowed to collect users’ SSH credentials and sent the data to a remote server controlled by the attackers.

  • Crypto backdoors are in the news again, and as bad for privacy as ever

     

    What is troubling, though, is that Ozzie’s reputation as one of the foremost engineers of recent years will allow some to claim that the backdoor puzzle has now been “solved” – because Ray Ozzie says it has. That’s definitely not the case, as the two critiques mentioned above, and others elsewhere, make plain. But politicians won’t worry about such technical niceties when it comes to calling for laws that mandate these “safe” backdoors in devices. That’s why it’s important that everyone who cares about their privacy and security should be ready to push back against attempts to turn a flawed idea into a flawed reality.

  • Ray Ozzie's Encryption Backdoor

     

    I have no idea why anyone is talking as if this were anything new. Several cryptographers have already explained explained why this key escrow scheme is no better than any other key escrow scheme. The short answer is (1) we won't be able to secure that database of backdoor keys, (2) we don't know how to build the secure coprocessor the scheme requires, and (3) it solves none of the policy problems around the whole system. This is the typical mistake non-cryptographers make when they approach this problem: they think that the hard part is the cryptography to create the backdoor. That's actually the easy part. The hard part is ensuring that it's only used by the good guys, and there's nothing in Ozzie's proposal that addresses any of that.

Security: Updates, "Hide n Seek" and World of Warcraft

Filed under
Security

Canonical Outs Kernel Security Update for Ubuntu 17.10, 16.04 LTS, and 14.04 LTS

Filed under
Security
Ubuntu

Following in the footsteps of the Debian Project, which recently released a similar kernel security patch for Debian GNU/Linux 9 "Stretch" and Debian GNU/Linux 8 "Jessie" operating system series to address two security vulnerabilities, Canonical also released kernel updates to patch these two flaws and another vulnerability in Ubuntu 17.10, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS.

One of these security vulnerabilities was caused by the way Linux kernel handled debug exceptions delivered via Mov SS or Pop SS instructions, which could allow a local attacker to crash the system by causing a denial of service. The issue (CVE-2018-8897) was discovered by Nick Peterson and affects only the amd64 architecture.

Read more

Security: CPUs, Xen, and Drupal

Filed under
Security

Security Leftovers

Filed under
Security
  • Save Joern — Open Source at ShiftLeft

    We want the technology developed at ShiftLeft to benefit open security projects and the security research community as much as possible.

  • Critical Windows bug fixed today is actively being exploited to hack users

    The first vulnerability resides in the VBScript Engine included in all currently supported versions of Windows. A so-called use-after-free flaw involving the way the engine handles computer memory allows attackers to execute code of their choice that runs with the same system privileges chosen by the logged-in user. When targeted users are logged in with administrative rights, attackers who exploit the bug can take complete control of the system. In the event users are logged in with more limited rights, attackers may still be able to escalate privileges by exploiting a separate vulnerability.

  • CVE-2018-10115 Affects All 7-Zip Versions Prior to 18.05

    7-Zip is a free open-source archiver with a high compression ratio. The program is under the License of GNU LGPL & BSD 3-clause and can be used both by home and enterprise users. “You can use 7-Zip on any computer, including a computer in a commercial organization. You don’t need to register or pay for 7-Zip,” its website says.

  • CVE-2018-8897 Opens Xen PV Systems Up To Exploit

    Besides kernels being addressed for the newly-disclosed CVE-2018-8897 vulnerability, users of Xen para-virtualization should also run a patched Xen system right away.

Security Leftovers

Filed under
Security
  • Security updates for Tuesday
  • Google Fixes Pixel XL Charging Bug, 56 Bugs with May 2018 Android Security Patch
  • Death by PowerPoint

    Some pretty wild stuff to send a message directly to Trump, and it seems to have worked (at least until actually informed people got involved.) The influence op was delivered over a channel likely to reach the target audience, using a format designed to appeal to their information consumption, and included a call to action. All necessary criteria for a successful PSYOPS operation. Basically, using TV to deliver a PowerPoint using lots of pictures, small words, and references to the Ego in Chief was textbook propaganda methodology — hats off to Netanyahu on that one. Of course, there is nothing new in the information here, it was just an influence op using misinformation to present factual evidence in the worst possible light. More on that in this thread: [...]

  • New SynAck ransomware uses Process Doppelgänging technique

    A new variant of the SynAck ransomware that infects Windows systems has been spotted by researchers from Russian security firm Kaspersky Lab who say it appears to be targeted malware as attacks have only been observed in the US, Kuwait, Germany and Iran.

    SynAck has been around since September 2017 but the new variant has some added functions which make it able to operate below the radar.

    It uses the Process Doppelgänging technique, basically a way in which malicious code is disguised as a legitimate Windows process. The technique was demonstrated at the Black Hat Europe security conference in December 2017 by the firm enSilo.

Download Kali Linux 2018.2 with new security features

Filed under
GNU
Linux
Security

On April 30th, 2018, Offensive Security announced releasing the new version of Kali Linux which in fact is the first ever version that includes Linux 4.15 kernel. It also includes x64 and x86 patches for the much-hyped Spectre and Meltdown security vulnerabilities.

Kali Linux is a popular Debian-derived Linux distribution developed for penetration testing and digital forensics. The platform is home to hundreds of penetration testing tools making it one of the best and advanced penetration testing distribution ever.

Read more

Security Leftovers

Filed under
Security
  • Report: China's Intelligence Apparatus Linked to Previously Unconnected Threat Groups

    Multiple groups operating under the China state-sponsored Winnti umbrella have been targeting organizations in the US, Japan, and elsewhere, says ProtectWise.

    Multiple previously unconnected Chinese threat actors behind numerous cyber campaigns aimed at organizations in the United States, Japan, and other countries over the past several years are actually operating under the control of the country's state intelligence apparatus.

    An investigation by security vendor ProtectWise has shown that the groups operating under the so-called Winnti umbrella since at least 2009 share a common goal, common infrastructure, and often the same tactics, techniques, and procedures.

  • Episode 95 - Twitter passwords and npm backdoors

    Josh and Kurt talk about Twitter doing the right thing when they logged a lot of passwords, the npm malicious getcookies package, and how backdoors work in code.

  • Security updates for Monday
Syndicate content

More in Tux Machines

Graphics: Wayland, RadeonSI, NVIDIA and More

  • Session suspension and restoration protocol
  • A Session Suspension & Restoration Protocol Proposed For Wayland
    KDE Wayland developer Roman Gilg who started contributing to Wayland via last year's Google Summer of Code is proposing a new Wayland protocol for dealing with desktop session suspension and restoration. This protocol extension would allow for more efficient support for client session suspension and restoration such as when you are logging out of your desktop session and want the windows restored at next log-in or if you are suspending your system. While Roman Gilg is working on this protocol with his KDE hat on, he has been talking with Sway and GNOME developers too for ensuring this protocol could work out for their needs.
  • RadeonSI Lands OpenGL 3.3 Compatibility Profile Support
    Thanks to work done over the past few months by AMD's Marek Olšák on improving Mesa's OpenGL compatibility profile support and then today carried over the final mile by Valve's Timothy Arceri, Mesa 18.2 now exposes OpenGL 3.3 under the compatibility context. Hitting Git tonight is the enabling of the OpenGL 3.3 compatibility profile for RadeonSI.
  • NVIDIA Releases DALI Library & nvJPEG GPU-Accelerated Library For JPEG Decode
    For coinciding with the start of the Computer Vision and Patern Recognition conference starting this week in Utah, NVIDIA has a slew of new software announcements. First up NVIDIA has announced the open-source DALI library for GPU-accelerated data augmentation and image loading that is optimized for data pipelines of deep learning frameworks like ResNET-50, TensorFlow, and PyTorch.
  • NVIDIA & Valve Line Up Among The Sponsors For X.Org's XDC 2018
    - The initial list of sponsors have been announced for the annual X.Org Developers' Conference (XDC2018) where Wayland, Mesa, and the X.Org Server tend to dominate the discussions for improving the open-source/Linux desktop. This year's XDC conference is being hosted in A Coruña, Spain and taking place in September. The call for presentations is currently open for X.Org/mesa developers wishing to participate.
  • Intel Broxton To Support GVT-g With Linux 4.19
    Intel developers working on the GVT-g graphics virtualization technology have published their latest batch of Linux kernel driver changes.

Fedora and Red Hat: Fedora Atomic, Fedora 29, *GPL and Openwashing ('Open Organization')

  • Fedora Atomic Workstation To Be Renamed Fedora Silverblue
    - Back in early May was the announcement of the Silverblue project as an evolution of Fedora Atomic Workstation and trying to get this atomic OS into shape by Fedora 30. Beginning with Fedora 29, the plan is to officially rename Fedora Atomic Workstation to Fedora Silverblue. Silverblue isn't just a placeholder name, but they are moving ahead with the re-branding initiative around it. The latest Fedora 29 change proposal is to officially change the name of "Fedora Atomic Workstation" to "Fedora Silverblue".
  • Fedora 29 Will Cater i686 Package Builds For x86_64, Hide GRUB On Boot
    The Fedora Engineering and Steering Committee (FESCo) approved on Friday more of the proposed features for this fall's release of Fedora 29, including two of the more controversial proposals.
  • Total War: WARHAMMER II Coming to Linux, Red Hat Announces GPL Cooperation Commitment, Linspire 8.0 Alpha 1 Released and More
    Starting today, Red Hat announced that "all new Red Hat-initiated open source projects that opt to use GPLv2 or LGPLv2.1 will be expected to supplement the license with the cure commitment language of GPLv3". The announcement notes that this development is the latest in "an ongoing initiative within the open source community to promote predictability and stability in enforcement of GPL-family licenses".
  • Red Hat Launches Process Automation Manager 7, Brackets Editor Releases Version 1.13, Qt Announces New Patch Release and More
    Red Hat today launched Red Hat Process Automation Manager 7, which is "a comprehensive, cloud-native platform for developing business automation services and process-centric applications across hybrid cloud environments". This new release expands some key capabilities including cloud native application development, dynamic case management and low-code user experience. You can learn more and get started here.
  • A summer reading list for open organization enthusiasts
    The books on this year's open organization reading list crystallize so much of what makes "open" work: Honesty, authenticity, trust, and the courage to question those status quo arrangements that prevent us from achieving our potential by working powerfully together.

Server Domination by GNU/Linux

  • Security and Performance Help Mainframes Stand the Test of Time
    As of last year, the Linux operating system was running 90 percent of public cloud workloads; has 62 percent of the embedded market share and runs all of the supercomputers in the TOP500 list, according to The Linux Foundation Open Mainframe Project’s 2018 State of the Open Mainframe Survey report. Despite a perceived bias that mainframes are behemoths that are costly to run and unreliable, the findings also revealed that more than nine in 10 respondents have an overall positive attitude about mainframe computing. The project conducted the survey to better understand use of mainframes in general. “If you have this amazing technology, with literally the fastest commercial CPUs on the planet, what are some of the barriers?” said John Mertic, director of program management for the foundation and Open Mainframe Project. “The driver was, there wasn’t any hard data around trends on the mainframe.”
  • HPE announces world's largest ARM-based supercomputer
    The race to exascale speed is getting a little more interesting with the introduction of HPE's Astra -- what will be the world's largest ARM-based supercomputer. HPE is building Astra for Sandia National Laboratories and the US Department of Energy's National Nuclear Security Administration (NNSA). The NNSA will use the supercomputer to run advanced modeling and simulation workloads for things like national security, energy, science and health care.

HHVM 3.27 Released