Language Selection

English French German Italian Portuguese Spanish

Security

Ubuntu, Debian, Fedora and elementary OS All Patched Against WPA2 KRACK Bug

Filed under
Security

As you are aware, there's a major WPA2 (Wi-Fi Protected Access II) security vulnerability in the wild, affecting virtually any device or operating system that uses the security protocol, including all GNU/Linux distributions.

Read more

Security Leftovers

Filed under
Security
  • Google and IBM launch open-source security tool for containers

    Google and IBM, together with a few other partners, released an open-source project that gathers metadata that developers can use to secure their software.

    According to an IBM blog post, the goal of the project is to help developers keep security standards, while microservices and containers cut the software supply chain.

  • Top 10 Hacking Techniques Used By Hackers

    We live in a world where cyber security has become more important than physical security, thousands of websites and emails are hacked daily. Hence, It is important to know the Top hacking techniques used by hackers worldwide to exploit vulnerable targets all over the internet.

  • Protect your wifi on Fedora against KRACK

    You may have heard about KRACK (for “Key Reinstallation Attack”), a vulnerability in WPA2-protected Wi-Fi. This attack could let attackers decrypt, forge, or steal data, despite WPA2’s improved encryption capabilities. Fear not — fixes for Fedora packages are on their way to stable.

  • Federal watchdog tells Equifax—no $7.25 million IRS contract for you

    The Government Accountability Office (GAO) on Monday rejected Equifax's bid to retain its $7.25 million "taxpayer identity" contract—the one awarded days after Equifax announced it had exposed the Social Security numbers and other personal data of some 145 million people.

  • Adobe Flash vulnerability exploited by BlackOasis hacking group to plant FinSpy spyware

    Security researchers have discovered a new Adobe Flash vulnerability that has already been exploited by hackers to deploy the latest version of FinSpy malware on targets. Kaspersky Lab researchers said a hacker group called BlackOasis has already taken advantage of the zero-day exploit – CVE-2017-11292 – to deliver its malicious payload via a Microsoft Word document.

  • Companies turn a blind eye to open source risk [Ed: No, Equifax got b0rked due to bad practices, negligence, incompetence, not FOSS]

    For instance, criminals who potentially gained access to the personal data of the Equifax customers exploited an Apache Struts CVE-2017-5638 vulnerability.

  • Checking Your Passwords Against the Have I Been Pwned List

    Two months ago, Troy Hunt, the security professional behind Have I been pwned?, released an incredibly comprehensive password list in the hope that it would allow web developers to steer their users away from passwords that have been compromised in past breaches.

Security: Equifax, Grafeas, Updates and Open Source Security Podcast

Filed under
Security

Security Leftovers

Filed under
Security
  • Outlook, Office 2007 slowly taken behind the shed, shots heard

    A decade after their release, Microsoft Office 2007 and Outlook 2007 today fell out of extended support. Gaze teary-eyed at your installation discs. The software has entered the Long Dark Tea-Time of the Soul.

    The cutoff has been coming for some time, of course, but if you're of a nostalgic bent, the Outlook 2007 epitaph is here, and the somewhat longer (with more dates to absorb) Office 2007 farewell is here.

    With extended support ending for both 2007-era families, no new features, bug fixes, security patches, nor support, will be available in future for the programs.

  • Researchers Reveal Critical KRACK Flaws in WPA WiFi Security

    The WPA2 protocol which is widely used to secure WiFi traffic is at risk from multiple vulnerabilities, collectively referred to as "KRACK Attacks" that were publicly disclosed on Oct. 16

    "Attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted," the vulnerability disclosure warns."The attack works against all modern protected Wi-Fi networks."

    KRACK is an acronym for Key Reinstallation Attacks, which were discovered by security research Mathy Vanhoef and Frank Piessens working at Belgian University KU Leuven. The researchers have disclosed the details of the KRACK attack in a research paper and plan on discussing it further in talks at the Computer and Communications Security (CCS) and Black Hat Europe conferences later this year.

  • The World Once Laughed at North Korean Cyberpower. No More.

Wi-Fi WPA2 Encryption Problem (and Hype About That)

Filed under
Security
  • Severe flaw in WPA2 protocol leaves Wi-Fi traffic open to eavesdropping

    An air of unease set into the security circles on Sunday as they prepared for the disclosure of high-severity vulnerabilities in the Wi-Fi Protected Access II protocol that make it possible for attackers to eavesdrop Wi-Fi traffic passing between computers and access points.

  • WiFi Security Is Borked - We're All Screwed... Maybe

    KRACK - or the Key Reinstallation AttaCK - looks like the new infosec word we all need to know. According to the authors of a paper that will be presented at conference in a couple of weeks, Mathy Vanhoef of KU Leuven and Frank Piessens say they have found a way to circumvent WPA2 security - one of the key tools used for protecting wireless networks. If KRACk proves to be true, all bets are off when it comes to stopping eavesdroppers from listening in to your wireless network.

  • Your Wifi router could be hiding a scary vulnerability

    Anybody that has a WiFi router might want to be sure to have their login details close at hand throughout the course of today.

    That’s because later today security researcher Mathy Vanhoef will reveal a potentially disastrous vulnerability in the WPA2 protocol.

    The Wifi Protected Access protocol appears to have been cracked by Vanhoef according to Gizmodo which took a look at the source code of the researcher’s website Krack Attacks and found this throw forward.

  • Wi-Fi WPA2 encryption possibly cracked

    Just to add on to your Monday morning blues, WPA2 (Wi-Fi Protected Access Version 2) which is the de-facto encryption method used by the majority of Wi-Fi routers is rumored to have been cracked.

Linus Torvalds lauds fuzzing for improving Linux security

Filed under
Linux
Security

Linus Torvalds release notification for Linux 4.14's fifth release candidate contains an interesting aside: the Linux Lord says fuzzing is making a big difference to the open source operating system.

Torvalds' announcement says Linux kernel 4.14 is coming along nicely, with this week's release candidate pleasingly small and “fairly normal in a release that has up until now felt a bit messier than it perhaps should have been.”

This week's most prominent changes concern “... more fixes for the whole new x86 TLB [translation lookaside buffer – Ed] handling due to the ASID [address space ID - Ed] changes that came in this release.”

Read more

Security: MalwareTech, JavaScript, Vista 10, TPM2, Intel Back Door, Linux Bug, Pizza Hut Breach, Telcos Spying

Filed under
Security
  • Let MalwareTech Surf! Status Report
  • 500 million PCs are being used for stealth cryptocurrency mining online

    A month or so ago, torrent search website The Pirate Bay raised concern among the community as visitors noticed their CPU usage surged whenever a page was opened.

  • Dutch slam Windows 10 for breaking privacy laws

    Dutch authorities claim Microsoft’s Windows 10 operating system is violating data protection and privacy laws, and warned they may impose fines on the US technology giant.

    “Microsoft breaches the Dutch data protection law by processing personal data of people that use the Windows 10 operating system on their computers,” the Dutch Data Protection Authority (DPA) said in a statement late Friday.

    The company fails to “clearly inform” users of Windows 10 that it “continuously collects personal data about the usage of apps and web surfing behavior through its web browser Edge, when the default settings are used,” the DPA said.

  • Using Elliptic Curve Cryptography with TPM2

    One of the most significant advances going from TPM1.2 to TPM2 was the addition of algorithm agility: The ability of TPM2 to work with arbitrary symmetric and asymmetric encryption schemes. In practice, in spite of this much vaunted agile encryption capability, most actual TPM2 chips I’ve seen only support a small number of asymmetric encryption schemes, usually RSA2048 and a couple of Elliptic Curves. However, the ability to support any Elliptic Curve at all is a step up from TPM1.2. This blog post will detail how elliptic curve schemes can be integrated into existing cryptographic systems using TPM2. However, before we start on the practice, we need at least a tiny swing through the theory of Elliptic Curves.

  • Sakaki's EFI Install Guide/Disabling the Intel Management Engine

    The Intel Management Engine ('IME' or 'ME') is an out-of-band co-processor integrated in all post-2006 Intel-CPU-based PCs. It has full network and memory access and runs proprietary, signed, closed-source software at ring -3,[1][2][3][4] independently of the BIOS, main CPU and platform operating system[5][6] — a fact which many regard as an unacceptable security risk (particularly given that at least one remotely exploitable security hole has already been reported[7][8]).

  • Linux vulnerable to privilege escalation

    An advisory from Cisco issued last Friday, October 13th, gave us the heads-up on a local privilege escalation vulnerability in the Advanced Linux Sound Architecture (ALSA).

    The bug is designated CVE-2017-15265, but its Mitre entry was still marked “reserved” at the time of writing. Cisco, however, had this to say about it before release:

  • Pizza Hut was hacked, company says

    According to a customer notice emailed from the pizza chain, those who placed an order on its website or mobile app between the morning of Oct. 1 and midday Oct. 2 might have had their information exposed.

    The “temporary security intrusion” lasted for about 28 hours, the notice said, and it’s believed that names, billing ZIP codes, delivery addresses, email addresses and payment card information — meaning account number, expiration date and CVV number — were compromised.

  • Want to see something crazy? Open this link on your phone with WiFi turned off

    These services are using your mobile phone’s IP address to look up your phone number, your billing information and possibly your phone’s current location as provided by cell phone towers (no GPS or phone location services required). These services are doing this with the assistance of the telco providers.

  • Telcos "selling realtime ability to associate web browsing with name & address"

Security: Kaspersky, Grafeas, Schneier Book

Filed under
Security

Microsoft Breaking the Law and Computer Security Woes

Filed under
Microsoft
Security

How do you dump the firmware from a "secure" voting machine? With a $15 open source hardware board

Filed under
Hardware
Security

One of the highlights of this year's Defcon conference in Vegas was the Voting Machine Hacking Village, where security researchers tore apart the "secure" voting machines America trusts its democracy to.

The Voting Machine Hacking Village just released its master report on the vulnerabilities they found, and the participants are talking about it on Twitter, including Joe Fitz's note that he dumped the firmware off a Accuvote TSX with one of Adafruit's $15 open source hardware FT232h breakout boards.

Read more

Syndicate content

More in Tux Machines

Ubuntu, Debian, Fedora and elementary OS All Patched Against WPA2 KRACK Bug

As you are aware, there's a major WPA2 (Wi-Fi Protected Access II) security vulnerability in the wild, affecting virtually any device or operating system that uses the security protocol, including all GNU/Linux distributions. Read more

Pixel 2 and 2 XL review—The best Android phone you can buy

Welcome to year two of Google Hardware. In 2016, Google jumped into the Android hardware space with its first self-branded device, the Google Pixel. Google's software prowess shined on the Pixel 1, offering up exclusive features like the Google Assistant, the best Android camera thanks to advanced software processing, fast day-one OS updates and betas, and the smoothest, best-performing overall build of Android. The killer software package made it the best Android phone of the previous generation. The Pixel still represented Google's first foray into smartphone hardware, though, and it didn't offer anything special in the hardware department. It was a bland-looking iPhone clone. It had the same specs and basic design as everything else. The Pixel even skipped water resistance, which had become an expected feature at that price point. Google said it wanted to make its own hardware, but it didn't actually build special hardware. Read more

6 Best Open Source Alternatives to Microsoft Office for Linux

Looking for Microsoft Office in Linux? Here are the best free and open source alternatives to Microsoft Office for Linux. Read more

Today in Techrights