Language Selection

English French German Italian Portuguese Spanish

Security

Red Hat: Common Criteria Certification and Thunderbolt

Filed under
Red Hat
Security

Security: Bolt, Updates, NIST, Starbucks

Filed under
Security

Introducing bolt: Thunderbolt 3 security levels for GNU/Linux

Filed under
GNU
Linux
Security

Today I released the first version 0.1 (aka "Accidentally Working") of bolt, a system daemon that manages Thunderbolt 3 devices. It provides a D-Bus API to list devices, enroll them (authorize and store them in the local database) and forget them again (remove previously enrolled devices). It also emits signals if new devices are connected (or removed). During enrollment devices can be set to be automatically authorized as soon as they are connected. A command line tool, called boltctl, can be used to control the daemon and perform all the above mentioned tasks (see the man page of boltctl(1) for details).

Read more

Security: VLC Bug Bounty, Avast Tools, Intel ME

Filed under
Security
  • European Commission Kicks Off Open-Source Bug Bounty

    The European Commission has announced its first-ever bug bounty program, and is calling on hackers to find vulnerabilities in VLC, a popular open-source multimedia player loaded on every workstation at the Commission.

    The program has kicked off with a three-week, invitation-only session, after which it will be open to the public. Rewards include a minimum of $2,000 for critical severity bugs, especially remote code execution.

    High severity bugs such as code execution without user intervention, will start at $750. Medium severity bugs will start at a minimum of $300; these include code execution with user intervention, high-impact crashes and infinite loops. Low-severity bugs, like information leaks, crashes and the like, will pay out starting at $100.

  • Avast launches open-source decompiler for machine code

    Keeping up with the latest malware and virus threats is a daunting task, even for industry professionals. Any device connected to the Internet is a target for being infected and abused. In order to stop attacks from happening, there needs to be an understanding of how they work so that a prevention method can be developed.

    To help with the reverse engineering of malware, Avast has released an open-source version of its machine-code decompiler, RetDec, that has been under development for over seven years. RetDec supports a variety of architectures aside from those used on traditional desktops including ARM, PIC32, PowerPC and MIPS.

  • Avast makes 'RetDec' machine-code decompiler open source on GitHub

    Today, popular anti-virus and security company, Avast, announces that it too is contributing to the open source community. You see, it is releasing the code for its machine-code decompiler on GitHub. Called "RetDec," the decompiler had been under development since 2011, originally by AVG -- a company Avast bought in 2016.

  • The Intel ME vulnerabilities are a big deal for some people, harmless for most

    (Note: all discussion here is based on publicly disclosed information, and I am not speaking on behalf of my employers)

    I wrote about the potential impact of the most recent Intel ME vulnerabilities a couple of weeks ago. The details of the vulnerability were released last week, and it's not absolutely the worst case scenario but it's still pretty bad. The short version is that one of the (signed) pieces of early bringup code for the ME reads an unsigned file from flash and parses it. Providing a malformed file could result in a buffer overflow, and a moderately complicated exploit chain could be built that allowed the ME's exploit mitigation features to be bypassed, resulting in arbitrary code execution on the ME.

    Getting this file into flash in the first place is the difficult bit. The ME region shouldn't be writable at OS runtime, so the most practical way for an attacker to achieve this is to physically disassemble the machine and directly reprogram it. The AMT management interface may provide a vector for a remote attacker to achieve this - for this to be possible, AMT must be enabled and provisioned and the attacker must have valid credentials[1]. Most systems don't have provisioned AMT, so most users don't have to worry about this.

Cryptography in Ubuntu 16.04 and GTK2 Demotion

Filed under
GNOME
Security
Ubuntu
  • Canonical Announces Certified FIPS 140-2 Cryptographic Packages for Ubuntu 16.04

    Canonical announced on Wednesday the availability of officially certified FIPS 140-2 cryptographic packages for the long-term supported Ubuntu 16.04 LTS (Xenial Xerus) operating system series through its Cryptographic Module Validation Program.

    Level 1 FIPS 140-2 cryptographic packages can now be purchased for your Ubuntu 16.04 LTS operating system through Canonical's Ubuntu Advantage service or as a separate, standalone product. Ubuntu Advantage subscribers can already find the FIPS-compliant modules in the Ubuntu Advantage private archive if they use Ubuntu 16.04 LTS (Xenial Xerus) on their PCs.

  • GTK2 demotion
  • Ubuntu Developers Working Towards The Eventual Demotion Of GTK2

    Not only are Ubuntu developers working towards demoting Python 2 on their Linux distribution but they are also working on being able to demote the GTK2 tool-kit from the main archive to universe followed by its eventual removal in the future.

    Matthias Klose is hoping to organize more work towards this slow demotion process of GTK2 and ideally to get some of the issues cleared up ahead of the Ubuntu 18.04 Long-Term Support release in April.

Security: Fuzzing, Windows, and ROBOT

Filed under
Security
  • Language bugs infest downstream software, fuzzer finds

    Developers working in secure development guidelines can still be bitten by upstream bugs in the languages they use.

    That's the conclusion of research presented last week at Black Hat Europe by IOActive's Fernando Arnaboldi.

    As Arnaboldi wrote in his Black Hat Europe paper [PDF]: “software developers may unknowingly include code in an application that can be used in a way that the designer did not foresee. Some of these behaviors pose a security risk to applications that were securely developed according to guidelines.”

  • Kaspersky Antivirus Engine Causing BSOD on Windows 10 Fall Creators Update

    Despite the criticism it received in the United States and in the United Kingdom, Kaspersky continues to be one of the leading security vendors for Windows users across the world, with its software protecting millions of systems powered by Microsoft’s OS.

    But it turns out that some of those whose computers were running the Windows 10 Fall Creators Update and Kaspersky Internet Security 2018 have been hit by a bug causing a Blue Screen of Death (BSOD) since earlier this month.

    BornCity reveals that the issue first appeared earlier this month when some users complained of a BSOD on Windows 10 build 16299.98, which indicates that these systems were running the latest version of the OS with cumulative update KB4051963.

  • ROBOT Attack

    ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server.

  • ROBOT Attack: 19-Year-Old Bug Returns With More Power To Target Facebook & Paypal

    The attack can compromise a website’s RSA encryption by decrypting the data using the private key of the TLS server. It was possible because of the vulnerability present in the RSA algorithm used in SSL protocol, exploited by Bleichenbacher.

Security: Patch Management, Windows Keyloggers, and Fingerprinting MySQL

Filed under
Security
  • Open Source Patch Management: Options for DIYers [Ed: "Linux comes with patch management," it says, which defeats much of the point of this article...]

    CVE-2017-5638 is the code vulnerability that will long live in the corporate memory of Equifax, the credit ratings agency. A simple patch management system might have kept that vulnerability from turning into one of the most high-profile data breaches in recent memory.

    CVE-2017-5638 is a remote code execution bug that affects the Jakarta Multipart parser in Apache Struts, an open source application framework for developing Java EE web applications. Remote code execution bugs are generally extremely serious, and for that reason, when the vulnerability was discovered, the Apache Foundation recommended that any developers or users of affected versions of Struts upgrade to later versions that had been patched to close the vulnerability.

  • HP laptops found to have hidden keylogger

    HP said more than 460 models of laptop were affected by the "potential [sic] security vulnerability".

    [...]

    In May, a similar keylogger was discovered in the audio drivers pre-installed on several HP laptop models.

  • Fingerprinting MySQL with scannerl

    The goal here is to identify the version of MySQL running on a remote host.

Security: NSA, Microsoft Debacles, and FOSS Updates

Filed under
Security
  • Script Recovers Event Logs Doctored by NSA Hacking Tool

    Security researchers have found a way to reverse the effects of an NSA hacking utility that deletes event logs from compromised machines.

    Last week, Fox-IT published a Python script that recovers event log entries deleted using the "eventlogedit" utility that's part of DanderSpritz, a supposed NSA cyber-weapon that was leaked online by a hacking group known as the Shadow Brokers.

    According to Fox-IT, they found a flaw in the DanderSpritz log cleaner when they realized the utility does not actually delete event log entries, but only unreferences them, merging entries together.

  • Pre-Installed Keylogger Discovered on Hundreds of HP Laptop Models

    A keylogger that can help record pretty much every keystroke on the computer has been discovered on HP’s devices, with a security researcher revealing that hundreds of laptop models come with this hidden software pre-installed.

    Michael Myng says in an analysis of the keylogger that the malicious code is hiding in the Synaptics Touchpad software and he actually discovered it when looking into ways to control the keyboard backlight on his laptop.

    According to his findings, the keylogger isn’t activated by default, but it can be turned on by any cybercriminals that get access to the system. The list of affected models includes hundreds of laptops like EliteBook, ProBook, Spectre, Zbook, Envy, and Pavilion.

  • Laptop touchpad driver included extra feature: a keylogger [Ed: This is the second time in recent times HP gets caught with keyloggers; This is no accident, it's intentional.]

    Flaws in software often offer a potential path for attackers to install malicious software, but you wouldn't necessarily expect a hardware vendor to include potentially malicious software built right into its device drivers. But that's exactly what a security researcher found while poking around the internals of a driver for a touchpad commonly used on HP notebook computers—a keystroke logger that could be turned on with a simple change to its configuration in the Windows registry.

  • Microsoft Needed 110 Days to Fix Critical Security Bug After First Ignoring It

    Microsoft needed more than 100 days to fix a critical credential leak in Dynamics 365 after the company originally ignored the bug report and only reacted after being warned that details could go public.

    Software engineer Matthias Gliwka explains in a long blog post that he discovered and reported a security flaw in Microsoft’s Customer Relationship Manager and Enterprise Resource Planning software in August, but the software giant refused to fix it on claims that administrator credentials would be required.

    Gliwka says he came across a wildcard transport layer security (TLS) certificate that also included the private key, which would in turn expose communications by anyone who could decrypt traffic. The developer says that extracting the certificate grants access to any sandbox environment, with absolutely no warning or message displayed to clients.

  • UK Spy Agency Finds Severe Flaw in Microsoft Antivirus in Kaspersky Bye-Bye Push
  • Security updates for Monday

Security: OpenSSL, Windows, Gun Safe and Debian

Filed under
Security

WordPress 4.9.1

Filed under
OSS
Security
Debian
  • WordPress hit with keylogger, 5,400 sites infected
  • WORDPRESS 4.9.1

    After a much longer than expected break due to moving and the resulting lack of Internet, plus WordPress releasing a package with a non-free file, the Debian package for WordPress 4.9.1 has been uploaded!

    WordPress 4.9 has a number of improvements, especially around the customiser components so that looked pretty slick. The editor for the customiser now has a series of linters what will warn if you write something bad, which is a very good thing! Unfortunately the Javascript linter is jshint which uses a non-free license which that team is attempting to fix.  I have also reported the problem to WordPress upstream to have a look at.

Syndicate content

More in Tux Machines

FreeNAS, World’s Most Popular Storage OS, Gets AMD Ryzen Support, Cloud Sync

Coming six months after the release of the FreeNAS 11 stable series, the FreeNAS 11.1 update is based on FreeBSD 11.1 and introduces cloud integration, support for AMD Ryzen and Intel Xeon Scalable family of processors, OpenZFS performance improvements, as well as preliminary support for Docker application container engine through a virtual machine built from RancherOS. "FreeNAS 11.1 adds a cloud sync (data import/export to the cloud) feature," reads the announcement. "This new feature lets you sync (similar to backup), move (erase from source), or copy (only changed data) data to and from public cloud providers that include Amazon S3 (Simple Storage Services), Backblaze B2 Cloud, Google Cloud, and Microsoft Azure." Read more

Amazon Linux 2 Benchmarks, 6-Way Linux OS EC2 Compute Cloud Comparison

With Amazon AWS this week having released Amazon Linux 2 LTS I was excited to put this updated cloud-focused operating system through some performance tests to see how it stacks up with the more well known Linux distributions. Read more

Open Source “PiTalk” Turns Your Raspberry Pi Minicomputer Into A Modular Smartphone

More than a year ago, I wrote about a Raspberry Pi-powered phone called PiPhone, and the readers loved it. Just recently, I came across another similar project on Kickstarter and decided to share it on Fossbytes. Named PiTalk, the project calls itself the “first ever DIY modular smartphone.” Powered by Python, PiTalk modular smartphone is compatible with Raspberry Pi Zero, Pi 2, and Pi 3. For voice and data communication, it has a 3G module. The basic features performed by PiTalk are: Read more

antiX MX-17 Linux OS Brings Latest Debian GNU/Linux 9.3 "Stretch" Updates

Powered by Linux kernel 4.13 and using Xfce 4.12.3 as default desktop environment, antiX MX-17 comes six months after the antiX MX-16 release and promises to bring all the latest security patches and software update from the software repositories of the recently released Debian GNU/Linux 9.3 "Stretch" operating system. The MX variant ships with all the antiX live features, including persistence up to 20GB, and automatic selection of appropriate drivers for most Broadcom wireless chipsets with minimal user intervention. Being targeted at low-end computers, antiX MX-17 offers a 32-bit PAE kernel for machines with less than 4GB RAM. Read more