Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • Wednesday's security advisories
  • Smartphones with fingerprint scanners under screen to hit market this year

    The majority of fingerprint scanners can be found either on the back of a smartphone or on the front, embedded in the home button. But it looks like that status quo is soon about to change. According to a report from The Investor, CrucialTec, a manufacturer of fingerprint modules based in South Korea, will launch its on-screen fingerprint scanning solution that allows you to unlock your device by placing a finger on the screen sometime this year.

    This means that we can expect to see the first smartphones featuring the new fingerprint technology hit the market in 2017. Unfortunately, CrucialTec did not reveal an exact time frame or the smartphone manufacturers it is currently working with.

  • Kaspersky launches 'secure operating system' -- with no trace of Linux in it [Ed: You must be pretty desperate for headlines and attention when your marketing pitch is, "we're not Linux!"]
  • Windows Botnet Spreading Mirai Variant

    A Chinese-speaking attacker is spreading a Mirai variant from a repurposed Windows-based botnet.

    Researchers at Kaspersky Lab published a report today, and said the code was written by an experienced developer who also built in the capability to spread the IoT malware to Linux machines under certain conditions.

  • Five New Linux Kernel Vulnerabilities Were Fixed in Ubuntu 16.10, 14.04 & 12.04

    We reported earlier that Canonical published multiple security advisories to inform Ubuntu users about the availability of new kernel updates that patch several flaws discovered recently by various developers.

    We've already told you about the issues that are affecting Ubuntu 16.04 LTS and Ubuntu 16.04.1 LTS (Xenial Xerus) users, so check that article to see how you can update your systems is you're still using the Linux 4.4 LTS kernel. But if you managed to upgrade to Ubuntu 16.04.2 LTS, which uses Ubuntu 16.10 (Yakkety Yak)'s Linux 4.8 kernel, then you need to read the following.

  • Another Linux Kernel Vulnerability Leading To Local Root From Unprivileged Processes

Canonical Releases New Kernel Update for Ubuntu 16.04 to Fix 7 Vulnerabilities

Filed under
Security
Ubuntu

Canonical published today, February 22, 2017, multiple security advisories to inform Ubuntu users about the availability of new kernel updates for their Linux-based operating systems.

Read more

Security Leftovers

Filed under
Security
  • Java and Python FTP attacks can punch holes through firewalls

    The Java and Python runtimes fail to properly validate FTP URLs, which can potentially allow attackers to punch holes through firewalls to access local networks.

    On Saturday, security researcher Alexander Klink disclosed an interesting attack where exploiting an XXE (XML External Entity) vulnerability in a Java application can be used to send emails.

  • Microsoft: no plans to patch known bugs before March [Ed: Microsoft is keeping open 'back doors' that are publicly known about, not just secret ones]

    Microsoft has no plans to issue updates for two vulnerabilities, one a zero-day and the other being one publicised by Google, before the scheduled date for its next round of updates rolls around in March.

    The company did not issue any updates in February, even though it had been scheduled to switch to a new system from this month onwards.

    It gave no reason for this, apart from saying: "This month, we discovered a last minute issue that could impact some customers and was not resolved in time for our planned updates today.

    "After considering all options, we made the decision to delay this month’s updates. We apologise for any inconvenience caused by this change to the existing plan."

    The Google-disclosed bug was made public last week, and is said to be a flaw in the Windows graphic device interface library that can be exploited both locally and remotely to read the contents of a user's memory.

  • Microsoft issues critical security patches, but leaves zero-day flaws at risk

    Microsoft has patched "critical" security vulnerabilities in its browsers, but has left at least two zero-day flaws with public exploit code.

    The software giant released numerous patches late on Tuesday to fix flaws in Adobe Flash for customers using Internet Explorer on Windows 8.1 and later, as well as Edge for Windows 10.

What’s the best Linux firewall distro of 2017?

Filed under
GNU
Linux
Security

You don’t have to manage a large corporate network to use a dedicated firewall. While your Linux distro will have an impressive firewall – and an equally impressive arsenal of tools to manage it – the advantages don’t extend to the other devices on your network. A typical network has more devices connected to the internet than the total number of computers and laptops in your SOHO. With the onslaught of IoT, it won’t be long before your router doles out IP addresses to your washing machine and microwave as well.

The one thing you wouldn’t want in this Jetsonian future is having to rely on your router’s limited firewall capabilities to shield your house – and everyone in it – from the malicious bits and bytes floating about on the internet.

A dedicated firewall stands between the internet and internal network, sanitising the traffic flowing into the latter. Setting one up is an involved process both in terms of assembling the hardware and configuring the software. However, there are quite a few distros that help you set up a dedicated firewall with ease, and we’re going to look at the ones that have the best protective open source software and roll them into a convenient and easy to use package.

Read more

More Security News

Filed under
Security

Security News

Filed under
Security
  • Security updates for Tuesday
  • Kaspersky: No whiff of Linux in our OS because we need new start to secure IoT [Ed: Kaspersky repeats the same anti-Linux rhetoric he used years ago to market itself, anti-Linux Liam Tung recycles]

    Eugene Kaspersky, CEO of Kaspersky Lab, says its new KasperskyOS for securing industrial IoT devices does not contain "even the slightest smell of Linux", differentiating it from many other IoT products that have the open-source OS at the core.

  • Reproducible Builds: week 95 in Stretch cycle
  • EU privacy watchdogs say Windows 10 settings still raise concerns

    European Union data protection watchdogs said on Monday they were still concerned about the privacy settings of Microsoft's Windows 10 operating system despite the U.S. company announcing changes to the installation process.

    The watchdogs, a group made up of the EU's 28 authorities responsible for enforcing data protection law, wrote to Microsoft last year expressing concerns about the default installation settings of Windows 10 and users' apparent lack of control over the company's processing of their data.

    The group - referred to as the Article 29 Working Party -asked for more explanation of Microsoft's processing of personal data for various purposes, including advertising.

KDE Plasma 5.8.6 Released for LTS Users with over 80 Improvements, Bug Fixes

Filed under
KDE
Security

Today, February 21, 2017, KDE announced the availability of the sixth maintenance update to the long-term supported KDE Plasma 5.8 desktop environment for Linux-based operating systems.

Read more

pfSense 2.3.3 RELEASE Now Available!

Filed under
Security
BSD

We are happy to announce the release of pfSense® software version 2.3.3!

This is a maintenance release in the 2.3.x series, bringing numerous stability and bug fixes, fixes for a handful of security issues in the GUI, and a handful of new features. The full list of changes is on the 2.3.3 New Features and Changes page, including a list of FreeBSD and internal security advisories addressed by this release.

This release includes fixes for 101 bugs, 14 Features, and 3 Todo items.

If you haven’t yet caught up on the changes in 2.3.x, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.

Read more

Also: NetBSD Accomplishes Reproducible Builds

Security News

Filed under
Security

Security Leftovers

Filed under
Security
  • Mobile apps and stealing a connected car

    The concept of a connected car, or a car equipped with Internet access, has been gaining popularity for the last several years. The case in point is not only multimedia systems (music, maps, and films are available on-board in modern luxury cars) but also car key systems in both literal and figurative senses. By using proprietary mobile apps, it is possible to get the GPS coordinates of a car, trace its route, open its doors, start its engine, and turn on its auxiliary devices. On the one hand, these are absolutely useful features used by millions of people, but on the other hand, if a car thief were to gain access to the mobile device that belongs to a victim that has the app installed, then would car theft not become a mere trifle?

  • [Video] Keynote: Security and Privacy in a Hyper-connected World - Bruce Schneier, Security Expert
  • RSA Conference: Lessons from a Billion Breached Data Records

    Troy Hunt sees more breached records than most of us, running the popular ethical data breach search service "Have I been pwned." In a session at the RSA Conference this week, Hunt entertained the capacity crowd with tales both humorous and frightening about breaches that he has been involved with.

    One of things that Hunt said he is often asked is exactly how he learns about so many breaches. His answer was simple.

    "Normally stuff just gets sent to me," Hunt said.

    He emphasized that he doesn't want to be a disclosure channel for breaches, as that's not a role he wants to play. Rather his goal is more about helping people to be informed and protect themselves.

  • How Google Secures Gmail Against Spam and Ransomware

    Google's Gmail web email service is used by millions of companies and consumers around the world, making it an attractive target for attackers. In a session at the RSA Conference here, Elie Bursztein, anti-fraud and abuse research team lead at Google, detailed the many technologies and processes that Google uses to protect users and the Gmail service itself from exploitation.

  • IBM Reveals Security Risks to Owners of Previously Owned IoT Devices

    hen you sell a car, typically the new owner gets the keys to the car and the original owner walks away. With a connected car, Charles Henderson, global head of X-Force Red at IBM Security, found that the original owner still has remote access capabilities, even years after the car has been sold.

    Henderson revealed his disturbing new research into a previously unexplored area of internet of things (IoT) security at the RSA Conference here on Feb. 17. In a video interview with eWEEK, Henderson detailed the management issue he found with IoT devices and why it's a real risk.

    "As smart as a connected car is, it's not smart enough to know that it has been sold, and that poses a real problem," Henderson said.

Syndicate content

More in Tux Machines

Linux Kernel and Graphics

Security News

  • Windows 10 least secure of Windows versions: study
    Windows 10 was the least secure of of current Windows versions in 2016, with 46% more vulnerabilities than either Windows 8 or 8.1, according to an analysis of Microsoft's own security bulletins in 2016. Security firm Avecto said its research, titled "2016 Microsoft Vulnerabilities Study: Mitigating risk by removing user privileges", had also found that a vast majority of vulnerabilities found in Microsoft products could be mitigated by removing admin rights. The research found that, despite its claims to being the "most secure" of Microsoft's operating systems, Windows 10 had 395 vulnerabilities in 2016, while Windows 8 and 8.1 each had 265. The research also found that while 530 Microsoft vulnerabilities were reported — marginally up from the 524 reported in 2015 — and 189 given a critical rating, 94% could be mitigated by removing admin rights. This was up from 85% in 2015.
  • Windows 10 Creators Update can block Win32 apps if they’re not from the Store [Ed: By Microsoft Peter. People who put Vista 10 on a PC totally lose control of that PC; remember, the OS itself is malware, as per textbook definitions. With DRM and other antifeatures expect copyright enforcement on the desktop soon.]
    The latest Windows 10 Insider Preview build doesn't add much in the way of features—it's mostly just bug fixes—but one small new feature has been spotted, and it could be contentious. Vitor Mikaelson noticed that the latest build lets you restrict the installation of applications built using the Win32 API.
  • Router assimilated into the Borg, sends 3TB in 24 hours
    "Well, f**k." Harsh language was appropriate under the circumstances. My router had just been hacked. Setting up a reliable home network has always been a challenge for me. I live in a cramped three-story house, and I don't like running cables. So my router's position is determined by the fiber modem in a corner on the bottom floor. Not long after we moved in, I realized that our old Airport Extreme was not delivering much signal to the attic, where two game-obsessed occupants fought for bandwidth. I tried all sorts of things. I extended the network. I used Ethernet-over-powerline connectors to deliver network access. I made a mystic circle and danced naked under the full moon. We lost neighbors, but we didn't gain a signal.
  • Purism's Librem 13 Coreboot Port Now "100%" Complete
    According to Purism's Youness Alaoui, their Coreboot port to the Librem 13 v1 laptop is now considered complete. The Librem 13 was long talked about having Coreboot over a proprietary BIOS while the initial models still had shipped with the conventional BIOS. Finally in 2017, they have now Coreboot at what they consider to be 100% complete for this Linux-friendly laptop.
  • The Librem 13 v1 coreboot port is now complete
    Here are the news you’ve been waiting for: the coreboot port for the Librem 13 v1 is 100% done! I fixed all of the remaining issues, it is now fully working and is stable, ready for others to enjoy. I fixed the instability problem with the M.2 SATA port, finished running all the tests to ensure coreboot is working correctly, fixed the headphone jack that was not working, made the boot prettier, and started investigating the Intel Management Engine issue.
  • Linux Update Fixes 11-Year-Old Flaw
    Andrey Konovalov, a security researcher at Google, found a use-after-free hole within Linux, CSO Online reported. This particular flaw is of interest because it appears to be situational. It only showed up in kernels built with a certain configuration option — CONFIG_IP_DCCP — enabled.

Kerala saves Rs 300 cr as schools switch to open software

The Kerala government has made a saving of Rs 300 crore through introduction and adoption of Free & Open Source Software (FOSS) in the school education sector, said a state government official on Sunday. IT became a compulsory subject in Kerala schools from 2003, but it was in 2005 only that FOSS was introduced in a phased manner and started to replace proprietary software. The decision made by the curriculum committee to implement it in the higher secondary sector has also been completed now. Read more

Tired of Windows and MAC computer systems? Linux may now be ready for prime time

Are you a bit tired of the same old options of salt and pepper, meaning having to choose only between the venerable Windows and MAC computer operating systems? Looking to branch out a bit, maybe take a walk on the wild side, learn some new things and save money? If so, the Linux operating system, which has been around for a long time and is used and loved by many hard-core techies and developers, may now be ready for prime time with the masses. Read more