Language Selection

English French German Italian Portuguese Spanish


Internet of Insecurity

Filed under
  • Linux TCP flaw enables remote attacks

    Researchers at the University of California, Riverside, say they have found a weakness in the transmission control protocol (TCP) used by Linux since late 2012 which allows the remote hijacking of Internet communications.

  • Serious security threat to many Internet users highlighted
  • Your 'Smart' Thermostat Is Now Vulnerable To Ransomware

    We've noted time and time again how the much ballyhooed "internet of things" is a privacy and security dumpster fire, and the check is about to come due. Countless companies and "IoT" evangelists jumped head first into the profit party, few bothering to cast even a worried look over at the reality that basic security and privacy standards hadn't come along for the ride. The result has been an endless parade of not-so-smart devices and appliances that are busy either leaking your personal details or potentially putting your life at risk.

    Of course, the Internet of Things hype machine began with smart thermostats and the sexy, Apple-esque advertising of Nest. The fun and games didn't last however, especially after several botched firmware updates resulted in people being unable to heat or cool their homes (relatively essential for a thermostat).

Security News

Filed under
  • No, 900 million Android devices are not at risk from the 'Quadrooter' monster

    Guys, gals, aardvarks, fishes: I'm running out of ways to say this. Your Android device is not in any immediate danger of being taken over a super-scary malware monster.

    It's a silly thing to say, I realize, but we go through this same song and dance every few months: Some company comes out with a sensational headline about how millions upon millions of Android users are in danger (DANGER!) of being infected (HOLY HELL!) by a Big, Bad Virus™ (A WHAT?!) any second now. Countless media outlets (cough, cough) pick up the story and run with it, latching onto that same sensational language without actually understanding a lick about Android security or the context that surrounds it.

    To wit: As you've no doubt seen by now, our latest Android malware scare du jour is something an antivirus software company called Check Point has smartly dubbed "Quadrooter" (a name worthy of Batman villain status if I've ever heard one). The company is shouting from the rooftops that 900 million (MILLION!) users are at risk of data loss, privacy loss, and presumably also loss of all bladder control -- all because of this hell-raising "Quadrooter" demon and its presence on Qualcomm's mobile processors.

  • 900 Million Androids Could Be Easy Prey for QuadRooter Exploits
  • Annoying "Open PDF in Edge" Default Option Puts Windows 10 Users at Risk

    Microsoft released today its monthly security patch, and one of the five security bulletins labeled as critical was a remote code execution (RCE) flaw in its standard PDF rendering library that could be exploited when opening PDF files.

Security News

Filed under

Security News

Filed under
  • Computers That Don't Track You

    Todd Weaver, the Founder and CEO of Purism shows Leo Laporte and Aaron Newcomb the Librem line of secure Linux computers. They discuss PureOS the operating system based on Debian, and how the computers are sourced and built. Plus, he talks about their line of no-carrier, encrypted smartphone coming next year.

  • The state of cyber security: we’re all screwed

    When cybersecurity professionals converged in Las Vegas last week to expose vulnerabilities and swap hacking techniques at Black Hat and Defcon, a consistent theme emerged: the internet is broken, and if we don’t do something soon, we risk permanent damage to our economy.

    “Half of all Americans are backing away from the net due to fears regarding security and privacy,” longtime tech security guru Dan Kaminsky said in his Black Hat keynote speech, citing a July 2015 study by the National Telecommunications and Information Administration. “We need to go ahead and get the internet fixed or risk losing this engine of beauty.”

  • Oh, not again: US reportedly finds new secret software in VW diesels [Ed: cannot trust proprietary software]

    Volkswagen first ended up in this situation after it admitted to intentionally installing secret software in its 2.0-liter diesels. That software curtailed nitrogen oxide emissions in lab-testing environments, but once on the road, the diesels would pollute well in excess of legal limitations. It was allegedly used in response to ever-stricter emissions regulations.

  • Chinese Hunting Chinese Over POP3 In Fjord Country

    More specifically, here at we've been seeing attempts at logging in to the pop3 mail retrieval service using usernames that sound distinctively like Chinese names, and the attempts originate almost exclusively from Chinese networks.

  • 'Sauron' spyware attacking targets in Belgium, China, Russia and Sweden

    A previously unknown hacking group called Strider has been conducting cyber espionage against selected targets in Belgium, China, Russia and Sweden, according to Symantec.

    The security firm suggested that the product of the espionage would be of interest to a nation state's intelligence services.

    Strider uses malware known as Remsec that appears primarily to have been designed for espionage, rather than as ransomware or any other nefarious software.

    Symantec has linked Strider with a group called Flamer which uses similar attack techniques and malware.

    The Lord of the Rings reference is deliberate as the Remsec stealth tool contains a reference to Sauron, the necromancer and main protagonist in a number of Tolkien's stories.

    "Strider has been active since at least October 2011. The group has maintained a low profile until now and its targets have been mainly organisations and individuals that would be of interest to a nation state's intelligence services," said Symantec in a blog post.

  • New MacBooks expected to feature Touch ID power button as well as OLED touch-panel [iophk: "as UID or password? Former is ok latter is insecure"]

    A source who has provided reliable information in the past has informed us that the new MacBook Pro models, expected to be launched in the fall, will feature a Touch ID power button as well as the previously-reported OLED touch-sensitive function keys.

  • it’s hard work printing nothing

    It all starts with a bug report to LibreSSL that the openssl tool crashes when it tries to print NULL. This bug doesn’t manifest on OpenBSD because libc will convert NULL strings to ”(null)” when printing. However, this behavior is not required, and as observed, it’s not universal. When snprintf silently accepts NULL, that simply leads to propagating the error.

  • London's Met Police has missed the Windows XP escape deadline [Ed: known problem, London's police is a prisoner of NSA and also China, Russia etc. [1, 2]]

    London’s Metropolitan Police has missed its deadline to dump Windows XP, with tens of thousands of copper still running the risky OS.

    The force, on the front line against terrorist threats and criminals in the capital city, is running Windows XP on around 27,000 PCs.

    At last count, in May 2015, the Met had a total of 35,640 PCs, with 34,920 of them running XP. Policemen set themselves a deadline of March 2016 to finish migrating to Windows 8.1.

    London Mayor Sadiq Khan, however, has apparently now revealed that just 8,000 of the force’s PCs have moved to Windows 8.1 since last September. The target is for another 6,000 by the end of September 2016.

    Khan provided the update in response to a question from Conservative Greater London Assembly member Andrew Boff.

  • Met Police still running Windows XP on 27,000 computers [iophk: "forget XP, Windows in general is dangerously out of date"]

    LONDON BOYS IN BLUE the Metropolitan Police may be armed with tasers and extendable batons, but they are backed up by Windows XP in a lot of cases, which is a really bad thing.

    Windows XP no longer gets official security updates, and Microsoft sees it as the sort of thing that should be scraped off shoes before walking on the carpet.

    The company will let people pay to keep using it, but only on a case-by-case basis. We do not know the police arrangement with Microsoft, but the Met needs to accelerate the updating of its computer systems as it puts Londoners' information at risk, according to London Assembly member Andrew Boff.

Security News

Filed under

Security News

Filed under
  • Protect yourself from cyberattacks

    3. Install Linux (free). One big decision making factor will be the age of your computer. If your hardware is old, you may well be better off replacing it with something new.

    I mentioned Linux, which has a few advantages. Windows as you are familiar with, is susceptible to infections by malware (viruses, adware, spyware, etc.), whereas Linux is practically invulnerable to infection. Part of that is down to the dominance of Windows, making it a big fat target, but it is also down to the Linux architecture making it extremely hard to hack. Another advantage with Linux (from my experience using Ubuntu), is that updates are generally installed without having to restart your machine. When a restart is needed, it is nice and quick, unlike a certain other operating system that spends ages ‘configuring updates’.

  • Nigerian Scammers Infect Themselves With Own Malware, Revealing New Wire-Wire Fraud Scheme [Ed: Windows]

    Once they’re in, the scammers allow the employee to continue with business as usual and discreetly monitor the account for potential financial transactions. As soon as they see that the employee is sending an invoice to a customer, they reroute it through their own email account and physically alter the account number and routing number before forwarding it on to the customer. The email address they use is often very similar to the original email address, so it’s easy to miss. Unlike spoofing, BEC techniques such as wire-wire rely on earning internal account access rather than externally impersonating a company account.

  • Is Hidden Linux Subsystem In Windows 10 Making Your PC Unsafe? [Ed: not any worse than a keylogger with back doors]
  • DARPA Cyber Grand Challenge Ends With Mayhem

    After three years of planning and lead-up contests, the finals of the Defense Advanced Research Projects Agency's Cyber Grand Challenge (CGC) to show the best in autonomous computer security concluded with a win by the Mayhem system from the ForAllSecure team, which won the $2 million grand prize. The Xandra system finished in second place, winning $1 million, while the Mechaphish system placed third, claiming $750,000.

Security Leftovers

Filed under
  • Hackers Could Break Into Your Monitor To Spy on You and Manipulate Your Pixels

    We think of our monitors as passive entities. The computer sends them data, and they somehow—magically?—turn it into pixels which make words and pictures.

    But what if that wasn’t the case? What if hackers could hijack our monitors and turn them against us?

    As it turns out, that’s possible. A group of researchers has found a way to hack directly into the tiny computer that controls your monitor without getting into your actual computer, and both see the pixels displayed on the monitor—effectively spying on you—and also manipulate the pixels to display different images.

  • Computer Expert Hacks Into Common Voting Machine in Minutes to Reveal Shocking 2016 Election Threat

    It took Princeton computer science professor Andrew Appel and one of his graduate students just minutes to hack into a voting machine still used in Louisiana, New Jersey, Virginia, and Pennsylvania, Politico reports.

    Professor Andrew Appel purchased for $82 a Sequoia AVC Advantage, one of the oldest machines still in use. Within 7 seconds, he and his student, Alex Halderman, had picked the lock open. Within minutes, the duo had removed the device’s unsecured ROM chips with their own hardware that makes it easy to alter the machine’s results.

  • Researchers Bypass Chip-and-Pin Protections at Black Hat

    Credit card companies for the most part have moved away from “swipe and signature” credit cards to chip and pin cards by this point; the technology known as EMV (Europay, MasterCard, and Visa) which is supposed to provide consumers with an added layer of security is beginning to see some wear, according to researchers.

Security News

Filed under
  • PLC-Blaster Worm Targets Industrial Control Systems [Ed: Remember Stuxnet?]

    PLC-Blaster was designed to target Siemens SIMATIC S7-1200 PLCs. Siemens is Europe’s biggest engineering company and a PLC market share leader. Siemens said in March shortly after the worm was unveiled at Black Hat Asia that the malware was not exploiting a vulnerability in Siemens gear. Maik Brüggemann, software developer and security engineer at OpenSource Security, said that worms like this one are a threat to any industrial network.


    When OpenSource Security took its findings to Siemens, the researchers were told there were no flaws in its PLC platforms using its SIMATIC S7-1200 PLC. “We were told these were not vulnerabilities and that everything worked as expected,” Brüggemann said.

  • Security Reseacher explains security issues related to Windows 10 Linux subsystem at Blackhat
  • Def Con: Do smart devices mean dumb security?

    From net-connected sex toys to smart light bulbs you can control via your phone, there's no doubt that the internet of things is here to stay.

    More and more people are finding that the devices forming this network of smart stuff can make their lives easier.

  • 1 billion computer monitors vulnerable to undetectable firmware attacks

    A team led by Ang Cui (previously) -- the guy who showed how he could take over your LAN by sending a print-job to your printer -- have presented research at Defcon, showing that malware on your computer can poison your monitor's firmware, creating nearly undetectable malware implants that can trick users by displaying fake information, and spy on the information being sent to the screen.

    It's a scarier, networked, pluripotent version of Van Eck phreaking that uses an incredibly sly backchannel to communicate with the in-device malware: attackers can blink a single pixel in a website to activate and send instructions to the screen's malware.

    What's more, there's no existing countermeasure for it, and most monitors appear to be vulnerable.

Security News

Filed under
  • Surveillance video shows a case of high-tech grand theft auto, more than 100 cars stolen [Ed: proprietary software, recall this about Jeep]

    Houston, Texas police announced the arrest of two men accused of stealing about 30 Jeep and Dodge vehicles. Authorities say they did it by using a laptop computer.

    Police tell KTRK they've been watching these guys for a while but were never able to catch them in the act stealing Jeeps - until last Friday.

    Police say Michael Arce and Jesse Zelaya stole more than 30 Jeeps in the Houston area over the last six months.

  • Openssh backdoor used on compromised Linux servers

    Some times ago, I have installed honeypot services on one of my servers, in order to see what happens in the real outside world. I especially installed the cowrie ssh honeypot which simulate a Linux shell and gather binaries that people want to install on the server (this tool is awesome, check here to install it).

  • random failures

    Lots of examples of random numbers failing, leading to cryptographic failure.

    The always classic Debian, OpenSSL, and the year of the zero.

    The time Sony signed Playstation code with the same nonce and leaked the keys.

    Samy phpwned session IDS.

    The Bitcoin app Blockchain used for entropy. Bonus giggles for not following the HTTP redirect, but actually using “301 Moved Permanently” as a random number.

    The paper Mining Your Ps and Qs has pretty extensive investigation into weak keys on network devices, many of which result from poor entropy.

    Now here’s a question. How many of these vulnerabilities could have been prevented by plugging in some sort of “true random” USB gizmo of the sort that regularly appears on kickstarter? I’m going to go with not many. USB gizmos don’t prevent inopportune calls to memset. USB gizmos don’t prevent nonce reuse. USB gizmos don’t block utterly retarded HTTP requests.

Syndicate content

More in Tux Machines

ARTIK is the Tizen’s Trojan Horse to dominate the IoT ecosystem

As part of the Forum “Tizen for the Internet of Things” held on September 22 in Moscow, Samsung Electronics has presented a new family of maker boards and modules named ARTIK, in addition to the infrastructure of the operating system Tizen 3.0. Samsung ARTIK’s value proposition, as declared by Samsung, is to reinvent the prototyping process by leveraging world-class data security granted by the company as well as a wide array of tools, both hardware and software, such as the ARTIK Modules and Cloud, formerly known as SmartThings Open Cloud. Read more

today's leftovers

today's howtos

Android Leftovers

  • Google Pixel review: The best Android phone, even if it is a little pricey
    Welcome to the age of Google Hardware. Apparently tired of letting third-party Android OEMs serve as the stewards of Android handsets, Google has become a hardware company. (Again). Earlier this year Google, launched a hardware division with former Motorola President Rick Osterloh at the helm. With the high-ranking title of "Senior Vice President," Osterloh doesn't oversee a side project—his group is on even footing with Android, Search, YouTube, and Ads. The hardware group is so powerful inside Google that it was able to merge Nexus, Pixel, Chromecast, OnHub, ATAP, and Glass into a single business unit. The group's coming out party was October 4, 2016, where it announced Google Home, Google Wifi, a 4K Chromecast, the Daydream VR headset, and the pair of phones we're looking at today: the Google Pixel and Google Pixel XL. The arrival of the Pixel phones marks the apparent death of the Nexus line; Google says that it has "no plans" for future Nexus devices. With the new branding comes a change in strategy, too. The Pixel brand is about making devices that are 100 percent Google, so despite Google's position as the developer of Android, get ready for Google-designed hardware combined with exclusive Google software.
  • Hands-on with the LeEco Le Pro3: services first, Android second
    LeEco’s flagship Le Pro3 smartphone isn’t trying to compete with the Google Pixel, which puts modern Google services in front of a stock Android backdrop. After playing with the Le Pro3 at the company’s U.S. launch event in San Francisco today, I’m left feeling that it’s an easy, low-cost way to get the full experience of LeEco’s applications. There are proprietary LeEco utility tools like the browser, email, calendar, messages, notes, and phone apps, along with bloatware like Yahoo Weather, but mostly the Pro3 is a means of distribution for the LeEco apps, like Live, LeVidi, and Le. There is also a standard-issue My LeEco app for managing services like EcoPass membership. Under it all is the EUI custom user interface. If you swipe left from the home screen, you see videos that LeEco recommends you watch — not Google Now.
  • Report: Google reaches agreement with CBS for 'Unplugged' web TV service - Fox and Disney may follow