Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • Friday's security updates
  • Why I gave your paper a Strong Reject

    Writing a bunch of wordy bullshit that doesn't mean anything. Trust me, you're not going to wow and amaze the program committee by talking about dynamic, scalable, context-aware, Pareto-optimal middleware for cloud hosting of sensing-intensive distributed vehicular applications. If your writing sounds like the automatically-generated, fake Rooter paper ("A theoretical grand challenge in theory is the important unification of virtual machines and real-time theory. To what extent can web browsers be constructed to achieve this purpose?"), you might want to rethink your approach. Be concise and concrete. Explain what you're doing in clear terms. Bad ideas won't get accepted just because they sound fancy.

  • Computer System Security Policy Debate (Follow-up)

    The challenge is that political people see everything as a political/policy issue, but this isn’t that kind of issue. I get particularly frustrated when I read ignorant ramblings like this that dismiss the overwhelming consensus of the people that actually understand what needs to be done as emotional, hysterical obstructionism. Contrary to what seems to be that author’s point, constructive dialogue and understanding values does nothing to change the technical risks of mandating exceptional access. Of course the opponents of Feinstein-Burr decry it as technologically illiterate, it is technologically illiterate.

Security Leftovers

Filed under
Security
  • Let's Encrypt Reaches 2,000,000 Certificates

    Earlier today, the Let's Encrypt certificate authority issued its two millionth certificate, less than two months after the millionth certificate. As we noted when the millionth certificate was issued, each certificate can cover several web sites, so the certificates Let's Encrypt has issued are already protecting millions and millions of sites.

  • Hackers Make This Search Engine Out Of 70 Million Voters’ Data

    Did you ever imagine an easily-browsable hacked data available to public and that too in the form of a search engine? Well, here is one of those interesting hacking cases where hackers made a search engine out of the hacked data of the 70 million citizens of Philippines and anyone can easily search for everybody else.

  • How Big Is Your Target?

    In his 2014 TED presentation Cory Doctorow compares an open system of development to the scientific method and credits the methods for bringing mankind out of the dark ages. Tim Berners-Lee has a very credible claim to patent the technology that runs the internet, but instead has championed for its open development. This open development has launched us forward into a brave new world. Nearly one third of all internet traffic rides on just one openly developed project. Its place of dominance may be unsure as we approach a world with cybersecurity headlines. Those headlines do much to feed the industry of fear resulting in government efforts to close doors on open source efforts.

    This paper is a qualitative theoretical discussion regarding cyber security and open source solutions written in three parts. Its goal is to demonstrate that the use of open source technologies reduces vulnerability to cyber attacks. The first part of this paper identifies the difficulties in presenting a software consideration model capable of illustrating the full spectrum of expectations for the performance of today’s code. Previous models merely address basic requirements for execution namely security, functionality & usability. While these aspects are important they fail to take into account modern requirements for maintenance, scalability, price, reliability and accessibility of software. This part of the paper modernizes the model developed by Andrew Waite and presents a clear model for software discussion.

Security Leftovers

Filed under
Security
  • Thursday's security updates
  • libressl - more vague promises

    There hasn’t been a lot of noise coming out of the LibreSSL camp recently. Mostly there’s not much to report, so any talks or presentations will recover a lot of the same material. But it’s an election year, and in that spirit, we can look back at some promises previously made and hopefully make a few new ones.

  • My OpenWrt Tor configuration

    In my previous article I shared my thoughts on running Tor on the router. I described an ideal Tor router configuration and argued that having Tor on the router benefits both security and usability.

    This article is about that ideal Tor router configuration. How did I configure my router, and why did I choose the configuration? The interesting part is that it really is “just configuration”. No programming involved. Even more interesting, it's easy too!

Security Leftovers

Filed under
Security
  • April security sensationalism and FUD

    If you happen to follow the security scene, you must have noticed a lot of buzz around various security issues discovered this month. Namely, a critical vulnerability in the Microsoft Graphics Component, as outlined in the MS16-039 bulletin, stories and rumors around something called Badlock bug, and risks associated using Firefox add-ons. All well and good, except it's nothing more than clickbait hype nonsense.

    Reading the articles fueled my anger to such heights that I had to wait a day or two before writing this piece. Otherwise, it would have just been venom and expletives. But it is important to express myself and protect the Internet users from the torrent of pointless, amateurish, sensationalist wanna-be hackerish security diarrhea that has been produced this month. Follow me.

  • DRAM bitflipping exploits that hijack computers just got easier
  • PacketFence v6.0 released

    The Inverse team is pleased to announce the immediate availability of PacketFence 6.0. This is a major release with new features, enhancements and important bug fixes. This release is considered ready for production use and upgrading from previous versions is strongly advised.

  • [Old] The Athens Affair

    How some extremely smart hackers pulled off the most audacious cell-network break-in ever

  • Write opinionated workarounds

    A few years ago, I decided that I should aim for my code to be as portable as possible. This generally meant targeting POSIX; in some cases I required slightly more, e.g., "POSIX with OpenSSL installed and cryptographic entropy available from /dev/urandom". This dedication made me rather unusual among software developers; grepping the source code for the software I have installed on my laptop, I cannot find any other examples of code with strictly POSIX compliant Makefiles, for example. (I did find one other Makefile which claimed to be POSIX-compatible; but in actual fact it used a GNU extension.) As far as I was concerned, strict POSIX compliance meant never having to say you're sorry for portability problems; if someone ran into problems with my standard-compliant code, well, they could fix their broken operating system.

Security Leftovers

Filed under
Security
  • Tuesday's security updates
  • Security advisories for Wednesday
  • Red Hat Product Security Risk Report: 2015

    This report takes a look at the state of security risk for Red Hat products for calendar year 2015. We look at key metrics, specific vulnerabilities, and the most common ways users of Red Hat products were affected by security issues.

    Our methodology is to look at how many vulnerabilities we addressed and their severity, then look at which issues were of meaningful risk, and which were exploited. All of the data used to create this report is available from public data maintained by Red Hat Product Security.

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security
  • Security updates for Monday
  • DHS CIO walks back staff comments on open source

    Some IT professionals at the Department of Homeland Security raised eyebrows over recent comments on GitHub that suggested a proposed federal open-source policy could result in the "mafia having a copy of all FBI system code" or could give terrorists "access to air traffic control software." The comments were attributed to the CIO's office.

    However, DHS CIO Luke McCormack has since filed his own official comments, noting that "prior comments do not represent DHS policy or views."

  • Microsoft PowerShell — Hackers’ New Favorite Tool For Coding Malware

    You might not know but PowerShell, the ubiquitous force running behind the Windows environment, is slowly becoming a secure way for the attackers to hide their malicious activities. Unfortunately, at the moment, there’s no technical method of distinguishing between malicious and good PowerShell source code.

  • MIT reveals AI platform which detects 85 percent of cyberattacks

    Today's cybersecurity professionals face daunting tasks: protecting enterprise networks from threats as best they can, damage limitation when data breaches occur, cyberforensics and documenting the evolution and spread of digital attacks and malware across the world.

Kali Linux Rolling Release — Best Features That Make It The Best OS For Ethical Hackers

Filed under
GNU
Linux
Security

Kali Linux, a hacker’s favorite operating system, is now available with first Rolling release. This release ensures that you are always using the latest and best tools for pen-testing purposes. The first Kali Linux Rolling release also brings a Kali Linux Package Tracker tool and changes the way VMware guest tools are installed. You can read more about the features below and use the links for downloading Kali Linux Rolling 2016.1 ISO files and torrents.

Read more

Security Leftovers

Filed under
Security
  • Flaw-finding Ruby on Rails bot steams past humans
  • Future of secure systems in the US

    Security and privacy are important to many people. Given the personal and financial importance of data stored in computers (traditional or mobile), users don’t want criminals to get a hold of it. Companies know this, which is why both Apple IOS and Google Android both encrypt their local file systems by default now. If a bill anything like what’s been proposed becomes law, users that care about security are going to go elsewhere. That may end up being non-US companies’ products or US companies may shift operations to localities more friendly to secure design. Either way, the US tech sector loses. A more accurate title would have been Technology Jobs Off-Shoring Act of 2016.

  • Software end of life matters!

    Anytime you work on a software project, the big events are always new releases. We love to get our update and see what sort of new and exciting things have been added. New versions are exciting, they're the result of months or years of hard work. Who doesn't love to talk about the new cool things going on?

  • JBOSS Backdoor opens 3 million servers at risk of attacks
Syndicate content

More in Tux Machines

Leftovers: OSS

Security Leftovers

  • Security updates for Thursday
  • OpenSSL patches two high-severity flaws
    OpenSSL has released versions 1.0.2h and 1.0.1t of its open source cryptographic library, fixing multiple security vulnerabilities that can lead to traffic being decrypted, denial-of-service attacks, and arbitrary code execution. One of the high-severity vulnerabilities is actually a hybrid of two low-risk bugs and can cause OpenSSL to crash.
  • Linux Foundation Advances Security Efforts via Badging Program
    The Linux Foundation Core Infrastructure Initiative's badging program matures, as the first projects to achieve security badges are announced.
  • Linux Foundation tackles open source security with new badge program
  • WordPress Plugin ‘Ninja Forms’ Security Vulnerability
    FOSS Force has just learned from Wordfence, a security company that focuses on the open source WordPress content management platform, that a popular plugin used by over 500,000 sites, Ninja Forms, contains serious security vulnerabilities.
  • Preparing Your Network for the IoT Revolution
    While there is no denying that IP-based connectivity continues to become more and more pervasive, this is not a fundamentally new thing. What is new is the target audience is changing and connectivity is becoming much more personal. It’s no longer limited to high end technology consumers (watches and drones) but rather, it is showing up in nearly everything from children’s toys to kitchen appliances (yes again) and media devices. The purchasers of these new technology-enabled products are far from security experts, or even security aware. Their primary purchasing requirements are ease of use.
  • regarding embargoes
    Yesterday I jumped the gun committing some patches to LibreSSL. We receive advance copies of the advisory and patches so that when the new OpenSSL ships, we’re ready to ship as well. Between the time we receive advance notice and the public release, we’re supposed to keep this information confidential. This is the embargo. During the embargo time we get patches lined up and a source tree for each cvs branch in a precommit state. Then we wait with our fingers on the trigger. What happened yesterday was I woke up to a couple OpenBSD developers talking about the EBCDIC CVE. Oh, it’s public already? Check the OpenSSL git repo and sure enough, there are a bunch of commits for embargoed issues. Pull the trigger! Pull the trigger! Launch the missiles! Alas, we didn’t look closely enough at the exact issues fixed and had missed the fact that only low severity issues had been made public. The high severity issues were still secret. We were too hasty.
  • Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan [Ed: Windows]
    A critical medical equipment crashed during a heart procedure due to a timely scan triggered by the antivirus software installed on the PC to which the said device was sending data for logging and monitoring.
  • Hotel sector faces cybercrime surge as data breaches start to bite
    Since 2014, things have become a lot more serious with a cross section of mostly US hotels suffering major breaches during Point-of-Sale (POS) terminals. Panda Security lists a string of attacks on big brands including on Trump Hotels, Hilton Worldwide, Hyatt, Starwood, Rosen Hotels & Resorts as well two separate attacks on hotel management outfit White Lodging and another on non-US hotel Mandarin Oriental.

Android Leftovers

today's howtos