Language Selection

English French German Italian Portuguese Spanish

Security

Security: Updates, Apple, Microsoft, Intel, IBM and Linux

Filed under
Security

Security: WPA3, Intel, and Tails

Filed under
Security

Security: Meltdown and Spectre Patches

Filed under
Security
  • Linux Mint project advises on Meltdown and Spectre

    The Linux Mint project has released a guide to address the Meltdown and Spectre bugs offering instructions for users on how they should mitigate the holes in their systems. It explains how to tighten up your web browsers and driver software, as well as providing a status update on when we can expect a patch to the kernel.

    The main browser that’s bundled with the operating system is Firefox. The advice is to ensure you update to Firefox 57.0.4, which was released several days ago. As for Chrome and Opera, you should go into the respective flags pages and enable strict site isolation, also called site per process. Google plans to fix the bug next month when it releases the next major edition of Google Chrome. An Opera update will follow.

  • Canonical Releases Ubuntu Kernel and Nvidia Updates to Fix Meltdown and Spectre

    As promised, Canonical released a few moments ago the new kernel and Nvidia updates to address the Meltdown and Spectre security vulnerability on all supported Ubuntu Linux releases.

    The company said last week in a public announcement that it will patch all supported Ubuntu releases against Meltdown and Spectre security vulnerabilities, and the first set of patches are now available in the stable software repositories of Ubuntu 17.10 (Artful Aardvark), Ubuntu 16.04 LTS (Xenial Xerus), and Ubuntu 14.04 LTS (Trusty Tahr) to address some of these issues.

  • Linux Mint security notice on Meltdown and Spectre

    A security notice was posted on the official Linux Mint blog on January 9, 2017. It informs users of the Linux distribution about the recently discovered security issues in modern processors called Meltdown and Spectre, and how these affect Linux Mint.

    The notice contains instructions to protect Linux Mint systems from potential attacks that target the vulnerabilities. It covers web browsers, Nvidia drivers, and the Linux kernel.

  • Tails 3.4 Anonymous Live System Released with Meltdown and Spectre Patches

    The Tails development team announced today the release and general availability of the Tails 3.4 amnesic incognito live system, also known as the anonymous live system.

    Tails is a Debian-based live Linux system designed with a single purpose in mind, to hide all your online activity from the prying eyes of the government. For that, it relies on the latest Tor and Tor Browser technologies by allowing users to connect to the Tor anonymous network.

  • Tails 3.4 privacy-focused Linux distro now available with Meltdown and Spectre fixes

    With everything going on in the world these days, it can feel like you are naked when using your computer. If you previously felt safe and secure, these last several years have probably eroded all of your confidence. Between Edward Snowden's revelations and the many vulnerabilities constantly hitting the news, it is tempting to just live in the woods without electricity.

    Before you sell your house, buy a tent, and become a nomad, you should consider a Linux distribution the helps you fight back against evil governments, nefarious hackers, and other bad people. Called "Tails," this Linux-based operating system is designed to be run from a live environment, such as on a DVD or flash drive, so you can hide your tracks and enjoy your God-given right to privacy. Today, version 3.4 becomes available and if you are already a Tails user, you should upgrade immediately. Why? Because it includes kernel 4.14.12 which offers fixes for Meltdown and Spectre (partially).

  • Greg Kroah-Hartman on Meltdown and Spectre Bugs: Go Update Your Linux Kernel

    Renowned Linux kernel developer Greg Kroah-Hartman has published an in-depth article on the status of the Meltdown and Spectre patches in the Linux kernel.

    As you already know, two severe hardware bugs were unearthed last week as the worst chip flaws in the history of computing. Dubbed Meltdown and Spectre, these security vulnerabilities affect us all, and put billions of devices at risk of attacks by allowing attackers to steal your sensitive data that's stored in kernel memory via locally installed apps or on the Web through malicious scripts.

Security leftovers

Filed under
Security

Security: Updates, Western Digital, Microsoft, WPA3, NSA

Filed under
Security

IPFire Open Source Firewall Linux Distro Gets Huge Number of Security Fixes

Filed under
Linux
OSS
Security

IPFire 2.19 Core Update 117 is now available to download and comes with the latest OpenSSL 1.0.2n TLS/SSL and crypto library, as well as an updated OpenVPN implementation that makes it easier to route OpenVPN Roadwarrior Clients to IPsec VPN networks by allowing users to choose routes in each client’s configuration.

The update also improves the IPsec implementation by allowing users to define the inactivity timeout time of an idle IPsec VPN tunnel that's being closed and updating the strongSwan IPsec-based VPN solution to version 5.6.1. It also disabled the compression by default and removed support for MODP groups with subgroups.

Read more

Security: Microsoft, Twitter, Korea and DHS

Filed under
Security

Who Was To Blame For The Ubuntu BIOS Bug?

Filed under
Security
Ubuntu

So who is to blame for the corruption of the BIOS?

Ultimately I would put the majority of the blame at the door of the manufacturers and the BIOS developers. You simply should not be able to corrupt the BIOS and there should be a reset option which returns it to factory settings if all else fails. The Ubuntu developers were the unlucky people to instantiate the bug by including a defective driver within the Kernel.

Some of the blame has to go to the users as well. Maybe we need to be a bit smarter when installing operating systems and not necessarily jump at the latest thing.

Read more

Security: MalwareTech, Linux vs Meltdown and Spectre, Linus Torvalds Rage, Microsoft Bricks Machines

Filed under
Security
  • MalwareTech Prosecution Appears To Be Falling Apart As Gov't Plays Keep Away With Documents Requested By Defense

    Marcus Hutchins, a.k.a. MalwareTech, went from internet hero (following his inadvertent shutdown of the WannaCry ransomware) to federal government detainee in a surprisingly short amount of time. Three months after saving the world from rampaging malware built on NSA exploits, Hutchins was arrested at the Las Vegas airport as he waited for his flight home to the UK.

    When the indictment was published, many people noted the charges didn't seem to be backed by much evidence. The government accused Hutchins of creating and selling the Kronos malware, but the offered very little to support this claim. While it's true much of the evidence against Hutchins will be produced in court, the indictment appeared to be stretching legal definitions of certain computer crimes to their limits.

    The government's case appears to be weak and reliant on dubious legal theories. It's not even 100% clear that creating and selling malware is an illegal act in and of itself. The charges the government brought rely heavily on proving Hutchins constructed malware with the intent to cause damage to computers. This isn't so easily proven, especially when the government itself is buying malware to deploy for its own purposes and has yet to bring charges against any of the vendors it buys from. Anyone selling exploits to governments could be said to be creating malware with intent to cause harm. That it's a government, rather than an individual, causing the harm shouldn't make any difference -- at least not if the government wants to claim selling of malware alone is a federal offense.

  • ​The Linux vs Meltdown and Spectre battle continues

    Meltdown is a CPU vulnerability. It works by using modern processors' out-of-order execution to read arbitrary kernel-memory location. This can include personal data and passwords. This functionality has been an important performance feature. It's present in many modern processors, most noticeably in 2010 and later Intel processors. By breaking down the wall between user applications and operating system's memory allocations, it can potentially be used to spy on the memory of other programs and the operating systems.

  • ‘It Can’t Be True.’ Inside the Semiconductor Industry’s Meltdown

    It was late November and former Intel Corp. engineer Thomas Prescher was enjoying beers and burgers with friends in Dresden, Germany, when the conversation turned, ominously, to semiconductors.

    Months earlier, cybersecurity researcher Anders Fogh had posted a blog suggesting a possible way to hack into chips powering most of the world’s computers, and the friends spent part of the evening trying to make sense of it. The idea nagged at Prescher, so when he got home he fired up his desktop computer and set about putting the theory into practice. At 2 a.m., a breakthrough: he’d strung together code that reinforced Fogh’s idea and suggested there was something seriously wrong.

  • Linus Torvalds Is Not Happy About Intel's Meltdown And Spectre Mess

    Meltdown and Spectre exploit an architectural flaw with the way processors handle speculative execution, a technique that most modern CPUs use to increase speed. Both classes of vulnerability could expose protected kernel memory, potentially allowing hackers to gain access to the inner workings of any unpatched system or penetrate security measures.

    The flaw can't be fixed with a microcode update, meaning that developers for major OSes and platforms have had to devise workarounds that could seriously hurt performance.

    In an email to a Linux list this week, Torvalds questioned the competence of Intel engineers and suggested that they were knowingly selling flawed products to the public. He also seemed particularly irritated that users could expect a five to 30 per cent projected performance hit from the fixes.

  • It gets worse: Microsoft’s Spectre-fixer wrecks some AMD PCs

    Microsoft’s fix for the Meltdown and Spectre bugs may be crocking AMD-powered PCs.

    A lengthy thread on answers.microsoft.com records numerous instances in which Security Update for Windows KB4056892, Redmond’s Meltdown/Spectre patch, leaves some AMD-powered PCs with the Windows 7 or 10 startup logo and not much more.

Security: Cryptocurrency Mining, Meltdown and Spectre, Updates, Cryptographic Key Generation

Filed under
Security
  • Cryptocurrency Mining Operations Take Aim at SSH Servers

    As the value of cryptocurrency continues to rise, there has been growing interest from attackers and security researchers alike.  

    So far in January 2018, multiple new attack vectors against cryptocurrencies have been disclosed as well as at least one major vulnerability. While there are potentially great opportunities to be had with cryptocurrency, the security issues serve as a reminder that there are risks too.

    A report released Jan. 8 alleges that among those now taking aim at cryptocurrency is the government of North Korea, which is conducting an un-authorized Monero mining operation. On Jan 3. a report from security firm F5 revealed that attackers are using a new python script to mine Monero on servers. While un-authorized mining operations are taking aim at servers, the security of the Electrum digital wallets used to access cryptocurrency has also been at risk and was patched on Jan. 7.

  • Clear Linux Rolls Out KPTI Page Isolation & Retpoline Support

    Intel's own Clear Linux distribution has now been updated with protection for addressing the Spectre and Meltdown vulnerabilities disclosed last week.

  • What You Need to Know About the Meltdown and Spectre CPU Flaws

    The computer industry is racing to deal with several new vulnerabilities that affect the majority of processors in modern computers and mobile devices. The flaws enable new attacks that break the critical memory defenses in operating systems and bypass fundamental isolation layers, including those vital to virtualization and container technologies.

    The most serious of the flaws, dubbed Meltdown or CVE-2017-5754, allows applications running in userspace to extract information from the kernel’s memory, which can contain sensitive data like passwords, encryption keys and other secrets. The good news is that Meltdown can be largely mitigated through software patches, unlike two other vulnerabilities known collectively as Spectre (CVE-2017-5753 and CVE-2017-5715) that will require CPU microcode updates and will likely haunt the industry for some time to come.

  • GCC 8 Patches Posted For Spectre Mitigation

    There's been a well-published branch the past few days of a patched GCC 7.2 code-base with the code changes for fending off Spectre while now patches have arrived on the mailing list for Spectre/CVE-2017-5715 of mainline GCC 8.

    Toolchain expert H.J. Lu of Intel has posted a set of five patches for Spectre mitigation with the current GCC 8 code-base. These patches introduce the new -mindirect-branch, -mindirect-branch-loop, -mfunction-return, -mindirect-branch-register options for GCC. Enabling the new functionality converts indirect branches to call and return thunks in order to avoid speculative execution.

  • Spectre and Meltdown explained

    I found this great article of Anton Gostev about Spectre and Meltdown, so I’m reposting it here :

    By now, most of you have probably already heard of the biggest disaster in the history of IT – Meltdown and Spectre security vulnerabilities which affect all modern CPUs, from those in desktops and servers, to ones found in smartphones. Unfortunately, there’s much confusion about the level of threat we’re dealing with here, because some of the impacted vendors need reasons to explain the still-missing security patches. But even those who did release a patch, avoid mentioning that it only partially addresses the threat. And, there’s no good explanation of these vulnerabilities on the right level (not for developers), something that just about anyone working in IT could understand to make their own conclusion. So, I decided to give it a shot and deliver just that.

  • Weekend tech reading: Spectre/Meltdown recap, 400Gbps Ethernet, next-gen DisplayPort
  • Security updates for Monday
  • What cryptographic key generation needs is a good source of entropy

    Let's move to computers. As opposed to board games, you generally want a computer to do the same thing every time you ask it to do it, assuming you give it the same inputs: you want its behaviour to be deterministic when presented with the same initial conditions. Random behaviour is generally not a good thing for computers. There are, of course, exceptions to this rule, such as when you want to use your computer to play a game, as things get boring quickly if there's no variation in gameplay.

    There's another big exception: cryptography. Not all cryptography, though; you definitely want a single plaintext to be encrypted to a single ciphertext under the same key in almost all cases. But there is one area where randomness is important, and that's in the creation of the cryptographic key(s) you're going to be using to perform those operations. It turns out that you need to have quite a lot of randomness available to create a key that is unique—and keys really need to be truly unique. If you don't have enough randomness, not only might you generate the same key (or set of them) repeatedly, but other people may do so as well. If they can guess what keys you're using, they could do things like read your messages or pretend to be you.

Syndicate content

More in Tux Machines

Today in Techrights

today's leftovers

  • Debian XU4 images updated
    I've updated my Debian images for the ODROID XU4; the newest build was done before stretch release, and a lot of minor adjustments have happened since then.
  • Parrot 4.0 Ethical Hacking Linux Distro Released
  • FBI says Russians hacked [sic] hundreds of thousands of home and office routers

    The warning followed a court order Wednesday that allowed the FBI to seize a website that the hackers [sic] planned to use to give instructions to the routers. Though that cut off malicious communications, it still left the routers infected, and Friday’s warning was aimed at cleaning up those machines.

  • FBI tells router users to reboot now to kill malware infecting 500k devices

    Researchers from Cisco’s Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers [sic] working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot.

Software and Games: KStars, Opera, OpenStack, MariaDB and More

  • KStars 2.9.6 is Released!
    I'm glad to announce the release of KStars 2.9.6 for Windows, MacOS, and Linux. This is a minor bugfix release.
  • Opera 54 Browser Enters Beta with News on the Speed Dial, Update & Recovery Menu
    Opera has promoted its upcoming Opera 54 web browser to the beta channel, giving us a glimpse of what to expect from the final version, due for release sometime next month. Based on the open-source Chromium 67.0.3396.18 web browser, Opera 54 recently entered beta stages of development with a plethora of new features and improvements, among which we can mention a new Update & Recovery Opera menu page that makes it easier for users to update the web browser and reset it to its default state, including the ability to clear temporary data, such as cookies.
  • OpenStack at a Crossroads
    The OpenStack of a few years ago is dead, however. What has emerged from the hype cycle is a materially different foundation, mission and software stack, with a great deal of change still ahead of it.
  • The OpenStack Foundation grows beyond OpenStack
    The OpenStack Foundation has made a considerable change to its development process and governance structure by introducing two open source projects that are not part of the OpenStack cloud platform. This week, the organization launched version 1.0 of Kata Containers - a runtime system with an emphasis on speed and security, enabling users to boot a VM in as little as five seconds - and introduced a brand new project called Zuul, spinning out the software development and integration platform that has been used by the OpenStack community internally since 2012.
  • Oracle nemesis MariaDB tries to lure enterprise folk with TX 3.0
    Open-source database biz MariaDB has upped the ante in its war against Oracle, promising enterprise customers better compatibility with – and easier migration from – Big Red. The Finnish firm's latest offering, MariaDB TX 3.0, released for GA today, extends the number of use cases to include temporal processing and advanced data protection for sensitive and personally identifiable information, as well as Oracle compatibility. The broad aim is to tap into customers' grumbles over legacy vendor lock-in, while convincing the bigger customers that they can move to an open-source database without compromising performance.
  • The Humble Monthly Bundle just added two great Linux games
    For those that are interested, you can secure a copy of two great Linux games in the current Humble Monthly Bundle. Just added today are: Get Cook, Serve, Delicious! 2!! Ken Follett's The Pillars of the Earth
  • SC-Controller 0.4.3 Released, Support Steam Controller & Sony DS4 Over Bluetooth
    For those looking to manage your Steam Controller and other supported Linux gaming peripheral input devices outside of Steam, there is a new release of the independently-developed SC-Controller Linux user-space software. While Linux 4.18 is bringing the Steam Controller kernel driver, for those looking for a Steam Controller solution right now to enjoy this excellent gaming controller for now outside of Steam, SC-Controller fills that void.

Huawei, Fuchsia and More

  • Huawei will no longer allow bootloader unlocking (Update: Explanation from Huawei)

    "In order to deliver the best user experience and prevent users from experiencing possible issues that could arise from ROM flashing, including system failure, stuttering, worsened battery performance, and risk of data being compromised, Huawei will cease providing bootloader unlock codes for devices launched after May 25, 2018. [...]"

  • Fuchsia Friday: How ad targeting might be a hidden cost of Fuchsia’s structure
     

    Fuchsia, by its nature, comes with the potential for a handful of new opportunities for ad targeting. Let’s peer into the dark side of Fuchsia’s innovative features.

  • iPhone Quarter, ZTE Troubles, Facebook Troubles, Nokia Come-back
     

    So the past month or two? The Quarterly results cycle came in. The item often of great interest is the Apple iPhone performance. 52.2 million iPhones shipped and that gives roughly a flat market share compared to the year before, so about 14%-15%. I'll come and do the full math later of the quarterly data. That race is no longer in any way interesting.

    But two Top 10 smartphone brands ARE in the news. One who is facing imminent death and the other who is making a miraculous return-from-dead. So imminent death and current Top 10 brand first. ZTE. The Trump administration has put a massive squeeze on ZTE and the company is in serious trouble of imminent collapse. Then bizarrely, Trump reversed course and felt he needed to protect CHINESE employment (???) and after yet another typical Trump-mess, we now are at a Never-Neverland where Trump's own party Republicans are revolting against their President and well, ZTE may end up a casualty of this mess. We'll keep an eye on it.

  •