Language Selection

English French German Italian Portuguese Spanish

Security

Tails 1.5 is out

Filed under
GNU
Linux
Security
Debian

There are numerous other changes that might not be apparent in the daily operation of a typical user. Technical details of all the changes are listed in the Changelog.

Read more

'CVE-2015-4495 and SELinux', Or why doesn't SELinux confine Firefox?

Filed under
Linux
Moz/FF
Security

Why don't we confine Firefox with SELinux?

That is one of the most often asked questions, especially after a new CVE like CVE-2015-4495, shows up. This vulnerability in firefox allows a remote session to grab any files in your home directory. If you can read the file then firefox can read it and send it back to the website that infected your browser.

The big problem with confining desktop applications is the way the desktop has been designed.

Read more

OpenSSH 7.0

Filed under
OSS
Security

OpenSSH 7.0 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support. OpenSSH also includes
transitional support for the legacy SSH 1.3 and 1.5 protocols
that may be enabled at compile-time.

Read more

Security Leftovers

Filed under
Security
  • Researchers Hack into a Linux-Powered Self-Aiming Sniper Rifle

    Two researchers, Michael Auger and Runa Sandvik, will present today, at the Black Hack conference in Las Vegas, their recent findings into the world of computerized weapons security.

  • OPM Wins Pwnie for Most Epic Fail at Black Hat Awards Show
  • DefCon ProxyHam Talk Disappears but Technology is No Secret

    Part of the drama at any Black Hat or DefCon security conference in any given year usually revolves around a talk that is cancelled for some mysterious reason, typically over fears that it could reveal something truly disruptive. Such is the case in 2015 at DefCon with a talk called ProxyHam, which was supposed to reveal technology that could enable an attacker to wireless proxy traffic over long distances, hiding their true location.

  • A chat with Black Hat's unconventional keynote speaker

    In 2010, Black Hat had its first female keynote, Jane Holl Lute, who served at the time as the deputy secretary of the Department of Homeland Security. Lute's first comment about the nature of cyberspace set the tone for her keynote, which was, in characteristic DHS cybersecurity style, tone-deaf to attendee levels of expertise.

  • Uneasy detente between Def Con hackers and 'feds'

    That led founder Jeff Moss to call for a "cooling off period" during which "feds" avoided coming near the annual conference in Las Vegas.

  • Design flaw in Intel processors opens door to rootkits, researcher says

    A design flaw in the x86 processor architecture dating back almost two decades could allow attackers to install a rootkit in the low-level firmware of computers, a security researcher said Thursday. Such malware could be undetectable by security products.

  • Why Your Mac Is More Vulnerable to Malware Than You Think

    The attack would enable a hacker to remotely target computers with malware that would both go undetected by security scanners and would afford the attacker a persistent hold on a system, even when it undergoes firmware and operating system updates. Because firmware updates require the assistance of the existing firmware to install, any malware in the firmware could block updates from being installed or write itself to a new update. Zetter reports that the only way to eliminate malware that’s embedded in a computer’s main firmware would be to re-flash the chip that contains the firmware.

  • ‘Zero-day’ stockpiling puts us all at risk

    The recent dump of emails from Hacking Team sheds new light on the extent of government involvement in the international market for zero-days. Rather than disclosing these vulnerabilities to software makers, so that they can be fixed, government agencies buy and then stockpile zero-days.

  • What's wrong with the web? -- authentication

Security Leftovers

Filed under
Security
  • Security updates for Friday
  • Security updates for Thursday
  • Black Hat Researchers Hack Rifle for Fun

    "The reason we started doing this in the first place is Runa [Sandvik] is from Norway and has a very romanticized vision of the U.S., so loving all things America, we needed to go to a gun show," Augur said.

    At to the gun show, Sandvik became interested in the TrackingPoint weapon after learning that it is a Linux-powered device that could be connected to a phone via a mobile app.

  • And even Wintel is not safe

    At the annual Black Hat conference delegates have been shown a new exploit for Intel and AMD x86 central processor units that has hitherto existed since 1977!

    [...]

    Christopher Domas, a security researcher with the Battelle Memorial Institute discovered the flaw. “By leveraging the flaw, attackers could install a rootkit in the processors System Management Mode (SMM), a protected region of code that underpins all the firmware security features in modern computers. Once installed, the rootkit could be used for destructive attacks like wiping the UEFI (Unified Extensible Firmware Interface) the modern BIOS or even to re-infect the OS after a clean install. Protection features like Secure Boot wouldn’t help, because they too rely on the SMM to be secure. The attack essentially breaks the hardware roots of trust,” Domas said.

  • HTML5 privacy hole left users open to tracking for three years

    A feature of HTML5 that allows sites to detect battery life on a visitor's device can also be used to track behaviour, a piece of research has revealed.

  • Sick of Flash security holes? HTML5 has its own

    HTML5 has been billed as the natural, standards-based successor to proprietary plug-ins such as Adobe's Flash Player for providing rich multimedia services on the Web. But when it comes to security, one of Flash's major weaknesses, HTML5 is no panacea.

    In fact, HTML5 has security issues of its own. Julien Bellanger, CEO of application security monitoring firm Prevoty, says HTML5 makes security more complex, not simpler. HTML5 security has been a question mark for years, and it has not improved over the stretch, he says.

  • Attackers can access Dropbox, Google Drive, OneDrive files without a user's password

    The attack differs from traditional man-in-the-middle attacks, which rely on tapping data in transit between two servers or users, because it exploits a vulnerability in the design of many file synchronization offerings, including Google, Box, Microsoft, and Dropbox services.

  • SDN switches aren't hard to compromise, researcher says

    Onie is a small, Linux based operating system that runs on a bare-metal switch. A network operating system is installed on top of Onie, which is designed to make it easy and fast for the OS to be swapped with a different one.

  • Open Network Switches Pose Security Risk, Researcher Says

    At the Black Hat show, a security expert demonstrates how vulnerable SDN switches that use the ONIE software are open to attacks by hackers.

  • OPM wins Pwnie, Google on Android security, DoJ on CFAA: Black Hat 2015 roundup

    Black Hat USA is finishing up in Las Vegas. News from its 18th year includes nuclear nightmares, Department of Justice on computer crime and research, Google on the state of Android security and much more.

  • on the detection of quantum insert

    The NSA has a secret project that can redirect web browsers to sites containing more sophisticated exploits called QUANTUM INSERT. (Do I still need to say allegedly?) It works by injecting packets into the TCP stream, though overwriting the stream may be a more accurate description. Refer to Deep dive into QUANTUM INSERT for more details. At the end of that post, there’s links to some code that can help one detect QI attacks in the wild. As noted by Wired and Bruce Schneier, among dozens of others, now we can defend ourselves against this attack (well, at least detect it).

Tails 1.5 RC1 Incognito Live CD Is Out for Testing and It Needs Your Help

Filed under
Security
Debian

The first Release Candidate of Tails 1.5, the amnesic incognito Live CD distribution used by Edward Snowden to browse websites anonymously and stay invisible online, was announced on August 6, 2015.

Read more

Security Leftovers

Filed under
Security
  • Tuesday's security advisories
  • Security updates for Wednesday
  • bad robot

    The best part of running your own server is definitely reviewing the logs.

  • MVEL as an attack vector

    Java-based expression languages provide significant flexibility when using middleware products such as Business Rules Management System (BRMS). This flexibility comes at a price as there are significant security concerns in their use. In this article MVEL is used in JBoss BRMS to demonstrate some of the problems. Other products might be exposed to the same risk.

Keep Dream of a Free and Open Internet Alive, Black Hat Keynoter Urges

Filed under
OSS
Security
Web

Black Hat keynoter Jennifer Granick, director of Civil Liberties at the Stanford Center for Internet and Society, discusses the need for legal and policy change to defend Internet freedom.

Read more

5 Best Practices for Security in Open Source Development

Filed under
OSS
Security

Let's look at five best practices for working with security in open source programming. When you write software, there's a high likelihood that you'll have to include some kind of security. Plenty of open source libraries are available to help you add security, but you have to do it right. Otherwise, you'll be asking for big trouble later, which might include your client getting featured on the national news.

Read more

More Oxide Security Issues Have Been Fixed in Ubuntu 15.04 and Ubuntu 14.04 LTS

Filed under
Security
Ubuntu

Canonical has released details about quite a few Oxide vulnerabilities that have been found and fixed in Ubuntu 15.04 and Ubuntu 14.04 LTS in a security notification.

Read more

Syndicate content

More in Tux Machines

today's howtos

Leftovers: Gaming

Leftovers: Red Hat

Leftovers: Ubuntu Derivatives