Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • Backdoor in JBoss Java Platform Puts 3.2 Million Servers at Risk
  • Let's Encrypt: threat or opportunity to other certificate authorities?

    Let's Encrypt is a certificate authority (CA) that just left beta stage, that provides domain name-validated (DV) X.509 certificates for free and in an automated way: users just have to run a piece of software on their server to get and install a certificate, resulting in a valid TLS setup.

  • Making it easier to deploy TPMTOTP on non-EFI systems

    On EFI systems you can handle this by sticking the secret in an EFI variable (there's some special-casing in the code to deal with the additional metadata on the front of things you read out of efivarfs). But that's not terribly useful if you're not on an EFI system. Thankfully, there's a way around this. TPMs have a small quantity of nvram built into them, so we can stick the secret there. If you pass the -n argument to sealdata, that'll happen. The unseal apps will attempt to pull the secret out of nvram before falling back to looking for a file, so things should just magically work.

  • Badlock Vulnerability Falls Flat Against Its Hype

    Weeks of anxiety and concern over the Badlock vulnerability ended today with an anticlimactic thud.

  • Samba 4.4.2, 4.3.8 and 4.2.11 Security Releases Available for Download
  • The Internet of bricks

    One of the promises of the "Internet of things" is that it gives us greater control over our homes, gadgets, and more. Free software also offers that sort of promise, along with the idea that, if necessary, we can support our own gadgetry when the manufacturer moves on to some new shiny object. The currently unfolding story of the Revolv hub shows that, in many cases, these promises are empty. The devices we depend on and think we own can, in fact, be turned into useless bricks at the manufacturer's whim.

    The Revolv "M1" home-automation hub was one of many products designed to bring home control to the Internet. It is able to control lights, heating, and more, all driven by smartphone-based applications. The product was sufficiently successful to catch the eye of the business-development folks at Nest, who acquired the company; Nest was acquired in turn by Google, and is now a separate company under the "Alphabet" umbrella.

  • Underwriters Labs refuses to share new IoT cybersecurity standard

    UL, the 122-year-old safety standards organisation whose various marks (UL, ENEC, etc.) certify minimum safety standards in fields as diverse as electrical wiring, cleaning products, and even dietary supplements, is now tackling the cybersecurity of Internet of Things (IoT) devices with its new UL 2900 certification. But there's a problem: UL's refusal to freely share the text of the new standard with security researchers leaves some experts wondering if UL knows what they're doing.

    When Ars requested a copy of the UL 2900 docs to take a closer look at the standard, UL (formerly known as Underwriters Laboratories) declined, indicating that if we wished to purchase a copy—retail price, around £600/$800 for the full set—we were welcome to do so. Independent security researchers are also, we must assume, welcome to become UL retail customers.

  • Combined malware threat is robbing banks of millions every day

    THE SECURITY attack dogs at IBM have uncovered two normally solo malware threats working together to rob banks in the US and Canada.

    IBM's X-Force division has dubbed the combined malware Stealma and Louise GozNym by merging the names of the individual, but now friendly, Gozi ISFB and Nymaim.

    "It appears that the operators of Nymaim have recompiled its source code with part of the Gozi ISFB source code, creating a combination that is being actively used in attacks against more than 24 US and Canadian banks, stealing millions of dollars so far," said IBM in a blog post.

Security Leftovers

Filed under
Security
  • Security updates for Thursday
  • Badlock: Samba Vulns & Patching your machines

    Unless you are living in a black hole aka SCIF, or otherwise totally disconnected from various news outlets, you have likely heard about the numerous vulns that dropped as a series of CVEs better known as ‘badlock’ Tuesday. Well, there is good news for those on Redhat based distros! Patches are already in the default repos for Fedora / RHEL / CentOS.

  • Gone In Six Characters: Short URLs Considered Harmful for Cloud Services

    TL;DR: short URLs produced by bit.ly, goo.gl, and similar services are so short that they can be scanned by brute force. Our scan discovered a large number of Microsoft OneDrive accounts with private documents. Many of these accounts are unlocked and allow anyone to inject malware that will be automatically downloaded to users’ devices. We also discovered many driving directions that reveal sensitive information for identifiable individuals, including their visits to specialized medical facilities, prisons, and adult establishments.

IPFire 2.19 - Core Update 100 released

Filed under
GNU
Linux
Security

It is a great moment to us and we are very proud to release the 100th Core Update today.

This update will bring you IPFire 2.19 which we release for 64 bit on Intel (x86_64) for the first time. This release was delayed by the various security vulnerabilities in openssl and glibc, but is packed with many improvements under the hood and various bug fixes.

Read more

Security Leftovers

Filed under
Security
  • Apple Bug Exposed Chat History With a Single Click

    IN THE MIDDLE of intense public debate over whether Apple should be forced to help the government decrypt iPhones for criminal investigations, the company quietly closed a six-month-old security vulnerability in its Messages app. Newly published details reveal just how severe that vulnerability was, allowing the exfiltration of chat history, including photos and videos, if the user could be tricked into clicking a single malicious link.

    The bug, which affected Apple’s laptop and desktop computers from September through March, highlights just how hard it is for companies like Apple to effectively secure sensitive data — even before those companies begin fielding requests from the government for special access. Tech companies like Apple are nearly unanimous in their agreement that creating “backdoors” through which the government may access protected data undermines even the most basic security measures, including those designed to protect against vulnerabilities like the Messages bug.

  • New Threat Can Auto-Brick Apple Devices

    If you use an Apple iPhone, iPad or other iDevice, now would be an excellent time to ensure that the machine is running the latest version of Apple’s mobile operating system — version 9.3.1. Failing to do so could expose your devices to automated threats capable of rendering them unresponsive and perhaps forever useless.

  • Execs: We’re not responsible for cybersecurity

    More than 90 percent of corporate executives said they cannot read a cybersecurity report and are not prepared to handle a major attack, according to a new survey.

    More distressing is that 40 percent of executives said they don't feel responsible for the repercussions of hackings, said Dave Damato, chief security officer at Tanium, which commissioned the survey with the Nasdaq.

    "I think the most shocking statistic was really the fact that the individuals at the top of an organization — executives like CEOs and CIOs, and even board members — didn't feel personally responsible for cybersecurity or protecting the customer data," Damato told CNBC's "Squawk Box" on Friday.

  • Brits suffer more than 2,000 ransomware attacks each day

    The security firm said that the enemy is now more organised than ever before, and that most groups have the same kind of resources, skills and support as nation-state hacker groups.

    "Advanced criminal attack groups now echo the skills of nation-state attackers. They have extensive resources and a highly skilled technical staff that operate with such efficiency that they maintain normal business hours and even take the weekends and holidays off," said Kevin Haley, director of Symantec Security Response.

    "We are even seeing low-level criminal attackers create call centre operations to increase the impact of their scams."

    These sophisticated hackers are often the first to embrace zero-day vulnerabilities, which increased by 125 percent in 2015 to 54.

Security Leftovers

Filed under
Security
  • Security advisories for Wednesday
  • Let's Encrypt free security certificate program leaves beta

    Let's Encrypt has announced that the free secure certificate program is leaving beta in its push to encrypt 100 percent of the web.

  • What happened with Badlock?

    Here's the thing though. It wasn't nearly as good as the hype claimed. It probably couldn't ever be as good as the hype claimed. This is like waiting for a new Star Wars movie. You have memories from being a child and watching the first few. They were like magic back then. Nothing that ever comes out again will be as good. Your brain has created ideas and memories that are too amazing to even describe. Nothing can ever beat the reality you built in your mind.

  • Microsoft rated 6 of 13 security updates as critical, Badlock bug fix rated important

    For April 2016 Patch Tuesday, Microsoft released 13 security bulletins, with six being rated as critical for remote code execution flaws and the patch for Badlock being among those rated only as important.

  • Open source runs the world and needs better security, claims Linux Foundation CTO

    Security is the biggest plague of open source software, and more people are needed to work together squashing bugs and plugging holes in the code on which much of the internet relies.

    That’s according to Nicko van Someren, chief technology officer at the Linux Foundation, who explained that huge swathes of the internet and companies with online business models rely on open source code, software and infrastructure.

Security Leftovers

Filed under
Linux
Security
  • Linux Foundation: The internet is crumbling

    The open source infrastructure of the internet is crumbling because of poor maintenance, the Linux Foundation warned today.

    Likening open source to the “roads and bridges of the internet”, Linux Foundation CTO Nicko van Someren said that underpaid developers are struggling to patch dangerous bugs and keep the open aspects of the web up to date.

  • Security is the biggest bug of open source, says Linux Foundation CTO

    CYBER SECURITY is the plague of open source software, and more people are needed to work together squashing bugs and plugging holes in the code on which much of the internet relies.

    That’s according to Nicko van Someren, chief technology officer at the Linux Foundation, who explained that huge swathes of the internet and companies with online business models rely on open source code, software and infrastructure.

    "Open source projects are the roads and bridges of the internet. Pretty much everything we do on the internet relies on open source," he said in a keynote speech at Cloud Expo in London.

  • Linux Computers Targeted by New Backdoor and DDoS Trojan

    After being bombarded with new malware towards the end of last year, the Linux ecosystem is rocked again by the discovery of a new trojan family, identified by security researchers as Linux.BackDoor.Xudp.

    The only detail that matters is that this new threat does not leverage automated scripts, vulnerabilities, or brute-force attacks to infect users and still relies on good ol' user stupidity in order to survive.

Security Leftovers

Filed under
Security

pfSense 2.3

Filed under
Security
BSD
  • pfSense 2.3-RELEASE Now Available!

    The most significant changes in this release are a rewrite of the webGUI utilizing Bootstrap, and the underlying system, including the base system and kernel, being converted entirely to FreeBSD pkg. The pkg conversion enables us to update pieces of the system individually going forward, rather than the monolithic updates of the past. The webGUI rewrite brings a new responsive look and feel to pfSense requiring a minimum of resizing or scrolling on a wide range of devices from desktop to mobile phones.

  • pfSense 2.3 Released With New Web UI

    BSD --
    PfSense 2.3 was released today as the newest version of this popular FreeBSD-based firewall/router OS appliance software.

    The pfSense 2.3 release has a rewritten web GUI that's now making use of Bootstrap to provide a clean and responsive experience. The pfSense 2.3 release also converts the underlying system now to completely using FreeBSD's pkg for package management, and there are various other underlying updates.

  • pfSense 2.3 BSD-Based Firewall Officially Released with Revamped webGUI, More

    Electric Sheep Fencing LLC., through Chris Buechler, today, April 12, 2016, has had the great pleasure of announcing the release of the stable pfSense 2.3 BSD-based firewall operating system.

Security Leftovers

Filed under
Security
  • Tuesday's security updates
  • Leaving Beta, New Sponsors

    Let’s Encrypt is leaving beta today. We’re also excited to announce that founding sponsors Cisco and Akamai have renewed their Platinum sponsorships with 3-year commitments, Gemalto is joining as our newest Gold sponsor, and HP Enterprise, Fastly, Duda and ReliableSite.net are our newest Silver sponsors.

  • Mozilla-supported Let’s Encrypt goes out of Beta

    In 2014, Mozilla teamed up with Akamai, Cisco, the Electronic Frontier Foundation, Identrust, and the University of Michigan to found Let’s Encrypt in order to move the Web towards universal encryption. Today, Let’s Encrypt is leaving beta. We here at Mozilla are very proud of Let’s Encrypt reaching this stage of maturity

    Let’s Encrypt is a free, automated and open Web certificate authority that helps make it easy for any Web site to turn on encryption. Let’s Encrypt uses an open protocol called ACME which is being standardized in the IETF. There are already over 40 independent implementations of ACME. Several web hosting services such as Dreamhost and Automattic, who runs WordPress.com, also use ACME to integrate with Let’s Encrypt and provide security that is on by default.

  • Experts crack nasty ransomware that took crypto-extortion to new heights

    A nasty piece of ransomware that took crypto-extortion to new heights contains a fatal weakness that allows victims to decrypt their data without paying the hefty ransom.

    When it came to light two weeks ago, Petya was notable because it targeted a victim's entire startup drive by rendering its master boot record inoperable. It accomplished this by encrypting the master boot file and displaying a ransom note. As a result, without the decryption password, the infected computer wouldn't boot up, and all files on the startup disk were inaccessible. A master boot record is a special type of boot sector at the very beginning of partitioned hard drive, while a master boot file is a file on NTFS volumes that contains the name, size and location of all other files.

  • Open source code is rarely patched when vulnerabilities are found [Ed: propaganda from Microsoft proxies makes it through to other sites]

    Open source code is a convenient and cost-effective way for developers to build apps. However, as CIO noted in a recent article, once that code makes its way into an app, it's rarely ever updated to fix vulnerabilities that are found later. CIO offered up some tips on how to keep open source products secure.

Isolating processes with Qubes OS 3.1

Filed under
GNU
Linux
Security

There are several approaches to computer security. One method is to try to make every component work as correctly and error-free as possible. This is called security through correctness. Another approach is called security by obscurity and it involves hiding secrets or flaws. A third approach to security is isolation, which is sometimes called security by compartmentalization. This third method keeps important pieces separate so if one component is compromised, the other components can continue to work, unaffected.

These different styles of security might make more sense if we look at an example from the non-digital world. Imagine we have some valuables we want to keep locked away and we decide to buy a safe to store our precious documents, jewels and money. If we buy a high quality safe that is hard to force open, that is security through correctness. If we hide our safe behind a picture or in a secret room, that is security through obscurity. Buying two safes and placing half of our valuables in each so if one is robbed then we still have half of our items is an example of security by compartmentalization.

Read more

Syndicate content

More in Tux Machines

Leftovers: OSS

Security Leftovers

  • Security updates for Thursday
  • OpenSSL patches two high-severity flaws
    OpenSSL has released versions 1.0.2h and 1.0.1t of its open source cryptographic library, fixing multiple security vulnerabilities that can lead to traffic being decrypted, denial-of-service attacks, and arbitrary code execution. One of the high-severity vulnerabilities is actually a hybrid of two low-risk bugs and can cause OpenSSL to crash.
  • Linux Foundation Advances Security Efforts via Badging Program
    The Linux Foundation Core Infrastructure Initiative's badging program matures, as the first projects to achieve security badges are announced.
  • Linux Foundation tackles open source security with new badge program
  • WordPress Plugin ‘Ninja Forms’ Security Vulnerability
    FOSS Force has just learned from Wordfence, a security company that focuses on the open source WordPress content management platform, that a popular plugin used by over 500,000 sites, Ninja Forms, contains serious security vulnerabilities.
  • Preparing Your Network for the IoT Revolution
    While there is no denying that IP-based connectivity continues to become more and more pervasive, this is not a fundamentally new thing. What is new is the target audience is changing and connectivity is becoming much more personal. It’s no longer limited to high end technology consumers (watches and drones) but rather, it is showing up in nearly everything from children’s toys to kitchen appliances (yes again) and media devices. The purchasers of these new technology-enabled products are far from security experts, or even security aware. Their primary purchasing requirements are ease of use.
  • regarding embargoes
    Yesterday I jumped the gun committing some patches to LibreSSL. We receive advance copies of the advisory and patches so that when the new OpenSSL ships, we’re ready to ship as well. Between the time we receive advance notice and the public release, we’re supposed to keep this information confidential. This is the embargo. During the embargo time we get patches lined up and a source tree for each cvs branch in a precommit state. Then we wait with our fingers on the trigger. What happened yesterday was I woke up to a couple OpenBSD developers talking about the EBCDIC CVE. Oh, it’s public already? Check the OpenSSL git repo and sure enough, there are a bunch of commits for embargoed issues. Pull the trigger! Pull the trigger! Launch the missiles! Alas, we didn’t look closely enough at the exact issues fixed and had missed the fact that only low severity issues had been made public. The high severity issues were still secret. We were too hasty.
  • Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan [Ed: Windows]
    A critical medical equipment crashed during a heart procedure due to a timely scan triggered by the antivirus software installed on the PC to which the said device was sending data for logging and monitoring.
  • Hotel sector faces cybercrime surge as data breaches start to bite
    Since 2014, things have become a lot more serious with a cross section of mostly US hotels suffering major breaches during Point-of-Sale (POS) terminals. Panda Security lists a string of attacks on big brands including on Trump Hotels, Hilton Worldwide, Hyatt, Starwood, Rosen Hotels & Resorts as well two separate attacks on hotel management outfit White Lodging and another on non-US hotel Mandarin Oriental.

Android Leftovers

today's howtos