Security updates for Monday

Recursive DNS Server Fingerprint Problem

Our goal is to identify hijacked resolvers by analyzing their fingerprints, in order to increase safety of Internet users. To do that, we utilize data collected via RIPE Atlas (atlas.ripe.net).

Online developer tutorials are spreading XSS and SQL injection flaws

The researchers, from across three universities in Germany and Trend Micro, checked the PHP code bases of more than 64,000 projects on Github and uncovered more than 100 vulnerabilities that they believe might have been introduced as a result of developers picking up the code that they used from online tutorials.

BrickerBot, the permanent denial-of-service botnet, is back with a vengeance

BrickerBot, the botnet that permanently incapacitates poorly secured Internet of Things devices before they can be conscripted into Internet-crippling denial-of-service armies, is back with a new squadron of foot soldiers armed with a meaner arsenal of weapons.

Reproducible Builds: week 104 in Stretch cycle

Webroot antivirus goes bananas, starts trashing Windows system files

Webroot's security tools went berserk today, mislabeling key Microsoft Windows system files as malicious and temporarily removing them – knackering PCs in the process.

Not only were people's individual copies of the antivirus suite going haywire, but also business editions and installations run by managed service providers (MSPs), meaning companies and organizations relying on the software were hit by the cockup.

Between 1200 and 1500 MST (1800 and 2100 UTC) today, Webroot's gear labeled Windows operating system data as W32.Trojan.Gen – generic-Trojan-infected files, in other words – and moved them into quarantine, rendering affected computers unstable. Files digitally signed by Microsoft were whisked away – but, luckily, not all of them, leaving enough of the OS behind to reboot and restore the quarantined resources.

How The Update Framework Improves Security of Software Updates

Updating software is one of the most important ways to keep users and organizations secure. But how can software be updated securely? That's the challenge that The Update Framework (TUF) aims to solve.

Justin Cappos, assistant professor at New York University, detailed how TUF works and what's coming to further improve the secure updating approach in a session at last week's DockerCon 17 conference in Austin, Texas. Simply using HTTPS and Transport Layer Security (TLS) to secure a download isn't enough as there have been many publicly reported instances of software repositories that have been tampered with, Cappos said.

Security Updates for Ubuntu Phone to End in June

Security updates for Ubuntu phone and tablet will end this June, Canonical has confirmed. Current OTA updates are currently limited to critical fixes and security updates — a decision we were first to tell you back in January. But after June 2017 Canonical “will no longer deliver any further updates”.

Canonical to stop supporting Ubuntu Phone in June

Canonical had already announced development of its Ubuntu Phone software was ending. Now we know when the final nail goes in the coffin: June.

Malware Hunts And Kills Poorly Secured Internet Of Things Devices Before They Can Be Integrated Into Botnets

Researchers say they've discovered a new wave of malware with one purpose: to disable poorly secured routers and internet of things devices before they can be compromised and integrated into botnets. We've often noted how internet-of-broken-things devices ("smart" doorbells, fridges, video cameras, etc.) have such flimsy security that they're often hacked and integrated into botnets in just a matter of seconds after being connected to the internet. These devices are then quickly integrated into botnets that have been responsible for some of the worst DDoS attacks we've ever seen (including last October's attack on DYN).

9 easy things you can do to stay safe on your Android phone

[Older] Microsoft mysteriously fixed security gaps allegedly used by US spies a month before they leaked

Misner’s post showed that three of nine vulnerabilities from the leak were fixed in a March 14 security update. Security commentators were bamboozled. As Ars Technica pointed out, when security holes are discovered, the individual or organization that found them is usually credited in the notes explaining the update. No such acknowledgment was found in the March 14 update.

Russian man gets longest-ever US hacking sentence, 27 years in prison [iophk: "because... computer"]

The Seleznev arrest and trial garnered international attention, in no small part because the 32-year-old hacker is the son of Valery Seleznev, a member of the Russian Parliament and ally to Russian President Vladimir Putin. Valery Seleznev has accused the US of "kidnapping" his son.

Security updates for Friday

Network Firewalls: How to Protect Your Network from Unauthorized Access

The Architecture of the Web Is Unsafe for Today's World

The Internet is based on protocols that assume content is secure. A new, more realistic model is needed.

Twenty-eight years ago, British computer scientist Tim Berners-Lee proposed a system to link text documents across a computer network. It changed the way the world communicates and does business. From its humble beginnings, the Internet has become a complex, dynamic, and heterogeneous environment.

Today, the Internet revolution's main instrument, the Web browser, exposes users to unbounded malicious content and has become unmanageable.

How did browsers become such a liability? Because they're based on an ancient set of communication rules, protocols that assume connections are secure and content is safe. The openness and utility of the protocols led to enormous innovation. But today, with all its sophistication, the Web is still based on protocols that weren't designed for security or enterprise-class management.

In encrypted-messaging market, open source not only key to success [Ed: Overlooked the point that easy-to-use programs whose sources code you cannot study are worse than nothing, just a trap. In this age of government-mandated back doors in programs and protocols the term "proprietary encryption" should be a paradox.]

A couple months ago, one of the oldest encrypted, ephemeral messaging apps, Wickr, decided to open up its cryptographic code for the world. By allowing hackers and developers to examine their crypto code, it reasoned, it could earn a veritable security merit badge. And the approach had already boosted the appeal of another secure-messaging app, Signal.

At least on the surface, Wickr’s open-source move appears to be paying off. Scott Stender, vice president of cryptography at NCC Group, a British company that specializes in helping clients manage cybersecurity risks, says it influenced his company’s decision to use Wickr, which incorporates end-to-end encryption, to keep its internal communications private.

Self Driving Taxis Are Going To Be A Nightmare To Secure, Warns Ex-Uber Security Researcher [Ed: Trams, trains, subways etc. go on rails; flights managed by programs nowadays. But there's a reason a pilot/driver is still crucial. Same for cars. Unless your driver/pilot is a suicidal maniac (which happens), the negative impact of accident on her/him helps secure the passengers.]

So over the last few years you probably remember seeing white hat hackers demonstrate how easily most modern smart cars can be hacked, often with frightening results. Cybersecurity researchers Charlie Miller and Chris Valasek have made consistent headlines in particular by highlighting how they were able to manipulate and disable a Jeep Cherokee running Fiat Chrysler's UConnect platform. Initially, the duo documented how they were able to control the vehicle's internal systems -- or kill it's engine entirely -- from an IP address up to 10 miles away.

Majority of open source has security flaws [Ed: So Black Duck markets itself by attacking FOSS again. Microsoft-connected FUD firm.]

Buggy open source components still dog dev teams [Ed: IDG too is feeding them...]

Researchers find commercial banking apps contain swarms of open-source bugs [Ed: [No, Osborne, Black Duck are not "researchers", they're Microsoft goons]

Black Duck audit highlights risk of open-source security vulnerabilities [Ed: No, Black Duck is just doing marketing by attacking FOSS, as usual]

Black Duck Open Source audits of 1000+ applications show widespread weakness in addressing open source security vulnerability risks [Ed: this is their press release]