Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security

5 Open Source Network Security Tools SMBs Should Consider

Filed under
OSS
Security

You might think that because your business is small you aren't an attractive target for hackers.

But you would be wrong.

According to the National Cyber Security Alliance (NCSA), 82 percent of small business owners believe that they are not a target for cyberattacks, but 43 percent of last year's cyberattacks targeted SMBs. And a single attack can cost SMBs up to $99,000.

Cyberattacks of all kinds are on the rise with data breaches increasing 15 percent over the past year, NCSA says. And ransomware, attacks that freeze up organizations' systems until they pay a ransom, has become particularly prevalent; in just the first three months of 2016, U.S. ransomware victims paid out $209 million to attackers, compared to $25 million for all of 2015.

Read more

IRC News, Freenode Update

Filed under
OSS
Security
Web

Security News

Filed under
Security
  • OpenSSL After Heartbleed by Rich Salz & Tim Hudson, OpenSSL

    In this video from LinuxCon Europe, Rich Salz and Tim Hudson from the OpenSSL team take a deep dive into what happened with Heartbleed and the steps the OpenSSL team are taking to improve the project.

  • OpenSSL after Heartbleed
  • Container Security: Your Questions Answered

    To help you better understand containers, container security, and the role they can play in your enterprise, The Linux Foundation recently produced a free webinar hosted by John Kinsella, Founder and CTO of Layered Insight. Kinsella covered several topics, including container orchestration, the security advantages and disadvantages of containers and microservices, and some common security concerns, such as image and host security, vulnerability management, and container isolation.

  • Google scales tiny mountain to hunt down crypto bugs

    Google's Project Wycheproof is a new effort by Google to improve the security of widely used cryptography code.

    Many of the algorithms used in cryptography for encryption, decryption, and authentication are complicated, especially when asymmetric, public key cryptography is being used. Over the years, these complexities have resulted in a wide range of bugs in real crypto libraries and the software that uses them.

  • Mysterious Rakos Botnet Rises in the Shadows by Targeting Linux Servers, IoT Devices

    Somebody is building a botnet by infecting Linux servers and Linux-based IoT devices with a new malware strain named Rakos.

Where Does Ubuntu Fit Into the Internet of Things?

Filed under
Security
Ubuntu

Ubuntu Linux started off as a desktop focused Linux distribution, but has expanded to multiple areas of the years. Ubuntu Linux is today a leading Linux server and cloud vendor and has aspirations to move into the embedded world, known today as the Internet of Things (IoT).

In a video interview, Mark Shuttleworth, founder of Ubuntu and Canonical Inc., details some of the progress his firm has made in 2016 in the IoT world.

Ubuntu has made past announcements about phone and TV efforts. While multiple Ubuntu phones exist, the standalone Ubuntu TV effort has evolved somewhat. Shuttleworth explained that Ubuntu Core, which is an optimized distribution of Ubuntu for embedded systems, is making some headway with TVs.

Read more

Security News

Filed under
Security
  • Security advisories for Tuesday
  • New Linux/Rakos threat: devices and servers under SSH scan (again) [Ed: No, it’s not a “Linux” problem that some people or developers use a crappy and predictable password]

    Apparently, frustrated users complain more often recently on various forums about their embedded devices being overloaded with computing and network tasks. What these particular posts have in common is the name of the process causing the problem. It is executed from a temporary directory and disguised as a part of the Java framework, namely “.javaxxx”. Additional names like “.swap” or “kworker” are also used. A few weeks ago, we discussed the recent Mirai incidents and Mirai-connected IoT security problems in The Hive Mind: When IoT devices go rogue and all that was written then still holds true.

  • Oi! Linux users! Want some really insecure closed-source software?

    Back in August Adobe reversed its decision to stop offering an NPAPI Flash plugin for Linux and promised that version 23 would come Penguinistas' way real soon now.

    At the time the decision was greeted with surprise, because Adobe had not thought to update Flash for Linux since 2012's version 11.2. But the company decided that Linux users deserved a security upgrade to the infamously hole-ridden product.

And More Security Leftovers

Filed under
Security

Google Releases Test Set to Check Cryptographic Library Security

Filed under
Google
Security

Google has released a set of tests that developers can use to check some open source cryptographic libraries for known security vulnerabilities.

The company has named the set of tests Project Wycheproof, after a mountain in Australia, which has the distinction of being the world's smallest registered mountain.

Read more

Also: Project Wycheproof

What's new in Tor 0.2.9.8?

Filed under
Security

Today, we've released the first stable version of the 0.2.9.x series, bringing exciting new features to Tor. The series has seen 1406 commits from 32 different contributors. Please, see the ChangeLog for more details about what has been done.

This post will outline three features (among many other things) that we are quite proud of and want to describe in more detail.

Read more

Also: Tor 0.2.9 Rolls Out with New Shared-Randomness Protocol, Single Onion Services

DISA looks to open source to squash cyber bugs, reorganizes its data centers

Filed under
OSS
Security

As part of the response to two massive data breaches involving systems at the Office of Personnel Management, the federal government decided to put the Defense Department in charge of building a new information technology backbone to house and process all of the data involved in security clearance investigations, one that would be safer from foreign attacks.

As one way to achieve that goal, the Defense Information Systems Agency, the lead agency in charge of the IT development, is considering opening up the National Background Investigation System’s underlying source code to the general public as soon as it’s fully baked. The theory is that it’s far better for white-hat hackers to find and help squash security bugs before the new system comes online than for bad-guy hackers to discover and make use of them to steal yet another batch of data.

Maj. Gen. Sarah Zabel, DISA’s vice director, said the idea was first proposed to her agency by the Defense Digital Service.

Read more

Syndicate content

More in Tux Machines

OSS Leftovers

  • Nextcloud 12 Officially Released, Adds New Architecture for Massive Scalability
    Nextcloud informs Softpedia today about the official availability of the final release of Nextcloud 12, a major milestone of the self-hosting cloud server technology that introduces numerous new features and improvements. The biggest new feature of the Nextcloud 12 release appears to be the introduction of a new architecture for massive scalability, called Global Scale, which is a next-generation open-source technology for syncing and sharing files. Global Scale increases scalability from tens of thousands of users to hundreds of millions on a single instance, while helping universities and other institutions significantly reduce the costs of their existing large installations.
  • ReactOS 0.4.5 Open-Source Windows-Compatible OS Launches with Many Improvements
    ReactOS 0.4.5 is a maintenance update that adds numerous changes and improvements over the previous point release. The kernel has been updated in this version to improve the FreeLoader and UEFI booting, as well as the Plug and Play modules, adding support for more computers to boot ReactOS without issues.
  • Sprint Debuts Open Source NFV/SDN Platform Developed with Intel Labs
    AT&T has been the headliner in the carrier race to software defined networking (SDN) and network function virtualization (NFV). But Sprint is putting its own stamp on the space this week with its debut of a new open source SDN/NFV mobile core solution.
  • Google’s New Home for All Things Open Source Runs Deep
    Google is not only one of the biggest contributors to the open source community but also has a strong track record of delivering open source tools and platforms that give birth to robust technology ecosystems. Just witness the momentum that Android and Kubernetes now have. Recently, Google launched a new home for its open source projects, processes, and initiatives. The site runs deep and has several avenues worth investigating. Here is a tour and some highlights worth noting.
  • Making your first open source contribution
  • Simplify expense reports with Smart Receipts
    The app is called Smart Receipts, it's licensed AGPL 3.0, and the source code is available on GitHub for Android and iOS.
  • How the TensorFlow team handles open source support
    Open-sourcing is more than throwing code over the wall and hoping somebody uses it. I knew this in theory, but being part of the TensorFlow team at Google has opened my eyes to how many different elements you need to build a community around a piece of software.
  • IRC for the 21st Century: Introducing Riot
    Internet relay chat (IRC) is one of the oldest chat protocols around and still popular in many open source communities. IRC's best strengths are as a decentralized and open communication method, making it easy for anyone to participate by running a network of their own. There are also a variety of clients and bots available for IRC.

Tizen News: Phones and TVs

  • Tizen 3.0-powered Samsung Z4 now available with offline retailers in india
    The Samsung Z4, the fourth smartphone in Samsung’s Z series and a successor to the Z2 (and not the Z3, as many would assume), has been formally announced and made an appearance at the Tizen Developer Conference (TDC 2017) this past week. The Z4 was rumoured to make its way to India on May 19th (Friday) and it did – arriving with offline retailers after launching in the country last Monday (one week ago).
  • Samsung 2017 QLED TVs World First to support autocalibration for HDR
  • Samsung approves You.i TV video platform for Tizen TV app development
    While Samsung has developed Tizen TV apps using JavaScript, You.i TV’s Engine Video app runs on Native Client (NACL), a web technology that does not only allows C++ applications to run in a standard browser but is said to be 24 times faster than JavaScript. Now that Samsung has approved You.i TV’s video engine platform, developers can craft more video content for Tizen Smart TV owners.
  • Samsung Smart TV gets a new Glympse app that enables location sharing on the TV
    Samsung Smart TV, powered by the intuitive, self-developed Tizen operating system, has gotten a cool new app which enables consumers to view the location of their friends, loved ones or even a pizza delivery or cable technician in real-time directly from their home’s largest screen. The new app is developed by Glympse, the leading real-time location services platform.

How To Encrypt DNS Traffic In Linux Using DNSCrypt

​Dnscrypt is a protocol that is used to improve DNS security by authenticating communications between a DNS client and a DNS resolver. DNSCrypt prevents DNS spoofing. It uses cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven’t been tampered with. DNSCrypt is available for multi-platforms including Windows, MacOS, Unix, Android, iOS, Linux and even routers. Read
more

Debian-Based Untangle 13.0 Linux Firewall Tackles Bufferbloat, Adds New Features

Untangle NG Firewall, the open-source and powerful Debian-based network security platform featuring pluggable modules for network apps, has been updated to version 13.0, a major release adding new features and numerous improvements. The biggest improvement brought by the Untangle NG Firewall 13.0 release is to the poor latency generated by excess buffering in networking equipment, called bufferbloat, by supporting a queueing algorithm designed to optimize QoS and bandwidth to enforce a controlled delay. Read more