Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • Cryptsetup Vulnerability Allows Easily Getting To A Root Shell

    CVE-2016-4484 was disclosed on Monday as a Cryptsetup issue that allows users to easily gain access to a root initramfs shell on affected systems in a little over one minute of simply hitting the keyboard's enter key.

    This Cryptsetup vulnerability is widespread and easy to exploit, simply requiring a lot of invalid passwords before being dropped down a root shell. The data on the LUKS-encrypted volume is still protected, but you have root shell access. The CVE reads, "This vulnerability allows to obtain a root initramfs shell on affected systems. The vulnerability is very reliable because it doesn't depend on specific systems or configurations. Attackers can copy, modify or destroy the hard disc as well as set up the network to exflitrate data. This vulnerability is specially serious in environments like libraries, ATMs, airport machines, labs, etc, where the whole boot process is protect (password in BIOS and GRUB) and we only have a keyboard or/and a mouse."

  • CVE-2016-4484: Cryptsetup Initrd root Shell
  • Security updates for Tuesday
  • Super Mari-owned: Startling Nintendo-based vulnerability discovered in Ubuntu

Security News

Filed under
Security
  • Boy, 17, admits TalkTalk hacking offences

    A 17-year-old boy has admitted hacking offences linked to a data breach at the communications firm TalkTalk.

    Norwich Youth Court was told he had used hacking tool software to identify vulnerabilities on target websites.

  • Upgrade for KDE neon Security Issue

    Last month we moved the neon archive to a new server so packages got built on our existing server then uploaded to the new server. Checking the config it seemed I’d made the nasty error of leaving it open to the world rather than requiring an ssh gateway to access the apt repository, so anyone scanning around could have uploaded packages. There’s no reason to think that happened but the default in security is to be paranoid for any possibility.

  • Security B-Sides conferences attract growing information security crowd

    The Security B-Sides DC conference is part of the B-Sides movement, which was created to provide a community framework to build events for and by information security practitioners. Alex Norman, the co-director of Security B-Sides DC, tells us how he wants to expand information security beyond security professionals, and to involve a larger, more diverse community.

Security News

Filed under
Security
  • Security advisories for Monday
  • Major Linux security hole gapes open

    An old Linux security 'feature' script, which activates LUKS disk encryption, has been hiding a major security hole in plain sight.

  • How to Secure Your Ubuntu Network

    In 2016, keeping your Ubuntu network secure is more important than ever. Despite what some people might think, there's much more to this than merely putting up a router to protect a network. You must also configure each of your PCs properly to ensure you're operating within a secure Ubuntu network. This article will show you how.

  • Linux Foundation Back Reproducible Builds Effort for Secure Software

    Building software securely requires a verifiable method of reproduction and that is why the Linux Foundation's Core Infrastructure Initiative is supporting the Reproducible Builds Project.

    In an effort to help open-source software developers build more secure software, the Linux Foundation is doubling down on its efforts to help the reproducible builds project. Among the most basic and often most difficult aspects of software development is making sure that the software end-users get is the same software that developers actually built.

Security Leftovers

Filed under
Security
  • Linux Foundation doubles down on support for tamper-free software

    The Linux Foundation’s Core Infrastructure Initiative (CII) is renewing its financial support for a project that ensures binaries produced from open source software projects are free of tampering.

    The Reproducible Builds Project provides tools and best practices to software projects to ensure that the binaries generated by a compilation process are identical each time and can be matched to the source code used to build them.

  • 3 encryption tools for Linux that will keep your data safe

    Encryption is an interesting thing. The first time I saw encryption in action was on a friend’s Gentoo Linux laptop that could only boot if the USB key with the boot partition and decryption key was inserted. Cool stuff, from a geek point-of-view.

    Fast forward, and revelations from Edward Snowden and ongoing concerns about government snooping are slowly bringing encryption and privacy tools into the mainstream. Even if you’re not worried about a Big Brother or some shady spy-versus-spy scenario, encryption can still protect your identity and privacy if your laptop is stolen. Think of all the things we keep on laptops: contact information, financial information, and client and company information. All of that data is worthy of protection. Luckily, Linux users have access to several tools for the affordable price of free.

    There are three main methods for protecting the data on your laptop, each with its own strengths and weaknesses.

  • The Network Standard Used in Cars Is Wide Open to Attack

    The networked electronics found under the hood of modern automobiles enable a great many useful and cool things, such as fuel-saving engine optimizations, parking assist mechanisms, collision avoidance systems, and myriad further applications most often involving sensing and the passing of data among vehicular systems and human drivers. As is pretty much always the case when electronics become networked, this connectivity also offers hackers new potential exploits.

    According to research presented last month at the ACM Conference on Computer and Communications Security in Vienna, courtesy of computer scientists at the University of Michigan (and Adrian Colyer's excellent The Morning Paper), the controller area network (CAN) protocol implemented by in-vehicle networks has a new and potentially quite dangerous vulnerability. The attack, known as a bus-off attack, exploits the CAN's built-in error handling facilities to potentially nuke both contemporary insecure CANs and future secured versions.

  • Top 5 Rootkit Threats and How to Root Them out

    Rootkits are much in the news lately. They were recently sighted in the Street Fighter V video game, critical infrastructure controls and even Yahoo email servers.

    In the case of Yahoo, the spying tool that the U.S. government ordered the company to install on its servers was a "buggy" rootkit that concealed itself on Yahoo's systems and provided the government with a backdoor into Yahoo emails, according to an article in Motherboard.

Security Leftovers

Filed under
Security
  • Google Pixel Phone Hacked in 60 Seconds at PwnFest 2016

    The brand new Android smartphone launched by Google just a few months back has been hacked by Chinese hackers just in less than a minute.

    Yes, the Google's latest Pixel smartphone has been hacked by a team white-hat hackers from Qihoo 360, besides at the 2016 PwnFest hacking competition in Seoul.

  • Too Big to Fail Open-Source Software Needs Hacker Help

    The internet runs on free and open-source code. LAMP is shorthand for the basic stack of applications that makes the internet work. It stands for: Linux, Apache, MySQL and PHP. Together, those four pieces of software provide the foundation that lets us share both important data and elaborately filtered selfies all over the world. They are also all free and open-source projects, maintained by core teams of developers. These workers are the saints of the information age.

    Open-source has a tendency to be more stable than proprietary code, thanks in no small part to what’s called Linus’s Law: “given enough eyeballs, all bugs are shallow.” Because open-source projects invite anyone to contribute, the idea is that lots of developers and testers will find and fix all the problems. It’s worked well so far, but it’s a theory that gets a bit creakier with age, as we’ve begun to see.

  • Heimdall Open-Source PHP Ransomware Targets Web Servers
  • Infect to Protect

    I’m not one to jump on each and every bandwagon I see. Sometimes that’s a good decision, sometimes it’s better to just wait and see where they go before taking any action.

    Containers are one of those ideas that, while promising and intriguing, were quite clumsy in the beginning, so I ignored them for a good while. It’s sufficiently mature now; so much so that’s quite difficult to ignore them. Time to investigate them again.

    [...]

    While the prototype I built isn’t practical and is of very limited use, I find the idea of sandboxed programs without the need for specialized runtimes very enticing.

    Programs can be still packaged the way they have been packaged in the past decades, without throwing away some of the sandboxing benefits that containers provide, all the while not introducing new concepts for users.

    Of course, something like this – even if properly implemented – won’t be a replacement for containers. Specially if one considers their role as packets ready for deployment, which have a lot of value for devops personnel.

    The code, as usual, is open source, and available from this Git repository.

Security Leftovers

Filed under
Security

Canonical Patches Multiple Kernel Vulnerabilities in All Supported Ubuntu OSes

Filed under
Security

Today, November 11, 2016, Canonical published several security advisories to inform users of the Ubuntu Linux operating system about new kernel updates that patch multiple vulnerabilities discovered lately.

Read more

The Future of IoT: Containers Aim to Solve Security Crisis

Filed under
Security

Despite growing security threats, the Internet of Things hype shows no sign of abating. Feeling the FoMo, companies are busily rearranging their roadmaps for IoT. The transition to IoT runs even deeper and broader than the mobile revolution. Everything gets swallowed in the IoT maw, including smartphones, which are often our windows on the IoT world, and sometimes our hubs or sensor endpoints.

New IoT focused processors and embedded boards continue to reshape the tech landscape. Since our Linux and Open Source Hardware for IoT story in September, we’ve seen Intel Atom E3900 “Apollo Lake” SoCs aimed at IoT gateways, as well as new Samsung Artik modules, including a Linux-driven, 64-bit Artik7 COM for gateways and an RTOS-ready, Cortex-M4 Artik0. ARM announced Cortex-M23 and Cortex-M33 cores for IoT endpoints featuring ARMv8-M and TrustZone security.

Read more

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security
  • IoTSeeker Scanner Finds Smart Devices With Dumb Credentials

    The IoTSeeker tool from Rapid7 is designed to comb through users’ networks and identify common IoT devices with default usernames and passwords enabled. Those are the devices upon which botnets such as Mirai feed, especially those with telnet exposed on default ports. Mirai searches for devices with telnet enabled and using default credentials and then compromises them and begins scanning again.

  • DDoS Attack and Resiliency Measures

    Recently DDoS has come into the news because of recent attack (by IoT devices) on Twitter. Although DDoS is not a new kind of attack, because of the advent of IoT, the "smart" devices are new victims for web-based attacks, and as per the predictions it is more likely to grow. What makes this situation even more perilous is the rapid growth of IoT devices out there on the market. As per the estimate, there would be around 50 billion connected devices by the year 2020.

    The DDoS attacks cannot be mitigated completely but by taking some measures the effect can be minimized. This is the theme of this article. Let’s first understand...

  • Donald Trump's campaign website 'hacked' by little poop emoji

    For a few hours the banner of Donald Trump's website contained a familar face. The poop emoji.

    Perhaps foreshadowing the state in which we're in, the little character appeared in the banner of donaldjtrump.com on Tuesday afternoon.

    This was a bug rather than a hack, and it allowed users to write in whatever they wished by adding it into the URL.

Syndicate content

More in Tux Machines

GNOME To Do 3.24 release, and it’s shining

GNOME To Do is a personal task manager for GNOME. It uses GNOME technologies and integrates very well with the desktop. And now, it’s finally being released! The 3.24 version comes with a few nice features and, most importantly, whole load of bugfixes. Let’s get started! Read more

TrueOS STABLE Update: 4/24/17

After testing the UNSTABLE push over the weekend, the devs are happy to release a new STABLE update and installation files today! This update consists of two parts: installer changes for those who install TrueOS fresh, and general updates for systems with TrueOS already installed. Read more Also: TrueOS 20170424 Stable Update

How to track and secure open source in your enterprise

Recently, SAS issued a rather plaintive call for enterprises to limit the number of open source projects they use to a somewhat arbitrary percentage. That seems a rather obvious attempt to protest the rise of the open source R programming language for data science and analysis in a market where SAS has been dominant. But there is a good point hidden in the bluster: Using open source responsibly means knowing what you’re using so you can track and maintain it. Read more

How I became a webcomic artist in less than a month with open source tools

If you are reading this, you probably care about, or are at least mildly interested in, open source. Like you, I care about and am interested in open source. Perhaps unlike you, I am also a webcomic artist. You can find my work at Herpaderp.party. Read more