Language Selection

English French German Italian Portuguese Spanish

Security

Grsecurity SLAPP Case Defeated

Filed under
GNU
Security
Legal
  • Kernel hardening group's suit against open source advocate thrown out

    A judge in San Francisco has granted a motion by noted open source advocate Bruce Perens to dismiss a defamation suit filed against him by Grsecurity, a group that supplies a patch for hardening the Linux kernel.

    Magistrate judge Laurel Beeler agreed to Perens' (right, below) motion on Thursday but denied his bid to invoke the anti-SLAPP (Strategic Lawsuit Against Public Participation) law in California.

    This law deals with legal complaints that are directed at stopping public discussion and free speech. California put in place an anti-SLAPP law in 1992.

  • Court Throws Out Libel Lawsuit Brought by Open Source Security

    The defendant Bruce Perens -- who is a respected programmer known for his founding of the Open Source Initiative -- criticized OSS's business model for distributing its security patches on the ground that it violated the open-source license and thus potentially subjected users to liability for copyright infringement or breach of contract. The plaintiffs [sued, basically for defamation -EV]....

Security: Russia, China, Mirai Variant, Firefox and Grsecurity/Perens

Filed under
Security

Security: Russia, China, Mirai Variant, Firefox and Grsecurity/Perens

Filed under
Security

Linux >=4.9: eBPF memory corruption bugs

Filed under
Linux
Security

A few BPF verifier bugs in the Linux kernel, most of which can be used
for controlled memory corruption, have been fixed over the last days.
One of the bugs was introduced in 4.9, the others were only introduced
in 4.14.

The fixes are in the net tree of the Linux kernel
(https://git.kernel.org/pub/scm/linux/kernel/git/davem/net...),
but not in Linus' tree yet.

The following bug was introduced in 4.9:

Read more

Security: NSA Explots, Wi-Fi, and BPF

Filed under
Security
  • Zealot Loads Cryptocurrency Miner on Linux, Windows Machines

    A new Apache Struts campaign that researchers named "Zealot" has come to light in recent weeks. Zealot loads Windows or Linux-based machines by installing a miner for Monero, which has become one of the hottest cryptocurrencies used in recent malware attacks.

  • 8 Best WiFi Hacking Software And Analysis Tools You Should Use In 2018

    Security analysis and penetration testing is an integral part of creating any kind of secure network. This brings us to the WiFi hacking software that could be used for ethically testing a wireless network and make amends. In the past, we’ve already covered the top wireless security apps for Android and now it’s the turn of such tools for your PC. In case you’re looking for a more diverse collection of tools (not for just wireless analysis), you can refer to another list.

  • BPF security issues in Debian

    Since Debian 9 "stretch", we've shipped a Linux kernel supporting the "enhanced BPF" feature which allows unprivileged user space to upload code into the kernel. This code is written in a restricted language, but one that's much richer than the older "classic" BPF. The kernel verifies that the code is safe (doesn't loop, only accesses memory it is supposed to, etc.) before running it. However, this means that bugs in the verifier could allow unsafe programs to compromise the kernel's security.

Security: Windows and Facebook Messenger

Filed under
Security
  • “I Just Pressed Shift Key 5 Times” — User Gains Full Access On A Windows XP ATM Machine

    When you’re running Windows XP in today’s times, you shouldn’t expect your machine to fully bulletproof against different kinds of malware attacks. Now combine it with some poor implementation on an ATM machine that demands heavy security measures and you’ve got a recipe for disaster.

  • Windows XP ATM Machine “Hacked” by Simply Pressing Shift Five Times in a Row

    We’ve known for a while that ATM machines running Windows XP (Embedded version or not) are exposed to attacks, but when we mix the lack of updates with bad configuration from IT admins what we get is a vulnerability that’s worryingly easy to exploit.

    One of the users of Russian blogging platform Habrahabr discovered that an ATM machine operated by state-owned bank Sberbank runs Windows XP and suffers from a security hole that makes it possible for pretty much anyone to completely hack it.

    While it’s not hard to figure out what hacking of an ATM machine means, it appears that the full-screen lock system that prevented the ATM interface from accessing other parts of the operating system could be bypassed by simply invoking Sticky Keys.

  • Cryptojacking Bot “Digimine” Spreading Via FB Messenger in Google Chrome Desktop

    Cryptocurrency mining is on the rise and so does the number of instances where wrong ways are used to harvest the digital currency. Just a day before yesterday, we told you about the Loapi Android malware that mines Monero on your device. Even if you’re sitting at a place like Starbucks, mining can happen anytime.

  • Digmine Cryptocurrency Miner Spreading via Facebook Messenger

    We found a new cryptocurrency-mining bot spreading through Facebook Messenger, which we first observed in South Korea. We named this Digmine based on the moniker (비트코인 채굴기 bot) it was referred to in a report of recent related incidents in South Korea. We’ve also seen Digmine spreading in other regions such as Vietnam, Azerbaijan, Ukraine, Vietnam, Philippines, Thailand, and Venezuela. It’s not far-off for Digmine to reach other countries given the way it propagates.

Security: Updates, Synopsys/Black Duck FUD, and Two-Factor Security Authentication

Filed under
Security
  • Security updates for Thursday
  • Synopsys: Going the distance with open source vulnerabilities [Ed: Having absorbed the Microsoft-connected FUD firm Black Duck, Synopsys is now a FUD source against FOSS. Puff pieces like these one will be common.]
  • Twitter Expands Two-Factor Security Authentication Options

    Back in May 2013, Twitter first added a Two-Factor Authentication (2FA) capability to its service, relying on SMS to deliver a six-digit login code. Now after four and a half years, Twitter is adding new options, announcing on Dec. 20 that its' 2FA approach will support third party tools.

    Twitter calls its' 2FA approach login verification and it provides a second layer of authentication and protection for Twitter accounts. Rather than just having a username and a password to get access to an account, 2FA approaches require a second password, that is randomly generated by a secondary device, or service like SMS.

    "We're rolling out an update to login verification," the official Twitter Safety account wrote in a message. "You’ll now be able to use a third party app for two-factor authentication instead of SMS text messages."

Security: Talking to Your Family About Digital Security, VLC, Rutkowska's Talk and Updates

Filed under
Security
  • How to Talk to Your Family About Digital Security

    You and your family are sipping hot cocoa, gathered around the [holiday object of your choice], and your family member suddenly asks: “Can you help me with my [insert device here]?”

    They need a question answered about their computer, phone, tablet, video game console, or internet-connected device. Maybe they have related questions about their online accounts.

    Or maybe there is a teenager or college student in your family that posts intensely personal information online, and has just realized that they should probably maintain more privacy in their online lives—but isn’t sure how to start.

  • EU offers cash bounties to improve the security of VLC media player

    You can now submit bugs you find in VLC Media Player on HackerOne, where bounties ranging from $100 for low-severity bugs and up to $2,000 for critical bugs are offered.

    With a total budget of €60,000, the VLC bug bounty is only a first “proof of concept” bug bounty in order to learn more about how to run future bounties within FOSSA-2.

  • Security through Distrusting

    At one extreme, we would like to ensure everything (software, hardware, infrastructure) is trusted. This means the code has no bugs or backdoors, patches are always available and deployed, admins always competent and trustworthy, and the infrastructure always reliable…

    On the other end of the spectrum, however, we would like to distrust (nearly) all components and actors, and have no single almighty element in the system.

    In my opinion, the industry has been way too much focused on this first approach, which I see as overly naive and non-scalable to more complex systems.

  • Rutkowska: Trust Makes Us Vulnerable

    Rutkowska argued that security professionals can - and should - minimize their trust in modern technologies, many of which could put users at risk. She presented several examples of how current technology leaves users vulnerable and how they could potentially be made secure.

  • Security updates for Wednesday

Security: Bromium, EternalBlue/EternalSynerg, Updates, Reproducible Builds and Zealot Campaign

Filed under
Security

Security: CryptoJacking Android FUD, North Korea Blamed for NSA/Microsoft Back Doors

Filed under
Security
Syndicate content

More in Tux Machines

Today in Techrights

today's leftovers

  • Debian XU4 images updated
    I've updated my Debian images for the ODROID XU4; the newest build was done before stretch release, and a lot of minor adjustments have happened since then.
  • Parrot 4.0 Ethical Hacking Linux Distro Released
  • FBI says Russians hacked [sic] hundreds of thousands of home and office routers

    The warning followed a court order Wednesday that allowed the FBI to seize a website that the hackers [sic] planned to use to give instructions to the routers. Though that cut off malicious communications, it still left the routers infected, and Friday’s warning was aimed at cleaning up those machines.

  • FBI tells router users to reboot now to kill malware infecting 500k devices

    Researchers from Cisco’s Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers [sic] working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot.

Software and Games: KStars, Opera, OpenStack, MariaDB and More

  • KStars 2.9.6 is Released!
    I'm glad to announce the release of KStars 2.9.6 for Windows, MacOS, and Linux. This is a minor bugfix release.
  • Opera 54 Browser Enters Beta with News on the Speed Dial, Update & Recovery Menu
    Opera has promoted its upcoming Opera 54 web browser to the beta channel, giving us a glimpse of what to expect from the final version, due for release sometime next month. Based on the open-source Chromium 67.0.3396.18 web browser, Opera 54 recently entered beta stages of development with a plethora of new features and improvements, among which we can mention a new Update & Recovery Opera menu page that makes it easier for users to update the web browser and reset it to its default state, including the ability to clear temporary data, such as cookies.
  • OpenStack at a Crossroads
    The OpenStack of a few years ago is dead, however. What has emerged from the hype cycle is a materially different foundation, mission and software stack, with a great deal of change still ahead of it.
  • The OpenStack Foundation grows beyond OpenStack
    The OpenStack Foundation has made a considerable change to its development process and governance structure by introducing two open source projects that are not part of the OpenStack cloud platform. This week, the organization launched version 1.0 of Kata Containers - a runtime system with an emphasis on speed and security, enabling users to boot a VM in as little as five seconds - and introduced a brand new project called Zuul, spinning out the software development and integration platform that has been used by the OpenStack community internally since 2012.
  • Oracle nemesis MariaDB tries to lure enterprise folk with TX 3.0
    Open-source database biz MariaDB has upped the ante in its war against Oracle, promising enterprise customers better compatibility with – and easier migration from – Big Red. The Finnish firm's latest offering, MariaDB TX 3.0, released for GA today, extends the number of use cases to include temporal processing and advanced data protection for sensitive and personally identifiable information, as well as Oracle compatibility. The broad aim is to tap into customers' grumbles over legacy vendor lock-in, while convincing the bigger customers that they can move to an open-source database without compromising performance.
  • The Humble Monthly Bundle just added two great Linux games
    For those that are interested, you can secure a copy of two great Linux games in the current Humble Monthly Bundle. Just added today are: Get Cook, Serve, Delicious! 2!! Ken Follett's The Pillars of the Earth
  • SC-Controller 0.4.3 Released, Support Steam Controller & Sony DS4 Over Bluetooth
    For those looking to manage your Steam Controller and other supported Linux gaming peripheral input devices outside of Steam, there is a new release of the independently-developed SC-Controller Linux user-space software. While Linux 4.18 is bringing the Steam Controller kernel driver, for those looking for a Steam Controller solution right now to enjoy this excellent gaming controller for now outside of Steam, SC-Controller fills that void.

Huawei, Fuchsia and More

  • Huawei will no longer allow bootloader unlocking (Update: Explanation from Huawei)

    "In order to deliver the best user experience and prevent users from experiencing possible issues that could arise from ROM flashing, including system failure, stuttering, worsened battery performance, and risk of data being compromised, Huawei will cease providing bootloader unlock codes for devices launched after May 25, 2018. [...]"

  • Fuchsia Friday: How ad targeting might be a hidden cost of Fuchsia’s structure
     

    Fuchsia, by its nature, comes with the potential for a handful of new opportunities for ad targeting. Let’s peer into the dark side of Fuchsia’s innovative features.

  • iPhone Quarter, ZTE Troubles, Facebook Troubles, Nokia Come-back
     

    So the past month or two? The Quarterly results cycle came in. The item often of great interest is the Apple iPhone performance. 52.2 million iPhones shipped and that gives roughly a flat market share compared to the year before, so about 14%-15%. I'll come and do the full math later of the quarterly data. That race is no longer in any way interesting.

    But two Top 10 smartphone brands ARE in the news. One who is facing imminent death and the other who is making a miraculous return-from-dead. So imminent death and current Top 10 brand first. ZTE. The Trump administration has put a massive squeeze on ZTE and the company is in serious trouble of imminent collapse. Then bizarrely, Trump reversed course and felt he needed to protect CHINESE employment (???) and after yet another typical Trump-mess, we now are at a Never-Neverland where Trump's own party Republicans are revolting against their President and well, ZTE may end up a casualty of this mess. We'll keep an eye on it.

  •