Language Selection

English French German Italian Portuguese Spanish

Security

Security News

Filed under
Security

FOSS and Security

Filed under
OSS
Security
  • Coffee Shop DevOps: How to use feedback loops to get smarter
  • How to design your project for participation

    Working openly means designing for participation. "Designing for participation" is a way of providing people with insight into your project, which you've built from the start to incorporate and act on that insight. Documenting how you intend to make decisions, which communication channels you’ll use, and how people can get in touch with you are the first steps in designing for participation. Other steps include working openly, being transparent, and using technologies that support collaboration and additional ways of inviting participation. In the end, it’s all about providing context: Interested people must be able to get up to speed and start participating in your project, team, or organization as quickly and easily as possible.

  • So long, Firefox Hello!

    After updating my PCLinuxOS install, I noticed that the icon of Firefox Hello had changed: it was read and displayed a message reading "Error!"

    I thought it was a simply login failure, so I logged in and the icon went green, as normal. However, I noticed that Hello did not display the "Start a conversation" window, but one that read "browse this page with a friend".

    A bit confused, I called Megatotoro, who read this statement from Mozilla to me. Apparently, I had missed the fact that Mozilla is discontinuing Hello starting from Firefox 49. Current Firefox version is 48, so...

  • FreeBSD 11.0 Up to Release Candidate State, Support for SSH Protocol v1 Removed

    The FreeBSD Project, through Glen Barber, has had the pleasure of announcing this past weekend the general availability of the first Release Candidate for the upcoming FreeBSD 11.0 operating system, due for release on September 2, 2016.

    It appears to us that the development cycle of FreeBSD 11.0 was accelerated a bit, as the RC1 milestone is here just one week after the release of the fourth Beta build. Again, the new snapshot is available for 64-bit (amd64), 32-bit (i386), PowerPC (PPC), PowerPC 64-bit (PPC64), SPARC64, AArch64 (ARM64), and ARMv6 hardware architectures.

  • Open Source//Open Society Conference Live Blog

    This conference offers 2 huge days of inspiration, professional development and connecting for those interested in policy, data, open technology, leadership, management and team building.

  • White House Source Code Policy Should Go Further

    A new federal government policy will result in the government releasing more of the software that it creates under free and open source software licenses. That’s great news, but doesn’t go far enough in its goals or in enabling public oversight.

    A few months ago, we wrote about a proposed White House policy regarding how the government handles source code written by or for government agencies. The White House Office of Management and Budget (OMB) has now officially enacted the policy with a few changes. While the new policy is a step forward for government transparency and open access, a few of the changes in it are flat-out baffling.

  • The Brewing Problem Of PGP Short-ID Collision Attacks
  • Starwood, Marriott, Hyatt, IHG hit by malware: HEI

    A data breach at 20 U.S. hotels operated by HEI Hotels & Resorts for Starwood, Marriott, Hyatt and Intercontinental may have divulged payment card data from tens of thousands of food, drink and other transactions, HEI said on Sunday.

  • Linux TCP Flaw Leaves 80% Android Phones Open To Spying
  • Good morning Android!

Security News

Filed under
Security
  • Serving Up Security? Microsoft Patches ‘Malicious Butler’ Exploit — Again

    It’s been a busy year for Windows security. Back in March, Microsoft bulletin MS16-027 addressed a remote code exploit that could grant cybercriminals total control of a PC if users opened “specially crafted media content that is hosted on a website.” Just last month, a problem with secure boot keys caused a minor panic among users.

    However, new Microsoft patches are still dealing with a flaw discovered in November of last year — it was first Evil Maid and now is back again as Malicious Butler. Previous attempts to slam this door shut have been unsuccessful. Has the Redmond giant finally served up software security?

  • PGP Short-ID Collision Attacks Continued, Now Targeted Linus Torvalds

    After contacted the owner, it turned out that one of the keys is a fake. In addition, labelled same names, emails, and even signatures created by more fake keys. Weeks later, more developers found their fake "mirror" keys on the keyserver, including the PGP Global Directory Verification Key.

  • Let's Encrypt: Why create a free, automated, and open CA?

    During the summer of 2012, Eric Rescorla and I decided to start a Certificate Authority (CA). A CA acts as a third-party to issue digital certificates, which certify public keys for certificate holders. The free, automated, and open CA we envisioned, which came to be called Let's Encrypt, has been built and is now one of the larger CAs in the world in terms of issuance volume.

    Starting a new CA is a lot of work—it's not a decision to be made lightly. In this article, I'll explain why we decided to start Let's Encrypt, and why we decided to build a new CA from scratch.

    We had a good reason to start building Let's Encrypt back in 2012. At that time, work on an HTTP/2 specification had started in the Internet Engineering Task Force (IETF), a standards body with a focus on network protocols. The question of whether or not to require encryption (via TLS) for HTTP/2 was hotly debated. My position, shared by my co-workers at Mozilla and many others, was that encryption should be required.

Security News

Filed under
Security

Security News

Filed under
Security
  • New FFS Rowhammer Attack Hijacks Linux VMs

    Researchers from the Vrije University in the Netherlands have revealed a new version of the infamous Rowhammer attack that is effective at compromising Linux VMs, often used for cloud hosting services.

  • Fixing Things

    Recent reports that TCP connections can be hijacked have kicked an anthill at Kernel.org. Linus and others have a patch.

  • Minica - lightweight TLS for everyone!

    A while back, I found myself in need of some TLS certificates set up and issued for a testing environment.

    I remembered there was some code for issuing TLS certs in Docker, so I yanked some of that code and made a sensable CLI API over it.

  • Guy Tricks Windows Tech Support Scammers Into Installing Ransomware Code

    A man named Ivan Kwiatkowski managed to install Locky ransomware on the machine of a person who was pretending to be a tech support executive of a reputed company. Ivan wrote his experiences in a blog post tells that how the tech support scammer fell into the pit he dug for innocent people.

Security News

Filed under
Security
  • Hacker demonstrates how voting machines can be compromised [Ed: Microsoft inside]

    Concerns are growing over the possibility of a rigged presidential election. Experts believe a cyberattack this year could be a reality, especially following last month's hack of Democratic National Committee emails.

    The ranking member of the Senate Homeland Security Committee sent a letter Monday to the Department of Homeland Security, saying in part: "Election security is critical, and a cyberattack by foreign actors on our elections systems could compromise the integrity of our voting process."

    Roughly 70 percent of states in the U.S. use some form of electronic voting. Hackers told CBS News that problems with electronic voting machines have been around for years. The machines and the software are old and antiquated. But now with millions heading to the polls in three months, security experts are sounding the alarm, reports CBS News correspondent Mireya Villarreal.

  • Another Expert Weighs in on Election Hacking

    Today the old Gray Lady, the New York Times, no less, weighed in on election hacking in an Op/Ed piece titled The Election Won't be Rigged. But it Could be Hacked. Of course, anyone who's read my second cybersecurity thriller, The Lafayette Campaign, a Tale of Election and Deceptions, already knew that.

    The particular focus of the NYT article is that since voting can be hacked, it's vital to have a way to audit elections after they occur to see whether that has been the case, and to reveal the true electoral result.

  • New release: usbguard-0.5.11
  • Linux.Lady Trojan Turns Redis Servers to Mining Rigs

Security Leftovers

Filed under
Security
  • Troyan Virus Turns Linux Servers into Bitcoin Miners

    A new and dangerous computer virus has been targeting Linux servers, its goal: to turn computer servers into Bitcoin miners. The attack is aimed at environments running the Redis NoSQL database, the virus is also able to probe the network interfaces of its hosts to propagate itself.

    Approximately more than 30,000 servers running the Redis database are in danger due to the lack of an access password. The virus is named “Linux.Lady” and it was discovered first by the Russian IT-security solutions vendor Dr. Web. The company released a report on the virus, classifying it into the Troyan subcategory.

  • A New Wireless Hack Can Unlock 100 Million Volkswagens

    In 2013, when University of Birmingham computer scientist Flavio Garcia and a team of researchers were preparing to reveal a vulnerability that allowed them to start the ignition of millions of Volkswagen cars and drive them off without a key, they were hit with a lawsuit that delayed the publication of their research for two years. But that experience doesn’t seem to have deterred Garcia and his colleagues from probing more of VW’s flaws: Now, a year after that hack was finally publicized, Garcia and a new team of researchers are back with another paper that shows how Volkswagen left not only its ignition vulnerable but the keyless entry system that unlocks the vehicle’s doors, too. And this time, they say, the flaw applies to practically every car Volkswagen has sold since 1995.

  • Almost every Volkswagen sold since 1995 can be unlocked with an Arduino

    The first affects almost every car Volkswagen has sold since 1995, with only the latest Golf-based models in the clear. Led by Flavio Garcia at the University of Birmingham in the UK, the group of hackers reverse-engineered an undisclosed Volkswagen component to extract a cryptographic key value that is common to many of the company's vehicles.

  • Road Warriors: Beware of ‘Video Jacking’

    A little-known feature of many modern smartphones is their ability to duplicate video on the device’s screen so that it also shows up on a much larger display — like a TV. However, new research shows that this feature may quietly expose users to a simple and cheap new form of digital eavesdropping.

    Dubbed “video jacking” by its masterminds, the attack uses custom electronics hidden inside what appears to be a USB charging station. As soon as you connect a vulnerable phone to the appropriate USB charging cord, the spy machine splits the phone’s video display and records a video of everything you tap, type or view on it as long as it’s plugged in — including PINs, passwords, account numbers, emails, texts, pictures and videos.

Security News

Filed under
Security
  • One bug to rule them all: 'State-supported' Project Sauron malware attacks world's top PCs

    Two top electronic security firms have discovered a new powerful malware suite being used to target just dozens of high-value targets around the world. The research shows that it was likely developed on the orders of a government engaging in cyber espionage.

    The California-based Symantec has labeled the group behind the attack Strider, while Moscow-based Kaspersky Labs dubbed it ProjectSauron. Both are references to J. R. R. Tolkien’s Lord of the Rings, a nod to the fact that the original malware code contained the word “Sauron.”

  • Disable WPAD now or have your accounts and private data compromised

    The Web Proxy Auto-Discovery Protocol (WPAD), enabled by default on Windows and supported by other operating systems, can expose computer users' online accounts, web searches, and other private data, security researchers warn.

    Man-in-the-middle attackers can abuse the WPAD protocol to hijack people's online accounts and steal their sensitive information even when they access websites over encrypted HTTPS or VPN connections, said Alex Chapman and Paul Stone, researchers with U.K.-based Context Information Security, during the DEF CON security conference this week.

  • With Anonymous' latest attacks in Rio, the digital games have begun

    A wave of denial of service (DDoS) attacks on state and city websites followed immediately after Anonymous delivered their statement. The group boasted taking down at least five sites, including www.brasil2016.gov.br, www.rio2016.com, www.esporte.gov.br, www.cob.org.br and www.rj.gov.br. They broadcast their exploits using the hashtags #OpOlympicHacking, #Leaked and #TangoDown, some of which were set up months ago.



  • Kaminsky Advocates for Greater Cloud Security

    There are a lot of different reasons why organizations choose to move to the cloud and many reasons why they do not. Speaking at a press conference during the Black Hat USA security event, security researcher Dan Kaminsky provided his views on what's wrong with the Internet today and where the cloud can fit in.

    "There's a saying we have," Kaminsky said. "There is no such thing as cloud, just other people's computers."

    While the cloud represents a utility model for computing, Kaminsky also suggests that there are ways to use the cloud to improve overall security. With the cloud, users and applications can be isolated or 'sandboxed' in a way that can limit risks.

    With proper configurations, including rate limiting approaches, the impact of data breaches could potentially be reduced as well. As an example, Kaminsky said that with rate limiting controls, only the money from a cash register is stolen by a hacker, as opposed to stealing all of a company's corporate profits for a month.

  • Linux TCP Flaw allows Hackers to Hijack Internet Traffic and Inject Malware Remotely
  • Our Encrypted Email Service is Safe Against Linux TCP Vulnerability

    ProtonMail is not vulnerable to the recently announced Linux TCP Vulnerability

In limiting open source efforts, the government takes a costly gamble

Filed under
OSS
Security

The vast majority of companies are now realizing the value of open sourcing their software and almost all have done so for at least certain projects. These days Google, Facebook, Microsoft, Apple and almost every major company is releasing code to the open source community at a constant rate.

As is the case with many cutting edge developments it’s taking governments a while to catch on and understand the value in going open source. But now governments around the world are beginning to take the view that as their software is funded by the public, it belongs to the public and should be open for public use and are starting to define codified policies for its release.

[...]

The vast majority of code is still not classified and therefore, much higher levels of open sourcing are possible. While a bigger embrace of open source may seem like a risk, the real danger lies in small, overly-cautious implementation which is costing taxpayers by the day and making us all less secure.

Read more

More Security Leftovers

Filed under
Security
  • Volkswagen Created A 'Backdoor' To Basically All Its Cars... And Now Hackers Can Open All Of Them

    In other words, VW created a backdoor, and assumed that it would remain hidden. But it did not.

    This is exactly the kind of point that we've been making about the problems of requiring any kind of backdoor and not enabling strong encryption. Using a single encryption key across every device is simply bad security. Forcing any kind of backdoor into any security system creates just these kinds of vulnerabilities -- and eventually someone's going to figure out how they work.

    On a related note, the article points out that the researchers who found this vulnerability are the same ones who also found another vulnerability a few years ago that allowed them to start the ignition of a bunch of VW vehicles. And VW's response... was to sue them and try to keep the vulnerability secret for nearly two years. Perhaps, rather than trying to sue these researchers, they should have thrown a bunch of money at them to continue their work, alert VW and help VW make their cars safer and better protected.

  • Software Freedom Doesn't Kill People, Your Security Through Obscurity Kills People

    The time has come that I must speak out against the inappropriate rhetoric used by those who (ostensibly) advocate for FLOSS usage in automotive applications.

    There was a catalyst that convinced me to finally speak up. I heard a talk today from a company representative of a software supplier for the automotive industry. He said during his talk: "putting GPLv3 software in cars will kill people" and "opening up the source code to cars will cause more harm than good". These statements are completely disingenuous. Most importantly, it ignores the fact that proprietary software in cars is at least equally, if not more, dangerous. At least one person has already been killed in a crash while using a proprietary software auto-control system. Volkswagen decided to take a different route; they decided to kill us all slowly (rather than quickly) by using proprietary software to lie about their emissions and illegally polluting our air.

    Meanwhile, there has been not a single example yet about use of GPLv3 software that has harmed anyone. If you have such an example, email it to me and I promise to add it right here to this blog post.

  • Linux Networking Flaw Allows Attacker To Trick Safety Mechanism
Syndicate content

More in Tux Machines

Desktop GNU/Linux/Chromebook

  • A Minimal Chrome OS Theme for Tint2
    I used to (and sort-of-still-do, I guess) run a sister site focused on Google Chrome, Chromecast and Chromebooks, i.e. the Chrome ecosystem. As such I am a fan of Chromebooks and Chrome OS, a Linux-based distribution based on Gentoo. The appearance of Chrome OS has waxed and waned in sync with Google’s ambitions and positioning for the OS, going form hyper-minimal to a full desktop clone (with the desktop-y Chrome Apps platform) through to a Material Design inspired Android + Chrome hybrid today.
  • Off-The-Shelf Hacker: Linux for Cheap Hardware, Then and Now
    Most people, don’t realize how prolific Linux has become. With the Embedded Linux Conference just a week away, I’ve been reflecting on how Linux has provided a sort of computing “circle of life” experience for me. It’s powered my computational hardware 20 years ago and continues to do so today.
  • [Video] XPS 13 Review | Linux Action Show 457
  • GParted 0.28.1
    This release of GParted restores the ability to move/resize primary partitions when an extended partition exists. The move/resize regression was introduced in version 0.28.0. This release also includes some minor bug fixes.
  • Antergos Linux : The beauty built on Arch
    Hi guys, welcome to the 16th segment of "Introduction with Linux Distro". Most of us know or heard about Arch Linux, which is one of the most widely used Linux distribution. For some reason, few users find it hard to install and use Arch. But in Linux world, there is almost always some alternative to your desired distribution. In today's segment, we will be introducing an Arch-based distribution which turned it completely on user-friendly side. So, let's get to know about Antergos Linux.

Kernel Space/Linux

Leftovers: Software

  • Picard 1.4 released
    The last time we put out a stable release was more than 2 years ago, so a lot of changes have made it into this new release. If you’re in a hurry and just want to try it out, the downloads are available from the Picard website.
  • Linux Digital Audio Workstations: Open Source Music Production
    Linux Digital Audio Workstations When most people think of music programs, they’ll usually think Mac OS or Windows. However, there are also a few Linux digital audio workstations. The support and features of these programs can vary, but they’re a good choice to setup a cheap recording studio. Some of them are even good competitors for paid programs, offering features such as multitrack recording, MIDI, and virtual instruments. Keep in mind that many audio editing programs for Linux rely on the Jack backend. You’ll need a dedicated system to install these programs on, since it doesn’t work properly in a virtual machine. In the following article, we’ll cover audio editing programs that are available for Linux. We’ll talk about the available features, as well as help you decide which program to use for your needs.
  • i2pd 2.12 released
    i2pd (I2P Daemon) is a full-featured C++ implementation of I2P client. I2P (Invisible Internet Protocol) is a universal anonymous network layer. All communications over I2P are anonymous and end-to-end encrypted, participants don't reveal their real IP addresses.
  • 4 Command-Line Graphics Tools for Linux
    For the most part, they’re wrong. Command-line image tools do much of what their GUI counterparts can, and they can do it just as well. Sometimes, especially when dealing with multiple image files or working on an older computer, command-line tools can do a better job. Let’s take a look at four command-line tools that can ably handle many of your basic (and not-so-basic) image manipulation tasks.
  • CloudStats - Best Server Monitoring Tool for Linux Servers
    CloudStats is an effective tool for Linux server monitoring and network monitoring. With CloudStats you get whole visibility into key performance criteria of your Linux Server. You can proactively track different server metrics like CPU, disk and memory usage, services, apps, processes and more. The best thing is that you don’t need to have any special technical skills – this tool for server monitoring is very easy to install and run from any device.
  • New Inkscape 0.92.1 fixes your previous works done with Inkscape
    This blog-post is about a happy-end after a previously published blog-post named New Inkscape 0.92 breaks your previous works done with Inkscape published on 20 January. A lot of reactions did happen about this previous blog-post and the news get quickly viral. That's why I thought it was nice to make another blog post to "close this case".
  • Qt 5.10 To Have Built-In Vulkan Support
    With Qt 5.8 there was experimental Direct3D 12 support that left some disappointed the toolkit didn't opt for supporting Vulkan first as a cross-platform, high-performance graphics API. Fortunately, with Qt 5.10, there will be built-in Vulkan support. Going back nearly one year there has been Vulkan work around Qt while with Qt 5.10 it's becoming a reality. However, with Qt 5.9 not even being released until the end of May, Qt 5.10 isn't going to officially debut until either the very end of 2017 or early 2018.
  • Rusty Builder
    Thanks to Georg Vienna, Builder can now manage your Rust installations using RustUp!
  • GNOME MPlayer knows how to grow your playlist size

today's howtos