Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • Six things you need to know about IoT security
  • OpenStack Cloud Security Moves Forward

    When it comes to understanding security in the cloud and specifically security in OpenStack clouds, there are many factors to consider. In a panel session moderated by eWEEK at the OpenStack Summit in Boston, leaders from across different elements of the OpenStack security spectrum provided insight and recommendations on cloud security.

    Security is a broad term in the OpenStack context and isn't just one single item. There is the OpenStack Security Project, which has a mission to help build tools and processes that help to secure OpenStack and its various projects. There is also the Vulnerability Management Team (VMT) that handles vulnerabilities for OpenStack project. Security in OpenStack is also reflected in various OpenStack projects, including notably Project Barbican for security key management. Finally there is just general security for cloud deployment by operators, which includes secure configuration and monitoring.

  • We Wuz Warned

    The tools that are infecting computers worldwide were indeed developed by, and then leaked from, the NSA. (Thanks for nothing, spooks.) The bitcoin.com article contains tips about how to protect yourself, and links to Windows patches, if you haven't yet been hit. Fortunately for us, the attacks seem to be focused on Windows systems; our Linux desktops are so far unscathed.

  • NSA-created cyber tool spawns global attacks — and victims include Russia

    Leaked alleged NSA hacking tools appear to be behind a massive cyberattack disrupting hospitals and companies across Europe, Asia, with Russia among the hardest-hit countries.

    But the Department of Homeland Security told POLITICO it had not confirmed any attacks in the U.S. on government targets or vital industries, such as hospitals and banks.

  • GCHQ tweeted about keeping Britain cyber-safe and it majorly backfired
  • Leaked NSA Hacking Tool On Global Ransomware Rampage [Ed: No, the problem isn't "patching" or "upgrade", the problem is Windows itself, irrespective of which version (back doors)]

    Thus, there's some debate online about whether the "problem" here is organizations who don't upgrade/patch or the NSA. Of course, these things are not mutually exclusive: you can reasonably blame both. Failing to update and patch your computers is a bad idea these days -- especially for large organizations with IT staff who should know better.

  • An NSA-derived ransomware worm is shutting down computers worldwide
  • WCry is so mean Microsoft issues patch for 3 unsupported Windows versions [Ed: Back doors in old versions of Windows belatedly closed because Microsoft risks losing millions of useds [sic] for good]

NHS Cautionary Tale About Windows

Filed under
Microsoft
Security

Windows Chaos

Filed under
Microsoft
Security
  • ‘CIA malware plants Gremlins’ on Microsoft machines – WikiLeaks

    WikiLeaks has released the latest instalment in the #Vault7 series, detailing two apparent CIA malware frameworks dubbed ‘AfterMidnight’ and ‘Assassin’ which it says target the Microsoft Windows platform.

  • WannaCry ransomware used in widespread attacks all over the world

    Earlier today, our products detected and successfully blocked a large number of ransomware attacks around the world. In these attacks, data is encrypted with the extension “.WCRY” added to the filenames.

    Our analysis indicates the attack, dubbed “WannaCry”, is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed “EternalBlue”) has been made available on the internet through the Shadowbrokers dump on April 14th, 2017 and patched by Microsoft on March 14.

  • NHS left reeling by cyber-attack: ‘We are literally unable to do any x-rays’

    Thousands of patients across England and Scotland have been in limbo after an international cyber-attack hit the NHS, with many having operations cancelled at the last minute.

    Senior medics sought to reassure patients that they could be seen in the normal way in emergencies, but others were asked to stay away if possible.

    According to one junior doctor who works in a London hospital, the attack left hospitals struggling to care for people. “However much they pretend patient safety is unaffected, it’s not true. At my hospital we are literally unable to do any x-rays, which are an essential component of emergency medicine,” the doctor told the Guardian.

  • "Worst-Ever Recorded" Ransomware Attack Strikes Over 57,000 Users Worldwide, Using NSA-Leaked Tools

    Update 4: According to experts tracking and analyzing the worm and its spread, this could be one of the worst-ever recorded attacks of its kind. The security researcher who tweets and blogs as MalwareTech told The Intercept “I’ve never seen anything like this with ransomware," and "the last worm of this degree I can remember is Conficker.” Conficker was a notorious Windows worm first spotted in 2008; it went on to infect over nine million computers in nearly 200 countries.

Microsoft Windows and Ransom

Filed under
Microsoft
Security
  • Massive ransomware attack hits UK hospitals, Spanish banks [Ed: Microsoft shows its real cost]

    A large number of hospitals, GPs, and walk-in clinics across England have been locked down by a ransomware attack, reports suggest. There are also some reports of a ransomware attack hitting institutions in Portugal and Spain, with telecoms provider Telefonica apparently hit hard. Further attacks have been reported in Russia, Ukraine, and Taiwan. Batten down the hatches: we might be in the middle of a global ransomware attack.

    Multiple sources point to this ransomware attack being based on the EternalBlue vulnerability, which was discovered by the NSA but was leaked by a group calling itself Shadow Brokers last month.

    NHS Digital has confirmed the attack and issued a brief statement, stating that there's no evidence that patient data had been accessed and that the attack was not specifically targeted at the NHS. At this point it isn't clear whether a central NHS network has been knocked offline by the ransomware or whether individual computers connected to the network are being locked out. In any case, a number of hospitals and clinics are reporting that their computer systems are inaccessible, and some telephone services are down too.

  • New ransomware Jaff demands $3,700 payments
  • Updates on CyberSecurity, WordPress and what we're cooking in the lab today.

    This is a Wordfence public service security announcement for all users of computers running any version of Windows.

    We have confirmed that a serious virulent ransomware threat known as WannaCrypt0r/WannaCry has affected Windows computers on shared networks in at least 74 countries worldwide, with 57,000 reported individual cases being affected. And according to the analysis team at Kaspersky Lab, that number is growing fast.

More Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security
  • Keylogger Discovered in HP Audio Driver
  • [EN] Keylogger in Hewlett-Packard Audio Driver

    Security reviews of modern Windows Active Domain infrastructures are – from our point of view – quite sobering. Therefore, we often look left and right, when, for example, examining the hardening of protection mechanisms of a workstation. Here, we often find all sorts of dangerous and ill-conceived stuff. We want to present one of these casually identified cases now, as it's quite an interesting one: We have discovered a keylogger in an audio driver package by Hewlett-Packard.

    A keylogger is a piece of software for which the case of dual-use can rarely be claimed. This means there are very few situations where you would describe a keylogger that records all keystrokes as 'well-intended'. A keylogger records when a key is pressed, when it is released, and whether any shift or special keys have been pressed. It is also recorded if, for example, a password is entered even if it is not displayed on the screen.

  • Microsoft rushes emergency fix for critical antivirus bug

    The critical security vulnerability in the Microsoft Malware Protection Engine affects a number of Microsoft products, including Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Forefront Security for SharePoint, Microsoft Endpoint Protection, and Microsoft Forefront Endpoint Protection. These tools are enabled by default in Windows 8, 8.1, 10, and Windows Server 2012.

  • Google Offers $20000 Rewards to Drive OSS-Fuzz Initiative
  • Call the fuzz, says Google, get the reward
  • How Google’s OSS-Fuzz is securing open-source software

    Google released OSS-Fuzz five months ago with a mission to make open-source projects stable, secure and reliable. Since then, the continuous fuzzing solution has found more than 1,000 bugs with 264 of them flagged as potential security bugs.

  • Google Fuzzing Service for OS Finds 1K Bugs in Five Months

    A Google-led initiative to find security vulnerabilities in popular open source projects has unearthed more than 1,000 bugs in various open source software in the five months since the effort was launched.

  • The IoT's Scramble to Combat Botnets

    With shadowy botnet armies lurking around the globe and vigilante gray-hat actors inoculating susceptible devices, the appetite for Internet of Things security is stronger than ever.

  • Exploiting the Linux kernel via packet sockets

    Lately I’ve been spending some time fuzzing network-related Linux kernel interfaces with syzkaller. Besides the recently discovered vulnerability in DCCP sockets, I also found another one, this time in packet sockets. This post describes how the bug was discovered and how we can exploit it to escalate privileges.

Security Leftovers

Filed under
Security
  • To mitigate major Edge printing bug, use a Xerox copier, baffled user advises

    Beyond being breathtakingly bizarre, the bug could potentially have serious consequences for architects, engineers, lawyers, and other professionals who rely on Edge to print drawings, blueprints, legal briefs, and similarly sensitive documents. Edge is the default application for viewing PDFs on Windows 10 computers. While the errors demonstrated above happened using the "Microsoft Print to PDF" option, multiple users report similar alterations when using regular printing settings. (And besides, the print-to-PDF option is the default printing method for the Microsoft browser.) The alterations depend on several variables, including the printer selected, the settings used, and computer being used. It's not clear how long this flaw has been active or whether it has already affected legal cases or other sensitive proceedings that use documents printed from the Internet.

  • Keylogger Found in Audio Driver of HP Laptops
  • Criminals are Now Exploiting SS7 Flaws to Hack Smartphone Two-Factor Authentication Systems
  • A Vicious Microsoft Bug Left a Billion PCs Exposed [iophk: "people are gullible: Windows was never secure in the 22 years since it added TCP/IP; for those that remember, it was not secure even before that and was plagued with malware spread by disk and NAS (then called file servers)."
  • Microsoft finally bans SHA-1 certificates in Internet Explorer, Edge [Ed: Quit pretending that Microsoft cares about security in browsers that have a baked-in back door]

    The Tuesday updates for Internet Explorer and Microsoft Edge force those browsers to flag SSL/TLS certificates signed with the aging SHA-1 hashing function as insecure. The move follows similar actions by Google Chrome and Mozilla Firefox earlier this year.

    Browser vendors and certificate authorities have been engaged in a coordinated effort to phase out the use of SHA-1 certificates on the web for the past few years, because the hashing function no longer provides sufficient security against spoofing.

Security Leftovers

Filed under
Security
  • How to protect your Google and Facebook accounts with a security key

    Google supports a format called FIDO Universal 2nd Factor (U2F), which it helped develop. Keys are available that work over USB, Bluetooth, and NFC, so they can be used with a smartphone or tablet in addition to a PC.

  • Cisco Patches WikiLeaks Security Vulnerability Affecting Hundreds Of Devices

    Cisco has patched a critical flaw in its IOS software that affected more than 300 models of routers and switches that was discovered after WikiLeaks exposed CIA documents.

    "We've spoken to a few customers about it, a few enterprise clients, and thankfully it didn't any disrupt business for us," said one top executive from a solution provider and Cisco Gold partner who did not wished to be named. "I'm glad to know they fixed the issue. … Their devices will always be a big target for attackers because Cisco is everywhere."

  • Microsoft makes emergency security fix

    Microsoft has released an urgent update to stop hackers taking control of computers with a single email.

    The unusual bug, in Microsoft anti-malware software such as Windows Defender, could be exploited without the recipient even opening the message.

    Researchers working for Google's Project Zero cyber-security outfit discovered the flaw at the weekend.

    The fix has been specially pushed out hours before the software giant's monthly Tuesday security update.

  • Google’s OSS-Fuzz Finds 1,000 Open Source Bugs

    The numbers are in, and judging by them, OSS-Fuzz, the program Google unveiled last December to continuously fuzz open source software, has been a success.

    In five months the effort has unearthed more than 1,000 bugs, a quarter of them potential security vulnerabilities, Google says.

  • Open source vulnerabilities hit VMware [Ed: Ridiculous! WMware is secret software with back doors (RSA/EMC), so why focus only on holes in a FOSS component?]

    Apache Struts 2 is an open source web application framework for developing Java applications that has been in use since 2007. The recent Apache Struts 2 vulnerability affected vCenter Server 6.0 and 6.5, vRealize Operations Manager 6.x, vRealize Hyperic Server 5.x, and versions 6.x and 7.x of the Horizon Desktop-as-a-Service Platform.

  • Samsung partners with McAfee, brings security software to the Galaxy S8, Smart TVs, and PCs [Ed: But Samsung should know adding proprietary software to Tizen and/or Android won't necessarily make these more secure]

Security Leftovers

Filed under
Security
  • Cisco kills leaked CIA 0-day that let attackers commandeer 318 switch models

    As previously reported, the zero-day exploit allowed attackers to issue commands that remotely execute malicious code on 318 models of Cisco switches. The attack code was published in early March by WikiLeaks as part of its Vault7 series of leaks, which the site is billing as the largest publication of intelligence documents ever.

    The bug resides in the Cisco Cluster Management Protocol (CMP), which uses the telnet protocol to deliver signals and commands on internal networks. It stems from a failure to restrict telnet options to local communications and the incorrect processing of malformed CMP-only telnet options.

  • Open source password strength meter could help boost account security

    It's no secret that most people are rubbish at choosing passwords -- it's something that's proved time and time again when the annual list of common passwords is released. To help overcome the problem, and hopefully increase the security of people's accounts, a team of researchers from the Carnegie Mellon University and the University of Chicago have created an open source password meter that provides advice about how to strengthen a password.

  • Apache OpenOffice: Not dead yet, you'll just have to wait until mid-May for mystery security fixes
  • NIST to security admins: You've made passwords too hard

    Despite the fact that cybercriminals stole more than 3 billion user credentials in 2016, users don't seem to be getting savvier about their password usage. The good news is that how we think about password security is changing as other authentication methods become more popular.

  • Google Docs Phishing Scam a Game Changer
Syndicate content

More in Tux Machines

LVFS makes Linux firmware updates easier

Traditionally, updating a BIOS or a network card's firmware in Linux meant booting into Microsoft Windows or preparing a MS-DOS floppy disk and hoping everything would work correctly after the update. Periodically searching a vendor website for updates is a manual and error-prone task and not something we should ask users to do. A firmware update service makes it simpler for end users to implement hardware updates. Read more

Mark McIntyre: How Do You Fedora?

Mark McIntyre is a geek by birth and Linux by choice. “I started coding at the early age of 13 learning BASIC on my own and finding the excitement of programming which led me down a path of becoming a professional coder,” he says. McIntyre and his niece are big fans of pizza. “My niece and I started a quest last fall to try as many of the pizza joints in Knoxville. You can read about our progress at https://knox-pizza-quest.blogspot.com/” Mark is also an amateur photographer and publishes his images on Flickr. Read more

today's leftovers

  • [LabPlot] Improved data fitting in 2.5
    Until now, the fit parameters could in principle take any values allowed by the fit model, which would lead to a reasonable description of the data. However, sometimes the realistic regions for the parameters are known in advance and it is desirable to set some mathematical constrains on them. LabPlot provides now the possibility to define lower and/or upper bounds for the fit parameters and to limit the internal fit algorithm to these regions only.
  • [GNOME] Maps Towards 3.28
    Some work has been done since the release of 3.26 in September. On the visual side we have adapted the routing sidebar to use a similar styling as is used in Files (Nautilus) and the GTK+ filechooser.
  • MX 17 Beta 2
  • MiniDebconf in Toulouse
    I attended the MiniDebconf in Toulouse, which was hosted in the larger Capitole du Libre, a free software event with talks, presentation of associations, and a keysigning party. I didn't expect the event to be that big, and I was very impressed by its organization. Cheers to all the volunteers, it has been an amazing week-end!
  • DebConf Videoteam sprint report - day 0
    First day of the videoteam autumn sprint! Well, I say first day, but in reality it's more day 0. Even though most of us have arrived in Cambridge already, we are still missing a few people. Last year we decided to sprint in Paris because most of our video gear is stocked there. This year, we instead chose to sprint a few days before the Cambridge Mini-Debconf to help record the conference afterwards.
  • Libre Computer Board Launches Another Allwinner/Mali ARM SBC
    The Tritium is a new ARM single board computer from the Libre Computer Board project. Earlier this year the first Libre Computer Board launched as the Le Potato for trying to be a libre and free software minded ARM SBC. That board offered better specs than the Raspberry Pi 3 and aimed to be "open" though not fully due to the ARM Mali graphics not being open.
  • FOSDEM 2018 Will Be Hosting A Wayland / Mesa / Mir / X.Org Developer Room
    This year at the FOSDEM open-source/Linux event in Brussels there wasn't the usual "X.Org dev room" as it's long been referred to, but for 2018, Luc Verhaegen is stepping back up to the plate and organizing this mini graphics/X.Org developer event within FOSDEM.
  • The Social Network™ releases its data networking code
    Facebook has sent another shiver running up Cisco's spine, by releasing the code it uses for packet routing. Open/R, its now-open source routing platform, runs Facebook's backbone and data centre networks. The Social Network™ first promised to release the platform in May 2017. In the post that announced the release, Facebook said it began developing Open/R for its Terragraph wireless system, but since applied it to its global fibre network, adding: “we are even starting to roll it out into our data center fabrics, running inside FBOSS and on our Open Compute Project networking hardware like Wedge 100.”
  • Intel Icelake Support Added To LLVM Clang
    Initial support for Intel's Icelake microarchitecture that's a follow-on to Cannonlake has been added to the LLVM/Clang compiler stack. Last week came the Icelake patch to GCC and now Clang has landed its initial Icelake enablement too.
  • Microsoft's Surface Book 2 has a power problem
     

    Microsoft’s Surface Book 2 has a power problem. When operating at peak performance, it may draw more power than its stock charger or Surface Dock can handle. What we’ve discovered after talking to Microsoft is that it’s not a bug—it’s a feature.

Kernel: Linux 4.15 and Intel

  • The Big Changes So Far For The Linux 4.15 Kernel - Half Million New Lines Of Code So Far
    We are now through week one of two for the merge window of the Linux 4.15 kernel. If you are behind on your Phoronix reading with the many feature recaps provided this week of the different pull requests, here's a quick recap of the changes so far to be found with Linux 4.15:
  • Intel 2017Q3 Graphics Stack Recipe Released
    Intel's Open-Source Technology Center has put out their quarterly Linux graphics driver stack upgrade in what they are calling the latest recipe. As is the case with the open-source graphics drivers just being one centralized, universal component to be easily installed everywhere, their graphics stack recipe is just the picked versions of all the source components making up their driver.
  • Intel Ironlake Receives Patches For RC6 Power Savings
    Intel Ironlake "Gen 5" graphics have been around for seven years now since being found in Clarkdale and Arrandale processors while finally now the patches are all worked out for enabling RC6 power-savings support under Linux.