Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security

Ubuntu 12.04 and SSHv1 Support Phased Out

Filed under
Security
  • Ubuntu 12.04 (Precise Pangolin) End of Life reached on April 28, 2017

    This is a follow-up to the End of Life warning sent last month to confirm that as of today (April 28, 2017), Ubuntu 12.04 is no longer generally supported. No more package updates will be accepted to the 12.04 primary archive, and it will be copied for archival to old-releases.ubuntu.com in the coming weeks.

  • OpenSSH Removes SSHv1 Support

    Dropping support for SSHv1 and associated ciphers that were either suspected to or known to be broken has been planned for several releases, and has been eagerly anticipated by many in the OpenBSD camp.

Security Leftovers

Filed under
Security
  • Security fail is people

    The other day I ran across someone trying to keep their locker secured by using a combination lock. As you can see in the picture, the lock is on the handle of the locker, not on the loop that actually locks the door. When I saw this I had a good chuckle, took a picture, and put out a snarky tweet. I then started to think about this quite a bit. Is this the user's fault or is this bad design? I'm going to blame bad design on this one. It's easy to blame users, we do it often, but I think in most instances, the problem is the design, not the user. If nothing is ever our fault, we will never improve anything. I suspect this is part of the problem we see across the cybersecurity universe.

  • Free software activities in April 2017

    Whilst anyone can inspect the source code of free software for malicious flaws, most software is distributed pre-compiled to end users.

    The motivation behind the Reproducible Builds effort is to permit verification that no flaws have been introduced — either maliciously or accidentally — during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.

Security Leftovers

Filed under
Security
  • Is there any way to truly secure Docker container contents?

    All this adds up to a lot of work, which is not taken care of for you by default in Docker. It is no surprise that many Docker images are insecure, given this picture. The unfortunate reality is that many Docker containers are running with known vulnerabilities that have known fixes, but just aren’t, and that’s sad.

  • Compromise recovery on Qubes OS

    Occasionally fuckups happen, even with Qubes (although not as often as some think).

    What should we – users or admins – do in such a situation? Patch, obviously. But is that really enough? What good is patching your system if it might have already been compromised a week earlier, before the patch was released, when an adversary may have learned of the bug and exploited it?

    That’s an inconvenient question for many of us – computer security professionals – to answer. Usually we would mutter something about Raising the Bar(TM), the high costs of targeted attacks, attackers not wanting to burn 0-days, or only nation state actors being able to afford such attacks, and that in case one is on their list of targets, the game is over anyway and no point in fighting. Plus some classic cartoon.

    While the above line of defense might work (temporarily), it really doesn’t provide for much comfort, long term, I think. We need better answers and better solutions. This post, together with a recently introduced feature in Qubes OS 3.2 and (upcoming) 4.0, is an attempt to offer such a solution.

  • Top 5 Kali Linux Pentest tools for WiFi/network and exploits
  • Linux/Shishiga Malware Brute-Forces SSH Credentials

    A new strain of Linux malware has been detected. Dubbed Linux/Shishiga, the malware could transform into a dangerous piece of malware. Linux/Shishiga was officially discovered and examined by researchers at Eset.

  • Cybercriminals have taken notice of leaked government spying techniques
  • Microsoft Closes Word/Wordpad Hole—6 Months after Report
  • [Older] The Pentagon’s Bug Bounty Program Should Be Expanded to Bases, DOD Official Says [iophk: "any version of Windows at all is inappropriate"]

    “About 75 percent of the devices that are control systems are on Windows XP or other nonsupported operating systems,” said Daryl Haegley, program manager for the Office of the Assistant Secretary of Defense for Energy, Installations and Environment.

    [...]

    “A lot of these systems are still Windows 95 or 98, and that’s OK—if they’re not connected to the internet,” Haegley added.

  • Don’t Info Op Until You See The Whites of Their Eyes
  • CFP P70

    This is the official CFP for P70.

  • VM escape - QEMU Case Study

    In this paper, we provide a in-depth analysis of CVE-2015-5165 (a memory-leak vulnerability) and CVE-2015-7504 (a heap-based overflow vulnerability), along with working exploits. The combination of these two exploits allows to break out from a VM and execute code on the target host. We discuss the technical details to exploit the vulnerabilities on QEMU's network card device emulation, and provide generic techniques that could be re-used to exploit future bugs in QEMU.

  • CIA’s anti-leaking tool leaked as ‘whistleblowers watch the watchers’

    Former MI5 intelligence officer Annie Machon and retired US Army Colonel Ann Wright, who is also a retired US State Department official, shared their views on these and other questions with RT.

    On Friday, WikiLeaks released a series of documentations on a US Central Intelligence Agency (CIA) project known as ‘Scribbles,’ which was allegedly created to allow ‘web beacon’ tags to be embedded “into documents that are likely to be copied.”

    WikiLeaks began publishing a huge cache of secret documents on the CIA named ‘Vault 7’ in March.

  • Vault 7: CIA tool to track people through Word docs released

    The documentation says: "Scribbles (SCRIB) is a document watermarking tool that can be used to batch process a number of documents in a pre-seeded input directory. It generates a random watermark for each document, inserts that watermark into the document, saves all such processed documents in an output directory, and creates a log file which identifies the watermarks inserted into each document."

    It says the tool was successfully tested on Office 2013 (on Windows 8.1 x64), documents from Office versions 97-2016 (Office 95 documents will not work!) and documents that are not locked forms, encrypted, or password-protected.

    There is a limitation to the Scribbles system: if a document that has the watermarks in it and is opened in OpenOffice, LibreOffice the watermark images and URLs may become visible.

  • The US Takes On the World in NATO’s Cyber War Games

    Last year, Capt. Sean Ruddy and his team of operator-soldiers from the US Cyber Brigade entered a Locked Shields, a NATO-organized cyber-defense war game that pits teams from dozens of countries against “live-fire” attacks. It was their first time. And of the 19 countries represented, the US finished dead last. This week, they got their shot at redemption.

More Security Leftovers

Filed under
Security
  • HardenedLinux: The way to the Ark

    We’ve been sharing some of our works on security practices ( STIG-4-Debian, Debian GNU/Linux profiles, etc) for servers running in data center. PaX/Grsecurity is the corner stone to most of our solutions. Evidences have revealed that PaX/Grsecurity can defeat multiple public exploits w/o any patch fixes in critical scenarios for a long run. With PaX/Grsecurity, for the 1st time we believe that we can build the defense based on free/libre & open source software/firmware solution to prevent many threats from Ring 3/0/-1/-2/-3. HardenedLinux is going to continue develop solutions of defense based on PaX/Grsecurity. From our point of view, we see no other option. Please remember this date: Apr 26 2017. This is the day we lost our Ark.

  • It's Official: Ubuntu 12.04 LTS (Precise Pangolin) Linux OS Reached End of Life

    Canonical, through Adam Conrad, informed us today that the Ubuntu 12.04 LTS (Precise Pangolin) operating system is now officially dead, reaching end of life on April 28, 2017.

    If you're still using Ubuntu 12.04 LTS on your desktop or server systems, it's time to upgrade to a newer, supported release. You can choose to upgrade to either Ubuntu 14.04 LTS (Trusty Tahr), which will be supported for two more years, until April 2019, or Ubuntu 16.04 LTS (Xenial Xerus), supported until April 2021.

Security Leftovers

Filed under
Security

IPFire 2.19 Now Supports On-Demand IPsec VPNs, Core Update 110 Is Now Available

Filed under
GNU
Linux
Security

IPFire's Michael Tremer announced today, April 28, 2017, the release of IPFire 2.19 Core Update 110, a new stable maintenance version of the open-source, Linux-based firewall operating system.

Coming two and a half months after the previous point release, IPFire 2.19 Core Update 110 is here to implement support for on-demand IPsec (Internet Protocol Security) VPNs (Virtual Private Networks), which might just come in handy to those who deal with a huge amount of IPsec net-to-net connections on their infrastructures.

Read more

Linux Mint-using terror nerd awaits sentence for training Islamic State

Filed under
Linux
Security

A paranoid Welsh Muslim who wore gloves while typing on his laptop, admitted being part of Islamic State, and, gasp, harbored a copy of Linux Mint, has been described as a “new and dangerous breed of terrorist.”

Samata Ullah, 34, who also used voice modulation software to disguise his thick Welsh accent while making instructional videos about encryption, pleaded guilty to five terrorism charges at Cardiff Crown Court. He was due to be sentenced Friday afternoon.

Read more

Security Leftovers

Filed under
Security

Tor 0.3.0.6 is released: a new series is stable!

Filed under
Security

Tor 0.3.0.6 is the first stable release of the Tor 0.3.0 series.

With the 0.3.0 series, clients and relays now use Ed25519 keys to authenticate their link connections to relays, rather than the old RSA1024 keys that they used before. (Circuit crypto has been Curve25519-authenticated since 0.2.4.8-alpha.) We have also replaced the guard selection and replacement algorithm to behave more robustly in the presence of unreliable networks, and to resist guard- capture attacks.

Read more

Syndicate content

More in Tux Machines

today's howtos

6-Way Enterprise Focused Linux Distribution Comparison With An Intel Core i9, Dual Xeon Gold Systems

Here's our latest Linux distribution comparison with this time looking at the out-of-the-box performance of six Linux distributions while running a range of enterprise/workstation-focused benchmarks while using two systems. One system is a high-end Core i9 7980XE desktop system and the other a Tyan 1U Xeon Scalable server with dual Xeon Gold 6138 processors. Read more

Security: FOSS Versus Windows

Linux/Android hacker SBC with hexa-core Rockchip SoC debuts at $75

The Vamrs “RK3399 Sapphire” SBC is on sale for $75, or $349 for a full kit. Vamrs is also prepping an RK3399-based “Rock960” 96Boards SBC. Rockchip’s RK3399 is one of the most powerful ARM-based system-on-chips available on hacker boards, featuring two server-class Cortex-A72 cores clocked to up to 2.0GHz, as well as four Cortex-A53 at up to 1.42GHz and a quad-core Mali-T864 GPU. The hexa-core SoC has appeared on T-Firefly’s Firefly-RK3399 SBC and RK3399 Coreboard computer-on-module, as well as Videostrong’s VS-RD-RK3399 SBC and Theobroma’s RK3399-Q7 Qseven module. Now we have a new contender: Shenzhen based Vamrs, which built the limited edition Rockchip RK3399 Sapphire SBC as the official RK3399 dev board for Rockchip, is now re-launching the board, which features a 40-pin Raspberry Pi compatible connector, with “many in stock” for a discounted price of $75. Read more