Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • Security updates for Monday
  • Old Linux kernel security bug bites

    OK, hands up, who knows what High-Level Data Link Control (HDLC) is? It's an archaic networking data framing protocol that's used in modems, X.25, frame-relay, ISDN, and other now uncommon networking technologies. I know it because I used to work with them back in the day. You'll get to know it now because a researcher discovered a security hole hidden within the Linux kernel driver that implements it.

  • Seven year-old Linux vulnerability now patched

    An old vulnerability was just discovered in the Linux kernel, potentially allowing hackers to gain privilege escalation, or cause a denial of service. The vulnerability was quickly fixed and there have been no signs of it in the wild, although that does not necessarily mean it went unnoticed.

  • OpenSSH 7.5 released

    OpenSSH 7.5 has just been released. It will be available from the mirrors listed at http://www.openssh.com/ shortly.

  • OpenSSH 7.5 Has Security Fixes, Removes OpenSSL 1.0 Support for Portable OpenSSH

    OpenSSH, the cross-platform and open-source 100% complete SSH 2.0 protocol implementation offering both SFTP server and client support was updated today to version 7.5.

    OpenSSH 7.5 comes three months after the release of OpenSSH 7.4 in late December 2016, and promises to be a maintenance update that addresses two important security issues, implements support for the "=-" syntax to make removing of methods from algorithm lists a lot easier, and fix numerous reported bugs.

  • Is Linux Mint a secure distribution?

    Linux Mint has been lambasted by some in the media for security problems over the last few years. But how accurate are such perceptions? Does Linux Mint really suffer from security problems or is it all much ado about nothing?

    A writer at DistroWatch wades into the controversy and examines some of the myths and misunderstandings about Linux Mint and security.

  • Linux Mint's security record

    Some of the more common misunderstandings I have encountered recently have involved the Linux Mint distribution. Mint has been a popular project in recent years and, with many people using the distribution and talking about the project, there is bound to be some mis-communication. In particular, most of the rumours and misunderstandings I have encountered have revolved around Mint's security practises and history. I would like to clear up a few of the more common rumours.

  • Mozilla Firefox is the First Pwn2own 2017 Victim to be Patched

    Some vendors respond to security issues faster than others. Last week, the 10th annual Pwn2own hacking challenge was hosted by Trend Micro's Zero Day Initiative (ZDI), with multiple groups of researchers taking aim at web browsers, operating systems and virtualization technology.

    Mozilla's Firefox web browser was successfully exploited on March 16, the second day of the Pwn2own event. Researchers from Chaitin Security Research Lab were the only group to attack Mozilla Firefox, and earned $30,000 for demonstrating a new zero-day exploit. The day the exploit was demonstrated, the only thing publicly revealed about the exploit is that it made use of an integer overflow flaw in combination with an uninitialized memory buffer in the Windows kernel.

Tails 3.0 Anonymous LiveCD Gets Third Beta Release with Important Security Fixes

Filed under
Security
Debian

The developers of the Tails amnesic incognito live system announced the availability of the third Beta release of the upcoming major Tails 3.0 operating system, which will be based on the soon-to-be-released Debian GNU/Linux 9 "Stretch" OS.

Read more

Security Leftovers

Filed under
Security
  • More than 300 Cisco switch models vulnerable to CIA hack

    A cache of CIA documents was dropped on the internet two weeks ago via WikiLeaks. It was a huge volume of data, some of which detailed CIA tools for breaking into smartphones and even smart TVs. Now, Cisco has said its examination of the documents points to a gaping security hole in more than 300 models of its switches. There’s no patch for this critical vulnerability, but it’s possible to mitigate the risk with some settings changes.

    Cisco’s security arm sent out an advisory on Friday alerting customers that the IOS and IOS XE Software Cluster were vulnerable to hacks based on the leaked documents. The 318 affected switch models are mostly in the Catalyst series, but there are also some embedded systems and IE-series switches on the list. These are enterprise devices that cost a few thousand dollars at least. So, nothing in your house is affected by this particular attack.

  • Assange chastises companies who haven't responded to CIA vulnerability offers

    Wikileaks head Julian Assange slammed companies not taking the site up on the sites offer to share security flaws the CIA had exploited in their products.

    In a screen-shot statement tweeted on Saturday, Wikileaks noted that "Organizations such as Mozilla" had responded to the site's emails offering unreleased security vulnerabilities from leaked CIA files. "Google and other companies" had not.

    "Most of these lagging companies have conflicts of interest due to their classified work with US government agencies. In practice such associations limit industry staff with US security clearances from fixing holes based on leaked information from the CIA. Should such companies choose to not secure their users against CIA or NSA attacks users may prefer organizations such as Mozilla or European companies that prioritize their users over government contracts," the statement read.

    Wikileaks recently published a trove of files leaked from the CIA, including descriptions of hacking techniques. The site made an effort to redact source code showing how to actually accomplish the techniques, although enough code slipped through the cracks for researchers to reverse engineer at least one of the security flaws.

  • Gentoo: 201703-02 Adobe Flash Player: Multiple vulnerabilities

OpenSSH 7.5 released

Filed under
OSS
Security

OpenSSH 7.5 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support. OpenSSH also includes
transitional support for the legacy SSH 1.3 and 1.5 protocols
that may be enabled at compile-time.

Read more

Also: OpenSSH 7.5 Released, Legacy Crypto Functions Still Heading For Retirement

Security Leftovers

Filed under
Security
  • Hire a DDoS service to take down your enemies

    According to Neustar, almost three quarters of all global brands, organizations and companies have been victims of a DDoS attack. And more than 3,700 DDoS attacks occur each day.

  • Apollo Lake 3.5-incher doubles down on security

    Kontron’s Linux-friendly, Intel Apollo Lake based “3.5″-SBC-APL” SBC features triple display support, a TPM 2.0 chip, and optional security services.

  • Leading Linux distros dawdle as kernel flaw persists

    A local privilege esclation flaw has been fixed in the Linux kernel, but several upstream distributions have yet to release updates. Administrators should plan on mitigating the vulnerability on Linux servers and workstations themselves and monitor the distributions for their update plans.

How to secure your Raspberry Pi

Filed under
Linux
Hardware
Security

The Raspberry Pi and many other inexpensive computer boards like it have become part of the "Internet of Things" or IoT revolution. Internet-connected computing devices have emerged beyond traditional servers, desktops, laptops, and mobile devices. Now your TV, DVR (digital video recorder), thermostat, refrigerator, Internet radio, Raspberry Pi, and other devices are on the network too.

IoT has been huge for experimentation and innovation. But as projects get rushed to completion, there have been severe consequences for ignoring security. And this applies both to commercial products and hobby projects. I'll talk about the Raspberry Pi specifically in this article, so this post is oriented more toward do-it-yourself projects.

Read more

Security Leftovers

Filed under
Security
  • Some HTTPS inspection tools might weaken security [iophk: "the death of web-mail UI"]

    In a typical enterprise environment, an HTTPS connection can even be intercepted and re-encrypted multiple times: at the network perimeter by gateway security products or data leak prevention systems and on endpoint systems by antivirus programs that need to inspect such traffic for malware.

    The problem is that users' browsers no longer get to validate the real server certificates because that task falls to the interception proxy. And as it turns out, security products are pretty bad at validating server certificates.

  • Defence against the Dark Arts involves controlling your hardware

    In light of the Vault 7 documents leak (and the rise to power of Lord Voldemort this year), it might make sense to rethink just how paranoid we need to be.

  • This laptop-bricking USB stick just got even more dangerous

    Remember that USB stick that would destroy almost anything in its path, from laptops, photo booths, kiosks, to even cars?

    Now there's a new version, and it's even more dangerous than before.

    In case you missed it the first time around, a Hong Kong-based company built a weaponized pocket-sized USB stick, which when plugged into a device, will rapidly charge its capacitors from the USB power supply and then discharge, frying the affected device's circuits.

  • Docker Image Vulnerability Research

    Managing known vulnerabilities is the first step towards a strong security posture. If we’re not updating our systems, and keeping an eye on emerging vulnerabilities that are yet to be patched upstream, we’re basically leaving the front door wide open.

Linux Security

Filed under
Security
  • Why Codethink is a founding member of the Civil Infrastructure Platform, a Linux Foundation initiative

    On April 4th 2016 a new Linux Foundation initiative called the Civil Infrastructure Platform was announced. CIP aims to share efforts around building a Linux-based commodity platform for industrial grade products that need to be maintained for anything between 25 and 50 years - in some cases even longer. Codethink is one of the founding members.

  • Ubuntu 12.04 Will Be End-Of-Life in April 28th 2017 & ESM Surprise
  • Update Shyness

    But the update madness had just started. A couple days after the PCLOS incident, I booted OpenMandriva and Discover notified me that there were updates. I must confess that the update process in OpenMandriva has not been easy for me: I prefer to use the Control Center, but sometimes it cannot install some packages and those have to be installed with Discover. Sometimes, the latter simply refuses to load the package list.

Security Leftovers

Filed under
Security
  • Security updates for Friday
  • Eight-year-old Linux security flaw finally fixed

    ANOTHER years-old vulnerability in the Linux kernel has been patched - the fourth such ageing security flaw that has been patched recently.

  • Paving with Good Intentions: The Attempt to Rescue the Network Time Protocol

    After the Heartbleed bug revealed in April 2014 how understaffed and under-funded the OpenSSL project was, the Network Time Foundation was discovered to be one of several projects in a similar condition. Unfortunately, thanks to a project fork, the efforts to lend NTP support have only divided the development community and created two projects scrambling for funds where originally there was only one.

  • Mozilla: Everyone's scared of hackers but clueless about fending them off

    According to Firefox maker Mozilla, we're nearly all afraid of hackers, but few of us feel we can protect ourselves from them.

    The non-profit's survey of 30,000 people found internet users' confidence is extremely low when it comes to privacy and security. The survey found that 90 percent of people are unsure how to protect themselves online, while 11.5 percent feel they know nothing about security.

Security Leftovers

Filed under
Security
Syndicate content

More in Tux Machines

Linux and Graphics: AMD, Linux 4.14 LTS, Etnaviv Gallium3D

  • Linux 4.14 Ensures The "Core Performance Boost" Bit Gets Set For AMD Ryzen CPUs
    Recently making waves in our forums was talk of a kernel patch to address a case where the AMD CPB (Core Performance Boost) isn't being exposed by Ryzen processors. Here's more details on that and some benchmarks. Being talked about recently is f7f3dc0: "CPUID Fn8000_0007_EDX[CPB] is wrongly 0 on models up to B1. But they do support CPB (AMD's Core Performance Boosting cpufreq CPU feature), so fix that."
  • Linus Torvalds Is Confident That Linux Kernel 4.14 LTS Will Arrive on November 5
    Development of Linux 4.14, the next LTS (Long Term Support) kernel series, continues with the fifth RC (Release Candidate) milestone, which was announced by Linus Torvalds himself this past weekend. According to Linus Torvalds, things have finally starting to calm down for the development of the Linux 4.14 LTS kernel, and it looks like the RC5 snapshot is smaller than he would have expected, at least smaller than last week's RC4, which is a good thing, meaning that there won't be need for eight RCs during this cycle.
  • Etnaviv Gallium3D Is Almost To OpenGL 2.0 Compliance
    The Etnaviv Gallium3D driver that provides reverse-engineered, open-source graphics support for Vivante graphics hardware is almost to exposing OpenGL 2.0. Etnaviv contributor Christian Gmeiner today posted a set of patches for adding occlusion queries support to the driver. The code at just over one thousand lines of code is the last major feature needed for exposing desktop OpenGL 2.0 capabilities with this community-driven driver.
  • AMD Developers Begin Making Open-Source FreeSync/AdaptiveSync Plans
    While the AMDGPU DC code is expected to land for Linux 4.15 with goodies like Vega display support, HDMI/DP audio, and atomic mode-setting, one of the sought after display features won't be initially supported: FreeSync or the VESA-backed AdaptiveSync. As we've known for a while, while AMDGPU DC fills out the requirements for being able to support FreeSync, the last bits of the implementation are not present as the interfaces are basically yet to be decided among the open-source driver developers. While AMD can post their existing FreeSync code as found in AMDGPU-PRO hybrid driver, they are trying to come up with a more standardized interface that will satisfy the other upstream Linux driver developers too that might want to support AdaptiveSync.

Servers and Red Hat: Cloud Foundry, Docker, CRI-O 1.0, Alibaba and Elasticsearch

  • How to deploy multi-cloud serverless and Cloud Foundry APIs at scale
    Ken Parmelee, who leads the API gateway for IBM and Big Blue’s open source projects, has a few ideas about open-source methods for “attacking” the API and how to create micro-services and make them scale. “Micro-services and APIs are products and we need to be thinking about them that way,” Parmelee says. “As you start to put them up people rely on them as part of their business. That’s a key aspect of what you’re doing in this space.”
  • Docker Opens Up to Support Kubernetes Container Orchestration
    There's been a lot of adoption of Kubernetes in the last few years, and as of Oct. 17 the open-source container orchestration technology has one more supporter. Docker Inc. announced at its DockerCon EU conference here that it is expanding its Docker platform to support Kubernetes. Docker had been directly competing against Kubernetes with its Swarm container orchestration system since 2015. The plan now is to provide a seamless platform that supports a heterogenous deployment that can include both Swarm and Kubernetes clusters. "Docker adapts to you because it's open," Docker founder Solomon Hykes said during his keynote address at DockerCon.
  • Introducing CRI-O 1.0
    Last year, the Kubernetes project introduced its Container Runtime Interface (CRI) -- a plugin interface that gives kubelet (a cluster node agent used to create pods and start containers) the ability to use different OCI-compliant container runtimes, without needing to recompile Kubernetes. Building on that work, the CRI-O project (originally known as OCID) is ready to provide a lightweight runtime for Kubernetes.
  • Red Hat brings its open source solutions to Alibaba Cloud
    Alibaba Cloud has joined the Red Hat Certified Cloud and Service Provider program, with Red Hat solutions to become directly available to Alibaba Cloud customers in the coming months.
  • Elasticsearch now on Alibaba Cloud, eyes China market
    The Amsterdam-based company behind Elasticsearch and Elastic Stack said the new offering would be available to Alibaba Cloud customers as an add-on, giving them access to real-time search, logging, and data analytics capabilities.

Software: VirtualBox 5.1.30, Cockpit 153, GNOME Mutter 3.27.1, KDE Neon

  • Oracle Releases VirtualBox 5.1.30 to Patch Glibc 2.26 Compile Bug on Linux Hosts
    Oracle released VirtualBox 5.1.30, a minor maintenance update to the open-source and cross-platform virtualization software that addresses a few important issues reported by users from previous versions. Coming one month after the VirtualBox 5.1.28 release, which probably most of you out there use right now on your personal computers, VirtualBox 5.1.30 contains a fix for a Glibc 2.26 compilation bug for Linux hosts and a 3D-related crash for Windows guest that use the Windows Additions package.
  • Cockpit 153
    Cockpit is the modern Linux admin interface. We release regularly. Here are the release notes from version 153.
  • GNOME Mutter 3.27.1 Brings Hybrid GPU Support
    Mutter 3.27.1 has just been released as the first development release for the GNOME 3.28 cycle of this compositor / window manager. The change most interesting to us about Mutter 3.27.1 is support for hybrid GPU systems. The context for the hybrid GPU system support is explained via this bug report, "supporting systems with multiple GPUs connected to their own connectors. A common configuration is laptops with an integrated Intel GPU connected to the panel, and a dedicated Nvidia/AMD GPU connected to the HDMI ports."
  • #KDE #KDENEON Release bonanaza! Frameworks, Plasma, KmyMoney and Digikam

Intel Ads as 'Articles'