Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • 20 Questions Security Leaders Need To Ask About Analytics

    It would be an understatement to say that the security world tends to be full of hype and noise. At times, it seems like vendors virtually xerox each other’s marketing materials. Everyone uses the same words, phrases, jargon, and buzzwords. This is a complicated phenomenon and there are many reasons why this is the case.

    The more important issue is why security leaders find ourselves in this state. How can we make sense of all the noise, cut through all the hype, and make the informed decisions that will improve the security of our respective organizations? One answer is by making precise, targeted, and incisive inquiries at the outset. Let’s start with a game of 20 questions. Our first technology focus: analytics.

  • Trend Micro shows that Linux systems not so bulletproof against trojans [Ed: very low risk (must fool the user or gain physical access)]
  • Sixth Linux DDoS Trojan Discovered in the Last 30 Days [Ed: drama over something that must fool users]

    Linux users have yet another trojan to worry about, and as always, crooks are deploying it mostly to hijack devices running Linux-based operating systems and use them to launch DDoS attacks at their behest.

  • Yet Another Linux Trojan Uncovered
  • Secure Docker on Linux or Windows platforms

    With Docker appearing in businesses of all shapes and sizes, security is a concern for many IT admins. Here's how to secure Docker on the container or the host machine.

  • New release: usbguard-0.6.1
  • Ransomware Getting More Targeted, Expensive

    I shared a meal not long ago with a source who works at a financial services company. The subject of ransomware came up and he told me that a server in his company had recently been infected with a particularly nasty strain that spread to several systems before the outbreak was quarantined. He said the folks in finance didn’t bat an eyelash when asked to authorize several payments of $600 to satisfy the Bitcoin ransom demanded by the intruders: After all, my source confessed, the data on one of the infected systems was worth millions — possibly tens of millions — of dollars, but for whatever reason the company didn’t have backups of it.

  • Web security CEO warns about control of internet falling into few hands

    The internet was designed to be a massive, decentralized system that nobody controlled, but it is increasingly controlled by a select few tech companies, including Google, Facebook, Apple and Amazon, and they are continuing to consolidate power, said the CEO of a cybersecurity company.

    "More and more of the internet is sitting behind fewer and fewer players, and there are benefits of that, but there are also real risks," said Matthew Prince, chief executive officer of web security company CloudFlare, in an interview with CNBC. His comments came at CloudFlare's Internet Summit — a conference featuring tech executives and government security experts — on Tuesday in San Francisco.

    Facebook has faced a lot of criticism for perceived abuse of its editorial sway among the 1.7 billion monthly active users who visit the site to consume news alongside family photos and ads. For example, a Norwegian newspaper editor recently slammed Mark Zuckerberg for Facebook's removal of a post featuring an iconic image known as the Napalm Girl that included a naked girl running from napalm bombs.

Security News

Filed under
Security

Security News

Filed under
Security
  • Security advisories for Wednesday
  • DevOps and the Art of Secure Application Deployment

    Secure application deployment principles must extend from the infrastructure layer all the way through the application and include how the application is actually deployed, according to Tim Mackey, Senior Technical Evangelist at Black Duck Software. In his upcoming talk, “Secure Application Development in the Age of Continuous Delivery” at LinuxCon + ContainerCon Europe, Mackey will discuss how DevOps principles are key to reducing the scope of compromise and examine why it’s important to focus efforts on what attackers’ view as vulnerable.

  • Sept 2016 Patch Tuesday: Microsoft released 14 security bulletins, rated 7 as critical

    Microsoft released 14 security bulletins for September, seven of which are rated critical due to remote code execution flaws. Microsoft in all its wisdom didn’t regard all RCEs as critical. There’s also an “important rated” patch for a publicly disclosed flaw which Microsoft claims isn’t a zero-day being exploited. But at least a 10-year-old hole is finally being plugged.

    Next month marks a significant change as Microsoft says it intends roll out "servicing changes" that include bundled patches. Unless things change, not all Windows users will be able to pick and choose specific security updates starting in October.

  • Microsoft Patches Zero Day Flaw Used In Two Massive Malvertising Campaigns [Ed: Microsoft, as usual, told the NSA about this months before patching]

    Microsoft was first notified about the so-called information disclosure bug in September 2015, security vendor Proofpoint said in an alert this week. But a patch for it became available only after Trend Micro and Proofpoint reported the bug again to Microsoft more recently when researching a massive malvertising campaign being operated by a group called AdGholas, the alert noted.

MySQL Patching

Filed under
Security
  • MySQL 0-day could lead to total system compromise
  • MySQL Exploit Evidently Patched

    News began circulating yesterday that the popular open source database MySQL contains a publicly disclosed vulnerability that could be used to compromise servers. The flaw was discovered by researcher Dawid Golunski and began getting media attention after he published a partial proof-of-concept of the exploit, which is purposefully incomplete to prevent abuse. He said the exploit affects "all MySQL servers in default configuration in all version branches (5.7, 5.6, and 5.5) including the latest versions." In addition, MariaDB and Percona DB which are derived from MySQL are affected.

Security News

Filed under
Security
  • Tuesday's security updates
  • [Mozilla:] Cybersecurity is a Shared Responsibility

    There have been far too many “incidents” recently that demonstrate the Internet is not as secure as it needs to be. Just in the past few weeks, we’ve seen countless headlines about online security breaches. From the alleged hack of the National Security Agency’s “cyberweapons” to the hack of the Democratic National Committee emails, and even recent iPhone security vulnerabilities, these stories reinforce how crucial it is to focus on security.

    Internet security is like a long chain and each link needs to be tested and re-tested to ensure its strength. When the chain is broken, bad things happen: a website that holds user credentials (e.g., email addresses and passwords) is compromised because of weak security; user credentials are stolen; and, those stolen credentials are then used to attack other websites to gain access to even more valuable information about the user.

    One weak link can break the chain of security and put Internet users at risk. The chain only remains strong if technology companies, governments, and users work together to keep the Internet as safe as it can be.

  • IoT malware exploits DVRs, home cameras via default passwords

    The Internet of Things business model dictates that devices be designed with the minimum viable security to keep the products from blowing up before the company is bought or runs out of money, so we're filling our homes with net-connected devices that have crummy default passwords, and the ability to probe our phones and laptops, and to crawl the whole internet for other vulnerable systems to infect.

    Linux/Mirai is an ELF trojan targeting IoT devices, which Malware Must Die describes as the most successful ELF trojan. It's very difficult to determine whether these minimal-interface devices are infected, but lab tests have discovered the malware in a wide range of gadgets.

  • Someone Is Learning How to Take Down the Internet

    First, a little background. If you want to take a network off the Internet, the easiest way to do it is with a distributed denial-of-service attack (DDoS). Like the name says, this is an attack designed to prevent legitimate users from getting to the site. There are subtleties, but basically it means blasting so much data at the site that it's overwhelmed. These attacks are not new: hackers do this to sites they don't like, and criminals have done it as a method of extortion. There is an entire industry, with an arsenal of technologies, devoted to DDoS defense. But largely it's a matter of bandwidth. If the attacker has a bigger fire hose of data than the defender has, the attacker wins.

  • Internet's defences being probed: security expert

    A big player, most possibly a nation state, has been testing the security of companies that run vital parts of the Internet's infrastructure, according to well-known security expert Bruce Schneier.

    In an essay written for the Lawfare blog, Schneier, an inventor of the Blowfish, Twofish and Yarrow algorithms, said that the probes which had been observed appeared to be very carefully targeted and seemed to be testing what exactly would be needed to compromise these corporations.

    Schneier said he did not know who was carrying out the probes but, at a first guess, said it was either China or Russia.

    Pointing out that the easiest way to take a network off the Internet was by using a distributed denial of service (DDoS) attack, he said that major firms that provide the basic infrastructure to make the Internet work had recently seen an escalation of such attacks.

  • Hackers smear Olympic athletes with data dump of medical files

    Hackers are trying to tarnish the U.S. Olympic team by releasing documents they claim show athletes including gymnast Simone Biles and tennis players Venus and Serena Williams used illegal substances during the Rio Games.

    The medical files, allegedly from the World Anti-Doping Agency, were posted Tuesday on a site bearing the name of the hacking group Fancy Bears. “Today we'd like to tell you about the U.S. Olympic team and their dirty methods to win,” said a message on the hackers' site.

    The World Anti-Doping Agency confirmed it had been hacked and blamed Fancy Bears, a Russian state-sponsored cyber espionage team that is also known as APT 28 -- the very same group that may have recently breached the Democratic National Committee.

Security News

Filed under
Security
  • Securing the Programmer

    I have a favorite saying: "If you are a systems administrator, you have the keys to the kingdom. If you are an open-source programmer, you don't know which or how many kingdoms you have the keys to." We send our programs out into the world to be run by anyone for any purpose. Think about that: by anyone, for any purpose. Your code might be running in a nuclear reactor right now, or on a missile system or on a medical device, and no one told you. This is not conjecture; this is everyday reality. Case in point: the US Army installed gpsd on all armor (tanks, armored personnel carriers and up-armored Humvees) without telling its developers.

    This article focuses on the needs of infrastructure software developers—that is, developers of anything that runs as root, has a security function, keeps the Internet as a whole working or is life-critical. Of course, one never knows where one's software will be run or under what circumstances, so feel free to follow this advice even if all you maintain is a toddler login manager. This article also covers basic security concepts and hygiene: how to think about security needs and how to keep your development system in good shape to reduce the risk of major computing security mishaps.

  • Software-Defined Security Market Worth 6.76 Billion USD by 2021
  • Two critical bugs and more malicious apps make for a bad week for Android
  • Let's Encrypt Aiming to Encrypt the Web

    By default, the web is not secure, enabling data to travel in the clear, but that's a situation that is easily corrected through the use of SSL/TLS. A challenge with implementing Secure Sockets Layer/Transport Layer Security has been the cost to acquire an SSL/TSL certificate from a known Certificate Authority (CA), but that has changed in 2016, thanks to the efforts of Let's Encrypt.

    Let's Encrypt is a non-profit effort that that was was announced in November 2014 and became a Linux Foundation Collaborative Project in April 2015. Let's Encrypt exited its beta period in April 2016 and to date has provided more than 5 million free certificates.

Security News

Filed under
Security
  • Security advisories for Monday
  • Linux with a irc trojan.
  • On Experts

    There are a rather large number of people who think they are experts, some think they're experts at everything. Nobody is an expert at everything. People who claim to have done everything should be looked at with great suspicion. Everyone can be an expert at something though.

  • OPM Hacking Report Says Agency Missed One Set Of Attacks, Spent Little On Cybersecurity [Ed: spent on Windows]

    The twice-hacked Office of Personnel Management has had little to offer but promises of "taking security seriously" and free identity theft protection for the thousands of government employees whose personal information was pried loose by hackers.

    Twice-hacked, because there was one breach the OPM did discover, and one it didn't. While it spent time walling off the breach it had detected, another went unnoticed, leaking enough info on government employees that the CIA began worrying about the safety of agents located abroad.

    A new report [PDF] by the Committee on Oversight and Government Reform (which AP refers to but, oddly, does not feel compelled to LINK to, despite it being a completely PUBLIC document) details where the OPM initially went wrong.

  • Hollywood Keeps Insisting Tech Is Easy, Yet Can't Secure Its Own Screeners

    While some will just look at this and mock Hollywood for bad security practices, it does raise more serious questions: if Hollywood can't figure out its own (basic) technology issues, why does it think that the tech industry should solve all its problems for it? If it doesn't even understand the basics, how can it insist that those in Silicon Valley can fix the things that it doesn't understand itself?

    We're already seeing this with the MPAA's ridiculous and misguided freakout over the FCC's plan to have cable companies offer up app versions so that authorized subscribers can access authorized, licensed content. The MPAA and its think tank friends keep falsely insisting that the FCC's recommendation requires the cable companies to ship the actual content to third parties. But the plan has never said that. It only required that third-party devices be able to access the content -- such as by passing through credentials so that the content could flow from the (licensed) cable service to the end user.

    The fact that these guys don't seem to understand the basics of how the technology works comes through not just in the fact that they failed to secure their screener system, but also in the policy proposals that they keep making. It's becoming increasingly difficult to take those policies seriously when they seem to be based on a fundamental ignorance of how technology actually works.

Hands-on: Blue Hydra can expose the all-too-unhidden world of Bluetooth

Filed under
Security

I installed Blue Hydra by "cloning" its Ruby code from its GitHub repository on an older MacBook Air I'd configured with Kali GNU/Linux "Rolling" (64 bit), a security-testing-focused version of Debian, and a SENA UD100 USB Bluetooth adapter. Blue Hydra will work on other Debian-based distributions, and it's even pre-installed as part of the current release of Pentoo (a security-focused live CD version of Gentoo Linux). Pwnie Express has also packaged Blue Hydra for use with its line of sensors (though not with the PwnPhone), and it can be integrated with the company's Pulse security monitoring and auditing service.

Read more

Security News

Filed under
Security
  • How OPNFV Earned Its Security Stripes and Received a CII Best Practices Badge

    Earning the CII badge will have a HUGE impact on OPNFV’s general approach to building security into the development model (something all open source projects should model). Statistics show that around 50 percent of vulnerabilities in a software are “flaws” (usually design fault/defective design, which is hard to fix after software has been released) and 50 percent bugs (implementation fault). Following these best practices will hopefully address both design and implementation faults before they become vulnerabilities.

  • MySQL Hit By "Critical" Remote Code Execution 0-Day

    The latest high-profile open-source software project having a bad security day is MySQL... MySQL 5.5/5.6/5.7 has a nasty zero-day vulnerability.

    Researchers have discovered multiple "severe" MySQL vulnerabilities with the CVE-2016-6662 being marked as critical and does affect the latest MySQL version.

    This 0-day is open for both local and remote attackers and could come via authenticated access to a MySQL database (including web UI administration panels) or via SQL injection attacks. The exploit could allow attackers to execute arbitrary code with root privileges.

  • CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day )
  • Is Debian the gold standard for Linux security?
  • 10 Best Password Managers For Linux Operating Systems

    With so many online accounts on the internet, it can be tediously difficult to remember all your passwords. Many people write them down or store them in a document, but that’s plain insecure. There are many password managers for Windows and OS X, but here we’ll look at some of the best password managers for Linux.

Security News

Filed under
Security
  • Moving towards a more secure web

    To help users browse the web safely, Chrome indicates connection security with an icon in the address bar. Historically, Chrome has not explicitly labelled HTTP connections as non-secure. Beginning in January 2017 (Chrome 56), we’ll mark HTTP sites that transmit passwords or credit cards as non-secure, as part of a long-term plan to mark all HTTP sites as non-secure.

  • UK Politician's Campaign Staff Tweets Out Picture Of Login And Password To Phones During Campaign Phone Jam

    When we talk password security here at Techdirt, those conversations tend to revolve around stories a bit above and beyond the old "people don't use strong enough passwords" trope. While that certainly is the case, we tend to talk more about how major corporations aren't able to learn their lessons about storing customer passwords in plain text, or about how major media outlets are occasionally dumb enough to ask readers to submit their own passwords in an unsecure fashion.

    But for the truly silly, we obviously need to travel away from the world of private corporations and directly into the world of politicians, who often times are tasked with legislating on matters of data security and privacy, but who cannot help but show their own ineptness on the matter themselves. Take Owen Smith, for example. Smith is currently attempting to become the head of the UK's Labour Party, with his campaign working the phones as one would expect. And, because this is the age of social media engagement, one of his campaign staffers tweeted out the following photo of the crew hard at work.

  • WiredTree Warns Linux Server Administrators To Update In Wake Of Critical Off-Path Kernel Vulnerability

    WiredTree, a leading provider of managed server hosting, has warned Linux server administrators to update their servers in response to the discovery of a serious off-path vulnerability in the Linux kernel’s handling of TCP connections.

  • Reproducible Builds: week 72 in Stretch cycle
Syndicate content

More in Tux Machines

Desktop Themes

  • Numix White Icons Looks Better On Dark Themes, Install In Ubuntu/Linux Mint Via PPA
  • Make Your Gnome Shell Kind Of Look Like Unity With United Gnome Theme
    Beside theme you can install these extensions to make desktop look more like Unity. Dash to dock: Enable panel mode and position it on the left; Dynamic Panel Transparency: The non-dark variant comes with a semi-transparent panel. Square icons used in the following screenshots.
  • Albatross Theme Forked From Shimmer Project For Ubuntu/Linux Mint
    It is glad to see that theme development is much faster now than past. Albatross theme is forked from Shimmer project team, they stopped the development long ago. If you want to keep your desktop simple, clean and elegant then for sure this theme is for you, it is specially targeting Gnome desktop and may work with Xfce. Currently this theme is compatible with Gtk 3.24+/3.22/3.20. If you intend to use this theme in the Xfce desktop then you must use xfwm4 from "Greybird/Adwaita" since that is not packed with this theme. Since this theme is in active development, if you encounter any bug or problem with this theme then report it to get it fixed. Obsidian-1 icons used in the following screenshot.
  • Pop Theme Suite: Make Your Ubuntu/Linux Look Like System76 Upcoming Desktop
    As I mentioned in my previous posts that lots theme development going on now but Linux community and a company is not even behind called "System76". Well they designed theme and icons for their own computers that run Ubuntu but good news is that it is free and comes under GPL-V2 license that means anyone can copy, share or remake their theme suite.

Hands on with the Pinebook

The Pine A64 was a 64-bit Quad-Core Single Board Computer which was kickstarted at the tail end of 2015 for delivery in the middle of 2016. Costing just $15, and hailed as a “Raspberry Pi killer,” the board raised $1.7 million from 36,000 backers. It shipped to its backers to almost universally poor reviews. Now they’re back, this time with a laptop—a 11.6-inch model for $89, or a 14-inch model for $99. Both are powered by the same 64-bit Quad-Core ARM Cortex A53 as the original Pine A64 board, but at least Pine are doing a much better job this time around of managing user expectations. Read more

OpenELEC 8.0.3

Linux, Graphics, and Tonight's Release

  • Linux 4.11 Set To Be Released Today
    After it was postponed last weekend, the Linux 4.11 kernel is set to be officially released in a matter of hours. As of writing, the Linux 4.11 codename remains the "Fearless Coyote", but there is the possibility that Torvalds may rename it when tagging the official 4.11.0 release today.
  • Linux Kernel 3.18.51 Released with MIPS, ARM, and CIFS Changes, Updated Drivers
  • Linux Kernel 4.4.65 LTS Is a Small Patch with Networking and File System Fixes
  • USB Type-C Port Manager Coming To Linux 4.12
    Another feature to look forward to with the Linux 4.12 kernel for those using newer hardware featuring USB Type-C is a port manager. The "TCPM" driver is queued as a new staging driver via usb-next for entering the Linux 4.12 kernel in the next two weeks. This USB Type-C Port Manager driver implements a power delivery state machine for source/sink ports. This driver serves as a state machine while other USB Type-C drivers are responsible for the rest of the functionality.
  • DirectFB Is Back To Being Dormant
    Back in August of 2015, DirectFB disappeared with its project site and code vanishing. Last November DirectFB re-appeared along with a new site and renewed focus on the project. Unfortunately, it's once again gone silent. With all the news this month about Ubuntu dropping Mir / Unity 8 and the continued work by many different desktop/compositor teams on Wayland, I was curious this weekend to check on how DirectFB is doing in 2017... Sadly, DirectFB.net as the new DirectFB site launched last November is now down again. The original DirectFB (dot) org web-site remains squatted. I've been unable to find any other "new" DirectFB website.
  • Sway Wayland Compositor Adding Proprietary NVIDIA Driver Support
    The Sway Wayland compositor that aims to be i3-compatible continues picking up new features.