Language Selection

English French German Italian Portuguese Spanish

Security

What’s the best Linux firewall distro of 2017?

Filed under
GNU
Linux
Security

You don’t have to manage a large corporate network to use a dedicated firewall. While your Linux distro will have an impressive firewall – and an equally impressive arsenal of tools to manage it – the advantages don’t extend to the other devices on your network. A typical network has more devices connected to the internet than the total number of computers and laptops in your SOHO. With the onslaught of IoT, it won’t be long before your router doles out IP addresses to your washing machine and microwave as well.

The one thing you wouldn’t want in this Jetsonian future is having to rely on your router’s limited firewall capabilities to shield your house – and everyone in it – from the malicious bits and bytes floating about on the internet.

A dedicated firewall stands between the internet and internal network, sanitising the traffic flowing into the latter. Setting one up is an involved process both in terms of assembling the hardware and configuring the software. However, there are quite a few distros that help you set up a dedicated firewall with ease, and we’re going to look at the ones that have the best protective open source software and roll them into a convenient and easy to use package.

Read more

More Security News

Filed under
Security

Security News

Filed under
Security
  • Security updates for Tuesday
  • Kaspersky: No whiff of Linux in our OS because we need new start to secure IoT [Ed: Kaspersky repeats the same anti-Linux rhetoric he used years ago to market itself, anti-Linux Liam Tung recycles]

    Eugene Kaspersky, CEO of Kaspersky Lab, says its new KasperskyOS for securing industrial IoT devices does not contain "even the slightest smell of Linux", differentiating it from many other IoT products that have the open-source OS at the core.

  • Reproducible Builds: week 95 in Stretch cycle
  • EU privacy watchdogs say Windows 10 settings still raise concerns

    European Union data protection watchdogs said on Monday they were still concerned about the privacy settings of Microsoft's Windows 10 operating system despite the U.S. company announcing changes to the installation process.

    The watchdogs, a group made up of the EU's 28 authorities responsible for enforcing data protection law, wrote to Microsoft last year expressing concerns about the default installation settings of Windows 10 and users' apparent lack of control over the company's processing of their data.

    The group - referred to as the Article 29 Working Party -asked for more explanation of Microsoft's processing of personal data for various purposes, including advertising.

KDE Plasma 5.8.6 Released for LTS Users with over 80 Improvements, Bug Fixes

Filed under
KDE
Security

Today, February 21, 2017, KDE announced the availability of the sixth maintenance update to the long-term supported KDE Plasma 5.8 desktop environment for Linux-based operating systems.

Read more

pfSense 2.3.3 RELEASE Now Available!

Filed under
Security
BSD

We are happy to announce the release of pfSense® software version 2.3.3!

This is a maintenance release in the 2.3.x series, bringing numerous stability and bug fixes, fixes for a handful of security issues in the GUI, and a handful of new features. The full list of changes is on the 2.3.3 New Features and Changes page, including a list of FreeBSD and internal security advisories addressed by this release.

This release includes fixes for 101 bugs, 14 Features, and 3 Todo items.

If you haven’t yet caught up on the changes in 2.3.x, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.

Read more

Also: NetBSD Accomplishes Reproducible Builds

Security News

Filed under
Security

Security Leftovers

Filed under
Security
  • Mobile apps and stealing a connected car

    The concept of a connected car, or a car equipped with Internet access, has been gaining popularity for the last several years. The case in point is not only multimedia systems (music, maps, and films are available on-board in modern luxury cars) but also car key systems in both literal and figurative senses. By using proprietary mobile apps, it is possible to get the GPS coordinates of a car, trace its route, open its doors, start its engine, and turn on its auxiliary devices. On the one hand, these are absolutely useful features used by millions of people, but on the other hand, if a car thief were to gain access to the mobile device that belongs to a victim that has the app installed, then would car theft not become a mere trifle?

  • [Video] Keynote: Security and Privacy in a Hyper-connected World - Bruce Schneier, Security Expert
  • RSA Conference: Lessons from a Billion Breached Data Records

    Troy Hunt sees more breached records than most of us, running the popular ethical data breach search service "Have I been pwned." In a session at the RSA Conference this week, Hunt entertained the capacity crowd with tales both humorous and frightening about breaches that he has been involved with.

    One of things that Hunt said he is often asked is exactly how he learns about so many breaches. His answer was simple.

    "Normally stuff just gets sent to me," Hunt said.

    He emphasized that he doesn't want to be a disclosure channel for breaches, as that's not a role he wants to play. Rather his goal is more about helping people to be informed and protect themselves.

  • How Google Secures Gmail Against Spam and Ransomware

    Google's Gmail web email service is used by millions of companies and consumers around the world, making it an attractive target for attackers. In a session at the RSA Conference here, Elie Bursztein, anti-fraud and abuse research team lead at Google, detailed the many technologies and processes that Google uses to protect users and the Gmail service itself from exploitation.

  • IBM Reveals Security Risks to Owners of Previously Owned IoT Devices

    hen you sell a car, typically the new owner gets the keys to the car and the original owner walks away. With a connected car, Charles Henderson, global head of X-Force Red at IBM Security, found that the original owner still has remote access capabilities, even years after the car has been sold.

    Henderson revealed his disturbing new research into a previously unexplored area of internet of things (IoT) security at the RSA Conference here on Feb. 17. In a video interview with eWEEK, Henderson detailed the management issue he found with IoT devices and why it's a real risk.

    "As smart as a connected car is, it's not smart enough to know that it has been sold, and that poses a real problem," Henderson said.

Security News

Filed under
Security

Security News

Filed under
Security
  • OpenSSL project releases patch to fix critical bug
  • Microsoft's monthlong patch delay could pose risks [Ed: Microsoft is in no hurry because there are back doors it knows about but keeps secret anyway]

    Microsoft has decided to bundle its February patches together with those scheduled for March, a move that at least some security experts disagree with.

    "I was surprised to learn that Microsoft wants to postpone by a full month," said Carsten Eiram, the chief research officer at vulnerability intelligence firm Risk Based Security, via email. "Even without knowing all the details, I find such a decision very hard to justify. They are aware of vulnerabilities in their products and have developed fixes; those should always be made available to customers in a timely fashion."

    Microsoft took everyone by surprise on Tuesday when it announced that this month's patches had to be delayed because of a "last minute issue" that could have had an impact on customers. The company did not initially specify for how long the patches will be postponed, which likely threw a wre

  • Zero-day flaw around, but Microsoft updates delayed by a month
  • Microsoft misses regular security fix date

    Microsoft has delayed the release of a security update that would have fixed a vulnerability cyber thieves are known to be exploiting.

    The fix was to be released as part of Microsoft's regular monthly security update for its Windows software.

  • How Google reinvented security and eliminated the need for firewalls

    In some ways, Google is like every other large enterprise. It had the typical defensive security posture based on the concept that the enterprise is your castle and security involves building moats and walls to protect the perimeter.

    Over time, however, that perimeter developed holes as Google’s increasingly mobile workforce, scattered around the world, demanded access to the network. And employees complained about having to go through a sometimes slow, unreliable VPN. On top of that, Google, like everyone else, was moving to the cloud, which was also outside of the castle.

  • No Firewalls, No Problem for Google

    On Tuesday at RSA Conference, Google shared the seven-year journey of its internal BeyondCorp rollout where it affirms trust based on what it knows about its users and devices connecting to its networks. And all of this is done at the expense—or lack thereof—of firewalls and traditional network security gear.

  • Android Phone Hacks Could Unlock Millions of Cars

Security News

Filed under
Security
  • Thursday's security updates
  • Capsule8 comes out of stealth to help protect Linux from attacks

    Capsule8 has emerged from stealth mode to unveil its plans for the industry’s first container-aware, real-time threat protection platform designed to protect legacy and next-generation Linux infrastructures from both known and unknown attacks. Founded by experienced hackers John Viega, Dino Dai Zovi and Brandon Edwards, Capsule8 is being built on the real-world experience of its founders in building and bringing to market defensive systems to protect against exploitation of previously unknown vulnerabilities. The company raised seed funding of $2.5 million from Bessemer Venture Partners, as well as individual investors Shardul Shah of Index Ventures and Jay Leek of ClearSky. The funding will help fuel the launch of the Capsule8 platform spring 2017.

  • Bruce Schneier Says Government Involvement in Coding Is Coming

    Security expert Bruce Schneier is painting a grim future for the tech community as the government will start to stick its nose into people’s codes.

    Schneier, present at the RSA Conference, said that until now everyone had this “special right” to code the world as they saw fit. “My guess is we’re going to lose that right because it’s too dangerous to give it to a bunch of techies,” he added, according to The Register.

  • How To Shrink Attack Surfaces with a Hypervisor

    A software environment’s attack surface is defined as the sum of points in which an unauthorized user or malicious adversary can enter or extract data. The smaller the attack surface, the better. We recently sat down with Doug Goldstein (https://github.com/cardoe or @doug_goldstein) to discuss how companies can use hypervisors to reduce attack surfaces and why the Xen Project hypervisor is a perfect choice for security-first environments. Doug is a principal software engineer at Star Lab, a company focused on providing software protection and integrity solutions for embedded systems.

  • Xen Project asks to limit security vulnerability advisories
  • Xen Project wants permission to reveal fewer vulnerabilities
  • Xen Project proposes issuing fewer advisories
  • Verified Boot: From ROM to Userspace

    Amid growing attacks on Linux devices, the 2016 Embedded Linux Conference demonstrated a renewed focus on security. One well-attended presentation at ELC Europe covered the topic of verified boot schemes. In this talk, Marc Kleine-Budde of Pengutronix revealed the architecture and strategies of a recently developed verified boot scheme for a single-core, Cortex-A9 NXP i.MX6 running on the RIoTboard SBC.

  • Yahoo's Security Incompetence Just Took $250 Million Off Verizon's Asking Price

    So last year we noted how Verizon proposed paying $4.8 billion to acquire Yahoo as part of its plan to magically transform from stodgy old telco to sexy new Millennial advertising juggernaut, which, for a variety of reasons, isn't going so well. One of those reasons is the fact that Yahoo failed to disclose the two, massive hacks (both by the same party) that exposed the credentials of millions of Yahoo customers during deal negotiations. The exposure included millions of names, email addresses, phone numbers, birthdates, hashed passwords (using MD5) and "encrypted or unencrypted" security questions and answers.

    As noted previously, Verizon had been using the scandal to drive down the $4.8 billion asking price, reports stating that Verizon was demanding not only a $1 billion reduction in the price, but another $1 billion to cover the inevitable lawsuits by Yahoo customers.

  • Updates on CyberSecurity, WordPress and what we're cooking in the lab today.

    One of the most effective ways the Wordfence team keeps the WordPress community and customers secure is through something we call the ‘Threat Defense Feed’. This is a combination of people, software, business processes and data. It’s an incredibly effective way to keep hackers out and provide our customers with early detection.

  • The 7 security threats to technology that scare experts the most

    What happens if a bad actor turns off your heat in the middle of winter, then demands $1,000 to turn it back on? Or even holds a small city’s power for ransom? Those kinds of attacks to personal, corporate, and infrastructure technology were among the top concerns for security experts from the SANS Institute, who spoke Wednesday during the RSA conference in San Francisco.

    Some of these threats target consumers directly, but even the ones that target corporations could eventually “filter down” to consumers, though the effects might not be felt for some time.

Syndicate content

More in Tux Machines

Rockstor 3.9.0 NAS Distro Adds Big Enhancements to the Disk Management Subsystem

Suman Chakravartula from the Rockstor project, an open-source NAS (Network-attached storage) solution using the Linux kernel and Btrfs file system, announced the general availability of Rockstor 3.9.0. Read more

Escuelas Linux 5.2 Officially Released with LibreOffice 5.3.1 & Google Chrome 57

Alejandro Diaz informs Softpedia today about the general availability of Escuelas Linux 5.2, the newest and most advanced version of his Bodhi/Ubuntu-based GNU/Linux distribution designed for educational purposes. Read more

today's leftovers

  • Linux Kernel Podcast for 2017/03/21
  • Announcing the Shim review process [Ed: accepting rather than fighting very malicious things]
    However, a legitimate criticism has been that there's very little transparency in Microsoft's signing process. Some people have waited for significant periods of time before being receiving a response. A large part of this is simply that demand has been greater than expected, and Microsoft aren't in the best position to review code that they didn't write in the first place.
  • rtop – A Nifty Tool to Monitor Remote Server Over SSH
    rtop is a simple, agent-less, remote server monitoring tool that works over SSH. It doesn’t required any other software to be installed on remote machine, except openSSH server package & remote server credentials.
  • Chakra GNU/Linux Users Get KDE Plasma 5.9.3 and KDE Applications 16.12.3, More
    Neofytos Kolokotronis from the Chakra GNU/Linux project, an open-source operating system originally based on Arch Linux and the KDE Plasma desktop environment, announced the availability of the latest KDE updates in the distro's repositories. Those of you using Chakra GNU/Linux as your daily drive will be happy to learn that the stable repos were filled with numerous up-to-date packages from the recently released KDE Plasma 5.9.3 desktop environment, KDE Applications 16.12.3 software suite, and KDE Frameworks 5.32.0 collection of over 70 add-on libraries for Qt 5.
  • YaST Team: Highlights of YaST development sprint 32
    One of the known limitations of the current installer is that it’s only able to automatically propose an encrypted schema if LVM is used. For historical reasons, if you want to encrypt your root and/or home partitions but not to use LVM, you would need to use the expert partitioner… and hope for the best from the bootloader proposal. But the new storage stack is here (well, almost here) to make all the old limitations vanish. With our testing ISO it’s already possible to set encryption with just one click for both partition-based and LVM-based proposals. The best possible partition schema is correctly created and everything is encrypted as the user would expect. We even have continuous tests in our internal openQA instance for it. The part of the installer managing the bootloader installation is still not adapted, which means the resulting system would need some manual fixing of Grub before being able to boot… but that’s something for an upcoming sprint (likely the very next one).
  • Debian stretch on the Raspberry Pi 3 (update) (2017-03-22)
    I previously wrote about my Debian stretch preview image for the Raspberry Pi 3.
  • Asus Tinker Board – Chromium YouTube Performance
    One of the many strengths of the Asus Tinker Board is its multimedia support. This 4K video capable machine is a mouthwatering prospect for the multimedia enthusiast. The machine has a respectable 1.8GHz ARM Cortex-A17 quad-core processor. It’s only 32-bit (unlike the Raspberry Pi 3) but has a higher clock speed. The Tinker Board also sports an integrated ARM-based Mali T764 graphics processor (GPU).

Microsoft vs GNU/Linux