Language Selection

English French German Italian Portuguese Spanish

Security

Tails 3.0 Anonymous LiveCD Gets Third Beta Release with Important Security Fixes

Filed under
Security
Debian

The developers of the Tails amnesic incognito live system announced the availability of the third Beta release of the upcoming major Tails 3.0 operating system, which will be based on the soon-to-be-released Debian GNU/Linux 9 "Stretch" OS.

Read more

Security Leftovers

Filed under
Security
  • More than 300 Cisco switch models vulnerable to CIA hack

    A cache of CIA documents was dropped on the internet two weeks ago via WikiLeaks. It was a huge volume of data, some of which detailed CIA tools for breaking into smartphones and even smart TVs. Now, Cisco has said its examination of the documents points to a gaping security hole in more than 300 models of its switches. There’s no patch for this critical vulnerability, but it’s possible to mitigate the risk with some settings changes.

    Cisco’s security arm sent out an advisory on Friday alerting customers that the IOS and IOS XE Software Cluster were vulnerable to hacks based on the leaked documents. The 318 affected switch models are mostly in the Catalyst series, but there are also some embedded systems and IE-series switches on the list. These are enterprise devices that cost a few thousand dollars at least. So, nothing in your house is affected by this particular attack.

  • Assange chastises companies who haven't responded to CIA vulnerability offers

    Wikileaks head Julian Assange slammed companies not taking the site up on the sites offer to share security flaws the CIA had exploited in their products.

    In a screen-shot statement tweeted on Saturday, Wikileaks noted that "Organizations such as Mozilla" had responded to the site's emails offering unreleased security vulnerabilities from leaked CIA files. "Google and other companies" had not.

    "Most of these lagging companies have conflicts of interest due to their classified work with US government agencies. In practice such associations limit industry staff with US security clearances from fixing holes based on leaked information from the CIA. Should such companies choose to not secure their users against CIA or NSA attacks users may prefer organizations such as Mozilla or European companies that prioritize their users over government contracts," the statement read.

    Wikileaks recently published a trove of files leaked from the CIA, including descriptions of hacking techniques. The site made an effort to redact source code showing how to actually accomplish the techniques, although enough code slipped through the cracks for researchers to reverse engineer at least one of the security flaws.

  • Gentoo: 201703-02 Adobe Flash Player: Multiple vulnerabilities

OpenSSH 7.5 released

Filed under
OSS
Security

OpenSSH 7.5 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support. OpenSSH also includes
transitional support for the legacy SSH 1.3 and 1.5 protocols
that may be enabled at compile-time.

Read more

Also: OpenSSH 7.5 Released, Legacy Crypto Functions Still Heading For Retirement

Security Leftovers

Filed under
Security
  • Hire a DDoS service to take down your enemies

    According to Neustar, almost three quarters of all global brands, organizations and companies have been victims of a DDoS attack. And more than 3,700 DDoS attacks occur each day.

  • Apollo Lake 3.5-incher doubles down on security

    Kontron’s Linux-friendly, Intel Apollo Lake based “3.5″-SBC-APL” SBC features triple display support, a TPM 2.0 chip, and optional security services.

  • Leading Linux distros dawdle as kernel flaw persists

    A local privilege esclation flaw has been fixed in the Linux kernel, but several upstream distributions have yet to release updates. Administrators should plan on mitigating the vulnerability on Linux servers and workstations themselves and monitor the distributions for their update plans.

How to secure your Raspberry Pi

Filed under
Linux
Hardware
Security

The Raspberry Pi and many other inexpensive computer boards like it have become part of the "Internet of Things" or IoT revolution. Internet-connected computing devices have emerged beyond traditional servers, desktops, laptops, and mobile devices. Now your TV, DVR (digital video recorder), thermostat, refrigerator, Internet radio, Raspberry Pi, and other devices are on the network too.

IoT has been huge for experimentation and innovation. But as projects get rushed to completion, there have been severe consequences for ignoring security. And this applies both to commercial products and hobby projects. I'll talk about the Raspberry Pi specifically in this article, so this post is oriented more toward do-it-yourself projects.

Read more

Security Leftovers

Filed under
Security
  • Some HTTPS inspection tools might weaken security [iophk: "the death of web-mail UI"]

    In a typical enterprise environment, an HTTPS connection can even be intercepted and re-encrypted multiple times: at the network perimeter by gateway security products or data leak prevention systems and on endpoint systems by antivirus programs that need to inspect such traffic for malware.

    The problem is that users' browsers no longer get to validate the real server certificates because that task falls to the interception proxy. And as it turns out, security products are pretty bad at validating server certificates.

  • Defence against the Dark Arts involves controlling your hardware

    In light of the Vault 7 documents leak (and the rise to power of Lord Voldemort this year), it might make sense to rethink just how paranoid we need to be.

  • This laptop-bricking USB stick just got even more dangerous

    Remember that USB stick that would destroy almost anything in its path, from laptops, photo booths, kiosks, to even cars?

    Now there's a new version, and it's even more dangerous than before.

    In case you missed it the first time around, a Hong Kong-based company built a weaponized pocket-sized USB stick, which when plugged into a device, will rapidly charge its capacitors from the USB power supply and then discharge, frying the affected device's circuits.

  • Docker Image Vulnerability Research

    Managing known vulnerabilities is the first step towards a strong security posture. If we’re not updating our systems, and keeping an eye on emerging vulnerabilities that are yet to be patched upstream, we’re basically leaving the front door wide open.

Linux Security

Filed under
Security
  • Why Codethink is a founding member of the Civil Infrastructure Platform, a Linux Foundation initiative

    On April 4th 2016 a new Linux Foundation initiative called the Civil Infrastructure Platform was announced. CIP aims to share efforts around building a Linux-based commodity platform for industrial grade products that need to be maintained for anything between 25 and 50 years - in some cases even longer. Codethink is one of the founding members.

  • Ubuntu 12.04 Will Be End-Of-Life in April 28th 2017 & ESM Surprise
  • Update Shyness

    But the update madness had just started. A couple days after the PCLOS incident, I booted OpenMandriva and Discover notified me that there were updates. I must confess that the update process in OpenMandriva has not been easy for me: I prefer to use the Control Center, but sometimes it cannot install some packages and those have to be installed with Discover. Sometimes, the latter simply refuses to load the package list.

Security Leftovers

Filed under
Security
  • Security updates for Friday
  • Eight-year-old Linux security flaw finally fixed

    ANOTHER years-old vulnerability in the Linux kernel has been patched - the fourth such ageing security flaw that has been patched recently.

  • Paving with Good Intentions: The Attempt to Rescue the Network Time Protocol

    After the Heartbleed bug revealed in April 2014 how understaffed and under-funded the OpenSSL project was, the Network Time Foundation was discovered to be one of several projects in a similar condition. Unfortunately, thanks to a project fork, the efforts to lend NTP support have only divided the development community and created two projects scrambling for funds where originally there was only one.

  • Mozilla: Everyone's scared of hackers but clueless about fending them off

    According to Firefox maker Mozilla, we're nearly all afraid of hackers, but few of us feel we can protect ourselves from them.

    The non-profit's survey of 30,000 people found internet users' confidence is extremely low when it comes to privacy and security. The survey found that 90 percent of people are unsure how to protect themselves online, while 11.5 percent feel they know nothing about security.

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security
Syndicate content

More in Tux Machines

Red Hat After Graphics People

GNOME News

  • Desk Changer is a Wallpaper Slideshow Extension for GNOME
    Have you been looking for a GNOME wallpaper slideshow extension? If so, you can stop. In the comments to our recent post on the way GNOME handles wallpapers a number of readers asked whether GNOME had an image slideshow feature built in, without the need for third-party apps and the like. The answer is yes, GNOME does. Sort of.
  • Minwaita: A Compact Version of Theme Adwaita for Gnome Desktop
    As you may already know that Ubuntu is switching back to Gnome, this is the transition time for Ubuntu to switch back. Some creators are motivated and creating themes for Gnome desktop, which is a good thing and hopefully we shall see plenty of Gnome themes and icons around soon. As its name shows "Minwaita" it is minimal/compact version of Adwaita theme, the theme is available after some enhancements to make Gnome more sleek and more vanilla Gnome experience without moving to away from Adwaita's design. This theme is compatible with Gnome 3.20 and up versions. This theme was released back in November, 2016 and still in continuous development that means if you find any problem or bug in the theme then report it to get it fixed in the next update. Obsidian-1 icons used in the following screenshots.
  • Gnome Pomodoro Timer Can Help You Increase Productivity
    If you are struggling with focus on something, it could be your work or study then try Pomodoro technique, this method developed by Francesco Cirillo in the late 1980s. The technique uses a timer to break down work into intervals, traditionally 25 minutes in length, separated by short breaks. You can read more about Pomodoro here.
  • Widget hierarchies in GTK+ 4.0
    In GTK+3, only GtkContainer subclasses can have child widgets. This makes a lot of sense for “public” container children like we know them, e.g. GtkBox — i.e. the developer can add, remove and reorder child widgets arbitrarily and the container just does layout.

Red Hat News

Leftovers: Ubuntu and Debian