Language Selection

English French German Italian Portuguese Spanish

Security News, Notably Microsoft/NSA Catastrophe

Filed under
Microsoft
Security
  • Major cyber attack hits companies, hospitals, schools worldwide

    Private security firms identified the ransomware as a new variant of "WannaCry" that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft's Windows operating system.

  • Massive cyberattack hits several hospitals across England
  • Rejection Letter

    We start with a shadowy US government agency, the NSA, systematically analyzing the software of the biggest American computer companies in search of vulnerabilities. So far, so plausible: this is one of the jobs of an intelligence and counter-espionage agency focussed on information technology. However, instead of helping Microsoft fix them, we are supposed to believe that the NSA hoard their knowledge of weaknesses in Microsoft Windows, a vitally important piece of their own nation's infrastructure, in case they'll come in handy againt some hypothetical future enemy. (I'm sorry, but this just won't wash; surely the good guys would prioritize protecting their own corporate infrastructure? But this is just the first of the many logical inconsistencies which riddle the back story and plot of "Zero Day".)

  • Microsoft issues ‘highly unusual’ Windows XP patch to prevent massive ransomware attack
  • Is it prudent to ask if Britain’s nuke subs, which also run Windows XP, have also been hit by ransomware?

    Let’s reword this to drive the point home. How likely is it that the United States NSA, through its persistent interest in keeping us unsafe, has managed to hand control of Britain’s nuclear weapons platforms to unknown ransomware authors, perhaps in Russia or Uzbekistan?

  • Current wave of ransomware not written by ordinary criminals, but by the NSA

    The lesson here is that the NSA’s mission, keeping a country safe, is in direct conflict with its methods of collecting a catalog of vulnerabilities in critical systems and constructing weapons to use against those systems, weapons that will always leak, instead of fixing the discovered weaknesses and vulnerabilities that make us unsafe.

  • Wana Decrypt0r Ransomware Outbreak Temporarily Stopped By "Accidental Hero"

    A security researcher that goes online by the nickname of MalwareTech is the hero of the day, albeit an accidental one, after having saved countless of computers worldwide from a virulent form of ransomware called Wana Decrypt0r (also referenced as WCry, WannaCry, WannaCrypt, and WanaCrypt0r).

  • DDOS attacks in Q1 2017

    In Q1 2017, the geography of DDoS attacks narrowed to 72 countries, with China accounting for 55.11% (21.9 p.p. less than the previous quarter). South Korea (22.41% vs. 7.04% in Q4 2016) and the US (11.37% vs. 7.30%) were second and third respectively.

    The Top 10 most targeted countries accounted for 95.5% of all attacks. The UK (0.8%) appeared in the ranking, replacing Japan. Vietnam (0.8%, + 0.2 p.p.) moved up from seventh to sixth, while Canada (0.7%) dropped to eighth.

  • Applied Physical Attacks and Hardware Pentesting

    This week, I had the opportunity to take Joe Fitzpatrick’s class “Applied Physical Attacks and Hardware Pentesting”. This was a preview of the course he’s offering at Black Hat this summer, and so it was in a bit of an unpolished state, but I actually enjoyed the fact that it was that way. I’ve taken a class with Joe before, back when he and Stephen Ridley of Xipiter taught “Software Exploitation via Hardware Exploitation”, and I’ve watched a number of his talks at various conferences, so I had high expectations of the course, and he didn’t disappoint.

  • SambaXP 2017: John Hixson’s Reflection

    The next talk was given by Jeremy Allison on the recent symlink CVE. Jeremy explained how it was discovered and the measures that were taken to fix it.

More in Tux Machines

today's leftovers

  • Why Linus is right (as usual)
    Last year, some security “hardening” code was added to the kernel to prevent a class of buffer-overflow/out-of-bounds issues. This code didn’t address any particular 0day vulnerability, but was designed to prevent a class of future potential exploits from being exploited. This is reasonable. This code had bugs, but that’s no sin. All code has bugs. The sin, from Linus’s point of view, is that when an overflow/out-of-bounds access was detected, the code would kill the user-mode process or kernel. Linus thinks it should have only generated warnings, and let the offending code continue to run.
  • Kube-Node: Let Your Kubernetes Cluster Auto-Manage Its Nodes
    As Michelle Noorali put it in her keynote address at KubeCon Europe in March of this year: the Kubernetes open source container orchestration engine is still hard for developers. In theory, developers are crazy about Kubernetes and container technologies, because they let them write their application once and then run it anywhere without having to worry about the underlying infrastructure. In reality, however, they still rely on operations in many aspects, which (understandably) dampens their enthusiasm about the disruptive potential of these technologies. One major downside for developers is that Kubernetes is not able to auto-manage and auto-scale its own machines. As a consequence, operations must get involved every time a worker node is deployed or deleted. Obviously, there are many node deployment solutions, including Terraform, Chef or Puppet, that make ops live much easier. However, all of them require domain-specific knowledge; a generic approach across various platforms that would not require ops intervention does not exist.
  • Red Hat, Inc. (RHT) Shares Bought by Aperio Group LLC
  • Cloudera, Inc. (CLDR) vs. Red Hat, Inc. (RHT): Breaking Down the Data

Software: VidCutter, Super Productivity, MKVToolNix

  • VidCutter 5.0 Released With Improved UI, Frame Accurate Cutting
    A new version of VidCutter, a free video trimmer app, is available for download. VidCutter 5.0 makes it easier to cut videos to specific frames, improves the export of video clips with audio and subtitle tracks, and refreshes the default application icon. Why Vidcutter? If you want split video, trim video, or join video clips into a single montage then Vidcutter is ideal. The app lets you perform these tasks, as well as many more, quickly and easily. VidCutter is a Qt5 application that uses the open-source FFMpeg media engine.
  • Linux Release Roundup: Fedora 27, Shotwell, Corebird + More
    It’s been another busy week in the world of Linux, but we’re here to bring you up to speed with a round-up of the most notable new releases. The past 7 days have given us a new version of free software’s most popular photo management app, a new release of a leading Linux distribution, and updated one of my favourite app finds of the year.
  • Super Productivity is a Super Useful To-Do App for Linux, Mac & Windows
    Super Productivity is an open-source to-do list and time tracking app for Windows, macOS and Linux. It’s built using Electron but doesn’t require an internet connection (which is pretty neat). And it has (optional) integration with Atlassian’s Jira software.
  • MKVToolNix 18.0.0 Open-Source MKV Manipulation App Adds Performance Improvements
    A new stable release of the MKVToolNix open-source and cross-platform MKV (Matroska) manipulation software arrived this past weekend with various performance improvements and bug fixes. MKVToolNix 18.0.0 continues the monthly series of stability and reliability updates by adding performance improvements to both the AVC and HEVC ES parsers thanks to the implementation of support for copying much less memory, and enabling stack protection when building the program with Clang 3.5.0 or a new version.

OSS Leftovers

  • Reveal.js presentation hacks
    Ryan Jarvinen, a Red Hat open source advocate focusing on improving developer experience in the container community, has been using the Reveal.js presentation framework for more than five years. In his Lightning Talk at All Things Open 2017, he shares what he's learned about Reveal.js and some ways to make better use of it. Reveal.js is an open source framework for creating presentations in HTML based on HTML5 and CSS. Ryan describes Gist-reveal.it, his project that makes it easier for users to create, fork, present, and share Reveal.js slides by using GitHub's Gist service as a datastore.
  • Font licensing and use: What you need to know
    Most of us have dozens of fonts installed on our computers, and countless others are available for download, but I suspect that most people, like me, use fonts unconsciously. I just open up LibreOffice or Scribus and use the defaults. Sometimes, however, we need a font for a specific purpose, and we need to decide which one is right for our project. Graphic designers are experts in choosing fonts, but in this article I'll explore typefaces for everyone who isn't a professional designer.
  • Broader role essential for OpenStack Foundation, says Mirantis’ Renski
  • URSA Announces Name Change to Open Source Integrators to Reflect Their Full Spectrum of Open ERP Expertise
  • 2018 is Year for Open Source Software for Pentagon
    The US Pentagon is set to make a major investment in open source software, if section 886 of the National Defense Authorization Act for Fiscal Year 2018 is passed. The section acknowledges the use of open source software, the release of source code into public repositories, and a competition to inspire work with open source that supports the mission of the Department of Defense.
  • How startups save buckets of money on early software development
     

    Moving along, we have to segue with a short modularity lesson. More specifically, how modularity applies to software.

    Essentially, all products and services become cheaper and more plentiful when all the processes involved in production become modularised.

today's howtos