Language Selection

English French German Italian Portuguese Spanish

Hardware Security Fiasco: The Latest

Filed under
Hardware
Security
  • Windows 10 Cumulative Update KB4056892 (Meltdown & Spectre Fix) Fails to Install

    Microsoft rolled out Windows 10 cumulative update KB4056892 yesterday as an emergency patch for systems running the Fall Creators Update in an attempt to fix the Meltdown and Spectre bugs affecting Intel, AMD, and ARM processors manufactured in the last two decades.

    But as it turns out, instead of fixing the two security vulnerabilities on some computers, the cumulative update actually breaks them down, with several users complaining that their systems were rendered useless after attempting to install KB4056892.

    Our readers pointed me to three different Microsoft Community threads (1, 2, 3) where users reported cumulative update KB4056892 issues, and in every case the problem appears to be exactly the same: AMD systems end up with a boot error before trying a rollback and failing with error 0x800f0845.

  • Linus Torvalds says Intel needs to admit it has issues with CPUs

    Linux creator Linus Torvalds has had some harsh words for Intel in the course of a discussion about patches for two [sic] bugs that were found to affect most of the company's processors.

  • We translated Intel's crap attempt to spin its way out of CPU security bug PR nightmare

    In the wake of The Register's report on Tuesday about the vulnerabilities affecting Intel chips, Chipzilla on Wednesday issued a press release to address the problems disclosed by Google's security researchers that afternoon.

    To help put Intel's claims into context, we've annotated the text. Bold is Intel's spin.

  • When F00F bug hit 20 years ago, Intel reacted the same way

    A little more than 20 years ago, Intel faced a problem with its processors, though it was not as big an issue as compared to the speculative execution bugs that were revealed this week.

  • Meltdown, Spectre and the Future of Secure Hardware

    Meltdown and Spectre are two different—but equally nasty—exploits in hardware. They are local, read-only exploits not known to corrupt, delete, nor modify data. For local single user laptops, such as Librem laptops, this is not as large of a threat as on shared servers—where a user on one virtual machine could access another user’s data on a separate virtual machine.

    As we have stated numerous times, security is a game of depth. To exploit any given layer, you go to a lower layer and you have access to everything higher in the stack.

  • KPTI — the new kernel feature to mitigate “meltdown”
  • Astounding coincidence: Intel's CEO liquidated all the stock he was legally permitted to sell after learning of catastrophic processor flaws
  • Intel CEO sold all the stock he could after Intel learned of security bug

     

    While an Intel spokesperson told CBS Marketwatch reporter Jeremy Owens that the trades were "unrelated" to the security revelations, and Intel financial filings showed that the stock sales were previously scheduled, Krzanich scheduled those sales on October 30. That's a full five months after researchers informed Intel of the vulnerabilities. And Intel has offered no further explanation of why Krzanich abruptly sold off all the stock he was permitted to.

CentOS Linux Receives

  • CentOS Linux Receives Security Updates Against Meltdown and Spectre Exploits

    Free Red Hat clone CentOS Linux has received an important kernel security update that patches the Meltdown and Spectre exploits affecting billions of devices powered by modern processors.

  • Ubuntu will fix Meltdown and Spectre by January 9th

    Ubuntu, perhaps the most popular Linux distribution, on the desktop, which has multitudes of other distributions depending on it to send out security updates, has announced that it will update the kernels of all supported releases in order to mitigate the newly publicly disclosed Meltdown and Spectre vulnerabilities, by January 9th.

  • Check This List to See If You’re Still Vulnerable to Meltdown and Spectre [Updated]

    Security researchers revealed disastrous flaws in processors manufactured by Intel and other companies this week. The vulnerabilities, which were discovered by Google’s Project Zero and nicknamed Meltdown and Spectre, can cause data to leak from kernel memory—which is really not ideal since the kernel is central to operating systems and handles a bunch of sensitive processes.

    Intel says that it’s working to update all of the processors it has introduced in the last few years. “By the end of next week, Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years,” the company said in a statement today.

  • Meltdown and Spectre CPU Flaws Expose Modern Systems to Risk

    After a rollercoaster day of speculation on Jan. 3 about a severe Intel chip flaw, Google's Project Zero research team revealed later that same day details about the CPU vulnerabilities.

    The CPU flaws have been branded as Meltdown and Spectre and have widespread impact across different silicon, operating system, browser and cloud vendors. The Meltdown flaw, identified as CVE-2017-5754, affects Intel CPUs. Spectre, known as CVE-2017-5753 and CVE-2017-5715, impacts all modern processors, including ones from Intel, Advanced Micro Devices and ARM.

  • Major Intel Kernel flaw may impact performance across Linux, Windows and Mac OS

    New reports have surfaced suggesting that there might be a major security flaw with Intel processors launched in the last decade. The harsh part is that patching the issue might slow down the performance of the CPU by up to 30 percent. Intel hasn't put out an official statement yet, but Linux Kernel patches are being pushed out to all users.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

Keeping patient data safe with open source tools

Healthcare is experiencing a revolution. In a tightly regulated and ancient industry, the use of free and open source software make it uniquely positioned to see a great deal of progress. I work at a scrappy healthcare startup where cost savings are a top priority. Our primary challenge is how to safely and efficiently manage personally identifying information (PII), like names, addresses, insurance information, etc., and personal health information (PHI), like the reason for a recent clinical visit, under the regulations of the Health Insurance Portability and Accountability Act of 1996, HIPAA, which became mandatory in the United States in 2003. Read more

Security Leftovers

  • Indian Bank Hit in $13.5M Cyberheist After FBI ATM Cashout Warning

    But according to Indian news outlet Dailypionneer.com, there was a second attack carried out on August 13, when the Cosmos Bank hackers transferred nearly $2 million to the account of ALM Trading Limited at Hang Seng Bank in Hong Kong.

  • How to Protect Yourself Against a SIM Swap Attack

    A sobering caveat: If a skilled SIM hijacker targets you, there’s realistically not much you can do to stop them, says Allison Nixon, threat research at security firm Flashpoint. “In most of the cases that we’ve seen, a sufficiently determined attacker can take over someone’s online footprint,” she says.

    That’s because ultimately, the machinations behind SIM swaps are largely out of your control. [...]

  • Open Source Security Podcast: Episode 110 - Review of Black Hat, Defcon, and the effect of security policies
    Josh and Kurt talk about Black Hat and Defcon and how unexciting they have become. What happened with hotels at Defcon, and more importantly how many security policies have 2nd and 3rd level effects we often can't foresee. We end with important information about pizza, bananas, and can openers.

YunoHost 3.0.0.1

At this point I have only set up YunoHost, created a few user accounts and installed a handful of applications. While I may play with it further, my main focus going into this trial was how well the framework of the distribution functions. That is: is it easy to install, how hard is it for new users to add services and accounts, and is it straight forward to keep the system up to date? Basically, I wanted to know whether I could give this distribution to someone who wanted to set up home-based network services for the first time and expect them to be able to use it. Based on my experiences so far with YunoHost, my answer is: probably. The distribution does make it pretty easy to create user accounts and install web-based services. In fact, YunoHost does this quite well. The admin panel is very streamlined, uncluttered and easy to navigate and getting something like a game of Hextris or a media streaming service installed is about as easy as a few mouse clicks. Managing the firewall, monitoring the system and creating backups are nearly as easy. The administrator still needs to figure out how to get backup archives off the disk to another location for safe keeping, but the bulk of the work in backing up and restoring the operating system is done for us. Where I feel the distribution runs into trouble is mostly little details, and a few general concepts. For example, asking the user to create an "admin" password but leaving the root password as the default is both likely to confuse people and leave a permanent security hole on the servers of most inexperienced hobbyist administrators. On the topic of accounts, it makes sense, from a security standpoint, to separate web accounts from system accounts. But, this means there may be some confusion as to why, once an account has been created, it cannot log into the system. Little concepts like this may throw new users and I don't feel these issues are well addressed by the documentation. The first time through, the system installer failed during the partitioning section. It worked the second time though with the same settings, so I'm not sure if this is a semi-persistent bug or a one-time error with my system. On the whole, YunoHost performs well. It's light on resources, it offers a lot of common network services home administrators will probably want and it is pretty easy to run and maintain. There are a few little wrinkles in the experience, but in general I found the distribution to be straight forward to use. For people looking to set up a home server, this is probably a good platform on which to build. Read more

Software: GIMP, Password Safe, and Podcasts

  • GIMP 2.10.6 Introduces Vertical Text, New Filters, and GIMP Extension Public Repo
    A brand-new point release for popular photo editing software GIMP has been released today, bringing GIMP to version 2.10.6 – this update doesn’t bring a whole load of significant features, but there are some great improvements and new functionalities. For starters, GIMP 2.10.6 finally introduces support for vertical text (top to bottom), which has been a highly requested feature particularly for East-Asian writing systems. Thus, users can now set text in mixed orientation (as is typical in East-Asian vertical writing) or upright orientation (more common for Western vertical writing), with right-to-left, as well as left-to-right columns.
  • Password Safe is a KeePass-Compatible Password Manager for Linux
    Password Safe is an open-source KeePass-compatible password manager for Linux, designed specifically for use on the GNOME desktop.
  • Linux users finally get a decent podcasts app called, well, ‘Podcasts’
    Podcasts are a hugely popular form of “infotainment” these days, with almost any and every niche you can think of catered for with a show or a segment. If you’re not enjoying the wealth of podcasts out there, you’re really missing out. Podcasts provide you with the experience of a radio show, covering a wide range of topics ranging from gospel to science fiction to music and every thing in between. There are so many ways to enjoy your podcst. On mobile, popular apps such as PocketCast offer users a one-stop-shop for all the podcasts you can listen to. Many music streaming services like Apple Music and Spotify offer dedicated sections on Podcasts.