OpenSUSE: New Local Build Environment Features and Highlights of YaST Development Sprint

• New Local Build Environment Features

  We have just created osc 0.167 release which focuses on the local build functionality. It is way easier now to deal with VM builds (eg. inside of KVM) and also building for foreign hardware architecture becomes way easier now.

• Highlights of YaST Development Sprint 90

  As usual, during this sprint we have been working on a wide range of topics. The release of the next (open)SUSE versions is approaching and we need to pay attention to important changes like the new installation media or the /usr/etc and /etc split.

VPN Vulnerability (CVE-2019-14899)

• New Vulnerability Lets Attackers Hijack VPN Connections on Most UNIX Systems

  Affecting most GNU/Linux distributions, as well as FreeBSD, OpenBSD, Android, iOS and macOS systems, the new security vulnerability could allow a local attacker to determine if another user is connected to a VPN (Virtual Private Network) server and whether or not there's an active connection to a certain website. The vulnerability (CVE-2019-14899) is exploitable with adjacent network access, which requires the attacker to have access to either the broadcast or collision domain of the vulnerable operating system, and lets attackers to hijack connections by injecting data into the TCP (Transmission Control Protocol) stream. The vulnerability has been reported to work against various popular VPN solutions, including OpenVPN, IKEv2/IPSec, as well as WireGuard, and it doesn't matter which VPN technology is being used, thus allowing attacker to determine the type of packets being sent through the encrypted VPN tunnel.

• Tricky VPN-busting bug lurks in iOS, Android, Linux distros, macOS, FreeBSD, OpenBSD, say university eggheads

  A bug in the way Unix-flavored systems handle TCP connections could put VPN users at risk of having their encrypted traffic hijacked, it is claimed. The University of New Mexico team of William Tolley, Beau Kujath, and Jedidiah Crandall this week said they've discovered CVE-2019-14899, a security weakness they report to be present in "most" Linux distros, along with Android, iOS, macOS, FreeBSD, and OpenBSD. The upshot is, if exploited, encrypted VPN traffic can be potentially hijacked and disrupted by miscreants on the network. To pull off the attack, the US-based posse says, a hacker would need to be "network adjacent" to their target, or control an access point on the victim's local network. Once the victim connected to their VPN, the spy would be able to, for one thing, tamper with the TCP stream to do things like inject packets into the stream.

• New Linux Vulnerability Lets Attackers Hijack VPN Connections

  Security researchers found a new vulnerability allowing potential attackers to hijack VPN connections on affected *NIX devices and inject arbitrary data payloads into IPv4 and IPv6 TCP streams. They disclosed the security flaw tracked as CVE-2019-14899 to distros and the Linux kernel security team, as well as to others impacted such as Systemd, Google, Apple, OpenVPN, and WireGuard. The vulnerability is known to impact most Linux distributions and Unix-like operating systems including FreeBSD, OpenBSD, macOS, iOS, and Android. A currently incomplete list of vulnerable operating systems and the init systems they came with is available below, with more to be added once they are tested and found to be affected: Ubuntu 19.10 (systemd), Fedora (systemd), Debian 10.2 (systemd), Arch 2019.05 (systemd), Manjaro 18.1.1 (systemd), Devuan (sysV init), MX Linux 19 (Mepis+antiX), Void Linux (runit), Slackware 14.2 (rc.d), Deepin (rc.d), FreeBSD (rc.d), and OpenBSD (rc.d).

• New Linux Vulnerability Lets Attackers Hijack VPN Connections

  Security researchers found a new vulnerability allowing potential attackers to hijack VPN connections on affected *NIX devices and inject arbitrary data payloads into IPv4 and IPv6 TCP streams. They disclosed the security flaw tracked as CVE-2019-14899 to distros and the Linux kernel security team, as well as to others impacted such as Systemd, Google, Apple, OpenVPN, and WireGuard.

• New vulnerability lets attackers sniff or hijack VPN connections

  The vulnerability -- tracked as CVE-2019-14899 -- resides in the networking stacks of multiple Unix-based operating systems, and more specifically, in how the operating systems reply to unexpected network packet probes.

How I Switched To Plan 9

Hi, I’m SL. You may remember me from my classic appearances in contentious 9fans threads, or maybe you’ve read one of my books. I’m a veteran UNIX admin of 20+ years. I produced a bunch of multimedia stuff on a Macbook in the mid-2000s. I ran 9front on all my production servers and on my personal laptop (my main personal computer) almost exclusively from 2011 to 2017. In early 2017 I moved to a new job that involved a lot of traveling and infrequent access to WiFi. It also turned out that carrying a second laptop (besides my work laptop) added too much bulk/weight to all the stuff I already had to carry everywhere I went. I bought one of those early iPad Pros equipped with an LTE connection and did most of my necessarily mobile computing via that device for the better part of two years. I was able to rig up a command line connection to 9front using a native iOS SSH client and drawterm -G. I explained how this was accomplished in a previous blog post. Infrequently, I carried a ThinkPad X230 Tablet, and later a ThinkPad X250 along with me, piggybacking off the iPad’s WiFi tethering. The experience sucked. Replacing a general purpose computer with a jacked-up surveillance sensor package is not my idea of solving the problem of mobile computing. Lugging around extra pounds put a lot of strain on my already compromised back. Something had to give. No pun intended. Recently, I acquired a used ThinkPad X1 Tablet (1st Gen). This thing is small enough to fit in my bag, works well with both OpenBSD and 9front, and weighs almost as little as my iPad Pro with it’s folding keyboard cover. Finally, I’m back in business.