Language Selection

English French German Italian Portuguese Spanish

Security

Security News

Filed under
Security
  • Report: Linux security must be upgraded to protect future tech

    The summit was used to expose a number of flaws in Linux's design that make it increasingly unsuitable to power modern devices. Linux is the operating system that runs most of the modern world. It is behind everything from web servers and supercomputers to mobile phones. Increasingly, it's also being used to run connected Internet of Things (IoT) devices, including products like cars and intelligent robots.

  • security things in Linux v4.6

    Hector Marco-Gisbert removed a long-standing limitation to mmap ASLR on 32-bit x86, where setting an unlimited stack (e.g. “ulimit -s unlimited“) would turn off mmap ASLR (which provided a way to bypass ASLR when executing setuid processes). Given that ASLR entropy can now be controlled directly (see the v4.5 post), and that the cases where this created an actual problem are very rare, means that if a system sees collisions between unlimited stack and mmap ASLR, they can just adjust the 32-bit ASLR entropy instead.

Security Leftovers

Filed under
Security
  • Friday's security advisories
  • ICANN grinds forward on crucial DNS root zone signing key update

    The Internet Corporation for Assigned Names and Numbers is moving -- carefully -- to upgrade the DNS root zone key by which all domains can be authenticated under the DNS Security Extensions protocol.

    ICANN is the organization responsible for managing the Domain Name System, and DNS Security Extensions (DNSSEC) authenticates DNS responses, preventing man-in-the-middle attacks in which the attacker hijacks legitimate domain resolution requests and replaces them with fraudulent domain addresses.

    DNSSEC still relies on the original DNS root zone key generated in 2010. That 1024-bit RSA key is scheduled to be replaced with a 2048-bit RSA key next October. Although experts are split over the effectiveness of DNSSEC, the update of the current root zone key signing key (KSK) is long overdue.

  • Cybersecurity isn't an IT problem, it's a business problem

    The emergence of the CISO is a relatively recent phenomenon at many companies. Their success often relies upon educating the business from the ground up. In the process, companies become a lot better about how to handle security and certainly learn how not to handle it.

    As a CIO, knowing the pulse of security is critical. I oversee a monthly technology steering committee that all the executives attend. The CISO reports during this meeting on the state of the security program. He also does an excellent job of putting risk metrics out there, color coded by red, yellow, and green. This kind of color grading allows us to focus attention on where we are and what we’re doing about it.

Security News

Filed under
Security
  • Don't Trust Consumer Routers

    Another example of why you shouldn’t trust consumer routers. d-link

    It isn’t just this specific d-link router. We’ve seen the same issues over and over and over with pretty much every non-enterprise vendor.

    Plus we don’t want our devices used by crackers to DDoS Brian Krebs anymore, right?

    We are Linux people. We CAN do this ourselves.

  • D-Link DWR-932 router is chock-full of security holes

    Security researcher Pierre Kim has unearthed a bucketload of vulnerabilities affecting the LTE router/portable wireless hotspot D-Link DWR-932. Among these are backdoor accounts, weak default PINs, and hardcoded passwords.

  • The Cost of Cyberattacks Is Less than You Might Think

    What's being left out of these costs are the externalities. Yes, the costs to a company of a cyberattack are low to them, but there are often substantial additional costs borne by other people. The way to look at this is not to conclude that cybersecurity isn't really a problem, but instead that there is a significant market failure that governments need to address.

  • NHS trusts are still using unsupported Windows XP PCs

    AT LEAST 42 National Health Service (NHS) trusts in the UK still run Microsoft's now-defunct Windows XP operating system.

    Motherboard filed Freedom of Information requests with more than 70 NHS hospital trusts asking how many Windows XP machines they use. 48 replied within the allotted time, and a whopping 42 of them admitted that they still use the operating system that reached end-of-life status in April 2014.

    Some of the culprits include East Sussex Healthcare, which has 413 Windows XP machines, Sheffield's Children's hospital with 1,290, and Guy's and St Thomas' NHS Trust in London with an insane 10,800 Windows XP-powered PCs.

    23 replied to Motherboard's quizzing about whether they have an extended support agreement in place and, unsurprisingly, the majority said that they do not.

Security Leftovers

Filed under
Security
  • Linux.Mirai Trojan causing mayhem with DDoS attacks

    A Trojan named Linux.Mirai has been found to be carrying out DDoS attacks.

    The malicious program first appeared in May 2016, detected by Doctor Web after being added to its virus database under the name Linux.DDoS.87. The Trojan can work with with the SPARC, ARM, MIPS, SH-4, M68K architectures and Intel x86 computers.

  • Don't Hide DRM in a Security Update

    Over 10,000 of you have joined EFF in calling on HP to make amends for its self-destructing printers in the past few days. Looks like we got the company’s attention: today, HP posted a response on its blog. Apparently recognizing that its customers are more likely to see an update that limits interoperability as a bug than as a feature, HP says that it will issue an optional firmware update rolling back the changes that it had made. We’re very glad to see HP making this step.

    But a number of questions remain.

    First, we’d like to know what HP’s plans are for informing users about the optional firmware update. Right now, the vast majority of people who use the affected printers likely do not know why their printers lost functionality, nor do they know that it’s possible to restore it. All of those customers should be able to use their printers free of artificial restrictions, not just the relatively few who have been closely following this story.

  • 6 Ways Driverless Cars Are Going To Kill Lots Of People

    You've probably read a few articles about driverless cars over the past couple of years. The technology is coming along quickly, with fleets of test cars already on the roads in some states. It seems like soon we'll achieve the American dream of stuffing our faces and texting all we want while still managing to avoid public transportation.

    But the reality is quite different. We're diving into this technology a little too quickly and ignoring all the warning signs about how we are going to screw up on the way to Driverless Car Utopia.

Security: Nmap 7.30 is Out

Filed under
OSS
Security
  • Nmap 7.30

    Integrated all 12 of your IPv6 OS fingerprint submissions from June to September. No new groups, but several classifications were strengthened, especially Windows localhost and OS X.

  • Nmap 7.30 Released As Stable With Many Additions
  • Nmap 7.30 Security Scanner Adds 12 New IPv6 OS Fingerprints, 7 NSE Scripts

    Today, September 29, 2016, the Nmap developers proudly announced the release of Nmap 7.30, the latest stable version of the free, open source and cross-platform security scanner and network mapper software.

    As expected, Nmap 7.30 is a major release that adds numerous new features and improvements, among which we can mention twelve new IPv6 OS fingerprints and seven NSE (Nmap Scripting Engine) scripts that have been submitted by various developers. There are now a total of 541 NSE scripts included in Nmap.

Security News

Filed under
Security
  • Security updates for Thursday
  • How 1.5 Million Connected Cameras Were Hijacked to Make an Unprecedented Botnet

    Last week, hackers forced a well-known security journalist to take down his site after hitting him for more than two days with an unprecedented flood of traffic.

    That cyberattack was powered by something the internet had never seen before: an army made of more than one million hacked Internet of Things devices.

    The hackers, whose identity is still unknown at this point, used not one, but two networks—commonly referred to as “botnets” in hacking lingo—made of around 980,000 and 500,000 hacked devices, mostly internet-connected cameras, according to Level 3 Communications, one of the world’s largest internet backbone providers. The attackers used all those cameras and other unsecured online devices to connect to the journalists’ website, pummeling the site with requests in an attempt to make it collapse.

  • NHS Hospitals Are Running Thousands of Computers on Unsupported Windows XP

    Hospitals across England are running thousands of out-of-date Windows XP machines, potentially putting patient data and other sensitive information at risk.

    Motherboard has found that at least 42 National Health Service (NHS) trusts in England are still using the Windows XP operating system, with many of them confirming that they no longer receive security updates for the software. Legal experts say that the NHS hospitals may be in breach of data protection regulations.

    “If hospitals are knowingly using insecure XP machines and devices to hold and otherwise process patient data they may well be in serious contravention of their obligations,” Jon Baines, Chair of the National Association of Data Protection and Freedom of Information Officers (NADPO), wrote in an email.

    In April 2014, Microsoft officially ended support for Windows XP, meaning that the company would no longer release security patches for the aging operating system. Any vulnerabilities discovered after that date would therefore be left for hackers to exploit. Governments and businesses could pay Microsoft for a custom extended support deal; the Crown Commercial Service, which is sponsored by the Cabinet Office, spent £5.5 million ($9 million) to continue receiving updates for the public sector, including for the NHS. That agreement ended in April 2015 and was not renewed.

Security News

Filed under
Security
  • security things in Linux v4.5
  • Time to Kill Security Questions—or Answer Them With Lies

    The notion of using robust, random passwords has become all but mainstream—by now anyone with an inkling of security sense knows that “password1” and “1234567” aren’t doing them any favors. But even as password security improves, there’s something even more problematic that underlies them: security questions.

    Last week Yahoo revealed that it had been massively hacked, with at least 500 million of its users’ data compromised by state sponsored intruders. And included in the company’s list of breached data weren’t just the usual hashed passwords and email addresses, but the security questions and answers that victims had chosen as a backup means of resetting their passwords—supposedly secret information like your favorite place to vacation or the street you grew up on. Yahoo’s data debacle highlights how those innocuous-seeming questions remain a weak link in our online authentication systems. Ask the security community about security questions, and they’ll tell you that they should be abolished—and that until they are, you should never answer them honestly.

    From their dangerous guessability to the difficulty of changing them after a major breach like Yahoo’s, security questions have proven to be deeply inadequate as contingency mechanisms for passwords. They’re meant to be a reliable last-ditch recovery feature: Even if you forget a complicated password, the thinking goes, you won’t forget your mother’s maiden name or the city you were born in. But by relying on factual data that was never meant to be kept secret in the first place—web and social media searches can often reveal where someone grew up or what the make of their first car was—the approach puts accounts at risk. And since your first pet’s name never changes, your answers to security questions can be instantly compromised across many digital services if they are revealed through digital snooping or a data breach.

  • LibreSSL and the latest OpenSSL security advisory

    Just a quick note that LibreSSL is not impacted by either of the issues mentioned in the latest OpenSSL security advisory - both of the issues exist in code that was added to OpenSSL in the last release, which is not present in LibreSSL.

  • Record-breaking DDoS reportedly delivered by >145k hacked cameras

    Last week, security news site KrebsOnSecurity went dark for more than 24 hours following what was believed to be a record 620 gigabit-per-second denial of service attack brought on by an ensemble of routers, security cameras, or other so-called Internet of Things devices. Now, there's word of a similar attack on a French Web host that peaked at a staggering 1.1 terabits per second, more than 60 percent bigger.

    The attacks were first reported on September 19 by Octave Klaba, the founder and CTO of OVH. The first one reached 1.1 Tbps while a follow-on was 901 Gbps. Then, last Friday, he reported more attacks that were in the same almost incomprehensible range. He said the distributed denial-of-service (DDoS) attacks were delivered through a collection of hacked Internet-connected cameras and digital video recorders. With each one having the ability to bombard targets with 1 Mbps to 30 Mbps, he estimated the botnet had a capacity of 1.5 Tbps.

    On Monday, Klaba reported that more than 6,800 new cameras had joined the botnet and said further that over the previous 48 hours the hosting service was subjected to dozens of attacks, some ranging from 100 Gbps to 800 Gbps. On Wednesday, he said more than 15,000 new devices had participated in attacks over the past 48 hours.

Networking and Security

Filed under
Server
Security
Web
  • FAQ: What's so special about 802.11ad Wi-Fi?

    Here are the broad strokes about 802.11ad, the wireless technology that’s just starting to hit the market.

  • 2.5 and 5 Gigabit Ethernet Now Official Standards

    In 2014, multiple groups started efforts to create new mid-tier Ethernet speeds with the NBASE-T Alliance starting in October 2014 and MGBASE-T Alliance getting started a few months later in December 2014. While those groups started out on different paths, the final 802.3bz standard represents a unified protocol that is interoperable across multiple vendors.

    The promise of 2.5 and 5 Gbps Ethernet is that they can work over existing Cat5 cabling, which to date has only been able to support 1 Gbps. Now with the 802.3bz standard, organizations do not need to rip and replace cabling to get Ethernet that is up to five times faster.

    "Now, the 1000BASE-T uplink from the wireless to wired network is no longer sufficient, and users are searching for ways to tap into higher data rates without having to overhaul the 70 billion meters of Cat5e / Cat6 wiring already sold," David Chalupsky, board of directors of the Ethernet Alliance and Intel principal engineer, said in a statement. "IEEE 802.3bz is an elegant solution that not only addresses the demand for faster access to rapidly rising data volumes, but also capitalizes on previous infrastructure investments, thereby extending their life and maximizing value."

  • A quick fix for stupid password reset questions

    It didn’t take 500 million hacked Yahoo accounts to make me hate, hate, hate password reset questions (otherwise known as knowledge-based authentication or KBA). It didn't help when I heard that password reset questions and answers -- which are often identical, required, and reused on other websites -- were compromised in that massive hack, too.

    Is there any security person or respected security guidance that likes them? They are so last century. What is your mother’s maiden name? What is your favorite color? What was your first pet’s name?

  • French hosting provider hit by DDoS close to 1TBps

    A hosting provider in France has been hit by a distributed denial of service attack that went close to one terabyte per second.

    Concurrent attacks against OVH clocked in at 990GBps.

    The attack vector is said to be the same Internet-of-Things botnet of 152,464 devices that brought down the website of security expert Brian Krebs.

    OVH chief technology officer Octave Klaba tweeted that the network was capable of attacks up to 1.5TBps.

  • Latest IoT DDoS Attack Dwarfs Krebs Takedown At Nearly 1Tbps Driven By 150K Devices

    If you thought that the massive DDoS attack earlier this month on Brian Krebs’ security blog was record-breaking, take a look at what just happened to France-based hosting provider OVH. OVH was the victim of a wide-scale DDoS attack that was carried via network of over 152,000 IoT devices.

    According to OVH founder and CTO Octave Klaba, the DDoS attack reached nearly 1 Tbps at its peak. Of those IoT devices participating in the DDoS attack, they were primarily comprised of CCTV cameras and DVRs. Many of these types devices' network settings are improperly configured, which leaves them ripe for the picking for hackers that would love to use them to carry our destructive attacks.

Security News

Filed under
Security
  • Security advisories for Wednesday
  • Facebook, Uber, Slack, and Pandora Pros Praise Free Security Tools

    Proponents of open source software argue that by letting passionate developers get involved and tweak underlying code, the tools they create are stronger and more reliable. Plus, for companies looking to bolster their digital defenses, the software has the added benefit of being free.

  • LibreSSL 2.5
  • LibreSSL 2.5 Released With New Features, iOS Support

    LibreSSL 2.5.0 is available today as the newest version of this growing fork of OpenSSL led by the OpenBSD project.

    LibreSSL 2.5's libtls implementation now supports ALPN and SNI while handling four cipher suite groups, there is tightened error handling in some areas, support for OCSP intermediate certificates, initial support for Apple's iOS platform, and a variety of other fixes and functionality improvements.

Security News

Filed under
Security
  • Sloppy programming leads to OpenSSL woes
  • OpenSSL Fixes Critical Bug Introduced by Latest Update

    OpenSSL today released an emergency security update after a patch in its most recent update issued last week introduced a critical vulnerability in the cryptographic library.

  • The Internet Of Poorly Secured Things Is Fueling Unprecedented, Massive New DDoS Attacks

    Last week, an absolutely mammoth distributed denial of service (DDoS) attack brought down the website of security researcher Brian Krebs. His website, hosted by Akamai pro bono, was pulled offline after it was inundated with 620Gbps of malicious traffic, nearly double the size of the biggest attack Akamai (which tracks such things via their quarterly state of the internet report) has ever recorded. Krebs was ultimately able to get his website back online after Google stepped in to provide DDoS mitigation through its Project Shield service.

  • Trump Offers More Insight On His Cybersecurity Plans: 10-Year-Old Relatives Vs. 400-lb Bedroom Dwellers

    Look, anyone who refers to cybersecurity or cyberwarfare as "the cyber" is probably better off not discussing this. But Donald Trump, in last night's debate, felt compelled to further prove why he's in no position to be offering guidance on technological issues. And anyone who feels compelled to portray hackers as 400-lb bedroom dwellers probably shouldn't be opening their mouth in public at all.

    With this mindset, discussions about what "the Google" and "the Facebook" are doing about trimming back ISIS's social media presence can't be far behind. Trump did note that ISIS is "beating us at our game" when it comes to utilizing social media. Fair enough.

Syndicate content

More in Tux Machines

Raspberry Pi PIXEL and More Improvements

Trainline creates open source platform to help developers deploy apps and environments in AWS

today's leftovers

  • Linux Unable To Boot Lenovo Yoga 900 & 900; Is Microsoft At Fault?
    The popular device developer Lenovo has verified the claims that Lenovo Yoga 900 and 900s unable to boot Linux OS but only Microsoft Windows 10. The new Lenovo convertible laptop, Lenovo Yoga 900 and 900s, would reject and decline any attempt to install Linux operating system, making users turn their heads to Microsoft as the suspect for this issue. [...] This issue about the OS started when an identity of BaronHK posted on Reddit about installing Linux on the latest Lenovo Yoga book in which BaronHK encountered being blocked by a locked solid state drive (SSD) which Linux cannot define itself, and come up to link the issue to Microsoft.
  • How Ubuntu 16.10 Beta 2 Performance Compares To Some Other Linux Distros
    The final Ubuntu 16.10 Beta for "Yakkety Yak" was released this week and we found its performance doesn't differ much from Ubuntu 16.04 LTS (with the exception of the newer graphics stack) while here are some results comparing it to other modern Linux distributions. Tested for this quick, one-page-article comparison were Ubuntu 16.04.1 LTS, Ubuntu 16.10 Beta 2, Clear Linux 10660, Fedora 24, openSUSE Tumbleweed 20160927, and the Arch-based Antergos 16.9-Rolling release.
  • Qt 3D WIP branches
  • New Qt 3D Functionality Is Being Worked On
    Sean Harmer of KDAB is organizing work around some upcoming "major Qt 3D features" for the open-source toolkit. It's not known if the next round of Qt 3D features will be ready for the Qt 5.9 tool-kit release, but KDAB is looking to have these new branches for feature work with continuous integration coverage.
  • Cross-compiling WebKit2GTK+ for ARM
    Of course, I know for a fact that many people use local recipes to cross-compile WebKit2GTK+ for ARM (or simply build in the target machine, which usually takes a looong time), but those are usually ad-hoc things and hard to reproduce environments locally (or at least hard for me) and, even worse, often bound to downstream projects, so I thought it would be nice to try to have something tested with upstream WebKit2GTK+ and publish it on trac.webkit.org,
  • Should we drop Vala?
    Is it Vala development a waste of time? Is Vala suitable for long term support libraries?
  • SUSECON 2016: Where Technology Reigns Supreme [Ed: “Article Sponsor: SUSE”]
  • openSUSE Tumbleweed – Review of the Weeks 2016/39
  • Free software activities in September 2016

Kernel Space/Linux

  • Linux Kernel 4.7.6 Is Out with MIPS and OCFS2 Improvements, Updated Drivers
    Today, September 30, 2016, renowned Linux kernel developer Greg Kroah-Hartman announced the release of the sixth maintenance update to the latest stable Linux 4.7 kernel series. Linux kernel 4.7.6 comes only five days after the release of the previous maintenance version, Linux kernel 4.7.5, and, according to the appended shortlog and the diff from the last update, it changes a total of 76 files, with 539 insertions and 455 deletions. In summary, it updates multiple drivers, adds improvements to various filesystems and hardware architectures, and improves the networking stack.
  • Linux Kernel 4.4.23 LTS Has ARM and MIPS Improvements, Updated Filesystems, More
    Immediately after announcing the release of Linux kernel 4.7.6, Greg Kroah-Hartman proudly informed the community about the general availability of the Linux 4.4.23 LTS kernel. The Linux 4.4 kernel is a long-term supported branch, the latest and most advanced one, used in many stable and reliable GNU/Linux operating systems, including Ubuntu 16.04 LTS (Xenial Xerus) and Alpine Linux 3.4. Therefore, it is imperative for it to receive regular updates that bring fixes to the most important issues, as well as other general improvements.
  • From NFS to LizardFS
    If you’ve been following me for a while, you’ll know that we started our data servers out using NFS on ext4 mirrored over DRBD, hit some load problems, switched to btrfs, hit load problems again, tried a hacky workaround, ran into problems, dropped DRBD for glusterfs, had a major disaster, switched back to NFS on ext4 mirrored over DRBD, hit more load problems, and finally dropped DRBD for ZFS.
  • IBM's Ginni Rometty Tells Bankers Not To Rest On Their Digital Laurels
  • BUS1, The Successor To KDBUS, Formally Unveiled -- Aiming For Mainline Linux Kernel
    BUS1 has been in development as an in-kernel IPC mechanism building off the failed KDBUS project. An "RFC" will soon be sent out to Linux kernel developers about BUS1 and the subject will be discussed at next month's Kernel Summit. David Herrmann, one of the BUS1 developers, presented at this week's systemd.conf conference about the new capability-based IPC for Linux. He talked about how BUS1 is superior to KDBUS, how BUS1 is similar to Android's Binder, Chrome's Mojo, Solaris' Doors, and other common IPC implementations.
  • A New Wireless Daemon Is In Development To Potentially Replace wpa_supplicant
    In addition to the BUS1 presentation, also exciting from the systemd.conf 2016 conference is a thorough walkthrough of a new wireless daemon for Linux being developed by Intel's Open-Source Technology Center. Intel has been developing a new wireless daemon for Linux to potentially replace wpa_supplicant. This new daemon isn't yet public but the code repositories for it will be opened up in the next few weeks. This new daemon has improvements around persistency, WiFi management, reduced abstractions for different operating systems and legacy interfaces, and changes to operation. This daemon is designed to be very lightweight and work well for embedded Linux use-cases especially, including IoT applications.