GNU World Order 401

Thoughts on the changing face of free and open source software.

Free Software Security Podcast/Josh Bressers: Episode 266 – The future of security scanning with Debricked

Josh and Kurt talk to Emil Wåreus from Debricked about the future of security scanners. Debricked is doing some incredibly cool things to avoid relying on humans for vulnerability identification and cataloging. Learn what the future of security scanning is going to look like.

Linux Action News 184

Don't buy that M1-powered Apple machine just yet, solving Wayland-driven fragmentation, and why Firefox is about to get an upgrade on Linux.

Plus the imminent problem KDE solved this week, and more.

Full Circle Weekly News #205

ClamAV 0.103.2 Is Released With Security Fixes For Four Vulnerabilities

The free software anti-virus scanner ClamAV has, ironically, made a security release fixing four vulnerabilities. Two of them could cause it to crash, one could cause it to enter a endless loop and a Windows-specific vulnerability could lead to privilege escalation. ClamAV has 8,532,858 virus signatures it can scan for in its database.

Why the U.S. Shouldn’t Play Games With Cyberwarfare as Its Power Declines

In the SolarWinds hack, a backdoor in one of the components was downloaded to the systems of 18,000 organizations, including the U.S. Treasury and Commerce departments, the Department of Homeland Security and the State Department.

In the Microsoft Exchange Server hack, an estimated 250,000 machinesworldwide might have been affected by a vulnerability that allowed hackers to control the machines and even infect other systems in the internal network of the targeted companies. Four major vulnerabilities in Microsoft Exchange Server were reported to Microsoft in early January. Unfortunately, it wasn’t until early March that Microsoft released patches, according to ZDNet. These vulnerabilities were used by the hackers during the period that Microsoft had either not released the patches, or companies had not upgraded their systems and installed the patches.

LinkedIn denies data leak after two-thirds user base is compromised

                   

Personal data of 500 million LinkedIn users, two thirds of its user base, has been scraped and is for sale online, according to a report from Cyber News.

                   

The data up for sale on a popular hacker platform includes account IDs, full names, email addresses, workplace information and links to social media accounts of users hosted on the platform.

Linkedin data leak: Major breach exposes 500 million users on Microsoft platform [details]

                       

While people are yet to digest the huge Facebook data leak of 533 million users (including 6.1 million Indians), Microsoft-owned professional networking platform LinkedIn is now facing a massive data leak of 500 million users that is allegedly being sold online.

                       

An archive with data purportedly scraped from 500 million LinkedIn profiles has been put for sale on a popular [cracker] forum, with another 2 million records leaked as a proof-of-concept sample by people behind the [crack].

Uninformed Legislators Shoot Down Right To Repair Legislation In Colorado

As we've noted a few times, 2021 is seeing record interest in new right to repair laws. Driven by grass roots activism, such laws are being pushed in more than fourteen states. Most variations not only protect your right to repair hardware you own, they open the door to more independent repair shops, and fewer corporate giants attempting to monopolize repair (Apple, John Deere, Microsoft, Sony, many more).

Another day, another data breach. Here’s how to see if you’ve been exposed

In early April, security experts made public the details of yet another Facebook data breach, this one affecting over half a billion users. As originally reported by Business Insider, personal information on 533 million Facebook users spanning 106 countries surfaced in a hacking forum, with records including email addresses, phone numbers, full names, locations, birthdays, and relationship statuses. This data traces back to a vulnerability fixed by Facebook in 2019, which allowed the scraping of profiles.

Got your covid shots? You might have to prove it. [Ed: Linux Foundation pushing mass surveillance again, using COVID]

“It’s a jumble,” says Jenny Wanger, who oversees covid-related initiatives for Linux Foundation Public Health. “This is all just a sign of how massively underfunded our public health infrastructure has been for so many years.”

Corona pass can be doctored, warns IT security expert

Peter Kruse, the founder of IT security company CSIS, points out to DR that it “does not take a genius” to reuse the result of an old test to make it look like it is one carried out within the last 72 hours.

“It is virtually impossible for a teacher or a hairdresser to check whether a test result is legitimate when the results are issued as they do,” he lamented.

All it takes is two clicks on an [Internet] browser, he added.

“Vaccine Passports”: ACLU Warns of Privacy Nightmare That Could Create “Two-Tiered Society”

As people try to find a safe way to gather and travel during the pandemic, there is growing interest in documenting who has been vaccinated or tested negative for COVID-19. The World Health Organization has warned so-called vaccine passports may not be an effective way to reopen, and healthcare professionals argue vaccine certificates may further exacerbate vaccine inequality. New York is already testing a digital vaccine passport app made by IBM called the Excelsior Pass, while countries including the U.K. and Israel have issued their own versions of electronic vaccine certificates. The U.S. government has ruled out the introduction of mandatory vaccine passports at the federal level, but many private companies are now developing COVID-19 tracking systems. ACLU policy analyst Jay Stanley says smartphone-based vaccine passport apps “raise a lot of questions” around privacy, access and discrimination. “We have systems in place already for proving you’ve been vaccinated,” he says. “Is that system so broken that we need to construct an entirely new electronic system?”

Fallback Directories - Upcoming Change

This is to announce that the Tor Project network team will soon change how fallback directories are selected as we are about to update that list.

Security updates for Thursday

Security updates have been issued by Fedora (chromium, libldb, rpm, samba, and seamonkey), openSUSE (isync), Oracle (kernel), Red Hat (openssl and squid), SUSE (ceph, flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk, fwupd, fwupdate, and openexr), and Ubuntu (curl, linux-lts-trusty, and lxml).

Microsoft's Windows 10, Exchange, and Teams hacked at Pwn2Own

Windows 10 hacked again at Pwn2Own, Chrome and Zoom also fall

eBook: Six best practices for effective Linux security management

Securing endpoints can an overwhelming routine for system administrators, especially when they're remote. Considering much of the world is now working remotely and may continue to do so in the future, the demand for security has increased exponentially.

Though Windows and Mac devices are popular targets for cyber criminals, Linux devices can fall victim as well; Linux-targeted malware can easily affect your critical devices. In some instances, Linux systems have been compromised and configured to distribute malware.