Language Selection

English French German Italian Portuguese Spanish

Security

Ubuntu 16.04 LTS Receives Minor Kernel Update That Patches Two Vulnerabilities

Filed under
Security
Ubuntu

Today, May 16, 2016, Canonical published multiple security notices to inform the Ubuntu community about the availability of a new kernel update for their operating systems.

Read more

Security Leftovers

Filed under
Security
  • Replacing /dev/urandom

    The kernel's random-number generator (RNG) has seen a great deal of attention over the years; that is appropriate, given that its proper functioning is vital to the security of the system as a whole. During that time, it has acquitted itself well. That said, there are some concerns about the RNG going forward that have led to various patches aimed at improving both randomness and performance. Now there are two patch sets that significantly change the RNG's operation to consider.

  • Mozilla asks the FBI for details of Tor vulnerability that could also affect Firefox

    Mozilla is fighting to force the FBI to disclose details of a vulnerability in the Tor web browser. The company fears that the same vulnerability could affect Firefox, and wants to have a chance to patch it before details are made public.

    The vulnerability was exploited by FBI agents to home in on a teacher who was accessing child pornography. Using a "network investigative technique", the FBI was able to identify the man from Vancouver, but Mozilla is concerned that it could also be used by bad actors.

    Perhaps unsurprisingly, the government says that it should be under no obligation to disclose details of the vulnerability to Mozilla ahead of anyone else. But the company has filed a brief with a view to forcing the FBI's hand. The argument is that users should be kept protected from known flaws by allowing software companies to patch them.

Security Leftovers

Filed under
Security
  • Thursday's security advisories
  • Friday's security updates
  • I never imagined a nuclear plant’s control system being online

    Many people think that the web is the internet. They see the Googles, the Facebooks, the Reddits… but the web is something built on top of the internet and so only the tip of the iceberg. The iceberg is composed of webcams, power plants, printers… billions of devices.

  • Heart Surgery Stalled For Five Minutes Thanks To Errant Anti-Virus Scan [Ed: Microsoft Windows]

    If you've ever had the pleasure of simply asking one medical outfit to transfer your records to another company or organization, you've probably become aware of the sorry state of medical IT. Billions are spent on medical hardware and software, yet this is a sector for which the fax machine remains the pinnacle of innovation and a cornerstone of daily business life. Meanwhile, getting systems to actually communicate with each other appears to be a bridge too far. And this hodge podge of discordant and often incompatible systems can very often have very real and troubling implications for patients.

  • How to make containers more secure

    CoreOS's Matthew Garrett talks about the security risks in containers and how he and others are working to mitigate such risks.

  • Docker Ramps Up Container Security

    Docker this week announced the rollout of security scanning technology to safeguard container content across the entire software supply chain.

  • Jenkins security patches could break plug-ins

    Popular open source automation server Jenkins has fixed multiple security vulnerabilities. The latest version changes how plug-ins use build parameters, though, so developers will need to adapt to the new process.

  • Security From Whom?

    To take advantage of the X11 protocol issues, you need to be able to speak X11 to the server. Assuming you haven’t misconfigured something (ssh or your file permissions) so other users’ software can talk to your server, that means causing you to run evil X11 protocol code like XEvilTeddy.

  • Convenience, security and freedom - can we pick all three?

    Moxie, the lead developer of the Signal secure communication application, recently blogged on the tradeoffs between providing a supportable federated service and providing a compelling application that gains significant adoption. There's a set of perfectly reasonable arguments around that that I don't want to rehash - regardless of feelings on the benefits of federation in general, there's certainly an increase in engineering cost in providing a stable intra-server protocol that still allows for addition of new features, and the person leading a project gets to make the decision about whether that's a valid tradeoff.

  • Announcing Certbot: EFF's Client for Let's Encrypt
  • Signal Return Orientated Programming attacks

    When a process is interrupted, the kernel suspends it and stores its state in a sigframe which is placed on the stack. The kernel then calls the appropriate signal handler code and after a sigreturn system call, reads the sigframe off the stack, restores state and resumes the process. However, by crafting a fake sigframe, we can trick the kernel into executing something else.

Linux can't keep you safe if you don't update it

Filed under
Linux
Security

At CoreOS Fest in Berlin, Greg Kroah-Hartman, Linux kernel developer and maintainer of the stable branch, talked about an inconvenient truth about Linux and security: vendors are notoriously bad about implementing patches.

For the last 15 years the kernel community has been following a rule to fix things as soon as possible. The Linux community fixes the bugs and pushed them so that vendors can push them to their users.

Read more

Security Leftovers

Filed under
Security

Mozilla and Tor

Filed under
Moz/FF
Security
  • Mozilla Wants Heads-Up From FBI on Tor Browser Hack

    The maker of the Firefox browser is wading into an increasingly contentious court battle over an undisclosed security vulnerability the FBI used to track down anonymous users of a child-porn site.

  • Mozilla To FBI: “Tell Us About The TOR Bug Used To Hack 1000+ Pedophiles”

    Recently, Mozilla filed a brief with the court, urging the FBI to reveal the technique used to hack 1000+ computers of pedophile TOR users. The open source supporter said that TOR software suite is based on Firefox and any known flaw can compromise the security of the end users.

  • Mozilla Asks U.S. Court to Disclose to it First Any Vulnerabilities in Tor

    There continue to be many people around the globe who want to be able to use the web and messaging systems anonymously, despite the fact that some people want to end Internet anonymity altogether. Typically, the anonymous crowd turns to common tools that can keep their tracks private, and one of the most common tools of all is Tor, an open source tool used all around the world.

    Project leaders behind Tor have continuously improved its security features, but now Mozilla is asking the U.S. District Court for the Western District of Washington, in the interest of Firefox users, to disclose any findings of vulnerability in Tor to it first, before any other party learns of the vulnerability. Here is the thought behind this.

  • Mozilla Asks Court To Force FBI To Turn Over Information On Hacking Tool It Used In Child Porn Case

    With the Tor browser being built on the Firefox framework, any exploit of Tor could affect vanilla Firefox users. Not only that, but the FBI is apparently sitting on another Firefox vulnerability it used in a previous investigation to unmask Tor users. (This refers to the FBI's 2012 child porn sting, which also used a NIT to obtain information about visitors to a seized website.) The filing notes the FBI has been less than helpful when approached for info about this Firefox/Tor-exploiting NIT.

Android Security Update May 2016: What you need to know

Filed under
Android
Security

And we're back! Google has released the latest Android security update and, as you might expect, there's plenty to be had. This time around, Google patched 40 vulnerabilities. Twelve of these 40 issues were marked as critical, with two of those identified as remote code execution vulnerabilities (aka, the worst kind). Unfortunately, the two remote code execution (RCE) issues are found in Android's mediaserver. This is the same subsystem that has been plagued with issues in the past few months. Those two RCE issues aren't the only ones to haunt the mediaserver.

Read more

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security

How Linux Kernel Development Impacts Security

Filed under
Linux
Security

The Linux kernel is a fast moving project, and it's important for both users and developers to quickly update to new releases to remain up-to-date and secure. That was the keynote message Greg Kroah-Hartman, maintainer of the stable Linux kernel, delivered at CoreOS Fest on May 9 here.

Kroah-Hartman is a luminary in the Linux community and is employed by the Linux Foundation, publishing on average a new Linux stable kernel update every week. In recent years, he has also taken upon himself the task of helping to author the "Who Writes Linux" report that details the latest statistics on kernel development. He noted that, from April 2015 to March 2016, there were 10,800 new lines of code added, 5,300 lines removed and 1,875 lines modified in Linux every day.

Read more

Also: Neat drm/i915 Stuff for 4.7

Syndicate content

More in Tux Machines

ownCloud Desktop Client 2.2.4 Released with Updated Dolphin Plugin, Bug Fixes

ownCloud is still alive and kicking, and they've recently released a new maintenance update of the ownCloud Desktop Client, version 2.2.4, bringing some much-needed improvements and patching various annoying issues. Read more

Early Benchmarks Of The Linux 4.9 DRM-Next Radeon/AMDGPU Drivers

While Linux 4.9 will not officially open for development until next week, the DRM-Next code is ready to roll with all major feature work having been committed by the different open-source Direct Rendering Manager drivers. In this article is some preliminary testing of this DRM-Next code as of 29 September when testing various AMD GPUs with the Radeon and AMDGPU DRM drivers. Linux 4.9 does bring compile-time-offered experimental support for the AMD Southern Islands GCN 1.0 hardware on AMDGPU, but that isn't the focus of this article. A follow-up comparison is being done with GCN 1.0/1.1 experimental support enabled to see the Radeon vs. AMDGPU performance difference on that hardware. For today's testing was a Radeon R7 370 to look at the Radeon DRM performance and for AMDGPU testing was the Radeon R9 285, R9 Fury, and RX 480. Benchmarks were done from the Linux 4.8 Git and Linux DRM-Next kernels as of 29 September. Read more

How to Effectively and Efficiently Edit Configuration Files in Linux

Every Linux administrator has to eventually (and manually) edit a configuration file. Whether you are setting up a web server, configuring a service to connect to a database, tweaking a bash script, or troubleshooting a network connection, you cannot avoid a dive deep into the heart of one or more configuration files. To some, the prospect of manually editing configuration files is akin to a nightmare. Wading through what seems like countless lines of options and comments can put you on the fast track for hair and sanity loss. Which, of course, isn’t true. In fact, most Linux administrators enjoy a good debugging or configuration challenge. Sifting through the minutiae of how a server or software functions is a great way to pass time. But this process doesn’t have to be an exercise in ineffective inefficiency. In fact, tools are available to you that go a very long way to make the editing of config files much, much easier. I’m going to introduce you to a few such tools, to ease some of the burden of your Linux admin duties. I’ll first discuss the command-line tools that are invaluable to the task of making configuration more efficient. Read more

Why Good Linux Sysadmins Use Markdown

The Markdown markup language is perfect for writing system administrator documentation: it is lightweight, versatile, and easy to learn, so you spend your time writing instead of fighting with formatting. The life of a Linux system administrator is complex and varied, and you know that documenting your work is a big time-saver. A documentation web server shared by you and your colleagues is a wonderful productivity tool. Most of us know simple HTML, and can whack up a web page as easily as writing plain text. But using Markdown is better. Read more