Language Selection

English French German Italian Portuguese Spanish

Security

Easter egg: DSL router patch merely hides backdoor instead of closing it

Filed under
Hardware
Security
Legal

First, DSL router owners got an unwelcome Christmas present. Now, the same gift is back as an Easter egg. The same security researcher who originally discovered a backdoor in 24 models of wireless DSL routers has found that a patch intended to fix that problem doesn’t actually get rid of the backdoor—it just conceals it. And the nature of the “fix” suggests that the backdoor, which is part of the firmware for wireless DSL routers based on technology from the Taiwanese manufacturer Sercomm, was an intentional feature to begin with.

Back in December, Eloi Vanderbecken of Synacktiv Digital Security was visiting his family for the Christmas holiday, and for various reasons he had the need to gain administrative access to their Linksys WAG200G DSL gateway over Wi-Fi. He discovered that the device was listening on an undocumented Internet Protocol port number, and after analyzing the code in the firmware, he found that the port could be used to send administrative commands to the router without a password.

After Vanderbecken published his results, others confirmed that the same backdoor existed on other systems based on the same Sercomm modem, including home routers from Netgear, Cisco (both under the Cisco and Linksys brands), and Diamond. In January, Netgear and other vendors published a new version of the firmware that was supposed to close the back door.

Read more

Oracle updates users on Heartbleed progress

Filed under
Red Hat
Server
Security

The Heartbleed fallout continues, but enterprise customers can draw some comfort from the fact that the companies that keep them in software are clearly as concerned as they are. For example, Oracle Corp. has announced mostly good, some bad and a bit of ugly news when it comes to security holes in its products.

Read more

Safety you can bank on: Chromebook, Linux, phone

Filed under
GNU
Linux
Security

If you're not deterred by learning strange software, you can save hundreds of dollars by downloading a copy of the open-source Linux operating system and burning it to a CD or copying it to a flash drive. As security journalist Brian Krebs explained in the summer of 2012, you can pop that into your Windows PC, boot the machine off it, and go online insulated from whatever might lurk in your copy of Windows.

(In that post, Krebs endorsed a version of Linux with the charming name Puppy Linux; I usually recommend a different variety called Ubuntu, but the differences don't amount to much in this context.)

Using Linux just for online banking also insulates you from most of its potential complexity: You're only running a browser.

But if installing new apps in Windows already fills you with dread, or the thought of picking one version of Linux out of dozens makes your head hurt, spend money instead of time. A Chromebook just might work — and might be all the computer you needed in the first place.

Read more

OpenSSL and Linux: A Tale of Two Open-Source Projects

Filed under
Linux
Security

Linux, arguably the world’s most emblematic open-source project, provides a counterpoint to OpenSSL’s problems. Volunteers all over the world submit seven changes to Linux every hour, and millions of lines of code improvements and fixes are voluntarily added to the software every year. Over 180 major companies, including Hewlett-Packard, Oracle, IBM and Samsung, every year contribute around half a million dollars to the Linux Foundation, the nonprofit that supports the Linux system.

So what explains the discrepancy between the inattention to OpenSSL and the great fortune of Linux? Good old lack of awareness, experts say.

Open-source advocates and participants say Linux has simply had the benefit of strong brand ambassadors and better name recognition than OpenSSL.

Read more

Edward Snowden Used the Tails Linux Distro to Stay Hidden

Filed under
Security
Debian

The name Edward Snowden will be remembered as one of the biggest whistle-blowers in recent history, if not the most important one. People know more about Edward Snowden than they know about close relatives, but it seems that little has been revealed until now about this methods and how he managed to remain undetected. It all has to do with Linux, of course.

Read more ►

TrueCrypt audit finds “no evidence of backdoors” or malicious code

Filed under
Security

Since September 2013, a handful of cryptographers have been discussing new problems and alternatives to the popular security application. By February 2014, the Open Crypto Audit Project—a new organization based in North Carolina that seeks formal 501(c)3 non-profit status—raised around $80,000 towards this goal on various online fundraising sites.

"[The results] don't panic me,” Matthew Green, a Johns Hopkins cryptography professor who has been one of the people leading this effort, told Ars. “I think the code quality is not as high as it should be, but on the other hand, nothing terrible is in there, so that's reassuring”

Read more ►

Former Chief Security Officer for Microsoft the Chairman of the Board of Firm Behind Heartbleed®

Filed under
GNU
Linux
Microsoft
Security

A serious conflict of interests that nobody in the media is talking about; Codenomicon is headed by Microsoft’s Howard A. Schmidt

Read more ►

CyanogenMod reveals new branding that represents openness, security and customization

Filed under
Android
Security

Well, folks, it looks like CyanogenMod, Inc. is starting to shape up to look like a real legit company. The company has already made big deals with phone manufacturers and successfully raised a good deal of money to help in their endeavors, and now they are making some changes to the way they present themselves.

Read more ►

Security Exaggeration, Linux on ATMs, and Mac Ubuntu

Filed under
Linux
Security
Ubuntu

A lot of Websites are still covering the last couple of Linux security breaches and today Steven J. Vaughan-Nichols said, "It's not Linux's fault!" It rarely is. A lot of talk is heard lately about those last XP users and what they will use next, but yesterday ComputerWorld.com said ATMs will likely be migrated to Linux as well. That's a whole demographic we forgot to count. Jack Wallen says Google is "single-handedly" responsible for propelling Linux to the top. And Michael Larabel reports that Ubuntu 14.04 runs very well on MacBooks.

Read more ►

Why the media loves to exaggerate Linux security problems

Filed under
GNU
Linux
Security

There have been a lot of media reports about Linux security problems recently. ZDNet has taken a stand and pointed out that the problem isn't with Linux, the problem is with certain Linux users and administrators. I'd also argue that the problem is also with certain media outlets who jump on the "linux security stinks!" bandwagon at the earliest opportunity.

Read more ►

Syndicate content

More in Tux Machines

Ubuntu Touch OTA-4 Update to Let Users Import SIM Contacts

A fresh OTA update is being prepared for Ubuntu Touch, and it should land soon. Developers have released some of the most important improvements that will be implemented in the upcoming release. Read more

Fedora Tools

  • Future Plans For Changing Fedora's Installer
    Over the last couple weeks there has been an "Anaconda Wishlist" thread occurring on Fedora's desktop mailing list. The thread, and the associated Workstation Working Group meeting, are directed at the future of the Fedora Anaconda Installer.
  • Tweak Your Fedora 22 Desktop Using Fedy And PostinstallerF
    None of the Linux distributions comes with all essential applications for daily usage, Agree? You have to install additional Repositories, softwares like Chrome, Flash player, Java or something in order to get a perfect distro for the daily usage. We can do it in two methods. First, you can manually search and install all the required softwares one by one, and the second one is you can use a tool that will help you to find and install all essential applications from one place. Which method would you prefer? I prefer the second method most, not because it is easy, but also it saves some time.
  • 27 ‘DNF’ (Fork of Yum) Commands for RPM Package Management in Linux

Red Hat CEO: Public cloud "obscenely expensive at scale"

Whitehurst believes Amazon Web Services (AWS) makes sense for test and dev, but it can't compete with private cloud at scale. Do you agree? Read more Also:

Intel Gets 'Clear' About Linux and Containers

Imad Sousou, VP in Intel's Software and Services Group and GM of the Intel Open Source Technology Center, discusses the Clear Linux and Clear container efforts. Read more