Warith Al Maawali has announced the release of Linux Kodachi 6.1 on July 27, 2019, which is based on Xbuntu 18.04 LTS.

It will provide you with a secure, anti-forensic, and anonymous operating system considering all features that a person who is concerned about privacy would need to have in order to be secure.

• RDP Exposure To The Internet

  The Remote Desktop Protocol, commonly referred to as RDP, is a proprietary protocol developed by Microsoft that is used to provide a graphical means of connecting to a network-connected computer. RDP client and server support has been present in varying capacities in most every Windows version since NT. Outside of Microsoft’s offerings, there are RDP clients available for most other operating systems. If the nitty gritty of protocols is your thing, Wikipedia’s Remote Desktop Protocol article is a good start on your way to a trove of TechNet articles.

  RDP is essentially a protocol for dangling your keyboard, mouse and a display for others to use. As you might expect, a juicy protocol like this has a variety of knobs used to control its security capabilities, including controlling user authentication, what encryption is used, and more. The default RDP configuration on older versions of Windows left it vulnerable to several attacks when enabled; however, newer versions have upped the game considerably by requiring Network Level Authentication (NLA) by default. If you are interested in reading more about securing RDP, UC Berkeley has put together a helpful guide, and Tom Sellers, prior to joining Rapid7, wrote about specific risks related to RDP and how to address them.

• Golang Malware Targets Linux-Based Servers [Ed: Better headline would say something like, "malware written in some programming language (Go) wants people to foolishly install it on a server and it's compiled for or made compatible with GNU/Linux"]

  A cryptominer campaign has been targeting Linux-based servers using a new Golang malware, according to research published by F5 Labs.

  Though not often seen in the threat landscape, the Golang malware was first identified in mid-2018 and has sustained throughout 2019. Researchers noted the latest operation, which has infected an estimated several thousand machines, began around June 10. The first exploit requests were identified around June 16.

• Microsoft wants to join private Linux security developer board [Ed: If Linux values security, then it will reject the company that started PRISM with the NSA]

  Microsoft has applied to join a private group of Linux developers responsible for reporting and discussing security issues before they go public.

• Microsoft bids for behind-the-scenes access to Linux flaws [Ed: They have already taken over parts of the Linux Foundation, so why not this?]

  Request to join security lists come as the firm reveals Linux usage on Azure VMs outweighs Windows usage.

• [Slackware] LibreOffice 6.2.5 packages available

  Earlier this week, the Document Foundation released version 6.2.5 of their office suite LibreOffice. I have built and uploaded sets of packages for Slackware 14.2 and also for -current, 32bits and 64bits.

  The Document Foundation themselves finally think that 6.2.x is production ready: “… Users in production environments can start evaluating LibreOffice 6.2.5…“. I was already happy with 6.2.4 and I find the capability to open and work with MS Office documents improving all the time.

We love the Raspberry Pi, and judging by the response we got to a late night tweet we sent out last weekend a lot of you love the Pi too!

Because of that, when the Pi 4 dropped we wanted to get Kali supported on it right away.

Whats new on the Raspberry Pi 4?

The Raspberry Pi 4 is actually a pretty amazing little machine. The Pi has always been known for its low cost and easy accessibility, but with the 4 we can actually throw real performance onto that list as well.

• Someone Is Spamming and Breaking a Core Component of PGP’s Ecosystem

  Last week, contributors to the PGP protocol GnuPG noticed that someone was “poisoning” or “flooding” their certificates. In this case, poisoning refers to an attack where someone spams a certificate with a large number of signatures or certifications. This makes it impossible for the the PGP software that people use to verify its authenticity, which can make the software unusable or break. In practice, according to one of the GnuPG developers targeted by this attack, the hackers could make it impossible for people using Linux to download updates, which are verified via PGP.

  It’s unclear who’s behind these attacks, but the targets are Robert J. Hansen and Daniel Kahn Gillmor, both OpenPGP protocol developers.

  “We've known for a decade this attack is possible. It's now here and it's devastating,” Hansen wrote in his attack post-mortem.

• Certificates Issued to Huawei Subsidiary Found in Cisco Switches

  Researchers noticed that the firmware for some Cisco switches contains X.509 certificates and associated private keys issued to a US-based subsidiary of Huawei. An investigation by the networking giant revealed that it was an oversight related to the use of an open-source third-party component.

  [...]

  In an informational advisory published on Wednesday, Cisco says its FindIT development team uses OpenDaylight for testing purposes and the certificates should not have been included in production firmware.

• St John Ambulance becomes latest casualty of a ransomware attack [iophk: those signing off on Windows deployments need to see real jail time]

  Though it's "confident" that data has not been shared outside St John Ambulance, it fessed that the data of everyone who has opened an account, booked or attended a training course until February 2019 was affected.

  This data includes names, courses, contact details, costs, invoicing details and, in some cases, driving licence data. No passwords or credit card details were taken, and no records have been doctored.

• Magento Patches Flaws Leading to Site Takeover

  Because at one point in the sanitization process sanitized links are injected back into the string via vsprintf(), an additional double quote is injected into the tag, which allows for an attribute injection.
  

  “This allows an attacker to inject arbitrary HTML attributes into the resulting string. By injecting a malicious onmouseover event handler and a style attribute to make the link an invisible overlay over the entire page, the XSS payload triggers as soon as a victim visits a page that contains such an XSS payload and moves his mouse,” the security firm says.

  Because the method is used to sanitize order cancellation notes, an attacker could exploit the vulnerability to inject arbitrary JavaScript that is triggered when an employee reviews the cancelled order.

• Server image mystery in Georgia election security case

  The FBI data could reveal whether [attackers] tampered with elections in Georgia because the server in question had a gaping security hole that went unpatched for more than six months before being publicly exposed. Data on the server included passwords used by county officials to access elections management files.

  Technicians at the Center for Elections Systems at Kennesaw State University, which then ran the state’s election system, erased the server’s data on July 7, 2017, less than a week after the voting integrity suit was filed. After the AP reported on it three months later, Kemp denied ordering the data destruction or knowing about it in advance and called it reckless, inexcusable and inept.

  But the FBI had a forensic backup, which it made in March 2017 when it investigated the security hole. The FBI has not responded to repeated requests by the AP to confirm that it continues to possess the data. FBI Atlanta spokeswoman Jenna Sellitto wouldn’t say whether the FBI has examined the data on that image to determine whether any tampering or other malicious activity occurred.

• Georgia Failed to Subpoena Image of Wiped Elections Server

  Marilyn Marks of the Coalition for Good Governance, a plaintiff in the case, said that if the state failed to secure the data from the FBI — despite informing U.S. District Judge Amy Totenberg in October 2017 of its intent to do so with the subpoena — it clearly has something to hide.

  "If they have destroyed records then it can be presumed that those records would have shown our allegations to be true," Marks said.

  Neither the Secretary of State's office nor an attorney representing it in the case, Josh Belinfante, would say why the subpoena was never filed. Nor would they say whether they had obtained the data through other means for secure safekeeping. The FBI in Atlanta also wouldn't say whether it has provided the state with a copy.

• Antivirus firms start flagging spyware installed by Chinese border control

  It recently came to light that the border control authority in China's Xinjiang region was installing surveillance software on the phones of tourists without their knowledge or consent. The software apparently kept an eye out for terms that related to Islamic extremism and literature by the Dalai Lama.