Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • 20 Questions Security Leaders Need To Ask About Analytics

    It would be an understatement to say that the security world tends to be full of hype and noise. At times, it seems like vendors virtually xerox each other’s marketing materials. Everyone uses the same words, phrases, jargon, and buzzwords. This is a complicated phenomenon and there are many reasons why this is the case.

    The more important issue is why security leaders find ourselves in this state. How can we make sense of all the noise, cut through all the hype, and make the informed decisions that will improve the security of our respective organizations? One answer is by making precise, targeted, and incisive inquiries at the outset. Let’s start with a game of 20 questions. Our first technology focus: analytics.

  • Trend Micro shows that Linux systems not so bulletproof against trojans [Ed: very low risk (must fool the user or gain physical access)]
  • Sixth Linux DDoS Trojan Discovered in the Last 30 Days [Ed: drama over something that must fool users]

    Linux users have yet another trojan to worry about, and as always, crooks are deploying it mostly to hijack devices running Linux-based operating systems and use them to launch DDoS attacks at their behest.

  • Yet Another Linux Trojan Uncovered
  • Secure Docker on Linux or Windows platforms

    With Docker appearing in businesses of all shapes and sizes, security is a concern for many IT admins. Here's how to secure Docker on the container or the host machine.

  • New release: usbguard-0.6.1
  • Ransomware Getting More Targeted, Expensive

    I shared a meal not long ago with a source who works at a financial services company. The subject of ransomware came up and he told me that a server in his company had recently been infected with a particularly nasty strain that spread to several systems before the outbreak was quarantined. He said the folks in finance didn’t bat an eyelash when asked to authorize several payments of $600 to satisfy the Bitcoin ransom demanded by the intruders: After all, my source confessed, the data on one of the infected systems was worth millions — possibly tens of millions — of dollars, but for whatever reason the company didn’t have backups of it.

  • Web security CEO warns about control of internet falling into few hands

    The internet was designed to be a massive, decentralized system that nobody controlled, but it is increasingly controlled by a select few tech companies, including Google, Facebook, Apple and Amazon, and they are continuing to consolidate power, said the CEO of a cybersecurity company.

    "More and more of the internet is sitting behind fewer and fewer players, and there are benefits of that, but there are also real risks," said Matthew Prince, chief executive officer of web security company CloudFlare, in an interview with CNBC. His comments came at CloudFlare's Internet Summit — a conference featuring tech executives and government security experts — on Tuesday in San Francisco.

    Facebook has faced a lot of criticism for perceived abuse of its editorial sway among the 1.7 billion monthly active users who visit the site to consume news alongside family photos and ads. For example, a Norwegian newspaper editor recently slammed Mark Zuckerberg for Facebook's removal of a post featuring an iconic image known as the Napalm Girl that included a naked girl running from napalm bombs.

Security News

Filed under
Security

Security News

Filed under
Security
  • Security advisories for Wednesday
  • DevOps and the Art of Secure Application Deployment

    Secure application deployment principles must extend from the infrastructure layer all the way through the application and include how the application is actually deployed, according to Tim Mackey, Senior Technical Evangelist at Black Duck Software. In his upcoming talk, “Secure Application Development in the Age of Continuous Delivery” at LinuxCon + ContainerCon Europe, Mackey will discuss how DevOps principles are key to reducing the scope of compromise and examine why it’s important to focus efforts on what attackers’ view as vulnerable.

  • Sept 2016 Patch Tuesday: Microsoft released 14 security bulletins, rated 7 as critical

    Microsoft released 14 security bulletins for September, seven of which are rated critical due to remote code execution flaws. Microsoft in all its wisdom didn’t regard all RCEs as critical. There’s also an “important rated” patch for a publicly disclosed flaw which Microsoft claims isn’t a zero-day being exploited. But at least a 10-year-old hole is finally being plugged.

    Next month marks a significant change as Microsoft says it intends roll out "servicing changes" that include bundled patches. Unless things change, not all Windows users will be able to pick and choose specific security updates starting in October.

  • Microsoft Patches Zero Day Flaw Used In Two Massive Malvertising Campaigns [Ed: Microsoft, as usual, told the NSA about this months before patching]

    Microsoft was first notified about the so-called information disclosure bug in September 2015, security vendor Proofpoint said in an alert this week. But a patch for it became available only after Trend Micro and Proofpoint reported the bug again to Microsoft more recently when researching a massive malvertising campaign being operated by a group called AdGholas, the alert noted.

MySQL Patching

Filed under
Security
  • MySQL 0-day could lead to total system compromise
  • MySQL Exploit Evidently Patched

    News began circulating yesterday that the popular open source database MySQL contains a publicly disclosed vulnerability that could be used to compromise servers. The flaw was discovered by researcher Dawid Golunski and began getting media attention after he published a partial proof-of-concept of the exploit, which is purposefully incomplete to prevent abuse. He said the exploit affects "all MySQL servers in default configuration in all version branches (5.7, 5.6, and 5.5) including the latest versions." In addition, MariaDB and Percona DB which are derived from MySQL are affected.

Security News

Filed under
Security
  • Tuesday's security updates
  • [Mozilla:] Cybersecurity is a Shared Responsibility

    There have been far too many “incidents” recently that demonstrate the Internet is not as secure as it needs to be. Just in the past few weeks, we’ve seen countless headlines about online security breaches. From the alleged hack of the National Security Agency’s “cyberweapons” to the hack of the Democratic National Committee emails, and even recent iPhone security vulnerabilities, these stories reinforce how crucial it is to focus on security.

    Internet security is like a long chain and each link needs to be tested and re-tested to ensure its strength. When the chain is broken, bad things happen: a website that holds user credentials (e.g., email addresses and passwords) is compromised because of weak security; user credentials are stolen; and, those stolen credentials are then used to attack other websites to gain access to even more valuable information about the user.

    One weak link can break the chain of security and put Internet users at risk. The chain only remains strong if technology companies, governments, and users work together to keep the Internet as safe as it can be.

  • IoT malware exploits DVRs, home cameras via default passwords

    The Internet of Things business model dictates that devices be designed with the minimum viable security to keep the products from blowing up before the company is bought or runs out of money, so we're filling our homes with net-connected devices that have crummy default passwords, and the ability to probe our phones and laptops, and to crawl the whole internet for other vulnerable systems to infect.

    Linux/Mirai is an ELF trojan targeting IoT devices, which Malware Must Die describes as the most successful ELF trojan. It's very difficult to determine whether these minimal-interface devices are infected, but lab tests have discovered the malware in a wide range of gadgets.

  • Someone Is Learning How to Take Down the Internet

    First, a little background. If you want to take a network off the Internet, the easiest way to do it is with a distributed denial-of-service attack (DDoS). Like the name says, this is an attack designed to prevent legitimate users from getting to the site. There are subtleties, but basically it means blasting so much data at the site that it's overwhelmed. These attacks are not new: hackers do this to sites they don't like, and criminals have done it as a method of extortion. There is an entire industry, with an arsenal of technologies, devoted to DDoS defense. But largely it's a matter of bandwidth. If the attacker has a bigger fire hose of data than the defender has, the attacker wins.

  • Internet's defences being probed: security expert

    A big player, most possibly a nation state, has been testing the security of companies that run vital parts of the Internet's infrastructure, according to well-known security expert Bruce Schneier.

    In an essay written for the Lawfare blog, Schneier, an inventor of the Blowfish, Twofish and Yarrow algorithms, said that the probes which had been observed appeared to be very carefully targeted and seemed to be testing what exactly would be needed to compromise these corporations.

    Schneier said he did not know who was carrying out the probes but, at a first guess, said it was either China or Russia.

    Pointing out that the easiest way to take a network off the Internet was by using a distributed denial of service (DDoS) attack, he said that major firms that provide the basic infrastructure to make the Internet work had recently seen an escalation of such attacks.

  • Hackers smear Olympic athletes with data dump of medical files

    Hackers are trying to tarnish the U.S. Olympic team by releasing documents they claim show athletes including gymnast Simone Biles and tennis players Venus and Serena Williams used illegal substances during the Rio Games.

    The medical files, allegedly from the World Anti-Doping Agency, were posted Tuesday on a site bearing the name of the hacking group Fancy Bears. “Today we'd like to tell you about the U.S. Olympic team and their dirty methods to win,” said a message on the hackers' site.

    The World Anti-Doping Agency confirmed it had been hacked and blamed Fancy Bears, a Russian state-sponsored cyber espionage team that is also known as APT 28 -- the very same group that may have recently breached the Democratic National Committee.

Security News

Filed under
Security
  • Securing the Programmer

    I have a favorite saying: "If you are a systems administrator, you have the keys to the kingdom. If you are an open-source programmer, you don't know which or how many kingdoms you have the keys to." We send our programs out into the world to be run by anyone for any purpose. Think about that: by anyone, for any purpose. Your code might be running in a nuclear reactor right now, or on a missile system or on a medical device, and no one told you. This is not conjecture; this is everyday reality. Case in point: the US Army installed gpsd on all armor (tanks, armored personnel carriers and up-armored Humvees) without telling its developers.

    This article focuses on the needs of infrastructure software developers—that is, developers of anything that runs as root, has a security function, keeps the Internet as a whole working or is life-critical. Of course, one never knows where one's software will be run or under what circumstances, so feel free to follow this advice even if all you maintain is a toddler login manager. This article also covers basic security concepts and hygiene: how to think about security needs and how to keep your development system in good shape to reduce the risk of major computing security mishaps.

  • Software-Defined Security Market Worth 6.76 Billion USD by 2021
  • Two critical bugs and more malicious apps make for a bad week for Android
  • Let's Encrypt Aiming to Encrypt the Web

    By default, the web is not secure, enabling data to travel in the clear, but that's a situation that is easily corrected through the use of SSL/TLS. A challenge with implementing Secure Sockets Layer/Transport Layer Security has been the cost to acquire an SSL/TSL certificate from a known Certificate Authority (CA), but that has changed in 2016, thanks to the efforts of Let's Encrypt.

    Let's Encrypt is a non-profit effort that that was was announced in November 2014 and became a Linux Foundation Collaborative Project in April 2015. Let's Encrypt exited its beta period in April 2016 and to date has provided more than 5 million free certificates.

Security News

Filed under
Security
  • Security advisories for Monday
  • Linux with a irc trojan.
  • On Experts

    There are a rather large number of people who think they are experts, some think they're experts at everything. Nobody is an expert at everything. People who claim to have done everything should be looked at with great suspicion. Everyone can be an expert at something though.

  • OPM Hacking Report Says Agency Missed One Set Of Attacks, Spent Little On Cybersecurity [Ed: spent on Windows]

    The twice-hacked Office of Personnel Management has had little to offer but promises of "taking security seriously" and free identity theft protection for the thousands of government employees whose personal information was pried loose by hackers.

    Twice-hacked, because there was one breach the OPM did discover, and one it didn't. While it spent time walling off the breach it had detected, another went unnoticed, leaking enough info on government employees that the CIA began worrying about the safety of agents located abroad.

    A new report [PDF] by the Committee on Oversight and Government Reform (which AP refers to but, oddly, does not feel compelled to LINK to, despite it being a completely PUBLIC document) details where the OPM initially went wrong.

  • Hollywood Keeps Insisting Tech Is Easy, Yet Can't Secure Its Own Screeners

    While some will just look at this and mock Hollywood for bad security practices, it does raise more serious questions: if Hollywood can't figure out its own (basic) technology issues, why does it think that the tech industry should solve all its problems for it? If it doesn't even understand the basics, how can it insist that those in Silicon Valley can fix the things that it doesn't understand itself?

    We're already seeing this with the MPAA's ridiculous and misguided freakout over the FCC's plan to have cable companies offer up app versions so that authorized subscribers can access authorized, licensed content. The MPAA and its think tank friends keep falsely insisting that the FCC's recommendation requires the cable companies to ship the actual content to third parties. But the plan has never said that. It only required that third-party devices be able to access the content -- such as by passing through credentials so that the content could flow from the (licensed) cable service to the end user.

    The fact that these guys don't seem to understand the basics of how the technology works comes through not just in the fact that they failed to secure their screener system, but also in the policy proposals that they keep making. It's becoming increasingly difficult to take those policies seriously when they seem to be based on a fundamental ignorance of how technology actually works.

Hands-on: Blue Hydra can expose the all-too-unhidden world of Bluetooth

Filed under
Security

I installed Blue Hydra by "cloning" its Ruby code from its GitHub repository on an older MacBook Air I'd configured with Kali GNU/Linux "Rolling" (64 bit), a security-testing-focused version of Debian, and a SENA UD100 USB Bluetooth adapter. Blue Hydra will work on other Debian-based distributions, and it's even pre-installed as part of the current release of Pentoo (a security-focused live CD version of Gentoo Linux). Pwnie Express has also packaged Blue Hydra for use with its line of sensors (though not with the PwnPhone), and it can be integrated with the company's Pulse security monitoring and auditing service.

Read more

Security News

Filed under
Security
  • How OPNFV Earned Its Security Stripes and Received a CII Best Practices Badge

    Earning the CII badge will have a HUGE impact on OPNFV’s general approach to building security into the development model (something all open source projects should model). Statistics show that around 50 percent of vulnerabilities in a software are “flaws” (usually design fault/defective design, which is hard to fix after software has been released) and 50 percent bugs (implementation fault). Following these best practices will hopefully address both design and implementation faults before they become vulnerabilities.

  • MySQL Hit By "Critical" Remote Code Execution 0-Day

    The latest high-profile open-source software project having a bad security day is MySQL... MySQL 5.5/5.6/5.7 has a nasty zero-day vulnerability.

    Researchers have discovered multiple "severe" MySQL vulnerabilities with the CVE-2016-6662 being marked as critical and does affect the latest MySQL version.

    This 0-day is open for both local and remote attackers and could come via authenticated access to a MySQL database (including web UI administration panels) or via SQL injection attacks. The exploit could allow attackers to execute arbitrary code with root privileges.

  • CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day )
  • Is Debian the gold standard for Linux security?
  • 10 Best Password Managers For Linux Operating Systems

    With so many online accounts on the internet, it can be tediously difficult to remember all your passwords. Many people write them down or store them in a document, but that’s plain insecure. There are many password managers for Windows and OS X, but here we’ll look at some of the best password managers for Linux.

Security News

Filed under
Security
  • Moving towards a more secure web

    To help users browse the web safely, Chrome indicates connection security with an icon in the address bar. Historically, Chrome has not explicitly labelled HTTP connections as non-secure. Beginning in January 2017 (Chrome 56), we’ll mark HTTP sites that transmit passwords or credit cards as non-secure, as part of a long-term plan to mark all HTTP sites as non-secure.

  • UK Politician's Campaign Staff Tweets Out Picture Of Login And Password To Phones During Campaign Phone Jam

    When we talk password security here at Techdirt, those conversations tend to revolve around stories a bit above and beyond the old "people don't use strong enough passwords" trope. While that certainly is the case, we tend to talk more about how major corporations aren't able to learn their lessons about storing customer passwords in plain text, or about how major media outlets are occasionally dumb enough to ask readers to submit their own passwords in an unsecure fashion.

    But for the truly silly, we obviously need to travel away from the world of private corporations and directly into the world of politicians, who often times are tasked with legislating on matters of data security and privacy, but who cannot help but show their own ineptness on the matter themselves. Take Owen Smith, for example. Smith is currently attempting to become the head of the UK's Labour Party, with his campaign working the phones as one would expect. And, because this is the age of social media engagement, one of his campaign staffers tweeted out the following photo of the crew hard at work.

  • WiredTree Warns Linux Server Administrators To Update In Wake Of Critical Off-Path Kernel Vulnerability

    WiredTree, a leading provider of managed server hosting, has warned Linux server administrators to update their servers in response to the discovery of a serious off-path vulnerability in the Linux kernel’s handling of TCP connections.

  • Reproducible Builds: week 72 in Stretch cycle
Syndicate content

More in Tux Machines

RPi-friendly home automation kit adds voice recognition support

Following its successful Kickstarter campaign for a standalone Matrix home automation and surveillance hub, and subsequent release of an FPGA-driven Matrix Creator daughter board for use with the Raspberry Pi, Matrix Labs today launched a “Matrix Voice” board on Indiegogo. The baseline board, currently available at early-bird pricing of $45, has an array of 7 microphones surrounding a ring of 18 software-controlled RGBW LEDs. A slightly pricier model includes an MCU-controlled WiFi/Bluetooth ESP32 wireless module. Read more

The Year Of Linux On Everything But The Desktop

The War on Linux goes back to Bill Gates, then CEO of Microsoft, in an “open letter to hobbyists” published in a newsletter in 1976. Even though Linux wouldn’t be born until 1991, Gates’ burgeoning software company – itself years away from releasing its first operating system – already felt the threat of open source software. We know Gates today as a kindly billionaire who’s joining us in the fight against everything from disease to income inequality, but there was a time when Gates was the bad guy of the computing world. Microsoft released its Windows operating system in 1985. At the time, its main competition was Apple and Unix-like systems. BSD was the dominant open source Unix clone then – it marks its 40th birthday this year, in fact – and Microsoft fired barrages of legal challenges to BSD just like it eventually would against Linux. Meanwhile Apple sued Microsoft over its interface, in the infamous “Look and Feel” lawsuit, and Microsoft’s reign would forever be challenged. Eventually Microsoft would be tried in both the US and the UK for antitrust, which is a government regulation against corporate monopolies. Even though it lost both suits, Microsoft simply paid the fine out of its bottomless pockets and kept right at it. Read more

Digital audio and video editing in GNU/Linux

  • Linux Digital Audio Workstation Roundup
    In the world of home studio recording, the digital audio workstation is one of the most important tools of the trade. Digital audio workstations are used to record audio and MIDI data into patterns or tracks. This information is then typically mixed down into songs or albums. In the Linux ecosystem, there is no shortage of Digital audio workstations to chose from. Whether you wish to create minimalist techno or full orchestral pieces, chances are there is an application that has you covered. In this article, we will take a brief look into several of these applications and discuss their strengths and weaknesses. I will try to provide a fair evaluation of the DAWs presented here but at the end of the day, I urge you to try a few of these applications and to form an opinion of your own.
  • Shotcut Video Editor Available As A Snap Package [Quick Update]
    Shotcut is a free, open source Qt5 video editor developed on the MLT Multimedia Framework (it's developed by the same author as MLT), available for Linux, Windows and Mac. Under the hood, Shotcut uses FFmpeg, so it supports many audio, video and image formats, along with screen, webcam and audio capture. The application doesn't require importing files, thanks to its native timeline editing. Other features worth mentioning are multitrack timeline with thumbnails and waveforms, 4k resolution support, video effects, as well as a flexible UI with dockable panels.
  • Simple Screen Recorder Is Now Available as a Snap App
    Simple Screen Recorder, a popular screen recording app for Linux desktops, is now available to install as a Snap app from the Ubuntu Store.

Kernel News: Linux 4.10 in SparkyLinux, Wayland 1.13.0, and Weston 2.0 RC2

  • Linux Kernel 4.10 Lands in SparkyLinux's Unstable Repo, Here's How to Install It
    The trend of offering users the most recent Linux kernel release continues today with SparkyLinux, an open-source, Debian-based distribution that always ships with the latest GNU/Linux technologies and software versions. SparkyLinux appears to be the third distro to offer its users the ability to install the recently released Linux 4.10 kernel, after Linux Lite and Ubuntu, as the developers announced earlier that the Linux kernel 4.10 packages are now available from the unstable repository.
  • Wayland 1.13.0 Display Server Officially Released, Wayland 1.14 Lands in June
    Bryce Harrington, a Senior Open Source Developer at Samsung, announced today the release and general availability of the Wayland 1.13.0 for GNU/Linux distributions that already adopted the next-generation display server.next-generation display server. Wayland 1.13.0 has entered development in the first days of the year, but the first Alpha build arrived at the end of January, along with the Alpha version of the Weston 2.0 compositor, including most of the new features that are present in this final release that you'll be able to install on your Linux-based operating systems in the coming days.
  • Weston 2.0 RC2 Wayland Compositor Arrives With Last Minute Fixes
    While Wayland 1.13 was released today, Bryce Harrington today opted against releasing the Weston 2.0 reference compositor and instead issue a second release candidate. Weston 2.0 is the next version of this "playground" for Wayland compositor technologies since the new output configuration API had broke the ABI, necessitating a break from the same versioning as Wayland.
  • [ANNOUNCE] weston 1.99.94