Language Selection

English French German Italian Portuguese Spanish

Security

Security and Microsoft Back/Bug Doors

Filed under
Microsoft
Security
  • Security updates for Friday
  • careful with the chrome HSTS

    I mean, yes, I set the HSTS header, but that was with the same cert that chrome is now insisting can’t be trusted. Why in the world would you permanently store “must have trusted cert” on the basis of an untrusted cert?

  • Hacked NSA tools put Windows users at possible risk

    The hacking group known as Shadow Brokers claims to have released National Security Agency malware designed to break into Windows computers. The software could make millions of Microsoft users vulnerable to malicious parties.

    [...]

    The NSA didn't immediately respond to a request for comment. But this isn't the first US intelligence agency whose tools have been leaked to the public. Just last month, WikiLeaks released techniques it claimed the CIA used for breaking into phones, computers, cars and smart TVs.

  • Leaked NSA point-and-pwn hack tools menace Win2k to Windows 8

    The Shadow Brokers have leaked more hacking tools stolen from the NSA's Equation Group – this time four-year-old exploits that attempt to hijack venerable Windows systems, from Windows 2000 up to Server 2012 and Windows 7 and 8.

    The toolkit puts into anyone's hands – from moronic script kiddies to hardened crims – highly classified nation-state-level weaponry that can potentially compromise and commandeer systems around the world. This is the same powerful toolkit Uncle Sam used once upon a time to hack into and secretly snoop on foreign governments, telcos, banks, and other organizations.

  • Microsoft blocks Kaby Lake and Ryzen PCs from Windows 7, 8 updates

    That means all updates, including security updates, will be unavailable on PCs with brand new hardware running the two older operating systems.

  • Microsoft says U.S. foreign intelligence surveillance requests more than doubled

    Microsoft said it received between 1,000 and 1,499 FISA orders for user content between January and June of 2016, compared to between 0 and 499 during both January-June 2015 as well as the second half of 2015.> Microsoft Corp (MSFT.O) said on Thursday it had received at least a thousand surveillance requests from the U.S. government that sought user content for foreign intelligence purposes during the first half of 2016.

Capsule8 Building Container-Aware Security Platform for Linux

Filed under
Linux
Security

Security startup Capsule8 emerged from its stealth mode in February with a plan to help provide a new model for application container security. In a video interview with eWEEK, Capsule8 CTO Dino Dai Zovi and CEO John Viega explain what's missing from container security today and what they are building to help fill the gap.

"Capsule8 is container-aware, real-time threat protection for Linux-based production environments," Dai Zovi said.

Dai Zovi explained that the company name Capsule8 is a pun on what it does—which is encapsulates security knowledge in software, providing a secure approach to application delivery and deployment.

Read more

An Important Linux Kernel Security Patch Is Available for CentOS 7, Update Now

Filed under
Linux
Red Hat
Security

CentOS maintainer Johnny Hughes has informed the community about the availability of yet another important kernel security update, this time for users of the CentOS Linux 7 operating system series.

Read more

Big Linux bug, low security concerns

Filed under
Linux
Security

This Linux/Android bug sure sounded bad.

The National Institute of Standards and Technology (NIST) and Symantec announced a LinuxKernel ipv4/udp.c bug that made the LinuxKernel 4.4 and earlier vulnerable to remote code-execution. In turn, an attacker could exploit this issue to execute arbitrary code. Worse still, even failed exploits might cause denial-of-service attacks.

There's only one problem with this analysis and the resulting uproar: It's wrong.

Yes, the bug existed. NIST described it as a "critical" bug, and its description makes it sound like it can open Linux and Android-powered devices to attacks via UDP network traffic. The important phrase is "sound like."

Read more

Long Term Support and Security

Filed under
Security
  • Freexian’s report about Debian Long Term Support, March 2017

    Like each month, here comes a report about the work of paid contributors to Debian LTS.

  • Unpatched vulnerability exposes Magento online shops to hacking

    An unpatched vulnerability in the Magento e-commerce platform could allow hackers to upload and execute malicious code on web servers that host online shops.

    The flaw was discovered by researchers from security consultancy DefenseCode and is located in a feature that retrieves preview images for videos hosted on Vimeo. Such videos can be added to product listings in Magento.

    The DefenseCode researchers determined that if the image URL points to a different file, for example a PHP script, Magento will download the file in order to validate it. If the file is not an image, the platform will return a "Disallowed file type" error, but won't actually remove it from the server.

  • NSA's arsenal of Windows hacking tools have leaked

    A new trove of alleged surveillance tools and exploits from the National Security Agency's elite hacking team have been released by the Shadow Brokers' hacking group.

    The group Friday appeared to release tools designed to target Windows PCs and servers, along with presentations and files purporting to detail the agency's methods of carrying out clandestine surveillance.

Security Leftovers

Filed under
Security

Security Leftovers

Filed under
Security
  • Is this a Ubuntu-based Botnet deploying Tor Relays and Bridges?
  • Microsoft Word 0-day was actively exploited by strange bedfellows

    A critical Microsoft Word zero-day that was actively exploited for months connected two strange bedfellows, including government-sponsored hackers spying on Russian targets and financially motivated crooks pushing crimeware.

  • Microsoft reduces Patch Tuesday to an incomprehensible mess
  • Nation-State Hackers Go Open Source [Ed: How to associate FOSS with crime? Hmmm… let us think. Our writer Kelly Jackson Higgins can take care of that…]

    Researchers who track nation-state groups say open-source hacking tools increasingly are becoming part of the APT attack arsenal.

    Nation-state hacking teams increasingly are employing open-source software tools in their cyber espionage and other attack campaigns.

  • New release: usbguard-0.7.0

    From all the bug fixes in this release, I’d like to point out one which required a backwards incompatible change and requires an update to existing policies. The Linux USB root hub devices use the kernel version as the bcdDevice attribute value. The value is part of the USB descriptor data which USBGuard uses for computing the device hash and therefore causes the device hash to change on every kernel update. This in turn makes USBGuard rules which rely on this hash to not match and block the device. And because it’s a root hub device that gets blocked, all the other devices get blocked too. The bug fix is simple, reset the bcdDevice value to zero before hashing (applied only for the Linux root hub devices).

Security Leftovers

Filed under
Security
  • Why creating an open-source ecosystem doesn’t mean you’re taking on security risks

    Anyone who uses technology benefits from open-source software. Most applications you use have implemented open-source code to varying degrees. This isn’t just small-time developers that use this code, either. Many large enterprises rely on this software to build their own products and solutions.

    Because of this, any CIO would be wise to have their developers follow the same blueprint. However, some developers have concerns about open-source. In an open environment where any contributor can drop potentially harmful code into the global library, is it safe — or wise — to lean heavily on these development resources?

  • Security updates for Wednesday
  • 9 Ways to Harden Your Linux Workstation After Distro Installation

    So far in this series, we’ve walked through security considerations for your SysAdmin workstation from choosing the right hardware and Linux distribution, to setting up a secure pre-boot environment and distro installation. Now it’s time to cover post-installation hardening.

Tor Security for Android and Desktop Linux

Filed under
Android
Linux
Security

Internet service providers in the United States have just been given the green light to sell usage history of their subscribers by S J Res 34, opening the gates for private subscriber data to become public. The law appears to direct ISPs to provide an "opt-out" mechanism for subscribers to retain private control of their usage history, which every subscriber should complete.

Read more

GnuTLS and reproducible builds

Filed under
GNU
Security
  • [Older] Improving by simplifying the GnuTLS PRNG

    One of the most unwanted baggages for crypto implementations written prior to this decade is the (pseudo-)random generator, or simply PRNG. Speaking for GnuTLS, the random generator was written at a time where devices like /dev/urandom did not come by default on widely used operating systems, and even if they did, they were not universally available, e.g., devices would not be present, the Entropy Gathering Daemon (EGD) was something that was actually used in practice, and was common for software libraries like libgcrypt to include code to gather entropy on a system by running arbitrary command line tools.

  • [Older] GNUtls: GnuTLS 3.5.10

    Released GnuTLS 3.5.11 which is a bug fix release in the stable branch.

  • [Older] Practical basics of reproducible builds

    One issue though: people have to trust me -- and my computer's integrity.
    Reproducible builds could address that.

    My release process is tightly controlled, but is my project reproducible? If not, what do I need? Let's check!

  • [Older] Practical basics of reproducible builds 2
Syndicate content

More in Tux Machines

10 Reasons Why I Switched To Telegram Messenger

Whatsapp may be the best player in the game when it comes to instant messaging apps, but Telegram Messenger is the entire game itself. Read
more

How To Install Wine And Run Windows Apps In Linux

​All kinds of software are currently available on Linux but every now and then, there is that Windows software or Game which is not available or has no equivalent on Linux Wine makes it possible to run those Windows programs and Games on your Linux desktop. So let’s look at how to install Wine on Linux and run Windows apps on Linux desktop. Read
more

OSS Leftovers

Today in Techrights