Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security

Security News

Filed under
Security
  • Two Million Passwords Breached in Ubuntu Hack
  • VBulletin flaw exploited in breach of Ubuntu Forums

    A known SQL injection vulnerability affecting vBulletin software was exploited by an attacker to breach the Ubuntu Forums database.

  • Ubuntu Forums data breach exposes 2 million users

    Ubuntu aficionados beware, as a data breach of the Ubuntu Forum has resulted in the leak of information for two million users. It should be noted that the breach has not hit Canonical Ltd., which runs the Ubuntu operating system, but rather the forum, so other services are still safe.

    The notice from Canonical explains that the breach was made possible through an SQL injection vulnerability in the forum’s Forumrunner add-on, which had not been patched. By injecting certain formatted SQL into the forum database, the hacker could then reach any table, particularly the “user” table.

  • Ubuntu Forum Hack Exposes 2 Million Users

    Ubuntu Linux developer Canonical has confirmed that a data breach exposed personal information of two million users of its forum.

  • How to scam $750,000 out of Microsoft Office: Two-factor auth calls to premium-rate numbers

    Gaming two-factor authentication systems with premium rate phone numbers can be very profitable – or it was until the flaws got reported.

    Belgian security researcher Arne Swinnen noticed that the authentication systems used by Facebook-owned Instagram, Google and Microsoft allow access tokens to be received by a voice call as well as a text message. By linking accounts to a premium-rate phone number he controlled and could pocket money from, he was able to scam the three companies out of cash – in some cases potentially thousands of dollars a day.

  • How Do Hackers Easily Crack Your Strongest Passwords — Explained
  • Security Skills Give Open Source Professionals a Career Advantage

    In today’s market, open source professionals with security expertise are crucial players on an employer roster. The growing use of cloud and big data, as well as the overhaul and expansion of many companies’ tech infrastructures, are driving the demand and need for professionals with this skillset.

    According to the 2016 Open Source Jobs Report, 14 percent of hiring managers and recruiters surveyed believe security to be the most important open source skill to date, ranking third just behind cloud technologies (51 percent) and networking (21 percent). Employers aren’t the only ones that see the value in security; 16 percent of open source professionals surveyed cited security as the most important open source skill and the biggest driver for open source growth in 2016.

  • AT&T Unveils Powerful New Security Platform

    AT&T this week unveiled a new powerful security platform, using big data analysis based on a Hadoop architecture which allows the company to ingest and analyze 5 billion security events in less than ten minutes.

  • Software security: Does quality provide a blueprint for change?

    Software security has been in the news a lot lately, between various high profile social media hacks to massive data breaches it feels like people in the industry are always talking about security, or more appropriately, the lack thereof. While having a conversation with somebody from my company’s internal security team a few weeks ago I had a bit of an epiphany: security in 2016 is much like quality was in 1999.

    Let’s think back 17 years and remember what the quality process was like in 1999. Code was written in rather monolithic chunks with very little thought (if any) given to how that code was to be tested. Testers were on completely separate teams, often times denied access to early versions of the software and code. Testers would write massive sets of test cases from technical specifications and would accept large drops of code from developers only after a feature was considered completed. Automation was either a pipe dream or only existed for very stable features that had been around for a while. A manual testing blitz would then kick off, bugs would be filed, work thrown back over the wall, rinse and repeat. After several of these cycles it was the testers job to give a go/no-go on whether the product was good enough to ship, essentially acting as gatekeepers.

  • As a blockchain-based project teeters, questions about the technology’s security

    There’s no shortage of futurists, industry analysts, entrepreneurs and IT columnists who in the past year have churned out reports, articles and books touting blockchain-based ledgers as the next technology that will run the world.

    In the middle of all this hype is a small fire that threatens to put some of those words to ash: The hijacking last month of around US$40 million of dollars worth of a cryptocurrency called ether – named after its blockchain platform, Ethereum — from The DAO, a crowd-sourced investment vehicle that has so far raised over US$100 million in the digital currency. Instead, the DAO has become paralyzed and on the verge of collapse.

  • Sandia Labs Researchers Build DNA-Based Encrypted Storage

    Researchers at Sandia National Laboratories in New Mexico are experimenting with encrypted DNA storage for archival applications.

    Husband and wife team George and Marlene Bachand are biological engineers with a remarkable vision of the future.

    The researchers at the Sandia National Laboratories Center for Integrated Nanotechnologies foresee a time when a speck of DNA on a piece of paper the size of a millimeter could securely store the entire anthology of Shakespeare’s works.

Canonical and Proprietary Forums Software (Again Cracked)

Filed under
Security
Ubuntu

Security News

Filed under
Security
  • Ubuntu user forums hack leaks millions of user details [Ed: Canonical continued using proprietary software that had already been breached, now gives GNU/Linux a bad name again. Many journalists out there cannot tell the difference between operating system and forums software, never mind proprietary and Free software. How many so-called "technology" journalists still say "commercial" software instead of proprietary software, as if FOSS is non-commercial?]

    Attacker took advantage of unpatched software.

    Canonical, the parent company of popular Linux distribution Ubuntu, has disclosed that its user web forums have suffered a major data breach.

    Over the weekend, Canonical said that it had come across claims that a third party had a copy of the Ubuntu Forums database.

    The company was able to verify that a breach had taken place, with a database containing details of two million Ubuntu Forums users being leaked.

  • As Open Source Code Spreads, So Do Components with Security Flaws[Ef: Catalin Cimpanu's headline would have us believe that proprietary software has no "Security Flaws", only FOSS]

    The company that provides hosting services for the Maven Central Repository says that one in sixteen downloads is for a Java component that contains a known security flaw.

  • OpenSSH has user enumeration bug

    A bug in OpenSSH allows an attacker to check whether user names are valid on a 'net-facing server - because the Blowfish algorithm runs faster than SHA256/SHA512.

    The bug hasn't been fixed yet, but in his post to Full Disclosure, Verint developer Eddie Harari says OpenSSH developer Darren Tucker knows about the issue and is working to address it.

    If you send a user ID to an OpenSSH server with a long (but wrong) password – 10 kilobytes is what Harari mentions in his post – then the server will respond quickly for fake users, but slower for real users.

Security News

Filed under
Security
  • Microsoft’s Windows RT security patch also stops you from loading Linux

    It was big news when Microsoft announced it was working on a version of Windows that would run on tablets with ARM-based processors… but by the time Windows RT actually launched it was a lot less exciting. Devices like the Microsoft Surface and Surface 2 couldn’t run desktop Windows apps and weren’t significantly cheaper than Intel Atom-powered tablets running the full version of Windows, and they didn’t even get better battery life.

  • The sad state of Linux download security

    Installation images for many of the most popular Linux distributions are difficult or impossible to obtain securely via download.

  • Why we use the Linux kernel's TCP stack

    Let's start with a broader question - what is the point of running an operating system at all? If you planned on running a single application, having to use a kernel consisting of multiple million lines of code may sound like a burden.

    But in fact most of us decide to run some kind of OS and we do that for two reasons. Firstly, the OS layer adds hardware independence and easy to use APIs. With these we can focus on writing the code for any machine - not only the specialized hardware we have at the moment. Secondly, the OS adds a time sharing layer. This allows us to run more than one application at a time. Whether it's a second HTTP server or just a bash session, this ability to share resources between multiple processes is critical. All of the resources exposed by the kernel can be shared between multiple processes!

    [...]

    Having said that, at CloudFlare we do use kernel bypass. We are in the second group - we care about performance. More specifically we suffer from IRQ storms. The Linux networking stack has a limit on how many packets per second it can handle. When the limit is reached all CPUs become busy just receiving packets. In that case either the packets are dropped or the applications are starved of CPU. While we don't have to deal with IRQ storms during our normal operation, this does happen when we are the target of an L3 (layer 3 OSI) DDoS attack. This is a type of attack where the target is flooded with arbitrary packets not belonging to valid connections - typically spoofed packets.

Security Leftovers

Filed under
Security
  • Notice of security breach on Ubuntu Forums [Ed: this is proprietary software on top of proprietary software. Shame!]

    Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched.

  • Ubuntu Forums Hacked! Here Is What Hacker Stole?
  • ChaosKey

    The Linux Kernel, starting with version 4.1, includes source for this driver. It should be built by default in your distribution. If your using Linux + KVM to host other Linux instances, read the VirtualMachine page to see how you can configure the guests to share the host entropy source.

Security Leftovers

Filed under
Security
  • Friday's security updates
  • Room for Application Security Improvement

    Using open source components is a common software development process; just how common, however, may come as a surprise -- even a shock -- to some. The average organization uses 229,000 open source components a year, found research by Sonatype, a provider of software development lifecycle solutions that manages a Central Repository of these components for the Java development community.

    There were 31 billion requests for downloads from the repository in 2015, up from 17 billion in 2014, according to Sonatype.

    The number "blows people's minds," said Derek Weeks, a VP and DevOps advocate at Sonatype. "The perspective of the application security professional or DevOps security professional or open source governance professional is, 'This really changes the game. If it were 100, I could control that, but if it is 200,000 the world has changed."

  • Ubuntu Forums Suffer Data breach; Credit Goes to SQL Flaw

Ubuntu Forums Cracked. Again.

Filed under
Security
Ubuntu

Security Leftovers

Filed under
Security

Canonical Patches Linux Kernel Vulnerability in All Supported Ubuntu OSes

Filed under
Security
Ubuntu

Today, July 14, 2016, Canonical published multiple security notices to inform users of the Ubuntu 16.04 LTS (Xenial Xerus), Ubuntu 14.04 LTS (Trusty Tahr) and Ubuntu 15.10 (Wily Werewolf) operating systems about the availability of a new kernel update.

Read more

Syndicate content

More in Tux Machines

Android Leftovers

Leftovers: OSS

  • Open-source oriented RISELab emerges at UC Berkeley to make apps smarter & more secure
    UC Berkeley on Monday launched a five-year research collaborative dubbed RISELab that will focus on enabling apps and machines that can interact with the environment around them securely and in real-time. The RISELab (Real-time Intelligence with Secure Execution) is backed by a slew of big name tech and financial firms: Amazon Web Services, Ant Financial, Capital One, Ericsson, GE Digital, Google, Huawei, Intel, IBM, Microsoft and VMWare.
  • Telecom organizations boosting support for open source
    Organizational support for open source initiatives is easing the integration of platforms into the telecom world. One key challenge for growing the support of open source into the telecommunications space is through various organizations that are looking to either bolster the use of open source or build platforms based on open source specifications. These efforts are seen as beneficial to operators and vendors looking to take advantage of open source platforms.
  • Google's Draco: Another Open Source Tool That Can Boost Virtual Reality Apps
    With 2017 ramping up, there is no doubt that cloud computing and Big Data analytics would probably come to mind if you had to consider the hot technology categories that will spread out this year. However, Google is on an absolute tear as it open sources a series of 3D graphics and virtual reality toolsets. Last week, we covered the arrival of Google's Tilt Brush apps and virtual reality toolsets. Now, Google has delivered a set of open source libraries that boost the storage and transmission of 3D graphics, which can help deliver more detailed 3D apps. "Draco" is an open source compression library, and here are more details.
  • Unpicking the community leader
    Today is Community Manager Appreciation Day. Now, I have to admit, I don't usually partake in the day all that much. The skeptic in me thinks doing so could be a little self-indulgent and the optimist thinks that we should appreciate great community leaders every day, not merely one day a year. Regardless, in respect of the occasion, I want to delve a little into why I think this work is so important, particularly in the way it empowers people from all walks of life. In 2006 I joined Canonical as the Ubuntu Community Manager. A few months into my new role I got an email from a kid based in Africa. He shared with me that he loved Ubuntu and the traditional African philosophy of Ubuntu, which translated to "humanity towards others," and this made his interest in the nascent Linux operating system particularly meaningful.
  • Open Source Mahara Opens Moodle Further Into Social Learning
    Designers, managers and other professionals are fond of Open Source, digital portfolio solution Mahara. Even students are incorporating their progress on specific competency frameworks, to show learning evidence. Mahara and Moodle have a long and durable relationship spanning years, ―so much so that the internet has nicknamed the super couple as “Mahoodle“―. A recent post on Moodlerooms’ E-Learn Magazine documents the fruitful partnership as it adds value to New Zealander Catalyst IT’s offerings.
  • U.S. policy on open source software carries IP risks [Ed: Latest FUD from law firm against Free software as if proprietary software is risk-free licensing-wise?]

Openwashing and EEE

Q&A with Arpit Joshipura, Head of Networking for The Linux Foundation

Arpit Joshipura became the Linux Foundation’s new general manager for networking and orchestration in December 2016. He’s tasked with a pretty tall order. He needs to harmonize all the different Linux Foundation open source groups that are working on aspects of network virtualization. Joshipura may be the right person for the job as his 30 years of experience is broad — ranging from engineering, to management, to chief marketing officer (CMO) roles. Most recently he was VP of marketing with Prevoty, an application security company. Prior to that he served as VP of marketing at Dell after the company acquired Force10 Networks, where he had been CMO. Read more