Language Selection

English French German Italian Portuguese Spanish


Security Leftovers

Filed under
  • Flaw-finding Ruby on Rails bot steams past humans
  • Future of secure systems in the US

    Security and privacy are important to many people. Given the personal and financial importance of data stored in computers (traditional or mobile), users don’t want criminals to get a hold of it. Companies know this, which is why both Apple IOS and Google Android both encrypt their local file systems by default now. If a bill anything like what’s been proposed becomes law, users that care about security are going to go elsewhere. That may end up being non-US companies’ products or US companies may shift operations to localities more friendly to secure design. Either way, the US tech sector loses. A more accurate title would have been Technology Jobs Off-Shoring Act of 2016.

  • Software end of life matters!

    Anytime you work on a software project, the big events are always new releases. We love to get our update and see what sort of new and exciting things have been added. New versions are exciting, they're the result of months or years of hard work. Who doesn't love to talk about the new cool things going on?

  • JBOSS Backdoor opens 3 million servers at risk of attacks

Security Leftovers

Filed under
  • Backdoor in JBoss Java Platform Puts 3.2 Million Servers at Risk
  • Let's Encrypt: threat or opportunity to other certificate authorities?

    Let's Encrypt is a certificate authority (CA) that just left beta stage, that provides domain name-validated (DV) X.509 certificates for free and in an automated way: users just have to run a piece of software on their server to get and install a certificate, resulting in a valid TLS setup.

  • Making it easier to deploy TPMTOTP on non-EFI systems

    On EFI systems you can handle this by sticking the secret in an EFI variable (there's some special-casing in the code to deal with the additional metadata on the front of things you read out of efivarfs). But that's not terribly useful if you're not on an EFI system. Thankfully, there's a way around this. TPMs have a small quantity of nvram built into them, so we can stick the secret there. If you pass the -n argument to sealdata, that'll happen. The unseal apps will attempt to pull the secret out of nvram before falling back to looking for a file, so things should just magically work.

  • Badlock Vulnerability Falls Flat Against Its Hype

    Weeks of anxiety and concern over the Badlock vulnerability ended today with an anticlimactic thud.

  • Samba 4.4.2, 4.3.8 and 4.2.11 Security Releases Available for Download
  • The Internet of bricks

    One of the promises of the "Internet of things" is that it gives us greater control over our homes, gadgets, and more. Free software also offers that sort of promise, along with the idea that, if necessary, we can support our own gadgetry when the manufacturer moves on to some new shiny object. The currently unfolding story of the Revolv hub shows that, in many cases, these promises are empty. The devices we depend on and think we own can, in fact, be turned into useless bricks at the manufacturer's whim.

    The Revolv "M1" home-automation hub was one of many products designed to bring home control to the Internet. It is able to control lights, heating, and more, all driven by smartphone-based applications. The product was sufficiently successful to catch the eye of the business-development folks at Nest, who acquired the company; Nest was acquired in turn by Google, and is now a separate company under the "Alphabet" umbrella.

  • Underwriters Labs refuses to share new IoT cybersecurity standard

    UL, the 122-year-old safety standards organisation whose various marks (UL, ENEC, etc.) certify minimum safety standards in fields as diverse as electrical wiring, cleaning products, and even dietary supplements, is now tackling the cybersecurity of Internet of Things (IoT) devices with its new UL 2900 certification. But there's a problem: UL's refusal to freely share the text of the new standard with security researchers leaves some experts wondering if UL knows what they're doing.

    When Ars requested a copy of the UL 2900 docs to take a closer look at the standard, UL (formerly known as Underwriters Laboratories) declined, indicating that if we wished to purchase a copy—retail price, around £600/$800 for the full set—we were welcome to do so. Independent security researchers are also, we must assume, welcome to become UL retail customers.

  • Combined malware threat is robbing banks of millions every day

    THE SECURITY attack dogs at IBM have uncovered two normally solo malware threats working together to rob banks in the US and Canada.

    IBM's X-Force division has dubbed the combined malware Stealma and Louise GozNym by merging the names of the individual, but now friendly, Gozi ISFB and Nymaim.

    "It appears that the operators of Nymaim have recompiled its source code with part of the Gozi ISFB source code, creating a combination that is being actively used in attacks against more than 24 US and Canadian banks, stealing millions of dollars so far," said IBM in a blog post.

Security Leftovers

Filed under
  • Security updates for Thursday
  • Badlock: Samba Vulns & Patching your machines

    Unless you are living in a black hole aka SCIF, or otherwise totally disconnected from various news outlets, you have likely heard about the numerous vulns that dropped as a series of CVEs better known as ‘badlock’ Tuesday. Well, there is good news for those on Redhat based distros! Patches are already in the default repos for Fedora / RHEL / CentOS.

  • Gone In Six Characters: Short URLs Considered Harmful for Cloud Services

    TL;DR: short URLs produced by,, and similar services are so short that they can be scanned by brute force. Our scan discovered a large number of Microsoft OneDrive accounts with private documents. Many of these accounts are unlocked and allow anyone to inject malware that will be automatically downloaded to users’ devices. We also discovered many driving directions that reveal sensitive information for identifiable individuals, including their visits to specialized medical facilities, prisons, and adult establishments.

IPFire 2.19 - Core Update 100 released

Filed under

It is a great moment to us and we are very proud to release the 100th Core Update today.

This update will bring you IPFire 2.19 which we release for 64 bit on Intel (x86_64) for the first time. This release was delayed by the various security vulnerabilities in openssl and glibc, but is packed with many improvements under the hood and various bug fixes.

Read more

Security Leftovers

Filed under
  • Apple Bug Exposed Chat History With a Single Click

    IN THE MIDDLE of intense public debate over whether Apple should be forced to help the government decrypt iPhones for criminal investigations, the company quietly closed a six-month-old security vulnerability in its Messages app. Newly published details reveal just how severe that vulnerability was, allowing the exfiltration of chat history, including photos and videos, if the user could be tricked into clicking a single malicious link.

    The bug, which affected Apple’s laptop and desktop computers from September through March, highlights just how hard it is for companies like Apple to effectively secure sensitive data — even before those companies begin fielding requests from the government for special access. Tech companies like Apple are nearly unanimous in their agreement that creating “backdoors” through which the government may access protected data undermines even the most basic security measures, including those designed to protect against vulnerabilities like the Messages bug.

  • New Threat Can Auto-Brick Apple Devices

    If you use an Apple iPhone, iPad or other iDevice, now would be an excellent time to ensure that the machine is running the latest version of Apple’s mobile operating system — version 9.3.1. Failing to do so could expose your devices to automated threats capable of rendering them unresponsive and perhaps forever useless.

  • Execs: We’re not responsible for cybersecurity

    More than 90 percent of corporate executives said they cannot read a cybersecurity report and are not prepared to handle a major attack, according to a new survey.

    More distressing is that 40 percent of executives said they don't feel responsible for the repercussions of hackings, said Dave Damato, chief security officer at Tanium, which commissioned the survey with the Nasdaq.

    "I think the most shocking statistic was really the fact that the individuals at the top of an organization — executives like CEOs and CIOs, and even board members — didn't feel personally responsible for cybersecurity or protecting the customer data," Damato told CNBC's "Squawk Box" on Friday.

  • Brits suffer more than 2,000 ransomware attacks each day

    The security firm said that the enemy is now more organised than ever before, and that most groups have the same kind of resources, skills and support as nation-state hacker groups.

    "Advanced criminal attack groups now echo the skills of nation-state attackers. They have extensive resources and a highly skilled technical staff that operate with such efficiency that they maintain normal business hours and even take the weekends and holidays off," said Kevin Haley, director of Symantec Security Response.

    "We are even seeing low-level criminal attackers create call centre operations to increase the impact of their scams."

    These sophisticated hackers are often the first to embrace zero-day vulnerabilities, which increased by 125 percent in 2015 to 54.

Security Leftovers

Filed under
  • Security advisories for Wednesday
  • Let's Encrypt free security certificate program leaves beta

    Let's Encrypt has announced that the free secure certificate program is leaving beta in its push to encrypt 100 percent of the web.

  • What happened with Badlock?

    Here's the thing though. It wasn't nearly as good as the hype claimed. It probably couldn't ever be as good as the hype claimed. This is like waiting for a new Star Wars movie. You have memories from being a child and watching the first few. They were like magic back then. Nothing that ever comes out again will be as good. Your brain has created ideas and memories that are too amazing to even describe. Nothing can ever beat the reality you built in your mind.

  • Microsoft rated 6 of 13 security updates as critical, Badlock bug fix rated important

    For April 2016 Patch Tuesday, Microsoft released 13 security bulletins, with six being rated as critical for remote code execution flaws and the patch for Badlock being among those rated only as important.

  • Open source runs the world and needs better security, claims Linux Foundation CTO

    Security is the biggest plague of open source software, and more people are needed to work together squashing bugs and plugging holes in the code on which much of the internet relies.

    That’s according to Nicko van Someren, chief technology officer at the Linux Foundation, who explained that huge swathes of the internet and companies with online business models rely on open source code, software and infrastructure.

Security Leftovers

Filed under
  • Linux Foundation: The internet is crumbling

    The open source infrastructure of the internet is crumbling because of poor maintenance, the Linux Foundation warned today.

    Likening open source to the “roads and bridges of the internet”, Linux Foundation CTO Nicko van Someren said that underpaid developers are struggling to patch dangerous bugs and keep the open aspects of the web up to date.

  • Security is the biggest bug of open source, says Linux Foundation CTO

    CYBER SECURITY is the plague of open source software, and more people are needed to work together squashing bugs and plugging holes in the code on which much of the internet relies.

    That’s according to Nicko van Someren, chief technology officer at the Linux Foundation, who explained that huge swathes of the internet and companies with online business models rely on open source code, software and infrastructure.

    "Open source projects are the roads and bridges of the internet. Pretty much everything we do on the internet relies on open source," he said in a keynote speech at Cloud Expo in London.

  • Linux Computers Targeted by New Backdoor and DDoS Trojan

    After being bombarded with new malware towards the end of last year, the Linux ecosystem is rocked again by the discovery of a new trojan family, identified by security researchers as Linux.BackDoor.Xudp.

    The only detail that matters is that this new threat does not leverage automated scripts, vulnerabilities, or brute-force attacks to infect users and still relies on good ol' user stupidity in order to survive.

Security Leftovers

Filed under

pfSense 2.3

Filed under
  • pfSense 2.3-RELEASE Now Available!

    The most significant changes in this release are a rewrite of the webGUI utilizing Bootstrap, and the underlying system, including the base system and kernel, being converted entirely to FreeBSD pkg. The pkg conversion enables us to update pieces of the system individually going forward, rather than the monolithic updates of the past. The webGUI rewrite brings a new responsive look and feel to pfSense requiring a minimum of resizing or scrolling on a wide range of devices from desktop to mobile phones.

  • pfSense 2.3 Released With New Web UI

    BSD --
    PfSense 2.3 was released today as the newest version of this popular FreeBSD-based firewall/router OS appliance software.

    The pfSense 2.3 release has a rewritten web GUI that's now making use of Bootstrap to provide a clean and responsive experience. The pfSense 2.3 release also converts the underlying system now to completely using FreeBSD's pkg for package management, and there are various other underlying updates.

  • pfSense 2.3 BSD-Based Firewall Officially Released with Revamped webGUI, More

    Electric Sheep Fencing LLC., through Chris Buechler, today, April 12, 2016, has had the great pleasure of announcing the release of the stable pfSense 2.3 BSD-based firewall operating system.

Security Leftovers

Filed under
  • Tuesday's security updates
  • Leaving Beta, New Sponsors

    Let’s Encrypt is leaving beta today. We’re also excited to announce that founding sponsors Cisco and Akamai have renewed their Platinum sponsorships with 3-year commitments, Gemalto is joining as our newest Gold sponsor, and HP Enterprise, Fastly, Duda and are our newest Silver sponsors.

  • Mozilla-supported Let’s Encrypt goes out of Beta

    In 2014, Mozilla teamed up with Akamai, Cisco, the Electronic Frontier Foundation, Identrust, and the University of Michigan to found Let’s Encrypt in order to move the Web towards universal encryption. Today, Let’s Encrypt is leaving beta. We here at Mozilla are very proud of Let’s Encrypt reaching this stage of maturity

    Let’s Encrypt is a free, automated and open Web certificate authority that helps make it easy for any Web site to turn on encryption. Let’s Encrypt uses an open protocol called ACME which is being standardized in the IETF. There are already over 40 independent implementations of ACME. Several web hosting services such as Dreamhost and Automattic, who runs, also use ACME to integrate with Let’s Encrypt and provide security that is on by default.

  • Experts crack nasty ransomware that took crypto-extortion to new heights

    A nasty piece of ransomware that took crypto-extortion to new heights contains a fatal weakness that allows victims to decrypt their data without paying the hefty ransom.

    When it came to light two weeks ago, Petya was notable because it targeted a victim's entire startup drive by rendering its master boot record inoperable. It accomplished this by encrypting the master boot file and displaying a ransom note. As a result, without the decryption password, the infected computer wouldn't boot up, and all files on the startup disk were inaccessible. A master boot record is a special type of boot sector at the very beginning of partitioned hard drive, while a master boot file is a file on NTFS volumes that contains the name, size and location of all other files.

  • Open source code is rarely patched when vulnerabilities are found [Ed: propaganda from Microsoft proxies makes it through to other sites]

    Open source code is a convenient and cost-effective way for developers to build apps. However, as CIO noted in a recent article, once that code makes its way into an app, it's rarely ever updated to fix vulnerabilities that are found later. CIO offered up some tips on how to keep open source products secure.

Syndicate content

More in Tux Machines

KNOPPIX 7.7.1 Distro Officially Released with Debian Goodies, Linux Kernel 4.7.9

Believe it or not, Klaus Knopper is still doing his thing with the KNOPPIX GNU/Linux distribution, which was just updated to version 7.7.1 to offer users the latest open source software and technologies. Read more

CentOS 6 Linux Servers Receive Important Kernel Security Patch, Update Now

We reported a couple of days ago that Johnny Hughes from the CentOS Linux team published an important kernel security advisory for users of the CentOS 7 operating system. Read more

Games for GNU/Linux

  • Why GNU/Linux ports can be less performant, a more in-depth answer
    When it comes to data handling, or rather data manipulation, different APIs can perform it in different ways. In one, you might simply be able to modify some memory and all is ok. In another, you might have to point to a copy and say "use that when you can instead and free the original then". This is not a one way is better than the other discussion - it's important only that they require different methods of handling it. Actually, OpenGL can have a lot of different methods, and knowing the "best" way for a particular scenario takes some experience to get right. When dealing with porting a game across though, there may not be a lot of options: the engine does things a certain way, so that way has to be faked if there's no exact translation. Guess what? That can affect OpenGL state, and require re-validation of an entire rendering pipeline, stalling command submission to the GPU, a.k.a less performance than the original game. It's again not really feasible to rip apart an entire game engine and redesign it just for that: take the performance hit and carry on. Note that some decisions are based around _porting_ a game. If one could design from the ground up with OpenGL, then OpenGL would likely give better performance...but it might also be more difficult to develop and test for. So there's a bit of a trade-off there, and most developers are probably going to be concerned with getting it running on Windows first, GNU/Linux second. This includes engine developers.
  • Why Linux games often perform worse than on Windows
    Drivers on Windows are tweaked rather often for specific games. You often see a "Game Ready" (or whatever term they use now) driver from Nvidia and AMD where they often state "increased performance in x game by x%". This happens for most major game releases on Windows. Nvidia and AMD have teams of people to specifically tweak the drivers for games on Windows. Looking at Nvidia specifically, in the last three months they have released six new drivers to improve performance in specific games.
  • Thoughts on 'Stellaris' with the 'Leviathans Story Pack' and latest patch, a better game that still needs work
  • Linux community has been sending their love to Feral Interactive & Aspyr Media
    This is awesome to see, people in the community have sent both Feral Interactive & Aspyr Media some little care packages full of treats. Since Aspyr Media have yet to bring us the new Civilization game, it looks like Linux users have been guilt-tripping the porters into speeding up, or just sending them into a sugar coma.
  • Feral Interactive's Linux ports may come with Vulkan sooner than we thought
  • Using Nvidia's NVENC with OBS Studio makes Linux game recording really great
    I had been meaning to try out Nvidia's NVENC for a while, but I never really bothered as I didn't think it would make such a drastic difference in recording gaming videos, but wow does it ever! I was trying to record a game recently and all other methods I tried made the game performance utterly dive, making it impossible to record it. So I asked for advice and eventually came to this way.

Leftovers: Software

  • DocKnot 1.00
    I'm a bit of a perfectionist about package documentation, and I'm also a huge fan of consistency. As I've slowly accumulated more open source software packages (alas, fewer new ones these days since I have less day-job time to work on them), I've developed a standard format for package documentation files, particularly the README in the package and the web pages I publish. I've iterated on these, tweaking them and messing with them, trying to incorporate all my accumulated wisdom about what information people need.
  • Shotwell moving along
    A new feature that was included is a contrast slider in the enhancement tool, moving on with integrating patches hanging around on Bugzilla for quite some time.
  • GObject and SVG
    GSVG is a project to provide a GObject API, using Vala. It has almost all, with some complementary, interfaces from W3C SVG 1.1 specification. GSVG is LGPL library. It will use GXml as XML engine. SVG 1.1 DOM interfaces relays on W3C DOM, then using GXml is a natural choice. SVG is XML and its DOM interfaces, requires to use Object’s properties and be able to add child DOM Elements; then, we need a new set of classes.
  • LibreOffice 5.1.6 Office Suite Released for Enterprise Deployments with 68 Fixes
    Today, October 27, 2016, we've been informed by The Document Foundation about the general availability of the sixth maintenance update to the LibreOffice 5.1 open-source and cross-platform office suite. You're reading that right, LibreOffice 5.1 got a new update not the current stable LibreOffice 5.2 branch, as The Document Foundation is known to maintain at least to versions of its popular office suite, one that is very well tested and can be used for enterprise deployments and another one that offers the latest technologies.