Language Selection

English French German Italian Portuguese Spanish

Security

Security: Google, Vulnerabilities Equities Process (VEP), Quad9 and More

Filed under
Security
  • Google investigators find hackers swipe nearly 250,000 passwords a week

    Hackers are constantly trying to break into Google accounts, so Google researchers spent a year tracing how hackers steal passwords and expose them on the internet's black market.

    To gather hard evidence about the tools hackers use to swipe passwords, Google collaborated with University of California Berkeley cybersecurity experts to track activity on some of these markets. On Thursday, they published their results.

  • Time Will Tell if the New Vulnerabilities Equities Process Is a Step Forward for Transparency

    The White House has released a new and apparently improved Vulnerabilities Equities Process (VEP), showing signs that there will be more transparency into the government’s knowledge and use of zero day vulnerabilities. In recent years, the U.S. intelligence community has faced questions about whether it “stockpiles” vulnerabilities rather than disclosing them to affected companies or organizations, and this scrutiny has only ramped up after groups like the Shadow Brokers have leaked powerful government exploits. According to White House Cybersecurity Coordinator Rob Joyce, the form of yesterday’s release and the revised policy itself are intended to highlight the government’s commitment to transparency because it’s “the right thing to do.”

  • Security updates for Friday
  • Quad9 Secure DNS Service Embeds IBM Security Intelligence
  • New “Quad9” DNS service blocks malicious domains for everyone

    The Global Cyber Alliance (GCA)—an organization founded by law enforcement and research organizations to help reduce cyber-crime—has partnered with IBM and Packet Clearing House to launch a free public Domain Name Service system. That system is intended to block domains associated with botnets, phishing attacks, and other malicious Internet hosts—primarily targeted at organizations that don't run their own DNS blacklisting and whitelisting services. Called Quad9 (after the 9.9.9.9 Internet Protocol address the service has obtained), the service works like any other public DNS server (such as Google's), except that it won't return name resolutions for sites that are identified via threat feeds the service aggregates daily.

  • The Internet of Shit is so manifestly insecure that people are staying away from it in droves
  • Security updates for Thursday
  • [Ubuntu] Security Team Weekly Summary: November 16, 2017
  • Hacking Blockchain with Smart Contracts to Control a Botnet

    Blockchain has been hailed by some in the technology industry as a potential method to help improve cyber security. However, security researcher Majid Malaika warns that Blockchain can potentially be abused to enable a new form of botnet that would be very difficult to take down.

    Malaika detailed his Blockchain-powered botnet in a session at the SecTor security conference on Nov. 15. The overall attack method has been dubbed "Botract" by Malaika, as it abuses inherent functionality in the smart contracts that help to enable Blockchain.

  • What Can The Philosophy of Unix Teach Us About Security?

Security: Boeing 757, Security Education Companion, Kaspersky 'Damage Control' and FUD

Filed under
Security

Security: Jobs, Linux 4.14, Bruce Schneier, Spyhunter

Filed under
Security
  • Security updates for Wednesday
  • Security Jobs Are Hot: Get Trained and Get Noticed

    The demand for security professionals is real. On Dice.com, 15 percent of the more than 75K jobs are security positions. “Every year in the U.S., 40,000 jobs for information security analysts go unfilled, and employers are struggling to fill 200,000 other cyber-security related roles, according to cyber security data tool CyberSeek” (Forbes). We know that there is a fast-increasing need for security specialists, but that the interest level is low.

  • security things in Linux v4.14
  • Schneier: It's Time to Regulate IoT to Improve Cyber-Security

    The time has come for the U.S. government and other governments around the world, to start regulating Internet of Things (IoT) security, according to Bruce Schneier, CTO of IBM's Resilient Systems.

    Schneier delivered his message during a keynote address at the SecTor security conference here. He noted that today everything is basically a computer, whether it's a car, a watch, a phone or a television. IoT today has several parts including sensors that collect data, computing power to figure out what to do with the collected data and then actuators that affect the real world.

  • Shady Anti-Spyware Developer Loses Lawsuit Against Competitor Who Flagged Its Software As Malicious

    Enigma Software makes Spyhunter, a malware-fighting program with a very questionable reputation. But the company isn't known so much for containing threats as it's known for issuing threats. It sued a review site for having the audacity to suggest its pay-to-clean anti-spyware software wasn't a good fit for most users… or really any users at all.

    Bleeping Computer found itself served with a defamation lawsuit for making fact-based claims (with links to supporting evidence) about Enigma's dubious product, dubious customer service tactics (like the always-popular "auto-renew"), and dubious lawsuits. Somehow, this dubious lawsuit managed to survive a motion to dismiss. Fortunately, Bleeping Computer was propped up by Malwarebytes' developers, who tossed $5,000 into Bleeping Computer's legal defense fund.

Security Leftovers

Filed under
Security
  • Survey of bug bounty hunters shows who pans for pwns

    Asking the crowd for help in fixing security problems is going mainstream. Microsoft, Facebook, and other tech giants have offered "bug bounties"—cash rewards or other prizes and recognition—to individuals discovering vulnerabilities in their products for years. (Ars even made it onto Google's security wall of fame in 2014 for reporting a Google search bug, though we didn't get a cash payout.)

  • Mother-Son Duo Fools iPhone X Face ID Like It’s No Big Deal

    Uploaded by Attaullah Malik on YouTube, the 41-second clip shows his 10-year-old son unlocking Face ID on an iPhone X which was configured to accept the mother’s face.

  • Watch a 10-Year-Old's Face Unlock His Mom's iPhone X

     

    Malik offered to let Ammar look at his phone instead, but the boy picked up his mother's, not knowing which was which. And a split second after he looked at it, the phone unlocked.

  • This 10-year-old was able to unlock his mom’s iPhone using Face ID

     

    Although Apple says Face ID is more secure than Touch ID, this raises questions about the possibility of false positives not only happening with twins and siblings around the same age, but with people of different sexes and significantly different ages. It is possible that the son’s age played a role as Apple has said that the “undeveloped facial features” in those under the age of 13 could cause issues with Face ID.

  • Safety alert: see how easy it is for almost anyone to hack [sic] your child’s connected toys

    Watch our video below to see just how easy it is for anyone to take over the voice control of a popular connected toy, and speak directly to your child through it. And we’re not talking professional hackers [sic]. It’s easy enough for almost anyone to do.

  • Trump administation to release rules on disclosure of cybersecurity flaws: NSA

    The Trump administration is expected to publicly release on 15 November its rules for deciding whether to disclose cybersecurity flaws or keep them secret, a national security official told Reuters.

Tails 3.3 is out

Filed under
Security
Debian

This release fixes many security issues and users should upgrade as soon as possible.

Read more

Security: USB Bugs, OnePlus 'Back Door', and ME 'Back Door'

Filed under
Security

Security: Kaspersky in the UK and Apple's Face ID

Filed under
Security

Security: Kaspersky, Shadow Brokers, Core Infrastructure Initiative, Face ID

Filed under
Security
  • The Daily Mail whisks up Kaspersky fears - but where's the meat?

    Make a note. Whenever you see the Daily Mail publish a headline which asks a question, the correct answer is invariably "no". If they had any reason to believe it was "yes", then they wouldn't have posed it as a question.

    The truth is that newspapers post these "Is the Loch Ness Monster on Tinder?"-style headlines because they know they'll get more clicks than if they use a headline which reflects the actual conclusion of the article.

  • NSA Cyber Weapons Turned Against Them in Hack

    A hack on the National Security Agency, claimed by a group called the “Shadow Brokers,” has caused a chilling effect on agency staffers, as they wonder whether it was a foreign hacker or someone on the inside.

  • Why the cybersecurity industry should care about Open Source maintenance

    In June of this year, Thales eSecurity joined the Core Infrastructure Initiative (CII), a project both founded and managed by The Linux Foundation, with the aim of collaboratively enhancing and strengthening the security and resilience of critical Open Source projects. Many of the world’s largest technology companies already belong to the CII, with Thales being officially recognised as the first global security firm to join the initiative.

  • You Can Easily Beat iPhone X Face ID Using This 3D-Printed Mask

    When it launched the iPhone X, Apple said that the company has worked with professional mask makers and Hollywood makeup artists. It was to make sure their facial recognition tech doesn’t fail when someone attempts to beat it.

Security: Proprietary Software and Microsoft's Back Doors

Filed under
Microsoft
Security
  • Hackers Can Use Your Antivirus Software To Spread Malware [Ed: Crackers can use just about any proprietary software to spread other (even more malicious) proprietary software]
  • NYT: NSA Spy Units Forced to 'Start Over' After Leaks, Hacks
  • Media: homeland security USA “shocked” by the data theft [Ed: "shocked" by impact of its own collusion with Microsoft]
  • Report: NSA Hunts for Moles Amid Crippling Information Leaks

    The National Security Agency has spent more than a year investigating a series of catastrophic breaches and has yet to determine whether it’s fighting foreign hackers or a mole inside the agency, The New York Times reports. At the center of the saga is a mysterious group called the Shadow Brokers, which has been taunting the agency with periodic dumps of secret code online—leaks that employees say are much more damaging to national security than the information leaked by former NSA contractor Edward Snowden. Some of the stolen code has been used in global malware attacks such as the WannaCry cyberattack, which crippled hospitals and government institutions across the world. Current and former employees have described a mole hunt inside the agency, with some employees reportedly asked to hand over their passports and undergo questioning. Yet investigators still don’t know who the culprits are, be it an insider who stole an entire thumb drive of sensitive code, or a group of Russian hackers—for some, the prime suspects—who managed to breach NSA defenses. “How much longer are the releases going to come?” one former employee was cited as saying. “The agency doesn’t know how to stop it—or even what ‘it’ is.”

pfSense: Not Linux, Not Bad

Filed under
Security
BSD

Through the years, I've used all sorts of router and firewall solutions at home and at work. For home networks, I usually recommend something like DD-WRT, OpenWRT or Tomato on an off-the-shelf router. For business, my recommendations typically are something like a Ubiquiti router or a router/firewall solution like Untangled or ClearOS. A few years ago, however, a coworker suggested I try pfSense instead of a Linux-based solution. I was hesitant, but I have to admit, pfSense with its BSD core is a rock-solid performer that I've used over and over at multiple sites.

Read more

Syndicate content

More in Tux Machines

Red Hat News

  • An Open Source Load Balancer for OpenShift
    A highly-available deployment of OpenShift needs at least two load balancers: One to load balance the control plane (the master API endpoints) and one for the data plane (the application routers). In most on-premise deployments, we use appliance-based load balancers (such as F5 or Netscaler).
  • Red Hat Beefs Up Platform as a Service Suite
    Red Hat has begun shipping Red Hat Fuse 7, the next major release of its distributed, cloud-native integration solution, and introduced a new fully hosted low-code integration platform as a service (iPaaS) offering, Fuse Online. With Fuse 7, the vendor says expanding its integration capabilities natively to Red Hat OpenShift Container Platform, an enterprise Kubernetes platform. Fuse gives customers a unified solution for creating, extending and deploying containerized integration services across hybrid cloud environments.
  • Red Hat ‘Fuses’ Low Code Development and Data Integration
    Red Hat, a provider of open source solutions, has announced Red Hat Fuse 7, the next major release of its distributed, cloud-native integration solution, and introduced a new fully hosted low-code integration platform as a service offering, Fuse Online. With Fuse 7, Red Hat is expanding its integration capabilities natively to Red Hat OpenShift Container Platform, a comprehensive enterprise Kubernetes platform. Fuse gives customers a unified solution for creating, extending and deploying containerized integration services across hybrid cloud environments.
  • The GPL cooperation commitment and Red Hat projects
    As of today, all new Red Hat-initiated open source projects that opt to use GPLv2 or LGPLv2.1 will be expected to supplement the license with the cure commitment language of GPLv3. The cure language will live in a file in the project source tree and will function as an additional permission extended to users from the start. This is the latest development in an ongoing initiative within the open source community to promote predictability and stability in enforcement of GPL-family licenses. The “automatic termination” provision in GPLv2 and LGPLv2.x is often interpreted as terminating the license upon noncompliance without a grace period or other opportunity to correct the error in compliance. When the Free Software Foundation released GPLv2 in 1991, it held nearly all GPL-licensed copyrights, in part a consequence of the copyright assignment policy then in place for GNU project contributions. Long after the Linux kernel and many other non-GNU projects began to adopt the GPL and LGPL, the FSF was still the only copyright holder regularly engaged in license enforcement. Under those conditions, the automatic termination feature of GPLv2 section 4 may have seemed an appropriate means of encouraging license compliance.
  • Monness Believes Red Hat (NYSE: RHT) Still Has Room to Grow
  • Comparing Red Hat (RHT) & Autoweb (AUTO)
  • As Red Hat (RHT) Share Value Rose, Calamos Advisors Upped Its Position by $300,831; Chilton Capital Management Increases Stake in Equinix (EQIX)
  • Blair William & Co. IL Buys 23,279 Shares of Red Hat Inc (RHT)

Total War: WARHAMMER

Red Hat changes its open-source licensing rules

From outside programming circles, software licensing may not seem important. In open-source, though, licensing is all important. So, when leading Linux company Red Hat announces that -- from here on out -- all new Red Hat-initiated open-source projects that use the GNU General Public License(GPLv2) or GNU Lesser General Public License (LGPL)v2.1 licenses will be expected to supplement the license with GPL version 3 (GPLv3)'s cure commitment language, it's a big deal. Read more

Android Leftovers