Language Selection

English French German Italian Portuguese Spanish

Security

Security in Android, Windows

Filed under
Android
Microsoft
Security
  • With Android Oreo, Google is introducing Linux kernel requirements

    Android may be a Linux-based operating system, but the Linux roots are something that few people pay much mind. Regardless of whether it is known or acknowledged by many people, the fact remains that Android is rooted in software regarded as horrendously difficult to use and most-readily associated with the geekier computer users, but also renowned for its security.

  • Exclusive: India and Pakistan hit by spy malware - cybersecurity firm [Ed: When you use Microsoft Windows in government in spite of back doors]

    Symantec Corp, a digital security company, says it has identified a sustained cyber spying campaign, likely state-sponsored, against Indian and Pakistani entities involved in regional security issues.

    In a threat intelligence report that was sent to clients in July, Symantec said the online espionage effort dated back to October 2016. 

    [...]

    Symantec’s report said an investigation into the backdoor showed that it was constantly being modified to provide “additional capabilities” for spying operations.

Security: “Roboto Condensed”, Tor, and TigerSwan

Filed under
Security
  • “Roboto Condensed” Social Engineering Attack Targets Both Chrome and Firefox Users. Various Payloads Being Delivered.
  • [Older] One Week With Tor

    A few people have asked me why I don't trust exit nodes with sensitive tasks like online banking. My distrust is mainly in the horrible state of SSL/TLS PKI. With hundreds of trusted roots, each with SSL/TLS certificate resellers, the amount of trust I must place in the least secure certificate vendor is huge. Any certificate vendor whose chain of trust resolves to a trusted root can issue certificates for any domain I visit. If a malicious exit node also has compromised or coerced a certificate vendor to produce (what we would consider, but our browser wouldn't) fraudulent certificate, I'm now in a pickle.

  • Thousands of mercenary resumés found exposed on Web

    The sensitive personal details of the job applicants, many claiming top-secret security clearance from the US government, were left unsecured by a recruiting company with whom TigerSwan had cut ties in February 2017, according to UpGuard.

Security: Updates, Windows EOL Meltdown, and Intel Back Doors

Filed under
Security
  • Security updates for Friday
  • Two years after Windows 10: Windows 7 is still threatening a 2020 EOL meltdown

    No. The issue is Windows 7. People and more especially businesses are still refusing to give it up. Yes, it has lost its market share - down from 60.75 in August 2015 to 48.43 percent in August 2017. But again - it's actually UP on this time last year, where it was at 47.25.

  • Intel ME controller chip has secret kill switch

    Security researchers at London-based Positive Technologies have identified an undocumented configuration setting that disables Intel Management Engine 11, a CPU control mechanism that has been described as a security risk.

    Intel's ME consists of a microcontroller that works with the Platform Controller Hub chip, in conjunction with integrated peripherals. It handles much of the data travelling between the processor and external devices, and thus has access to most of the data on the host computer.

Security: Onity, Instagram and Intel Management Engine (ME) Back Doors

Filed under
Security
  • The Epic Crime Spree Unleashed By Onity's Ambivalence To Its Easily Hacked Hotel Locks

    Back in 2012, we wrote about Onity, the company that makes a huge percentage of the keycard hotel door locks on the market, and how laughably easy it was to hack its locks with roughly $50 of equipment. Surprisingly, Onity responded to the media coverage and complaints from its hotel customers with offers of fixes that ranged from insufficient (a piece of plastic that covered the port used to hack the door locks) to cumbersome (replacing the circuit boards on the locks entirely) and asked many of these customers to pay for these fixes to its broken product. Many of these customers wanted to sue Onity for obvious reasons, but a judge ruled against allowing a class action suit to proceed. That was our last story on the subject.

  • Site sells Instagram users’ phone and e-mail details, $10 a search

    At first glance, the Instagram security bug that was exploited to obtain celebrities' phone numbers and e-mail addresses appeared to be limited, possibly to a small number of celebrity accounts. Now a database of 10,000 credentials published online Thursday night suggests the breach is much bigger.

  • Celebs’ phone numbers and e-mail addresses exposed in active Instagram hack
  • Intel kill switch code indicates connection to NSA

    Dmitry Sklyarov, Mark Ermolov and Maxim Goryachy, security researchers for Positive Technologies, based in Framingham, Mass., found the Intel kill switch that has the ability to disable the controversial Intel Management Engine (ME).

    Experts have been wary of the Intel ME because it is an embedded subsystem on every chip that essentially functions as a separate CPU with deep access to system processes and could be active even if the system were hibernating or shut off.

Security: Pacemaker Security, Female Hackers, Internet of Things 'Leaks'

Filed under
Security
  • FDA, Homeland Security Issue First Ever Recall, Warnings About Flimsy Pacemaker Security

    We've well established that the internet of things (IOT) market is a large, stinky dumpster fire when it comes to privacy and security. But the same problems that plague your easily hacked thermostat or e-mail password leaking refrigerator take on a decidedly darker tone when we're talking about your health. The health industry's outdated IT systems are a major reason for a startling rise in ransomware attacks at many hospitals, but this same level of security and privacy apathy also extends to medical and surgical equipment -- and integral medical implants like pacemakers.

    After a decade of warnings about dubious pacemaker security, researchers at Medsec earlier this year discovered that a line of pacemakers manufactured by St. Jude Medical were vulnerable to attacks that could kill the owner. The researchers claimed that St. Jude had a history of doing the bare minimum to secure their products, and did little to nothing in response to previous warnings about device security. St. Jude Medical's first response was an outright denial, followed by a lawsuit against MedSec for "trying to frighten patients and caregivers."

  • What Being a Female Hacker {sic} Is Really Like
  • Even encrypted data streams from the Internet of Things are leaking sensitive information; here’s what we can do

    As the Internet of Things (IoT) begins to enter the mainstream, concerns about the impact such “smart” devices will have on users’ privacy are growing. Many of the problems are obvious, but so far largely anecdotal. That makes a new paper from four researchers at Princeton University particularly valuable, because they analyze in detail how IoT devices leak private information to anyone with access to Internet traffic flows, and what might be done about it. Now that basic privacy protections for Internet users have been removed in the US, allowing ISPs to monitor traffic and sell data about their customers’s online habits to third parties, it’s an issue with heightened importance.

Security: Intel ME Back Door, Updates, Back Doors in Cars, Pacemaker, FCC, Hotel and GitHub Flukes

Filed under
Security
  • A Workaround To Disable Intel Management Engine 11

    Positive Technologies is now reporting on a discovery by one of their researches to be able to disable Intel Management Engine 11 (Skylake era) after discovering an undocumented mode.

    The security researchers discovered "an undocumented PCH strap that can be used to switch on a special mode disabling the main Intel ME functionality at an early stage." Those wanting to learn more can read this blog post.

  • Security updates for Thursday
  • Quebec man fights back after dealer remotely disables car over $200 fee

     

    A car dealership in Sherbrooke, Que., may have broken the law when it used a GPS device to disable the car of a client who was refusing to pay an extra $200 fee, say consumer advocates consulted by CBC News.

     

    [...]

     

    "To turn off somebody's vehicle after he had already paid off the loan is clearly illegal … it's not your car anymore," Iny said.

  • 465k patients told to visit doctor to patch critical pacemaker vulnerability

    Talk about painful software updates. An estimated 465,000 people in the US are getting notices that they should update the firmware that runs their life-sustaining pacemakers or risk falling victim to potentially fatal hacks.

    Cardiac pacemakers are small devices that are implanted in a patient's upper chest to correct abnormal or irregular heart rhythms. Pacemakers are generally outfitted with small radio-frequency equipment so the devices can be maintained remotely. That way, new surgeries aren't required after they're implanted. Like many wireless devices, pacemakers from Abbott Laboratories contain critical flaws that allow hijackers within radio range to seize control while the pacemakers are running.

  • FDA alerts on pacemaker recall for cyber flaw

     

    The FDA issued an alert Aug. 29 regarding manufacturer Abbott's recall notice affecting six pacemaker devices. The recall is for firmware updates that will "reduce the risk of patient harm due to potential exploitation of cybersecurity vulnerabilities," the FDA wrote in its alert.

  • FCC “apology” shows anything can be posted to agency site using insecure API

    The Federal Communications Commission's website already gets a lot of traffic—sometimes more than it can handle. But thanks to a weakness in the interface that the FCC published for citizens to file comments on proposed rule changes, there's a lot more interesting—and potentially malicious—content now flowing onto one FCC domain. The system allows just about any file to be hosted on the FCC's site—potentially including malware.

  • Inside an Epic Hotel Room Hacking {sic} Spree

     

    Even after my article on Brocious’ lock hacking and his high-profile Las Vegas reveal, Onity didn’t patch the security flaw in its millions of vulnerable locks. In fact, no software patch could fix it. Like so many other hardware companies that increasingly fill every corner of modern society with tiny computers, Onity was selling a digital product without much of a plan to secure its future from hackers. It had no update mechanism for its locks. Every one of the electronic boards inside of them would need to be replaced. And long after Brocious’ revelation, Onity announced that it wouldn’t pay for those replacements, putting the onus on its hotel customers instead. Many of those customers refused to shell out for the fix—$25 or more per lock depending on the cost of labor—or seemed to remain blissfully unaware of the problem.

     

    [...]

     

    and demanded Cashatt’s entire communication history from Facebook.

  • How I lost 17,000 GitHub Auth Tokens in One Night

     

    Turns out that there was a bug in my logic but not necessarily my code. After all, it did run flawlessly for a few years. So if my code was fine, where was the bug?

     

    Looking at the update time of some of the records, I was able to place them roughly around the time of another event: A GitHub outage.

  • 7 Things to Know About Today's DDoS Attacks

    Distributed denial-of-service (DDoS) attacks continue to be a weapon of choice among threat actors seeking to extort money from victims, disrupt operations, conceal data-exfiltration activities, further hacktivist causes, or even to carry out cyberwar.

    What was once a threat mostly to ISPs and organizations in the financial services, e-commerce, and gaming industry, has become a problem for businesses of all sizes. A small company is just as likely these days to become a target of a DDoS attack, as a big one — and for pretty much the same reasons.

  • Security ROI isn't impossible, we suck at measuring

    As of late I've been seeing a lot of grumbling that security return on investment (ROI) is impossible. This is of course nonsense. Understanding your ROI is one of the most important things you can do as a business leader. You have to understand if what you're doing makes sense. By the very nature of business, some of the things we do have more value than other things. Some things even have negative value. If we don't know which things are the most important, we're just doing voodoo security.

Security: False Claim of Wikileaks 'Hack', Spambot Data Breach, and Intel Back Door

Filed under
Security
  • WikiLeaks 'hacked' as OurMine group answers 'hack us' challenge [Ed: not Wikileaks' fault at all]

    The group appears to have carried out an attack known as “DNS poisoning” for a short while on Thursday morning. Rather than attacking WikiLeaks’ servers directly, they have convinced one or more DNS servers, which are responsible for turning the human-readable “wikileaks.org” web address into a machine-readable string of numbers that tells a computer where to connect, to alter their records. For a brief period, those DNS servers told browsers that wikileaks.org was actually located on a server controlled by OurMine.

  • More Than 700 Million Passwords Exposed in Massive Spambot Data Breach

    In one of the largest data breaches in history, a misconfigured spambot computer program publicly leaked more than 700 million email addresses and passwords, though experts say that repeated or fake email addresses could reduce the number of real people impacted.

  • Eureka! The Intel Management Engine can finally be disabled, thanks to the NSA

    Researchers from security firm, Positive Technologies have just stumbled upon something truly phenomenal. They have found a method to disable the much hated Intel Management Engine (ME) in a way that still allows the computer to boot up. This discovery could potentially secure many businesses and state institutions from being compromised by highly sophisticated malware.

Angelfire

Filed under
Microsoft
Security

Today, August 31st 2017, WikiLeaks publishes documents from the Angelfire project of the CIA. Angelfire is an implant comprised of five components: Solartime, Wolfcreek, Keystone (previously MagicWand), BadMFS, and the Windows Transitory File system. Like previously published CIA projects (Grasshopper and AfterMidnight) in the Vault7 series, it is a persistent framework that can load and execute custom implants on target computers running the Microsoft Windows operating system (XP or Win7).

Solartime modifies the partition boot sector so that when Windows loads boot time device drivers, it also loads and executes the Wolfcreek implant, that once executed, can load and run other Angelfire implants. According to the documents, the loading of additional implants creates memory leaks that can be possibly detected on infected machines.

Keystone is part of the Wolfcreek implant and responsible for starting malicious user applications. Loaded implants never touch the file system, so there is very little forensic evidence that the process was ever ran. It always disguises as "C:\Windows\system32\svchost.exe" and can thus be detected in the Windows task manager, if the operating system is installed on another partition or in a different path.

BadMFS is a library that implements a covert file system that is created at the end of the active partition (or in a file on disk in later versions). It is used to store all drivers and implants that Wolfcreek will start. All files are both encrypted and obfuscated to avoid string or PE header scanning. Some versions of BadMFS can be detected because the reference to the covert file system is stored in a file named "zf".

The Windows Transitory File system is the new method of installing AngelFire. Rather than lay independent components on disk, the system allows an operator to create transitory files for specific actions including installation, adding files to AngelFire, removing files from AngelFire, etc. Transitory files are added to the 'UserInstallApp'.

Read more

Security: Updates, Keys, Intel Management Engine, Paper by Martin Schallbruch

Filed under
Security

Security: Updates, Reproducible Builds, IoT Applications

Filed under
Security
Syndicate content

More in Tux Machines

Tizen 3.0 and Home Spying Appliances

Vulkan FOSS Adoptions

  • SDL 2.0.6 released, introduces Vulkan support
    The cross-platform development library has seen the release of its latest version. Quite a few exciting changes this time around, including support for Vulkan and more types of gamepads. SDL [Official Site] is something that has been used in quite a diverse array of projects and plenty of game ports that have made their way to Linux have taken advantage of it. The latest release has its fair share of general improvements but most noticeable is the implementation of Vulkan support. This hopefully will make it easier for developers to take advantage of the Vulkan API and help it gain more traction.
  • X.Org Foundation Has Become A Khronos Adopter
    The X.Org Foundation board announced during this week's XDC2017 summit that they have officially completed the paperwork to become a Khronos adopter. The X.Org Foundation is now considered a pro-bono adopter for The Khronos Group so that the community-based open-source drivers targeting Khronos APIs for conformance can submit conformance test results and become a certified implementation.

Security: DHS on Potential Voting Machines Cracking, Joomla Patches Critical Flaw

  • DHS tells 21 states they were Russia hacking targets before 2016 election
  • 1. WikiLeaks, Russian edition: how it’s being viewed
    Russia has been investing heavily in a vision of cyberdemocracy that will link the public directly with government officials to increase official responsiveness. But it is also enforcing some of the toughest cybersecurity laws to empower law enforcement access to communications and ban technologies that could be used to evade surveillance. Could WikiLeaks put a check on Russia’s cyber regime? This week, the online activist group released the first of a promised series of document dumps on the nature and workings of Russia’s surveillance state. So far, the data has offered no bombshells. “It’s mostly technical stuff. It doesn’t contain any state contracts, or even a single mention of the FSB [security service], but there is some data here that’s worth publishing,” says Andrei Soldatov, coauthor of “The Red Web,” a history of the Soviet and Russian internet. But, he adds, “Anything that gets people talking about Russia's capabilities and actions in this area should be seen as a positive development.”
  • Joomla patches eight-year-old critical CMS bug
    Joomla has patched a critical bug which could be used to steal account information and fully compromise website domains. This week, the content management system (CMS) provider issued a security advisory detailing the flaw, which is found in the LDAP authentication plugin. Lightweight Directory Access Protocol (LDAP) is used by Joomla to access directories over TCP/IP. The plugin is integrated with the CMS. Joomla considers the bug a "medium" severity issue, but according to researchers from RIPS Technologies, the problem is closer to a critical status.
  • Joomla! 3.7.5 - Takeover in 20 Seconds with LDAP Injection
    With over 84 million downloads, Joomla! is one of the most popular content management systems in the World Wide Web. It powers about 3.3% of all websites’ content and articles. Our code analysis solution RIPS detected a previously unknown LDAP injection vulnerability in the login controller. This one vulnerability could allow remote attackers to leak the super user password with blind injection techniques and to fully take over any Joomla! <= 3.7.5 installation within seconds that uses LDAP for authentication. Joomla! has fixed the vulnerability in the latest version 3.8.

OpenSUSE fonts – The sleeping beauty guide

Pandora’s box of fonts is one of the many ailments of the distro world. As long as we do not have standards, and some rather strict ones at that, we will continue to suffer from bad fonts, bad contrast, bad ergonomics, and in general, settings that are not designed for sustained, prolonged use. It’s a shame, because humans actually use computers to interface with information, to READ text and interpret knowledge using the power of language. It’s the most critical element of the whole thing. OpenSUSE under-delivers on two fonts – anti-aliasing and hinting options that are less than ideal, and then it lacks the necessary font libraries to make a relevant, modern and pleasing desktop for general use. All of this can be easily solved if there’s more attention, love and passion for the end product. After all, don’t you want people to be spending a lot of time interacting, using and enjoying the distro? Hopefully, one day, all this will be ancient history. We will be able to choose any which system and never worry or wonder how our experience is going to be impacted by the choice of drivers, monitors, software frameworks, or even where we live. For the time being, if you intend on using openSUSE, this little guide should help you achieve a better, smoother, higher-quality rendering of fonts on the screen, allowing you to enjoy the truly neat Plasma desktop to the fullest. Oh, in the openSUSE review, I promised we would handle this, and handle it we did! Take care. Read more