Language Selection

English French German Italian Portuguese Spanish

Security

Security: Updates, "Internet of Things", DNS Issues and More

Filed under
Security
  • Security updates for Thursday
  • New Japanese Law Lets Government Hack IOT Devices, Warn Owners They're Vulnerable

    By now we've established pretty clearly that the well-hyped "internet of things" sector couldn't actually care less about security or privacy. Companies are in such a rush to cash in on our collective thirst for internet connected tea kettles and not-so-smart televisions, they don't much care if your new gadget was easily hacked or integrated into a DDoS botnet. And by the time security and privacy flaws have been discovered, companies and consumers alike are off to hyperventilate about the next must-have gadget, leaving untold millions of devices in the wild as new potential points of entry into home and business networks.

  • A DNS flag day

    A flag day for DNS is coming on February 1; it may have escaped notice even though it has been planned for nearly a year. Some DNS servers will simply be marked as "dead" by much of the rest of the internet on or after that day, which means that domain owners need to ensure their DNS records will still be available after that point. A longstanding workaround for non-compliant servers will be dropped—mostly for better performance but also in support of DNS extensions, some of which can help alleviate security problems.

    The Domain Name System, or DNS, is a foundational service on the internet. It is, of course, what connects domain names, like lwn.net, with their IP addresses. Without DNS records, and a server that will provide those records in response to queries, a domain is effectively "off the net". DNS provides for lookups of various types of information beyond just IP addresses, such as policy information for Sender Policy Framework (SPF) or keys for DomainKeys Identified Mail (DKIM).

    The problem that has led to the flag day stems from DNS servers that do not implement the "Extension Mechanisms for DNS", also known as EDNS(0) or just EDNS; it is specified in RFC 6891. EDNS was introduced in 1999 and finalized in 2013. Some servers do not properly respond to requests that ask if they support various EDNS features. It is important to note that there is no requirement that the servers actually support any extensions, just that they reply properly (with a normal DNS response), rather than ignoring and not answering EDNS queries.

  • Ubuntu 18.04 Needs to Patching, Alpine 3.9 Released, Three New openSUSE Tumbleweed Snapshots, Latest Version of Red Hat Infrastructure Migration Solution Now Available and Electric Cloud Announces ElectricAccelerator 11.0

OPNsense 19.1 released

Filed under
Security
BSD

For more than four years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.

The 19.1 release, nicknamed "Inspiring Iguana", consists of a total of 620 individual changes since 18.7 came out 6 months ago, spread out over12 intermediate releases including the recent release candidates. That is the average of 2 stable releases per month, security updates and important bug fixes included! If we had to pick a few highlights it would be: The firewall alias API is finally in place. The migration to HardenedBSD 11.2 has been completed. 2FA now works with a remote LDAP / local TOTP
combination. And the OpenVPN client export was rewritten for full API support as well.

Read more

Security: Apple, State Bank of India (SBI), QC and Reproducible Builds

Filed under
Security
  • Lawyer sues Apple, claims FaceTime bug “allowed” recording of deposition

    In a lawsuit filed Monday evening in Harris County District Court, Larry Williams claimed the company was negligent when it allowed the microphone to be used in this way.

  • SBI Leaked Banking Data of Millions Of Users Through Unprotected Server

    State Bank of (SBI), one of the largest bank in India, left millions of its customer’s financial data exposed for anyone to a look into, according to a TechCrunch report.

    The Mumbai-based server, which has been secured now, stored over two months of user data including bank balances, transaction history, and more.

  • India’s largest bank SBI leaked account data on millions of customers

    India’s largest bank has secured an unprotected server that allowed anyone to access financial information on millions of its customers, like bank balances and recent transactions.

    The server, hosted in a regional Mumbai-based data center, stored two months of data from SBI Quick, a text message and call-based system used to request basic information about their bank accounts by customers of the government-owned State Bank of India (SBI), the largest bank in the country and a highly ranked company in the Fortune 500.

    [...]

    The passwordless database allowed us to see all of the text messages going to customers in real time, including their phone numbers, bank balances and recent transactions. The database also contained the customer’s partial bank account number. Some would say when a check had been cashed, and many of the bank’s sent messages included a link to download SBI’s YONO app for internet banking.

  • Will quantum computing break security?

    All in all, in fact, there's a strong body of expert opinion that says we shouldn't be overly worried about quantum computing breaking our encryption in the next five or even 10 years.

  • Chris Lamb: Free software activities in January 2019

    Whilst anyone can inspect the source code of free software for malicious flaws almost all software is distributed pre-compiled to end users.

    The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.

Security: Quantum Computing FUD, Updates and Apple Faces Lawsuit Over The FaceTime Eavesdropping Bug

Filed under
Security

Security: Exploiting systemd-journald and Latest From Reproducible Builds Team

Filed under
Security
  • Exploiting systemd-journald Part 1

    Capsule8 developed a proof-of-concept exploit for the two vulnerabilities in systemd-journald, which were published by Qualys on January 9th.

  • Reproducible Builds: Weekly report #196

    There was considerable progress towards making the Debian Installer images reproducible with a number of rounds of code review, a subsequent merge of Chris Lamb’s merge request and the closing of the corresponding bug report for the time being, pending further testing.

Ubuntu 18.04 needs patching

Filed under
Security
Ubuntu

Ubuntu is a very popular Linux distribution for servers, clouds, and the desktop. So, when parent company Canonical announces it is moving Ubuntu 18.04, the latest long term support (LTS) edition, to a new Linux kernel, it's time to pay attention and patch.

This kernel, 4.15.0-44.47, contains 11 security fixes and other minor improvements.

The most significant of these are four problems with Linux's implementation of the ext4 filesystem. Ext4 is the most commonly used Linux filesystem, and it's the Ubuntu Linux family's default file system.

Read more

Security Leftovers

Filed under
Security
  • Pwn the LIFX Mini white

    In a very short limited amount of time, three vulnerabilities have been discovered:

    Wifi credentials of the user have been recovered (stored in plaintext into the flash memory).

    No security settings. The device is completely open (no secure boot, no debug interface disabled, no flash encryption).

    Root certificate and RSA private key have been extracted.

  • Anyone Can Spy on You With FaceTime, Here's How to Turn It Off

    A new creepy flaw in Apple’s popular video and audio call app FaceTime allows the caller to listen in on the receiver’s iPhone, even if that person has not picked up the call, according to multiple news reports and users who claims they have experienced the bug.

  • Apple was slow to act on FaceTime bug report, which came from mother of 14 year old who found it
  • Apple Was Slow to Act on FaceTime Bug That Allows Spying on iPhones

    On Jan. 19, Grant Thompson, a 14-year-old in Arizona, made an unexpected discovery: Using FaceTime, Apple’s video chatting software, he could eavesdrop on his friend’s phone before his friend had even answered the call.

    His mother, Michele Thompson, sent a video of the hack to Apple the next day, warning the company of a “major security flaw” that exposed millions of iPhone users to eavesdropping. When she didn’t hear from Apple Support, she exhausted every other avenue she could, including emailing and faxing Apple’s security team, and posting to Twitter and Facebook. On Friday, Apple’s product security team encouraged Ms. Thompson, a lawyer, to set up a developer account to send a formal bug report.

    But it wasn’t until Monday, more than a week after Ms. Thompson first notified Apple of the problem, that Apple raced to disable Group FaceTime and said it was working on a fix. [...]

  • Major iPhone FaceTime bug lets you hear the audio of the person you are calling … before they pick up

    A significant bug has been discovered in FaceTime and is currently spreading virally over social media. The bug lets you call anyone with FaceTime, and immediately hear the audio coming from their phone — before the person on the other end has accepted or rejected the incoming call. Apple says the issue will be addressed in a software update “later this week”. (Update: Apple has taken Group FaceTime offline in an attempt to address the issue in the interim).

Security: Kali Linux, GNOME Security Internship, Patching, OpenPGP Trust Model and More

Filed under
Security
  • Under the Magnifying Glass: Kali Linux is the complete toolbox for penetration testing

    Every IT infrastructure offers points of attack that hackers can use to steal and manipulate data. Only one thing can prevent these vulnerabilities from being exploited by unwelcome guests: You need to preempt the hackers and identify and close the gaps. Kali Linux can help.

    To maintain the security of a network, you need to check it continuously for vulnerabilities and other weak points through penetration testing. You have a clear advantage over attackers because you know the critical infrastructure components, the network topology, points of attack, the services and servers executed, and so on. Exploitation tests should look for vulnerabilities in a secure, real environment, so you can shut down any vulnerabilities found – and you need to do this over and over again.

    The variety of IT components dedicated to security does not make selecting a suitable tool any easier, because all possible attack vectors need to be subjected to continuous testing. Kali Linux [1] meets these requirements – and does much more.

  • GNOME Security Internship - Update 4

    After 4 long posts talking about USB devices, lock screen and keyboards are you a bit lost? Are you trying to find an answer to the question: “What will happen when I plug a USB device?”

  • Upgraded system on my server

    I started using that server during my work at Canonical. So it got Ubuntu installed. According to OVH panel it was 13.04 release. Then 13.10, 14.04 and finally 16.04 landed. In pain. Took me two days to get it working again (mail issues).

    At that time I decided that it will not get any Ubuntu update. The plan was to upgrade to proper Debian release. And Buster will get frozen soon…

    One day I took a list of installed packages and started “ubuntu:xenial” container. Test shown will it be big work to do such upgrade. Turned out that not that much.

    Today I saw a post saying that php 7.1 goes into “security fixes only” mode. And I had 7.0 in use… So decided that ok, this is the time.

    [...]

    Why Debian?

    Someone may ask why not Fedora or RHEL or CentOS? I work at Red Hat now, right?

    Yes, I do. But Debian is operating system I know most. It’s tools etc. Also upgrade was possible to do online. Otherwise I would have to start with reinstalation.

    Now I have only one machine running Ubuntu. My wife’s laptop. But it is “no way” zone. It works for her and we have an agreement that I do not touch it. Unless requested.

  • Identity with OpenPGP trust model

    Most of time, you won’t be able to directly verify the identity of everyone you’d like to communicate with. This creates a necessity of obtaining indirect proof of authenticity, and the model normally used for that purpose in OpenPGP is the Web of Trust. I won’t be getting into the fine details — you can find them e.g. in the GNU Privacy Handbook. For our purposes, it suffices to say that in WoT the authenticity of keys you haven’t verified may be assessed by people whose keys you trust already, or people they know, with a limited level of recursion.

    The more key holders you can trust, the more keys you can have verified indirectly and the more likely it is that your future recipient will be in that group. Or that you will be able to get someone from across the world into your WoT by meeting someone residing much closer to yourself. Therefore, you’d naturally want the WoT to grow fast and include more individuals. You’d want to preach OpenPGP onto non-crypto-aware people. However, this comes with inherent danger: can you really trust that they will properly verify the identity of the keys they sign?

    I believe this is the most fundamental issue with WoT model: for it to work outside of small specialized circles, it has to include more and more individuals across the world. But this growth inevitable makes it easier for a malicious third party to find people that can be tricked into certifying keys with forged identities.

  • FaceTime Bug Lets iPhone Users Spy On Others Before They Pick Up Call
  • Save the Dates! Linux Security Summit Events for 2019.
  • Can you trust the personal Internet of Things?

Security: FaceTime, 'Keyless', System Updates

Filed under
Security
  • FaceTime bug lets callers hear you before you answer (really)

    We have tested this method and confirmed that it works. After a caller completes the steps, they will be able to hear the recipient's audio—but the recipient will be able to hear the caller's audio, too. It doesn't really work for eavesdropping for that reason, thankfully, but you could potentially catch someone by surprise. After the steps have been followed, the caller's end shows that the recipient is part of a FaceTime call. But as far as the recipient can tell, the recipient has not yet answered.

  • 'Keyless' cars are almost all vulnerable to £10 [intrusion] kits

    An investigation by Which? found a glut of cars including the Ford Fiesta and Focus, VW Golf and Nissan Qashqai are all at risk from technology designed to let thieves mimic the signal of the car's lock and gain access.

    Worst still, any budding car thieves can buy the technology for about a tenner.

  • Security updates for Tuesday
  • FOSS Project Spotlight: Mender.io, an Open-Source Over-the-Air Software Update Manager for IoT Devices

    Mender is an open-source (Apache 2.0) project to address over-the-air (OTA) software update management for Linux-based IoT devices. When we researched this five years ago, there were no open-source end-to-end (device-to-server) options to manage the lifecycle of OTA updates for connected devices. Some open-source options were available, but they either had a proprietary management server, or they were client-only and required integration with another back-end server.

    In short, the options available to IoT device-makers either had vendor lock-in or simply were too kludgy. Thus, we created Mender, which has two components: the runtime client integrated into the device and the management server with an intuitive user interface to manage updates at scale for large fleets.

Security: Debian, FaceTime, QLineEdit, Roadmap to Securing Your Infrastructure

Filed under
Security
  • https mirror

    Debian mirror servers are not run by Debian system admins but mirror admins kindly offer their servers and network capacities to our users. So, providing https support depends on them, we cannot force it.

  • There’s a Huge Bug in FaceTime. Disable It Now

    Anyone can call you on FaceTime and hear audio or see video from your phone before you answer. This bug is going viral on social media, and the only protection is disabling FaceTime.

  • Privacy: GUI applications leaking passwords

    Most of these applications use the Qt’s default text component – QLineEdit – when they need password input, because QLineEdit has a nice convenient mode where it masks the content of the text field – it shows asterisks or circles instead of the actual characters it contains.

    This is a nice way to block over-the-shoulder snooping, and is a common approach to do password entry even in non-Qt software.

    [...]

    When the QLineEdit is destroyed, so is the QString variable that stores the password. But, while the buffer that QString uses to store the data is freed/deleted, its contents remain in memory until some other dynamically allocated object is created in the same memory space and overwrites the data. This is because QString does not fill its buffer with zeroes on destruction. This means that the passwords remain in memory for much longer than needed (problem 2).

  • Roadmap to Securing Your Infrastructure: Intro

    As you’ll see throughout the year, I’m a huge fan of using open source tools to solve problems. You won’t hear me saying to go spend $10,000 to solve your problem. We’ll always look to open source solutions, when available. I enjoy using creativity to solve problems as well and would love to hear about problems you have creatively solved as well as open source products you use in your security practices.

Syndicate content

More in Tux Machines

qoob – excellent foobar-like music player for Linux

Are you debilitated by the countless music players that use web technologies with a massive RAM footprint? Maybe you want a lean yet slick audio player with a good range of features? You might be interested in qoob. It’s a music player written in the versatile and hugely popular Python programming language. The software uses Qt 5, a cross-platform application framework and widget toolkit for creating classic and embedded graphical user interfaces. qoob is similar to foobar2000, a freeware audio player respected for its highly modular design, breadth of features, and extensive user flexibility in configuration. Unlike foobar, qoob is available for Linux and it’s released under an open source license. Read more

Programming: GStreamer, Rust, Python and More

  • GStreamer 1.15.1 unstable development release
    The GStreamer team is pleased to announce the first development release in the unstable 1.15 release series. The unstable 1.15 release series adds new features on top of the current stable 1.16 series and is part of the API and ABI-stable 1.x release series of the GStreamer multimedia framework. The unstable 1.15 release series is for testing and development purposes in the lead-up to the stable 1.16 series which is scheduled for release in a few weeks time. Any newly-added API can still change until that point, although it is rare for that to happen. Full release notes will be provided in the near future, highlighting all the new features, bugfixes, performance optimizations and other important changes.
  • GStreamer: GStreamer Rust bindings 0.13.0 release
    A new version of the GStreamer Rust bindings, 0.13.0, was released. This new release is the first to include direct support for implementing GStreamer elements and other types in Rust. Previously this was provided via a different crate. In addition to this, the new release features many API improvements, cleanups, newly added bindings and bugfixes.
  • Niko Matsakis: Rust lang team working groups
    Now that the Rust 2018 edition has shipped, the language design team has been thinking a lot about what to do in 2019 and over the next few years. I think we’ve got a lot of exciting stuff on the horizon, and I wanted to write about it.
  • RVowpalWabbit 0.0.13: Keeping CRAN happy
    Another small RVowpalWabbit package update brings us version 0.0.13. And just like Rblpapi yesterday, we have a new RVowpalWabbit update to cope with staged installs which will be a new feature of R 3.6.0. No other changes were made No new code or features were added.
  • Test automation framework thoughts and examples with Python, pytest and Jenkins
    In this article I'll share some personal thoughts about Test Automation Frameworks; you can take inspiration from them if you are going to evaluate different test automation platforms or assess your current test automation solution (or solutions). Despite it is a generic article about test automation, you'll find many examples explaining how to address some common needs using the Python based test framework named pytest and the Jenkins automation server: use the information contained here just as a comparison and feel free to comment sharing alternative methods or ideas coming from different worlds. It contains references to some well (or less) known pytest plugins or testing libraries too.
  • Basics of Object-Oriented Programming
    In programming, an object is simply a 'thing'. I know, I know...how can you define something as a 'thing'. Well, let's think about it - What do 'things' have? Attributes, right? Let's take a Song for example. A song has attributes! It has a Title, an Artist, a Genre, etc. How about a Dog - A dog has four legs, a color, a name, an owner, and a breed. Though there are millions Dogs with countless names, owners, etc, the one thing that ties them all together are the very fact that every single one can be described as a Dog. Although this may seem like a not-very informative explanation, these types of examples are what ultimately made me understand Object-oriented programing. The set of activities that an object can perform is an Object's behavior. A dog can bark, wag it's tail, sit, and even shake if it's owner trains them. In the same way, a programmer can create an object and teach it tricks in order to achieve certain goals. In Ruby(my first programming language), EVERYTHING is an object. This means that every piece of code you encounter can perform certain tricks at your command, some are built into Ruby while others can be created at your disposal. Let's look at a common element in programming, a simple string. As you can see, after the string is defined, I'm able to call different 'methods' or functions on the string I created. Ruby has several built in methods on common objects(ie strings, integers, arrays, and hashes.
  • Hello pytest-play!
    pytest-play is a rec&play (rec not yet available) pytest plugin that let you execute a set of actions and assertions using commands serialized in JSON format. It tries to make test automation more affordable for non programmers or non Python programmers for browser, functional, API, integration or system testing thanks to its pluggable architecture and third party plugins that let you interact with the most common databases and systems.
  • Nikola v8.0.2 is out!
    Nikola is a static site and blog generator, written in Python. It can use Mako and Jinja2 templates, and input in many popular markup formats, such as reStructuredText and Markdown — and can even turn Jupyter Notebooks into blog posts! It also supports image galleries, and is multilingual. Nikola is flexible, and page builds are extremely fast, courtesy of doit (which is rebuilding only what has been changed).
  • Mu!
    In the past several days, I innaugurated a private Fediverse instance, "Mu", running Pleroma for now. Although Mastodon is the dominant implementation, Pleroma is far easier to install, and uses less memory on small, private instances. By doing this, I'm bucking the trend of people hating to run their own infrastructure. Well, I do run my own e-mail service, so, what the heck, might as well join the Fediverse. So far, it was pretty fun, but Pleroma has problem spots. For example, Pleroma has a concept of "local accounts" and "remote accounts": local ones are normal, into which users log in at the instance, and remote ones mirror accounts on other instances. This way, if users Alice@Mu and Bob@Mu follow user zaitcev@SLC, Mu creates a "remote" account UnIqUeStRiNg@Mu, which tracks zaitcev@SLC, so Alice and Bob subscribe to it locally. This permits to send zaitcev's updates over the network only once. Makes sense, right? Well... I have a "stuck" remote account now at Mu, let's call it Xprime@Mu and posit that it follows X@SPC. Updates posted by X@SPC are reflected in Xprime@Mu, but if Alice@Mu tries to follow X@SPC, she does not see updates that Xprime@Mu receives (the updates are not reflected in Alice's friends/main timeline) [1]. I asked at #pleroma about it, but all they could suggest was to try and resubscribe. I think I need to unsubscribe and purge Xprime@Mu somehow. Then, when Alice resubscribes, Pleroma will re-create a remote, say Xbis@Mu, and things hopefully ought to work. Well, maybe. I need to examine the source to be sure.
  • Django ORM optimization story on selecting the least possible
    This an optimization story that should not surprise anyone using the Django ORM. But I thought I'd share because I have numbers now! The origin of this came from a real requirement. For a given parent model, I'd like to extract the value of the name column of all its child models, and the turn all these name strings into 1 MD5 checksum string.
  • Reasons Mitogen sucks
    I have a particular dislike for nonspecific negativity, where nothing can be done to address its source because the reasons underlying it are never explicitly described. In the context of Mitogen, there has been a consistent stream of this sort originating from an important camp in public spaces, and despite efforts to bring specifics out into the open, still it continues to persist. For that reason I'd like to try a new strategy: justify the negativity and give it a face by providing all the fuel it needs to burn. Therefore in this post, in the interests of encouraging honesty, I will critique my own work.
  • The North Star of PyCascades, core Python developer Mariatta Wijaya, receives the 2018 Q3 Community Service Award
    At Montreal PyCon 2015, Guido Van Rossum delivered the closing keynote during which Guido issued a public ask, “I want at least two female Python core developers in the next year ... and I will try to train them myself if that's what it takes. So come talk to me." Consequently, Mariatta did just that, she reached out to Guido after PyCon 2016 to learn more about starting in Python core development. Mariatta recalls, “I hadn’t contributed to open source [yet] and I wanted to know how to start”. Guido recommended some ways for Mariatta to start including reviewing the dev guide, looking at open issues and joining and introducing herself on the Python dev mailing list .
  • Episode #118: Better Python executable management with pipx

NVIDIA: GTX 1660 and Linux

  • NVIDIA have released the 418.43 driver, includes support for the just released GeForce GTX 1660
    Two bits of NVIDIA news for you today, not only have they released a new stable driver, they've also put out their latest GPU with the GTX 1660. First up, the new stable driver 418.43 is out which you can find here. It follows on from the 418.30 beta driver, released last month. The big new feature of the driver is initial support for G-SYNC Compatible monitors! So those of you with a FreeSync monitor should be able to use it (if you weren't already using the beta driver). This new driver also adds in support for the just released GeForce GTX 1660 Ti, the GeForce RTX 2070 with Max-Q Design and the GeForce RTX 2080 with Max-Q Design. There's also NVIDIA optical flow support, NVIDIA Video Codec SDK 9.0, support for stereo presentation in Vulkan and more.
  • NVIDIA 418.43 Stable Linux Driver Released, Includes GTX 1660 Ti Support
    As expected given today's GeForce GTX 1660 Ti launch, NVIDIA has released a new Linux graphics driver supporting the 1660 Ti as well as the RTX 2070 with Max-Q Design and RTX 2080 with Max-Q Design, among other changes. This is actually the first stable release in the NVIDIA 418 series for Linux users and succeeds last month's NVIDIA 418.30 Linux driver beta. Most of the changes in today's NVIDIA 418.43 driver release were previously found in the 418.30 version, just now made official with this stable driver debut plus adding in the NVIDIA GeForce GTX 1660 Ti graphics card support.
  • NVIDIA 390.116 Legacy & 410.104 Long-Lived Linux Drivers Released
    In addition to NVIDIA christening the 418 driver series as stable today with the GeForce GTX 1660 Ti release, they also issued updates for their 390 legacy driver series as well as the 410 long-lived driver release series. The NVIDIA 390.116 driver is out for those still using NVIDIA Fermi graphics cards on Linux. This update is the first in a while and has a number of fixes to the Linux driver, on the FreeBSD side there is now 12.0 support, support for the Linux 5.0 kernel, X.Org Server 1.20 fixes, and other random fixes collected in the past few months. For those using this NVIDIA legacy driver can find out more information via this DevTalk thread.
  • GeForce GTX 1660 Ti Launch Today - Supported By The NVIDIA Linux Driver, No Nouveau Yet
    After weeks of leaks, the GeForce GTX 1660 Ti is expected to be formally announced in just a few hours. This is a ~$300 Turing graphics card but without any ray-tracing support as so far has been common to all Turing graphics cards. The GTX 1600 series family is expected to expand as well in the weeks ahead.

Betty – A Friendly Interface For Your Linux Command Line

All Linux experts might already know this statement “Command line mode is more powerful than GUI” but newbies are scared about CLI. Don’t think that working on Linux CLI is difficult as everything is opensource nowadays and you can get it in online whatever you want. If you have any doubt just google it and you will get many suggestion, select the suitable one and move forward. If you are looking for some virtual assistant tool instead of google. Yes, there is a tool is available for this and the tool name is Betty which helps you to get the information right from your terminal. Do you want to try? if so, go through the entire article for details. Read more