Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • Security updates for Tuesday

    Security updates have been issued by Debian (firmware-nonfree, golang-github-seccomp-libseccomp-golang, and ruby-kramdown), Fedora (kernel, libmetalink, and nodejs), openSUSE (go1.13, perl-XML-Twig, and thunderbird), Oracle (kernel, libvncserver, and thunderbird), Red Hat (kernel-rt and python-paunch and openstack-tripleo-heat-templates), SUSE (dpdk, google-compute-engine, libX11, webkit2gtk3, xen, and xorg-x11-libX11), and Ubuntu (nss and samba).

  • Security updates for Wednesday

    Security updates have been issued by Debian (dovecot and roundcube), Fedora (python36), Gentoo (chromium), openSUSE (ark, firefox, go1.13, java-11-openjdk, libX11, wireshark, and xen), Red Hat (bind and kernel), SUSE (libreoffice and python36), and Ubuntu (dovecot and software-properties).

  • Microsoft August 2020 Patch Tuesday fixes 120 vulnerabilities, two zero-days
  • Nearly Every Android Phone Has Over 400 Vulnerabilities

    Many smartphones rely on third-party Digital Signal Processor (DSP) chips, which is basically a system on a chip. The system abilities include charging capabilities, such as “quick charge,” multimedia, audio features, image processing, and voice data.

  • Intel Publishes 18 New Security Advisories For 52 Vulnerabilities

    It is Intel's August 2020 disclosure day with 18 new advisories being issued for covering 52 vulnerabilities.

    Intel engineers uncovered around half of those 52 vulnerabilities internally while the rest were found by external security researchers.

GNOME 3.36.5 Desktop Update Released with Various Improvements and Bug Fixes

Filed under
GNOME
Security

Coming about a month after the release of the GNOME 3.36.4 update, GNOME 3.36.5 is here as the latest stable bugfix release for the GNOME 3.36 desktop environment series. As expected, the new update is packed with updated core components and apps to keep GNOME 3.36’s stability and reliability at the higher standards.

Highlights of the GNOME 3.36.5 update include Firefox Sync improvements for the Flatpak version of the Epiphany (GNOME Web) web browser, along with a fix for the way newly created tabs are ordered when closing new tabs, as well as a fix for a drag-and-drop crash in File Roller that occurred when cancelling the file overwrite process.

Read more

Security Leftovers

Filed under
Security
  • Security updates for Monday

    Security updates have been issued by Debian (pillow, ruby-kramdown, wpa, and xrdp), Fedora (ark and rpki-client), Gentoo (apache, ark, global, gthumb, and iproute2), openSUSE (chromium, grub2, java-11-openjdk, libX11, and opera), Red Hat (bind, chromium-browser, java-1.7.1-ibm, java-1.8.0-ibm, and libvncserver), SUSE (LibVNCServer, perl-XML-Twig, thunderbird, and xen), and Ubuntu (samba).

  • Have I Been Pwned to release code base to the open source community

    Members of the general public can submit their email addresses into the Have I Been Pwned search engine to find out if they have been "pwned," and if their emails have been linked to a data breach, each one and a summary of what happened is displayed -- as well as what information has been exposed.

    Since its launch in 2013, Hunt has poured more resources, including time and energy, into managing the search engine over time, expanding the service to include domain monitoring and breach alerts.

    At the heart, one main operator isn't enough to ensure future scalability or sustainability, and with this in mind, Hunt previously attempted to find a buyer to help expand his life's work.

    Unfortunately, the merger and/or acquisition process failed, and so Hunt has decided to pursue another alternative -- opening up the Have I Been Pwned code base to the open source community.

  • Researcher Demonstrates Several Zoom Vulnerabilities at DEF CON 28

    Popular video conferencing app Zoom has addressed several security vulnerabilities, two of which affect its Linux client that could have allowed an attacker with access to a compromised system to read and exfiltrate Zoom user data—and even run stealthy malware as a sub-process of a trusted application.
    According to cybersecurity researcher Mazin Ahmed, who presented his findings at DEF CON 2020 yesterday, the company also left a misconfigured development instance exposed that wasn't updated since September 2019, indicating the server could be susceptible to flaws that were left unpatched.

BIOS/UEFI Leftovers

Filed under
Linux
Security
  • BIOS Update Dell Latitude E6440 on Linux

    My BIOS was 4 years out of date. I thought it was time to update it. I went to the Dell Support page and noticed that they only had *.exe files available. I sighed and was initially frustrated because my initial supposition was that I was going to have to have a working copy of Windows to do the update. My last Dell Latitude, a D630, the BIOS updates required a lot of fiddling on my part. At the time, I would burn a special FreeDOS CD with the BIOS update EXE on it. I figured I would have to do the same with this computer. The good news is, that is not the case and it could be I am the last person to know this bit of information.

    [...]

    Due to my laziness and inhibition to use Windows caused me to avoid pursuing updating my BIOS. Dell, on newer systems (~2015 and later), have built in a service to perform these updates outside of the operating system and has removed or eliminated your excuses for keeping your system up to date and more secure.

    I am glad I took the time today to figure this out and do the proper thing in keeping my system updated.

  • Boothole GRUB2 bug breaks Secure Boot on Linux and Windows
  • Linux GRUB2 bootloader flaw breaks Secure Boot on most computers and servers

    Operating system maintainers, computer manufacturers, security and virtualization software vendors have worked together over the past few months to coordinate a unified response to a vulnerability that allows attackers to bypass boot process integrity verification, one of the key security features of modern computers. The flaw is located in the GRUB2 Linux bootloader, but because of how Secure Boot is implemented, it can be used to compromise the booting process of Windows and other systems as well.

Security, Openwashing, Proprietary Software and Back Doors

Filed under
Security
  • Reproducible Builds in July 2020

    Welcome to the July 2020 report from the Reproducible Builds project.

    In these monthly reports, we round-up the things that we have been up to over the past month. As a brief refresher, the motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced from the original free software source code to the pre-compiled binaries we install on our systems. (If you’re interested in contributing to the project, please visit our main website.)

  • Have I Been Pwned — which tells you if passwords were breached — is going open source

    While not all password checkup tools actually use Hunt’s database (a just-announced LastPass feature calls on one hosted by Enzoic instead), many of them are apparently based on the same “k-Anonymity” API that Cloudflare engineering manager Junade Ali originally designed to support Have I Been Pwned’s tool.

  • Facebook’s new open-source Pysa security tool detects [cr]ackable code

    Pysa is designed exclusively to analyze code written in Python. That limits the scenarios where the tool can be applied, but it could be still useful for other companies because Python is the world’s second most widely used programming language as of earlier this year. It’s especially popular in artificial intelligence development and is also the language in which most of the code for Instagram is written.

    Facebook has applied Pysa to the Instagram code base to great effect. According to the company, the tool was responsible for spotting 44% of the server-side security issues that it detected in the photo sharing service during the first half of 2020. Some 49 of the flaws Pysa caught were determined to be “severe” vulnerabilities.

    Under the hood, the tool works by employing a technique known as static code analysis. It sifts through Facebook developers’ raw code files without the delay of running them to quickly generate security assessments.

  • [Cr]ackers can still steal wads of cash from ATMs. Here's the vulnerabilities that could let them in.

    “You’re literally trusting this machine to hold thousands of dollars, but it’s running [Windows operating system] CE 6.0? It is just a computer, on a network, running an older operating system,” Keown said, noting that the latest release for CE 6.0 was over a decade ago in 2009. “This is still a problem. Let’s focus some effort here and see if we can’t move the needle in the right direction.”

  • Canon Admits Ransomware Attack in Employee Note, Report

    The consumer-electronics giant has suffered partial outages across its U.S. website and internal systems reportedly, thanks to the Maze gang.

  • Windows, Gates and a firewall: Microsoft's delicate castle in China

    Microsoft arrived in China in 1992 and opened its largest research and development centre outside the United States. It now employs around 6,200 people in China.

  • All you need to hijack a Mac is an old Office document and a .zip file

    The exploit uses a rigged Office document, saved in an archaic format (.slk), to trick the target machine into allowing Office to activate macros without consent and without notifying the user.

    The attack then takes advantage of two further vulnerabilities in order to seize control of the machine. By including a dollar sign at the start of the filename, [an attacker] can break free of the restrictive Office sandbox, while compressing the file within a .zip folder bypasses macOS controls that prevent downloaded items from accessing user files.

  • Apple’s Chinese business could be devastated by Trump’s WeChat ban

    Apple has a significant Chinese customer base, and nearly all of its critical manufacturing and assembly partners are based there. Trump’s ban might not only force Apple to remove WeChat from its App Store — which would destroy Apple’s Chinese smartphone business — it could existentially change how Apple is able to build and sell new products in the future.

  • It's Time To Stop Talking and Take Action Against the Beasts that Want to Control Us

    I know I have not been active on this BLOG the past year. No reasons. Anyway, I'm back at it. This time, I have a specific focus on Big Tech. The way I see it, the root of the problem is not the tech companies themselves, it starts with the software we use. This includes Adobe, Intuit, Microsoft. I call them AIM. They are the worst offenders in there attempts to control the free world.

Security, Fear, Uncertainty, Doubt

Filed under
Security

Security Leftovers

Filed under
Security
  • How a Fake WordPress Plugin Can Kill Your Site

    A nulled plugin is a copy of a premium WordPress plugin that’s distributed illegally online. People who do this argue it’s OK to do so because WordPress and its derivative works (like plugins) are licensed under a General Public License (GPL). According to them, that makes it OK to copy and distribute plugins how they like.

    While that’s technically true, pirating premium plugins comes with a cost. Legitimate WordPress plugin developers lose money and, more importantly, it compromises the security and integrity of WordPress websites using these nulled plugins. When you hear of a WordPress site being hacked, it’s often because they’re using a nulled plugin.

  • Security updates for Friday

    Security updates have been issued by CentOS (firefox, java-1.8.0-openjdk, java-11-openjdk, libvncserver, postgresql-jdbc, and thunderbird), Debian (firejail and gupnp), Fedora (cutter-re, postgresql-jdbc, radare2, and webkit2gtk3), openSUSE (chromium, firefox, kernel, and python-rtslib-fb), Oracle (container-tools:ol8, kernel, and nss and nspr), Scientific Linux (thunderbird), and SUSE (firefox, kernel, postgresql10 and postgresql12, python-ipaddress, and xen).

  • Reproducible Builds (diffoscope): diffoscope 155 released

    The diffoscope maintainers are pleased to announce the release of diffoscope version 155. This version includes the following changes:

    [ Chris Lamb ]
    * Bump Python requirement from 3.6 to 3.7 - most distributions are either
      shipping3.5 or 3.7, so supporting 3.6 is not somewhat unnecessary and also
      more difficult to test locally.
    * Improvements to setup.py:
      - Apply the Black source code reformatter.
      - Add some URLs for the site of PyPI.org.
      - Update "author" and author email.
    * Explicitly support Python 3.8.
    
    [ Frazer Clews ]
    * Move away from the deprecated logger.warn method logger.warning.
    
    [ Mattia Rizzolo ]
    * Document ("classify") on PyPI that this project works with Python 3.8.
    

  • Open source tool Infection Monkey allows security pros to test their network like never before

    Guardicore unveiled new capabilities for Infection Monkey, its free, open source breach and attack simulation (BAS) tool that maps to the MITRE ATT&CK knowledge base and tests network adherence to the Forrester Zero Trust framework.

Security: Patches, L1TF/Foreshadow, PE Tree, IPFire and BootHole

Filed under
Security

  • Security updates for Thursday

    Security updates have been issued by Debian (clamav and json-c), Fedora (python2, python36, and python37), Red Hat (thunderbird), Scientific Linux (thunderbird), SUSE (java-11-openjdk, kernel, rubygem-actionview-4_2, wireshark, xen, and xrdp), and Ubuntu (openjdk-8 and ppp). 

  •        

  • Researchers Make More Discoveries Around L1TF/Foreshadow - It's Not Good

    Security researchers from Graz University of Technology and CISPA Helmholtz are out with their latest findings on CPU speculative execution vulnerabilities, namely taking another look at L1TF/Foreshadow. Their findings are bad news not only for Intel but potentially other CPU vendors as well.

    [...]

    The new vulnerability outlined in the paper is "Dereference Trap" for leaking registers from an SGX enclave in the presence of only a speculative register dereference. 

    The discovery of speculative dereferencing of a user-space register in the kernel as opposed to the prefetcher not only means that some mitigations may be inadequate, but they can improve the performance of the original attack and reportedly produce similar behavior on non-Intel CPUs. 

  • PE Tree: Free open source tool for reverse-engineering PE files

    PE Tree allows malware analysts to view Portable Executable (PE) files in a tree-view using pefile – a multi-platform Python module that parses and works with PE files – and PyQt5, a module that can be used to create graphical user interfaces.

    “PE Tree is developed in Python and supports the Windows, Linux and Mac operating systems. It can be installed and run as either a standalone application or an IDAPython plugin,” Tom Bonner, a threat researcher at BlackBerry, explained.

  •        

  • IPFire: A new location database for the Internet

    In the last couple of months, we, the IPFire development team, have launched a small side project: A new location database for the Internet. In this article, I would like to give you a brief background story on why and how it come to this...

    [...]

    Other applications would be threat prevention like we use it in IPFire. Connection attempts from certain countries can simply be blocked, or port forwardings can be limited to certain countries only.

    That is, however, not an exact science. The Internet changes constantly. IP address ranges are re-assigned from one party to another one, and often it can take some time until those location databases are all updated. Up to that point, you will see wrong information like the Google front page being shown in a wrong language. This might only be a bit of an inconvenience, but for a firewall, we need more recent and reliable data.

  •        

  • What to do about the BootHole vulnerability

    Late last month, security researchers discovered a major vulnerability in the software that controls how PCs boot their operating systems. This is one of those issues that sounds scarier than it is. Fixing it will be a major process, especially for Linux system administrators and corporate IT organizations with a mixture of different PC vintages and manufacturers. The problem has been named BootHole, and it could affect up to a billion computers.

Security: Zoom Holes, New Patches and etcd Project Security Committee

Filed under
Security
  • Zoombomber crashes court hearing on Twitter hack with Pornhub video
  • Security updates for Wednesday

    Security updates have been issued by Debian (net-snmp), Fedora (mingw-curl), openSUSE (firefox, ghostscript, and opera), Oracle (libvncserver and postgresql-jdbc), Scientific Linux (postgresql-jdbc), SUSE (firefox, kernel, libX11, xen, and xorg-x11-libX11), and Ubuntu (apport, grub2, grub2-signed, libssh, libvirt, mysql-8.0, ppp, tomcat8, and whoopsie).

  • The CNCF etcd project reaches a significant milestone with completion of security audit

    This week, a third-party security audit was published on etcd, the open source distributed key-value store that plays a crucial role in scaling Kubernetes in the cloud. For etcd, this audit was important in multiple ways. The audit validates the project’s maturity and sheds light on some areas where the project can improve. This sort of audit is required criteria for any project in the Cloud Native Computing Foundation (CNCF) to qualify for graduation from the CNCF.

    Read the CNCF blog post that I co-authored to learn more about the audit and what it uncovered. As one of the project maintainers and one of two members of the etcd Project Security Committee, I’d love to share a few reasons I’m hopeful for etcd’s future and why now is a great time to contribute to etcd’s open source community.

Security: Back Doors, EFF, Trump/Microsoft Blackmail and 1Password on GNU/Linux

Filed under
Security

  • Bill Barr Applauds FOSTA Sponsor's Clone Of Senate's Encryption-Breaking 'Lawful Access' Bill

    I guess those "rule of law" folks don't care if a law is any good or will do what it intends to do without causing significant collateral damage. All they care about is that it's a law and, as a law, everyone should just subject themselves to it with a minimum of complaining.

  • Supporting Digital Freedom at the (Virtual) Summer Security Conferences

    During a typical year, EFF staff members would be headed to Las Vegas to present our latest work to the world and ensure legal support for computer security researchers at the long-running hacker events BSidesLV, Black Hat, and DEF CON. These summer security conferences are a natural opportunity for the curious and the professional to geek out on tech. Hackers, tinkerers, and reverse engineers were among the first to embrace the excitement and potential of their own imaginations in digital space. They have been a core part of EFF and the online freedom community since the beginning, and we relish thanking them face to face.

    But this year, as we each grapple with a sobering pandemic, these conferences have had to undergo big changes and are all happening in virtual space. DEF CON is even free to attend. This pandemic, as well as far-reaching protests, have forced us to rethink much of our daily lives—and these questions can feel overwhelming.

  • TikTok Ban: A Seed of Genuine Security Concern Wrapped in a Thick Layer of Censorship

    It is ironic that, while purporting to protect America from China’s authoritarian government, President Trump is threatening to ban the TikTok app. Censorship of both speech and social media applications, after all, is one of the hallmarks of the Chinese Internet strategy.  While there is significant cause for concern with TikTok’s security, privacy, and its relationship with the Chinese government, we should resist a governmental power to ban a popular means of communication and expression.  

    As is too often the case with government pronouncements, the Trump administration has proposed a ban without specifying what the ban would actually be or what authority allows for it. Rather, the President has said broadly, “we’re banning them from the United States,” or most recently, “it's going to be out of business in the United States.” This could mean a ban on using the app, or perhaps a ban on distributing TikTok in app stores, or maybe something else. Any way you slice it, an effective ban of the scope suggested cannot be squared with the Constitution. 

  • ‘1Password’ App Coming To Linux, Initial Release Available For Download

    The user-friendly and cross-platform password manager app, 1Password, is finally coming for all Linux platforms with full-feature and native support. Currently, a development preview for Linux has been unveiled.

    This is the initial release for testing and validation purposes only. Hence, you should not use its Linux development preview for production or business environments.

    As planned, an official release with long-term support will be announced later this year after including new updates, features, and changes over the next few months. However, if you want a stable version of 1Password for Linux, you can use 1Password X in your browser.

    1Password is available for all devices, browsers, and operating systems such as Windows, macOS, iOS, Android, Chrome OS, Google Chrome, Brave, Edge, and Firefox. And now it is also going to be available for Linux desktop as well.

Syndicate content

More in Tux Machines

Android Leftovers

Tiny module and dev kit run RT Linux on STM32MP1

Exor’s 25.4 x 25.4mm, extended temp “NanoSOM nS02” module runs real-time Linux and its XPlatform industrial IoT software on a soldered, 800MHz STM32MP157 with up to 1GB DDR3L and 32GB eMMC. An “OpenHMI nS02” dev kit with 5-inch touchscreen is optional. Italian embedded technology firm Exor Embedded has launched a NanoSOM nS02 module that runs real-time Linux on the new 800MHz version of ST’s dual-core, Cortex-A7 based STM32MP157. As with the recent, Apollo Lake based, FPGA-enabled GigaSOM GS01 module, Exor announced the product with Arrow, which will be distributing the module and an OpenHMI nS02 Development Kit (see farther below). Read more

Endless OS 3.8.5

Endless OS 3.8.5 was released for existing users today, August 10th, 2020. Downloadable images for new users will be available in the next few days. Read more

Linspire 9.0 Released

Today our development team is excited to announce the release of Linspire 9.0; packed with a TON of improvements and security updates, this is a major update that we’ve been working hard to get out to our faithful users. The global pandemic has delayed its release, but the development team has worked diligently and meticulously behind-the-scenes over the past few months, fine-tuning every detail of what is widely considered to be the premier Linux desktop on the market today. The Linspire 9.0 series will be the last one featuring the 18.04 LTS codebase; upcoming Linspire X will be based on the 20.04 LTS code and kernel. Read more Also: Linspire 9.0 Officially Released, Based on Ubuntu 18.04 LTS and Linux 5.4 LTS