Language Selection

English French German Italian Portuguese Spanish

Security

Security Leftovers

Filed under
Security
  • How We’re Making Certbot More Usable

    The movement to encrypt the web has reached milestone after milestone in recent years as major platforms and small websites alike have made the shift from insecure HTTP to more secure HTTPS. Let’s Encrypt and EFF’s Certbot have changed the game here, making what was once an expensive, technically demanding process into an easy and affordable task for webmasters across a range of resource and skill levels.

    Today we’re releasing a behind-the-scenes look at what it takes to make a tool like Certbot easy to use. This case study walks readers through our designers’ and developers’ process for redesigning our interactive Certbot website: our methods, the challenges of doing user research on a tight budget, and strategies to make the most of the resources available to your team. We hope this case study can serve as a resource for other scrappy groups of designers and developers working to improve their own tools and projects.

  • Whirlpool Left Appliance Data, User Emails Exposed Online

    Another day, another shining example of why connecting everything from your Barbie dolls to tea kettles to the internet was a bad idea. This week it's Whirlpool that's under fire after a researcher discovered that the company had failed to secure a database containing 28 million records collected from the company's "smart" appliances. The database contained user email addresses, model names and numbers, unique appliance identifiers, and data collected from routine analysis of the appliances' condition, including how often the appliance is used, when its off or on, and whether it had any issues.

  • Alex Mooney’s Hilarious Self-Own

    Mooney actually came back out the door and had a staffer film him while explaining that “this is not the SCIF” and, once they entered, “nobody was using a cell phone”. The problem is that he’s using as a backdrop for this explanation the sign showing that electronics were not to be used even going through this outer door, and his entry through that door, with his cell phone going, has been documented by Scott Thuman, Alex Mooney, the New York Times and hopefully, law enforcement: [...]

Security Leftovers

Filed under
Security
  • Security updates for Friday

    Security updates have been issued by Debian (firefox-esr), Gentoo (php), Oracle (firefox), Scientific Linux (sudo), and SUSE (accountsservice, binutils, nfs-utils, and xen).

  • stealth virus – unique mutation Virus in Word.doc Mail Attachment not detected by Virus Scanner anymore – emotet most evil and costly malware yet

    on the heise security conference last year was said: Virus Scanners since around 10 years are not sufficient anymore.

    (heise a computer focused news outlet itself was infected on Mai 2019 with emotet trojan probably via word.doc (src))

    today that statement has become reality.

    neither ClamAV nor Antivir were able to spot the virus or virus-loader in the word.doc attachment.

  • An Open-Source Success Story: Apache SpamAssassin Celebrates 18 Years of Effectively Combating Spam Email

    Apache SpamAssassin celebrates its 18th birthday this year, a huge accomplishment for everyone who has contributed to the open-source project for nearly the past two decades. SpamAssassin, a renowned and respected open-source anti-spam platform, provides a secure, reliable framework upon which companies can build highly effective spam filtering and email security solutions.

    The project is the epitome of an open source success story: expert engineers and developers volunteered their time to combat the unsolicited email problem. The team demonstrated innovation, leadership and perseverance in the face of both success and adversity. Along the way, they incorporated enterprise functionality into the platform they had created as a means to solve real-world issues.

    Kevin McGrail, a cyber security and privacy expert and one of the lead developers for the SpamAssassin project since 1996, also considers SpamAssassin an open source success story, stating in a recent conversation with the LinuxSecurity team, “It protects millions of users every day and provides the inspiration if not the foundation of numerous commercial solutions for battling spammers.” Over the years McGrail has served as a developer, administrator, project chair and release manager for the SpamAssassin project. He is still involved with the project to this day. McGrail is also Director of Business Growth at InfraShield.com and serves as a Top Contributor, Developer Expert and Evangelist for Google G Suite.

  • Interview with Security Analyst Lou Stella | Jupiter Extras 25

    Ell and Wes talk to Lou Stella, Security Analyst at Rackspace, about transitioning to the cyber security industry.

Security Leftovers

Filed under
Security

Red Hat Enterprise Linux 7 and CentOS 7 Get Important Kernel Security Update

Filed under
Red Hat
Security

Marked as important by Red Hat Product Security, the new Linux kernel security patch is here to fix a use-after-free flaw (CVE-2018-20856) discovered in the __blk_drain_queue() function in block/blk-core.c, as well as a heap overflow issue (CVE-2019-3846) discovered in the mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c.

It also addresses a heap overflow issue (CVE-2019-10126) discovered in the mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c and a Bluetooth flaw (CVE-2019-9506) that may lead to BR/EDR encryption key negotiation attacks (KNOB).

Read more

KDE Plasma 5.17 Desktop Environment Gets First Point Release with 40 Bug Fixes

Filed under
KDE
Security

Released last week on October 15th, the KDE Plasma 5.17 desktop environment introduces Night Color support on X11, fractional scaling on Wayland, HiDPI and multi-screen improvements, as well as the ability to support for managing and configuring Thunderbolt devices in System Settings.

It also improves the notification system with a new Do Not Disturb mode that automatically detects presentations, Breeze GTK theme support for the Google Chrome and Chromium web browsers, Nvidia GPU stats in System Settings, and color scheme support for GTK and GNOME apps in the Breeze GTK theme.

Read more

Security and BSD Leftovers

Filed under
Security
BSD
  • Security updates for Wednesday

    Security updates have been issued by Arch Linux (go, go-pie, pacman, and xpdf), CentOS (java-1.7.0-openjdk, java-1.8.0-openjdk, java-11-openjdk, and patch), openSUSE (gcc7), Red Hat (firefox, kernel, and qemu-kvm-rhev), Slackware (mozilla), SUSE (kernel, libcaca, openconnect, python, sysstat, and zziplib), and Ubuntu (libxslt, linux-azure, and linux-lts-xenial, linux-aws).

  • os-release file appears

    There’s now (well, for DragonFly 5.7 users) an /etc/os-release file to show the installed DragonFly version.

  • samsung ativ book 9

    Physically, it’s in the ultraportable category with a 12 inch screen and weighing about two pounds. It’s a completely fanless design, using an M-5Y31 CPU (Broadwell generation). My model came with 8GB RAM and 256GB SSD, but it’s possible to find some with half that. Everything is a bit tiny and compromised, so in my opinion it wouldn’t make for a good all around machine (like the Carbon X1), but if space and weight is at a premium, it’s a good substitute.

    I immediately installed OpenBSD 6.6 when it arrived and have been using it for a few days. I have a few complaints, and I’m not confident in recommending it, but no regrets.

Canonical Outs New Linux Kernel Security Update for Ubuntu 18.04 and 16.04 LTS

Filed under
Linux
Security
Ubuntu

Affecting both the Linux 4.15 kernel used in Ubuntu 18.04 LTS (Bionic Beaver) and Ubuntu 16.04.6 LTS (Xenial Xerus) systems, the new security patch fixed an improperly implemented Spectre mitigation in the ptrace susbsystem (CVE-2019-15902), which could allow a local attacker to expose sensitive information.

It also addresses a buffer overread (CVE-2019-15918) discovered that the SMB networking file system implementation, which could allow an attacker to expose sensitive information (kernel memory), two flaws (CVE-2019-15117 and CVE-2019-15118) discovered in the USB audio driver that may allow a physically proximate attacker to crash the system, and a flaw (CVE-2019-14821) in the KVM hypervisor implementation that let a local attacker to crash the system.

Read more

Leftovers: MX-19, Versalogic and Security

Filed under
Security
Misc
  • MX-19 “patito feo” released!

    We are pleased to offer MX-19 for your use.

    As usual, this iso includes the latest updates from debian 10.1 (buster), antiX and MX repos.

  • Compact Apollo Lake SBC aims sky high

    Versalogic’s Linux-ready, sandwich-style “Harrier” SBC has an Apollo Lake processor and a compact 95 x 55mm footprint, ECC RAM support, and ruggedization features designed for high altitude UAVs.

    Versalogic announced a Harrier SBC due in Q1 2020 that revises the compact, COM-and-carrier design of its three-year-old, Intel Bay Trail based Osprey, but advances to the newer Intel Apollo Lake. The Osprey is similarly bereft of real-world ports to enable easier real-world deployments in constrained environments.

  • Security updates for Tuesday

    Security updates have been issued by CentOS (jss and kernel), Debian (libpcap, openjdk-8, and tcpdump), Fedora (java-11-openjdk), openSUSE (libreoffice), Oracle (java-1.7.0-openjdk), Red Hat (java-1.7.0-openjdk, python, and wget), Scientific Linux (java-1.7.0-openjdk), SUSE (ceph, ceph-iscsi, ses-manual_en, dhcp, openconnect, and procps), and Ubuntu (exiv2, linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-raspi2, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-hwe, linux-azure, linux-gcp, linux-gke-5.0, linux-snapdragon, and uw-imap).

  • Password lessons: Longer is better, so is salt

    Infosec pros who had no idea of how easily a stolen list of hashed passwords could be cracked got a sobering lesson at this month’s SecTor security conference in Toronto.

    There, Will Hunt, co-founder of the U.K. based In.security consulting firm, casually talked of systems that can be built around a common (about $1,500) Nvidea GTX 2080 graphics card that could make 100 billion guesses a second in a brute force attack.

Tails 4.0 is out

Filed under
GNU
Linux
Security
Debian

We are especially proud to present you Tails 4.0, the first version of Tails based on Debian 10 (Buster). It brings new versions of most of the software included in Tails and some important usability and performance improvements. Tails 4.0 introduces more changes than any other version since years.

Read more

Early coverage:

  • Tails 4.0

    Tails (The Amnesic Incognito Live System) is, as the spelled out name implies, a privacy focused distribution, designed to run from removable media. Version 4.0 has been released.

  • Tails 4.0 Anonymous Linux OS Released, Based on Debian GNU/Linux 10 "Buster"

    The Tails project released today the final version of the Tails 4.0 operating system, a major release that introduces numerous enhancements and updated components.

    Based on the Debian GNU/Linux 10 "Buster" operating system, Tails 4.0 is here with up-to-date components to keep your online identity hidden from potential attackers. These include the latest Tor Browser 9.0 anonymous web browser, Tor 0.4.1.6 anonymous network client and server, OnionShare 1.3.2 anonymous file sharing tool, MAT 0.9.0 metadata removal tool, and KeePassXC password manager.

    Tails 4.0 is also powered by the latest Linux 5.3 kernel series, shipping with Linux kernel 5.3.2 in the live ISO image, which brings better support for newer hardware and many other improvements. On top of that, Tails 4.0 ships with GnuPG 2.2.12, Enigmail 2.0.12, Electrum 3.3.8, Git 2.20.1, LibreOffice 6.1.5, Inkscape 0.92.4, GIMP 2.10.8, and Audacity 2.2.2.

Security: Patches, Nostromo, PureBoot and Microsoft's Latest DRM Lock-down (Locking GNU/Linux Out for 'Security')

Filed under
Security
  • Security updates for Monday

    Security updates have been issued by Debian (aspell, graphite-web, imagemagick, mediawiki, milkytracker, nfs-utils, and openjdk-11), Fedora (kernel, kernel-headers, kernel-tools, mediawiki, and radare2), openSUSE (dhcp, libpcap, lighttpd, and tcpdump), Scientific Linux (java-1.8.0-openjdk), Slackware (python), SUSE (bluez, kernel, and python-xdg), and Ubuntu (aspell).

  • Nostromo web servers exposed by resurrected RCE vulnerability

    A security researcher has disclosed the existence of a remote code execution (RCE) vulnerability in the open source Nostromo web server software.

    On Monday, a threat analyst and bounty hunter with the online handle Sudoka published a technical analysis of the bug, tracked as CVE-2019-16278.

    The vulnerability impacts Nostromo, also known as nhttpd, a niche web server used by some in the Unix and open source community but altogether dwarfed in popularity by Apache.

    In a blog post, Sudoka said the vulnerability stems from shortcomings in how the path of URLs are verified. Inadequate URL checks mean that an unauthenticated attackers is able to force a server to point to a shell file, resulting in the potential execution of arbitrary code.

  • PureBoot Best Practices

    Recently we started offering the PureBoot Bundle–PureBoot installed and configured on your laptop at the factory and bundled with a pre-configured Librem Key so you can detect tampering from the moment you unbox your laptop. It’s been great to see so many customers select the PureBoot Bundle and now that PureBoot is on so many more customer laptops, we felt it was a good time to write up a post to describe some best practices when using PureBoot.

    If you are just getting started with PureBoot and want to know the basics, check out our Getting Started Guide for pointers on what to do when you start up your PureBoot Bundle for the first time. In this post I’ll assume you have already gone through the first boot and first reboot of your laptop and have settled into daily use.

  •                

  • Secured-core PCs offer new defense against firmware attacks

                     

                       

    Microsoft, chipmakers, and several PC makers on Monday announced Secured-core PCs, which use hardware-based defense mechanisms to combat firmware-level security attacks.

  •                

  • Microsoft's New Plan to Defend the Code Deep Within PCs

                     

                       

    The idea of secured-core PC is to take firmware out of that equation, eliminating it as a link in the chain that determines what's trustworthy on a system. Instead of relying on firmware, Microsoft has worked with AMD, Intel, and Qualcomm to make new central processing unit chips that can run integrity checks during boot in a controlled, cryptographically verified way. Only the chip manufacturers will hold the encryption keys to broker these checks, and they're burned onto the CPUs during manufacturing rather than interacting with the firmware's amorphous, often unreliable code layer.

  •              
                 

Syndicate content

More in Tux Machines

Type Title Author Replies Last Postsort icon
Story SUSE Leftovers Roy Schestowitz 1 15/11/2019 - 7:09pm
Story Security: IPFire Update, Latest Patches and Freexian/Debian Report Roy Schestowitz 15/11/2019 - 6:58pm
Story Ubuntu Docker Images Compacted Roy Schestowitz 15/11/2019 - 6:56pm
Story Graphics: Intel, D9VK, NVIDIA Roy Schestowitz 1 15/11/2019 - 6:40pm
Story Android Leftovers Rianne Schestowitz 15/11/2019 - 6:37pm
Story OpenWrt 19.07.0 first release candidate Roy Schestowitz 15/11/2019 - 6:35pm
Story OnLogic Karbon 700: Passively-Cooled, Up To 8 Core / 16 Thread Industrial & Rugged PC Rianne Schestowitz 15/11/2019 - 6:23pm
Story 5 Eye-Catching GTK Themes by Vinceliuice Rianne Schestowitz 15/11/2019 - 6:21pm
Story Deepin Linux Shows Off Its Next Big Feature: A Smart AI Voice Assistant Rianne Schestowitz 15/11/2019 - 6:15pm
Story Linux Presentation Software that Shines Roy Schestowitz 15/11/2019 - 6:13pm