Language Selection

English French German Italian Portuguese Spanish

Security

Top Linux developer on Intel chip security problems: 'They're not going away.'

Filed under
Linux
Security

Greg Kroah-Hartman, the stable Linux kernel maintainer, could have prefaced his Open Source Summit Europe keynote speech, MDS, Fallout, Zombieland, and Linux, by paraphrasing Winston Churchill: I have nothing to offer but blood sweat and tears for dealing with Intel CPU's security problems.

Or as a Chinese developer told him recently about these problems: "This is a sad talk." The sadness is that the same Intel CPU speculative execution problems, which led to Meltdown and Spectre security issues, are alive and well and causing more trouble.

The problem with how Intel designed speculative execution is that, while anticipating the next action for the CPU to take does indeed speed things up, it also exposes data along the way. That's bad enough on your own server, but when it breaks down the barriers between virtual machines (VM)s in cloud computing environments, it's a security nightmare.

Read more

Avast Online Security and Avast Secure Browser are spying on you

Filed under
Moz/FF
Security

Are you one of the allegedly 400 million users of Avast antivirus products? Then I have bad news for you: you are likely being spied upon. The culprit is the Avast Online Security extension that these products urge you to install in your browser for maximum protection.

But even if you didn’t install Avast Online Security yourself, it doesn’t mean that you aren’t affected. This isn’t obvious but Avast Secure Browser has Avast Online Security installed by default. It is hidden from the extension listing and cannot be uninstalled by regular means, its functionality apparently considered an integral part of the browser. Avast products promote this browser heavily, and it will also be used automatically in “Banking Mode.” Given that Avast bought AVG a few years ago, there is also a mostly identical AVG Secure Browser with the built-in AVG Online Security extension.

Read more

Security: VisibleV8, Snuffleupagus, So-called 'Awareness Month' and Other FUD

Filed under
Security
  • VisibleV8: Stealthy open source tool for monitoring JavaScript in the wild

    The tool, called VisibleV8, runs in the Chrome browser and is designed to detect malicious programs that are capable of evading existing malware detection systems.

    “When you go to most websites, your browser starts running the site’s JavaScript programs pretty much immediately – and you have little or no idea of what that JavaScript is doing,” says Alexandros Kapravelos, co-author of a paper on VisibleV8 and an assistant professor of computer science at NC State.

    “Previous state-of-the-art malware detection systems rely on making changes to JavaScript code in order to see how the code is being executed. But this approach is easily detected, allowing malware programs to alter their behavior in order to avoid being identified as malicious.

  • Browser tool aims to help researchers ID malicious websites, code

    Researchers have developed an open-source tool that allows users to track and record the behavior of JavaScript programs without alerting the websites that run those programs. The tool, called VisibleV8, runs in the Chrome browser and is designed to detect malicious programs that are capable of evading existing malware detection systems.

  • Snuffleupagus: Open source security tool hardens PHP sites against cyber-attacks

    PHP is the most popular programming language for web applications. But PHP websites are also among the most targeted by hackers and account for many security incidents.

    Snuffleupagus, an open source security module, aims to raise the costs of attacking PHP websites.

    Developed by web hosting company NBS System, Snuffleupagus acts as an added layer of defense for PHP applications, intercepting malicious requests that exploit vulnerabilities in the underlying PHP code.

  • October is Cyber Security Awareness Month. Developers Are Some of Our Best Guardians. [Ed: FUD-based marketing tactics “Awareness Month” for Sonatype]
  • What Heartbleed Taught the Tech World [Ed: It taught us that proxies of Microsoft Corporation can go on about bugs for 5 years, using them to make a stigma about FOSS and to distract from NSA collusion/collaboration of Microsoft that actually caused damage, e.g. WannaCry]

Audiocasts/Screencasts: Linux Action News, Open Source Security Podcast and Voyager 19 10 GE Run Through

Filed under
GNU
Linux
Security
  • Linux Action News 129

    GNOME decides to fight, Ubuntu’s desktop director steps down, GitLab backs off their telemetry plans, and we’ve got the data on Google’s Project Treble.

    Plus, the latest Firefox has a new dashboard, and it looks like Disney+ won’t work on Linux.

  • Open Source Security Podcast: Episode 167 - Security is terrible because digital literacy is terrible

    Josh and Kurt talk about the horrid state of digital literacy in the US. We start out talking about broken Phillips Hue light bulbs, then discuss research from Pew on the digital literacy of Americans. We may have accidentally discovered a use for all the cookie warnings every web site has.

  • Voyager 19 10 GE Run Through

    In this video, we are looking at Voyager Live 19.10 GE.

Security Leftovers

Filed under
Security
  • another reason NOT to use wireless keyboards

    „In the popular series of wireless keyboards Fujitsu LX390 found two dangerous vulnerabilities.

    According to researchers from the company SySS, exploitation of vulnerabilities allows nearby attackers to „spy“ passwords entered on the keyboard, or even to seize control of the system.

  • IPFire 2.23 - Core Update 137 is available for testing

    A little bit behind schedule, we are happy to announce the upcoming release of IPFire 2.23 - Core Update 137. It comes with an updated kernel, a reworked Quality of Service and various bug and security fixes.

  • KeepassXC 2.5.0 Adds ‘Export to HTML’ & 1Password OpVault Support

    KeePassXC, KeePass cross-platform community edition, released version 2.5.0 today with a large number of new features and improvements.

  • company it takedown by ransomeware by 0-day in the Bonjour utility for iTunes – followup to emotet and trickbot

    According to the organization, the problems began on October 13. Although the production lines themselves were not affected, workflows were disrupted due to failures in order service systems. It took employees three days to recover the email. Access to delivery systems of production appeared only to October 21.

    Experts linked the incident to the cryptographer BitPaymer, which was marked by attacks on the district administration in Alaska, the company Arizona Beverages, French TV channel M6. Earlier this month, researchers reported that the malware infiltrates corporate infrastructure through 0-day in the Bonjour utility for iTunes.

    As told to journalists a leading analyst of FoxIT Maarten van Dantzig (Maarten van Dantzig), after the attack on Pilz on VirusTotal found distribution BitPaymer with the same ransom demand, which received employees of the industrial giant. The researcher pointed out that the current incident fits into the pattern of behavior of the cryptographer — his operators prefer massive campaigns to hunt for single targets. The attackers demand large sums of money from such victims — up to a million dollars.

  • ignoring security problems is ALWAYS a „good“ idea – Japanese Robot Hotel

    The Network hosts A POC-code vulnerability, the operation of which allows attackers to remotely monitor visitors through cameras, according to the Tokyo Reporter.

Security Leftovers

Filed under
Security
  • How We’re Making Certbot More Usable

    The movement to encrypt the web has reached milestone after milestone in recent years as major platforms and small websites alike have made the shift from insecure HTTP to more secure HTTPS. Let’s Encrypt and EFF’s Certbot have changed the game here, making what was once an expensive, technically demanding process into an easy and affordable task for webmasters across a range of resource and skill levels.

    Today we’re releasing a behind-the-scenes look at what it takes to make a tool like Certbot easy to use. This case study walks readers through our designers’ and developers’ process for redesigning our interactive Certbot website: our methods, the challenges of doing user research on a tight budget, and strategies to make the most of the resources available to your team. We hope this case study can serve as a resource for other scrappy groups of designers and developers working to improve their own tools and projects.

  • Whirlpool Left Appliance Data, User Emails Exposed Online

    Another day, another shining example of why connecting everything from your Barbie dolls to tea kettles to the internet was a bad idea. This week it's Whirlpool that's under fire after a researcher discovered that the company had failed to secure a database containing 28 million records collected from the company's "smart" appliances. The database contained user email addresses, model names and numbers, unique appliance identifiers, and data collected from routine analysis of the appliances' condition, including how often the appliance is used, when its off or on, and whether it had any issues.

  • Alex Mooney’s Hilarious Self-Own

    Mooney actually came back out the door and had a staffer film him while explaining that “this is not the SCIF” and, once they entered, “nobody was using a cell phone”. The problem is that he’s using as a backdrop for this explanation the sign showing that electronics were not to be used even going through this outer door, and his entry through that door, with his cell phone going, has been documented by Scott Thuman, Alex Mooney, the New York Times and hopefully, law enforcement: [...]

Security Leftovers

Filed under
Security
  • Security updates for Friday

    Security updates have been issued by Debian (firefox-esr), Gentoo (php), Oracle (firefox), Scientific Linux (sudo), and SUSE (accountsservice, binutils, nfs-utils, and xen).

  • stealth virus – unique mutation Virus in Word.doc Mail Attachment not detected by Virus Scanner anymore – emotet most evil and costly malware yet

    on the heise security conference last year was said: Virus Scanners since around 10 years are not sufficient anymore.

    (heise a computer focused news outlet itself was infected on Mai 2019 with emotet trojan probably via word.doc (src))

    today that statement has become reality.

    neither ClamAV nor Antivir were able to spot the virus or virus-loader in the word.doc attachment.

  • An Open-Source Success Story: Apache SpamAssassin Celebrates 18 Years of Effectively Combating Spam Email

    Apache SpamAssassin celebrates its 18th birthday this year, a huge accomplishment for everyone who has contributed to the open-source project for nearly the past two decades. SpamAssassin, a renowned and respected open-source anti-spam platform, provides a secure, reliable framework upon which companies can build highly effective spam filtering and email security solutions.

    The project is the epitome of an open source success story: expert engineers and developers volunteered their time to combat the unsolicited email problem. The team demonstrated innovation, leadership and perseverance in the face of both success and adversity. Along the way, they incorporated enterprise functionality into the platform they had created as a means to solve real-world issues.

    Kevin McGrail, a cyber security and privacy expert and one of the lead developers for the SpamAssassin project since 1996, also considers SpamAssassin an open source success story, stating in a recent conversation with the LinuxSecurity team, “It protects millions of users every day and provides the inspiration if not the foundation of numerous commercial solutions for battling spammers.” Over the years McGrail has served as a developer, administrator, project chair and release manager for the SpamAssassin project. He is still involved with the project to this day. McGrail is also Director of Business Growth at InfraShield.com and serves as a Top Contributor, Developer Expert and Evangelist for Google G Suite.

  • Interview with Security Analyst Lou Stella | Jupiter Extras 25

    Ell and Wes talk to Lou Stella, Security Analyst at Rackspace, about transitioning to the cyber security industry.

Security Leftovers

Filed under
Security

Red Hat Enterprise Linux 7 and CentOS 7 Get Important Kernel Security Update

Filed under
Red Hat
Security

Marked as important by Red Hat Product Security, the new Linux kernel security patch is here to fix a use-after-free flaw (CVE-2018-20856) discovered in the __blk_drain_queue() function in block/blk-core.c, as well as a heap overflow issue (CVE-2019-3846) discovered in the mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c.

It also addresses a heap overflow issue (CVE-2019-10126) discovered in the mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c and a Bluetooth flaw (CVE-2019-9506) that may lead to BR/EDR encryption key negotiation attacks (KNOB).

Read more

KDE Plasma 5.17 Desktop Environment Gets First Point Release with 40 Bug Fixes

Filed under
KDE
Security

Released last week on October 15th, the KDE Plasma 5.17 desktop environment introduces Night Color support on X11, fractional scaling on Wayland, HiDPI and multi-screen improvements, as well as the ability to support for managing and configuring Thunderbolt devices in System Settings.

It also improves the notification system with a new Do Not Disturb mode that automatically detects presentations, Breeze GTK theme support for the Google Chrome and Chromium web browsers, Nvidia GPU stats in System Settings, and color scheme support for GTK and GNOME apps in the Breeze GTK theme.

Read more

Syndicate content

More in Tux Machines

Type Title Author Replies Last Postsort icon
Story Red Hat: State of syslog-ng on RHEL 8 / CentOS 8, AMQ Streams and More Roy Schestowitz 04/12/2019 - 6:32pm
Story today's howtos Roy Schestowitz 04/12/2019 - 6:24pm
Story elementary OS 5.1 Hera Released. Here’s What’s New arindam1989 2 04/12/2019 - 5:34pm
Story Security: Updates, Tips and Breaches Roy Schestowitz 04/12/2019 - 5:24pm
Story Android Leftovers Rianne Schestowitz 04/12/2019 - 5:14pm
Story Audiocasts/Shows: Full Circle Weekly, LINUX Unplugged, mintCast, Podcast With Audacity on Linux Roy Schestowitz 04/12/2019 - 5:06pm
Story MX Linux MX-19 petito feo - The longest mile Rianne Schestowitz 04/12/2019 - 4:44pm
Story Android Leftovers Rianne Schestowitz 04/12/2019 - 4:39pm
Story Red Hat Enterprise Linux 7 and CentOS 7 Receive Important Kernel Security Update Rianne Schestowitz 04/12/2019 - 4:30pm
Story GNOME Foundation is Being Sued Because of Shotwell Photo Manager itsfoss 35 04/12/2019 - 4:25pm