Security Leftovers
-
8 notable open-source security initiatives of 2022 | CSO Online [Ed: They make it sound like security is only a problem when it comes to Free software; meanwhile, proprietary software puts back doors in the binaries (for states)]
So why is it important to improve open-source security? The answer is, in part, “because it underpins everything,” Wheeler says. “Software really does now run the world. The latest studies have shown that, on average, 70% to 90% of applications are, once you look inside, open-source software (OSS) components. That’s not a problem per se – OSS enables an incredible number of goods and services – but it’s a problem if the OSS is vulnerable to attack.” To cause any change, organizations need resources, including people’s time and money, he adds. “Some actions won’t require much, but you still often need some as a catalyst. Some will require more resources because the software industry is large, and the amount of software is huge. For many developers, ‘make it secure’ is a new, unanticipated requirement.”
-
Qubes Canary 032
We have published Qubes Canary 032. The text of this canary is reproduced below.
This canary and its accompanying signatures will always be available in the Qubes security pack (qubes-secpack).
-
Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs
Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on.
Microsoft Teams is a communication platform, included in the 365 product family, used by more than 270 million people for exchanging text messages, videoconferencing, and storing files.
The newly discovered security issue impacts versions of the application for Windows, Linux, and Mac and refers to Microsoft Teams storing user authentication tokens in clear text without protecting access to them.
-
New Linux Malware Shikitega Can Take Full Control of Devices | eSecurityPlanet [Ed: AT&T never bothered explaining how such malware makes it into "Linux" in the first place; but they blame "Linux" regardless]
AT&T Alien Labs has discovered a new Linux malware that can be used for highly evasive attacks, as the infection has been designed for persistence and runs on practically all kinds of Linux devices.