Security Leftovers
-
Security updates for Monday [LWN.net]
Security updates have been issued by Debian (chromium and thunderbird), Fedora (keylime, libarchive, libtasn1, pgadmin4, rubygem-nokogiri, samba, thunderbird, wireshark, and xorg-x11-server-Xwayland), Gentoo (curl, libreoffice, nss, unbound, and virtualbox), Mageia (advancecomp, couchdb, firefox, freerdp, golang, heimdal, kernel, kernel-linus, krb5, leptonica, libetpan, python-slixmpp, thunderbird, and xfce4-settings), Oracle (firefox, nodejs:16, and thunderbird), Scientific Linux (firefox and thunderbird), Slackware (samba), SUSE (chromium and kernel), and Ubuntu (linux-oem-5.17).
-
Consider Disabling Browser Push Notifications on Family and Friends Devices - Lloyd Atkinson
A vector for phishing attacks and malware. Your non-technical family members and friends will likely fall for these at some point. For their sake, disable them.
-
Towards a More Open Secure Element Chip - bunnie’s blog
“Secure Element” (SE) chips have traditionally taken a very closed-source, NDA-heavy approach. Thus, it piqued my interest when an early-stage SE chip startup, Cramium (still in stealth mode), approached me to advise on open source strategy. This blog post explains my reasoning for agreeing to advise Cramium, and what I hope to accomplish in the future.
As an open source hardware activist, I have been very pleased at the progress made by the eFabless/Google partnership at creating an open-to-the-transistors physical design kit (PDK) for chips. This would be about as open as you can get from the design standpoint. However, the partnership currently supports only lower-complexity designs in the 90nm to 180nm technology nodes. Meanwhile, Cramium is planning to tape out their security chip in the 22nm node. A 22nm chip would be much more capable and cost-effective than one fabricated in 90nm (for reference, the RP2040 is fabricated in 40nm, while the Raspberry Pi 4’s CPU is fabricated in 28nm), but it would not be open-to-the-transistors.
Cramium indicated that they want to push the boundaries on what one can do with open source, within the four corners of the foundry NDAs. Ideally, a security chip would be fabricated in an open-PDK process, but I still feel it’s important to engage and help nudge them in the right direction because there is a genuine possibility that an open SDK (but still closed PDK) SE in a 22nm process could gain a lot of traction. If it’s not done right, it could establish poor de-facto standards, with lasting impacts on the open source ecosystem.
-
Enterprise and Edge Scale Security with NeuVector Container Security 5.1 | SUSE Communities
I’m excited to announce the general availability of the SUSE NeuVector container security platform version 5.1. With the 5.1 release, customers will benefit from more efficient and powerful vulnerability scanning and admission controls across multiple clusters through centralized enterprise scanning, auto-scaling scanners and support for the new Kubernetes (1.25+) pod security admission (PSA) standard. The release also supports the Cilium network plug-in. This will provide Cilium users with advanced security capabilities, including zero trust security automation and full layer 7 firewall protection with WAF (Web Application Firewall), DLP (Data Leakage Prevention), DPI (Deep Packet Inspection), among others. This will enable security controls to scale across clusters and clouds which may have different or multiple types of CNI plugins. In addition, the release of open source build tools for NeuVector is now available for community users to create and build their own versions.
-
Lynis: A Linux Security Audit Tool You Should Know About
Auditing tools are used to provide information about a system. These tools look at file systems, file permissions, running processes, configuration files, and more, to determine the security posture of the system. Auditing tools can help identify areas on the system where security can be improved and provide information on how to improve it.