Security Leftovers and Microsoft/Windows TCO

posted by Roy Schestowitz on Oct 12, 2023

• BPF and security

  The eBPF in-kernel virtual machine is approaching its tenth anniversary as part of Linux; it has grown into a tool with many types of uses in the ecosystem. Alexei Starovoitov, who was the creator of eBPF and did much of the development of it, especially in the early going, gave the opening talk at Linux Security Summit Europe 2023 on the relationship between BPF and security. In it, he related some interesting history, from a somewhat different perspective than what is often described, he said. Among other things, it shows how BPF has been both a security problem and a security solution along the way.

• Security policies for GNU toolchain projects

  While the CVE process was created in response to real problems, it's increasingly clear that CVE numbers are creating problems of their own. At the 2023 GNU Tools Cauldron, Siddhesh Poyarekar expressed the frustration that toolchain developers have felt as the result of arguing with security researchers about CVE-number assignments. In response, the GNU toolchain community is trying to better characterize what is — and is not — considered to be a security-relevant bug in its software.

  Fuzzing the binutils utilities has, he began, become a popular exercise; it is an example of the "fuzzing epidemic" that is happening more widely. Fuzzing is good, he took pains to say, but what happens afterward is not. Researchers have started filing for CVE numbers, often for bugs which are not, in truth, security problems. The "infection" is spreading from binutils into the rest of the toolchain ecosystem. The whole CVE system, he said, is broken. People will report issues and get CVE numbers, but nobody involved has any real understanding of the context in which these bugs are found. As a result, a lot of engineering time goes into rebuilding packages, backporting fixes, and so on, all for problems that are not seen as valid security issues.

  Poyarekar would like to create a better focus for security efforts and channel that work into a more helpful direction. Doing so requires creating a better understanding of what constitutes a security issue. In short, a security issue is a bug that allows a user to do something that they would otherwise be unable to do. Issues can be divided into a few subcategories; there are, for example, "direct vulnerabilities" that affect the integrity of the system as a whole. Other types include security features (such as hardening) that do not work as they should, or design flaws that make exploits easier. The first two types tend to get fixed, often after the assignment of a CVE number. Design flaws can get CVEs from zealous researchers as well, but tend to result in little more than "hand wringing".

• Curl 8.4.0 released

  Version 8.4.0 of the curl data-transfer tool has been released, mostly in response to a relatively severe security vulnerability that can be triggered when a SOCKS5 proxy server is in use. See this blog post for details on what went wrong. ""In hindsight, shipping a heap overflow in code installed in over twenty billion instances is not an experience I would recommend.""

• Security updates for Wednesday

  Security updates have been issued by Debian (curl, mediawiki, tomcat10, and tomcat9), Fedora (libcaca, oneVPL, oneVPL-intel-gpu, and tracker-miners), Gentoo (curl), Mageia (cups and firefox, thunderbird), Red Hat (curl, kernel, kernel-rt, kpatch-patch, libqb, libssh2, linux-firmware, python-reportlab, tar, and the virt:rhel module), Slackware (curl, libcue, libnotify, nghttp2, and samba), SUSE (conmon, curl, glibc, kernel, php-composer2, python-reportlab, samba, and shadow), and Ubuntu (curl, dotnet6, dotnet7, firefox, libx11, samba, tiff, and webkit2gtk).

• Passwordless by default: Make the switch to passkeys

  Earlier this year we rolled out support for passkeys, a simpler and more secure way to sign into your accounts online. We’ve received really positive feedback from our users, so today we’re making passkeys even more accessible by offering them as the default option across personal Google Accounts.

  This means the next time you sign in to your account, you’ll start seeing prompts to create and use passkeys, simplifying your future sign-ins. It also means you’ll see the “Skip password when possible” option toggled on in your Google Account settings.

• Go ahead, let the unknowable security risks of Windows Copilot onto your PC fleet

  Those home machines – there’s only a few hundred million of them – are gradually getting the latest Windows 11 upgrade, and many of those users are slapping a technicolor Copilot icon on the taskbar. (Wisely, it's not enabled by default – yet.) The "PRE" embossed on the bottom of the Copilot icon tells you that it's still in preview – in other words, Microsoft's public beta of a very new and still broadly untested technology.

• Inside the deadly instant loan app scam that blackmails with nudes

  There are many apps that promise hassle-free loans in minutes. Not all of them are predatory. But many - once downloaded - harvest your contacts, photos and ID cards, and use that information later to extort you.

  When customers don't repay on time - and sometimes even when they do - they share this information with a call centre where young agents of the gig economy, armed with laptops and phones are trained to harass and humiliate people into repayment.

• Windows TCO

  • Ransomwared health insurer wasn't using antivirus software

    It's not unusual for government agencies in developing nations to use unlicensed software, when commercial licenses are often priced beyond their means. In 2021, for example, The Register covered an outage at Pakistan's Federal Board of Revenue that it swore could not have been caused by unpaid licenses because it caught up on its bills. Your correspondent also once spoke to a major vendor of design software that had 500 people show up to a conference in India – a nation in which it had sold no licenses and in which users felt they could pirate with impunity.

  • As Michigan bank becomes latest victim, SEC opens probe into MOVEit vulnerability

    MOVEit is managed file transfer software offered by Progress Software Corp. that is designed to provide secure and compliant file transfers for sensitive data within and between organizations. A vulnerability in the software discovered earlier this year, officially designated CVE-2023-34362, allows an unauthenticated, remote attacker to send a specially crafted SQL injection to a vulnerable MOVEit Transfer instance.

  • Justice department wants to fight R5 million fine over ransomware attack in court

    If that is 5 million ZMW, the current conversion rate to USD would make it $232,249.90 USD.

  • Justice department wants to fight R5 million fine over ransomware attack in court

    The Information Regulator imposed a R5 million fine on the department in July 2023 as an administrative penalty after failing to comply with an enforcement notice issued in May.

    Essentially, the regulator found that negligence contributed to the department falling victim to the attack.

  • Justice department takes Info Regulator to court over R5-million fine

    The department of justice & constitutional development is taking the Information Regulator to court to fight a R5-million fine the regulator imposed on it over a 2021 cyberattack.

    The fine against the department was the first administrative penalty imposed by the Information Regulator since its establishment and the court case could serve to set an important precedent in the way information security breaches are regulated in South Africa.

  • Notorious Qakbot Botnet Threat Continues Despite FBI Takedown

    LNK or Shell Link files are Windows shortcuts that can be used to open a separate file, folder, or application. In this case, the phishing emails have been circulating the LNK files with names such as “ATTENTION-Invoice-29-August.docx.lnk” or “Booking info.pdf.lnk” to trick recipients into opening them, which can then download and execute a malicious payload.

  • Internet companies Google, Amazon and Cloudflare report biggest-ever denial of service operation

    As the online world has developed, so too has the power of denial of service operations, some of which can generate millions of bogus requests per second. The recent attacks measured by Google, Cloudflare and Amazon - which began in late August and which the tech giants say are ongoing - were capable of generating hundreds of millions of request per second.