Security Leftovers
-
Atlantic Council ☛ Capture the (red) flag: An inside look into China’s hacking contest ecosystem
China has built the world’s most comprehensive ecosystem for capture-the-flag (CTF) competitions—the predominant form of hacking competitions, which range from team-versus-team play to Jeopardy-style knowledge challenges.
-
Bruce Schneier ☛ Justice Department Indicts Tech CEO for Falsifying Security Certifications
The Wall Street Journal is reporting that the CEO of a still unnamed company has been indicted for creating a fake auditing company to falsify security certifications in order to win government business.
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-21-openjdk, and webkit2gtk3), Debian (apache2), Red Hat (expat), SUSE (cups-filters, jetty-minimal, OpenIPMI, and python-starlette), and Ubuntu (linux-azure, linux-azure, linux-azure-5.15, linux-azure, linux-azure-5.4, and oath-toolkit).
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 281 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
281. This version includes the following changes:* Don't try and test with systemd-ukify within Debian stable.
[ Jelle van der Waa ]
* Add support for UKI files.
-
Bleeping Computer ☛ Intel, AMD CPUs on Linux impacted by newly disclosed Spectre bypass
The latest generations of Intel processors, including Xeon chips, and AMD's older microarchitectures on Linux are vulnerable to new speculative execution attacks that bypass existing ‘Spectre’ mitigations.
The vulnerabilities impact Intel's 12th, 13th, and 14th chip generations for consumers and the 5th and 6th generation of Xeon processors for servers, along with AMD's Zen 1, Zen 1+, and Zen 2 processors.