Security Leftovers
-
Medevel ☛ Cracking the Code: Static vs. Dynamic Analysis for Aspiring Security Pros
Unveiling the Power of Code Analysis in Penetration Testing
Cracking the Code: Static vs. Dynamic Analysis for Aspiring Security Pros
-
Bryan Lunduke ☛ Did The Internet Archive Hack Themselves?
The Internet Archive Hack gets weirder and weirder by the day.
-
TecMint ☛ 10 Best Open Source Firewalls for Securing GNU/Linux Servers
As a GNU/Linux administrator for over ten years, my primary responsibility has always been the security management of GNU/Linux servers.
-
LWN ☛ A vulnerability in the Guix build system
Guix project has disclosed a security vulnerability in the build daemon that the distribution uses to build and install software locally. The vulnerability allows an existing unprivileged user to get access to a setuid binary, and from there potentially interfere with any other software built or installed on the computer. The project recommends upgrading the guix daemon now, to avoid the issue. This exploit requires the ability to start a derivation build and the ability to run arbitrary code with access to the store in the root PID namespace on the machine the build occurs on. As such, this represents an increased risk primarily to multi-user systems and systems using dedicated privilege-separation users for various daemons: without special sandboxing measures, any process of theirs can take advantage of this vulnerability.