Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Submitted by Roy Schestowitz on Wednesday 10th of April 2019 03:25:46 PM Filed under
Security
  • It's raining patches, Hallelujah! Microsoft and Adobe put out their latest major fixes
  • Reproducible Builds: Weekly report #206
  • Brace yourselves: Exploit published for serious Magento bug allowing card skimming [Updated]

    Attack code was published on Friday that exploits a critical vulnerability in the Magento e-commerce platform, all but guaranteeing it will be used to plant payment card skimmers on sites that have yet to install a recently released patch.

    PRODSECBUG-2198 is a SQL injection vulnerability that attackers can exploit with no authentication required. Hackers could exploit the flaw to take administrative control of administrator accounts, assuming the hackers can download user names and password hashes and crack the hashes. From there, attackers could install the backdoors or skimming code of their choice. A researcher at Web security firm Sucuri said Thursday that company researchers reverse-engineered an official patch released Tuesday and successfully created a working proof-of-concept exploit.

  • Knock and don’t run: the tale of the relentless hackerbots
  • Mozilla Firefox 66.0.3 Now Available for Download on Linux, Windows, and Mac

    Needless to say, there are no new features in this release, as Mozilla typically uses these smaller updates for bug fixes and further performance improvements. New features are usually included in major browser updates.

    As per GHacks, Firefox 66.0.3 addresses performance issues with certain HTML5 games on Pogo.com. The browser should now work correctly when accessing this website and games should no longer run slower than expected on the platform.

  • Mozilla releases Firefox 66.0.3

    Mozilla plans to release Firefox 66.0.3, a minor upgrade to the web browser's stable channel, later today on April 10, 2019.

    Firefox 66.0.3 is the third minor release after the release of Firefox 66.0 in March 2019. Firefox 66.0.1 was a security update to address new vulnerabilities discovered by participants of the Pwn2Own hacking contest, Firefox 66.0.2 a bug fix release that addressed an issue with certain online editors.

  • Mozilla Open Policy & Advocacy Blog: What we think about the UK government’s ‘Online Harms’ white paper

    The UK government has just outlined its plans for sweeping new laws aimed at tackling illegal and harmful content and activity online, described by the government as ‘the toughest internet laws in the world’. While the UK proposal has some promising ideas for what the next generation of content regulation should look like, there are several aspects that would have a worrying impact on individuals’ rights and the competitive ecosystem. Here we provide our preliminary assessment of the proposal, and offer some guidance on how it could be improved.

    According to the UK white paper, companies of all sizes would be under a ‘duty of care’ to protect their users from a broad class of so-called ‘online harms’, and a new independent regulator would be established to police them. The proposal responds to legitimate public policy concerns around how platforms deal with illegal and harmful content online, as well as the general public demand for tech companies to ‘do more’. We understand that in many respects the current regulatory paradigm is not fit for purpose, and we support an exploration of what codified content ‘responsibility’ might look like.

  • Mysterious [Attackers] Hid Their Swiss Army Spyware for 5 Years

    In a talk at the Kaspersky Security Analyst Summit in Singapore Wednesday, Kaspersky security researcher Alexey Shulmin revealed the security firm's discovery of a new spyware framework—an adaptable, modular piece of software with a range of plugins for distinct espionage tasks—that it's calling TajMahal. The TajMahal framework's 80 modules, Shulmin says, comprise not only the typical keylogging and screengrabbing features of spyware, but also never-before-seen and obscure tricks. It can intercept documents in a printer queue, and keep track of "files of interest," automatically stealing them if a USB drive is inserted into the infected machine. And that unique spyware toolkit, Kaspersky says, bears none of the fingerprints of any known nation-state [attacker] group.

  • ‘She lies to everyone’: Feds say Mar-a-Lago intruder had hidden-camera detector in hotel [iophk: "Windows mindset, Windows TCO"]

    A federal prosecutor argued in court Monday that Yujing Zhang, the Chinese woman arrested trying to enter President Donald Trump’s private Mar-a-Lago club in Palm Beach, “lies to everyone she encounters,” adding that a search of her hotel room uncovered more than $8,000 in cash, as well as a “signal-detector” device used to reveal hidden cameras.

  • Thumb drive carried by Mar-a-Lago intruder immediately installed files on a [Windows computer]

     

    The details came to light at a bond hearing on Monday in a Florida federal court. There, a Secret Service agent testified that the malware Zhang carried was capable of infecting a computer as soon as the thumb drive was plugged in. According to a report published Monday by the Miami Herald: [...]

  • Chinese Woman Arrested at Mar-a-Lago Had a Hidden Camera Detector, Prosecutors Say

     

    Mr. Ivanovich testified that the computer analyst who reviewed Ms. Zhang’s devices said that the thumb drive she was carrying had immediately begun installing malware.
     

    “He stated that he had to immediately stop the analysis and shut off his [Windows] computer to halt the corruption,” Mr. Ivanovich said.

  • Chinese Intruder at Mar-a-Lago to Stay in Jail Another Week

     

    Secret Service agent Samuel Ivanovich testified Monday that another agent put the USB drive into his computer and it immediately began to install files. The agent shut down the computer to prevent a possible infection, but Ivanovich couldn’t identify the malware. The device is still being analyzed, Ivanovich said.

  • Mar-a-Lago mystery Chinese malware lady to stay in jail for another week
»

More in Tux Machines

digiKam 7.7.0 is released

After three months of active maintenance and another bug triage, the digiKam team is proud to present version 7.7.0 of its open source digital photo manager. See below the list of most important features coming with this release. Read more

Dilution and Misuse of the "Linux" Brand

Samsung, Red Hat to Work on Linux Drivers for Future Tech

The metaverse is expected to uproot system design as we know it, and Samsung is one of many hardware vendors re-imagining data center infrastructure in preparation for a parallel 3D world. Samsung is working on new memory technologies that provide faster bandwidth inside hardware for data to travel between CPUs, storage and other computing resources. The company also announced it was partnering with Red Hat to ensure these technologies have Linux compatibility. Read more

today's howtos

  • How to install go1.19beta on Ubuntu 22.04 – NextGenTips

    In this tutorial, we are going to explore how to install go on Ubuntu 22.04 Golang is an open-source programming language that is easy to learn and use. It is built-in concurrency and has a robust standard library. It is reliable, builds fast, and efficient software that scales fast. Its concurrency mechanisms make it easy to write programs that get the most out of multicore and networked machines, while its novel-type systems enable flexible and modular program constructions. Go compiles quickly to machine code and has the convenience of garbage collection and the power of run-time reflection. In this guide, we are going to learn how to install golang 1.19beta on Ubuntu 22.04. Go 1.19beta1 is not yet released. There is so much work in progress with all the documentation.

  • molecule test: failed to connect to bus in systemd container - openQA bites

    Ansible Molecule is a project to help you test your ansible roles. I’m using molecule for automatically testing the ansible roles of geekoops.

  • How To Install MongoDB on AlmaLinux 9 - idroot

    In this tutorial, we will show you how to install MongoDB on AlmaLinux 9. For those of you who didn’t know, MongoDB is a high-performance, highly scalable document-oriented NoSQL database. Unlike in SQL databases where data is stored in rows and columns inside tables, in MongoDB, data is structured in JSON-like format inside records which are referred to as documents. The open-source attribute of MongoDB as a database software makes it an ideal candidate for almost any database-related project. This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the MongoDB NoSQL database on AlmaLinux 9. You can follow the same instructions for CentOS and Rocky Linux.

  • An introduction (and how-to) to Plugin Loader for the Steam Deck. - Invidious
  • Self-host a Ghost Blog With Traefik

    Ghost is a very popular open-source content management system. Started as an alternative to WordPress and it went on to become an alternative to Substack by focusing on membership and newsletter. The creators of Ghost offer managed Pro hosting but it may not fit everyone's budget. Alternatively, you can self-host it on your own cloud servers. On Linux handbook, we already have a guide on deploying Ghost with Docker in a reverse proxy setup. Instead of Ngnix reverse proxy, you can also use another software called Traefik with Docker. It is a popular open-source cloud-native application proxy, API Gateway, Edge-router, and more. I use Traefik to secure my websites using an SSL certificate obtained from Let's Encrypt. Once deployed, Traefik can automatically manage your certificates and their renewals. In this tutorial, I'll share the necessary steps for deploying a Ghost blog with Docker and Traefik.

More on Tux Machines: About ● Gallery ● Forum ● Blogs ● Search ● News ● RSS Feed

Part of Bytes Media ● Sister sites below.

TechBytes Techrights button

Powered by Drupal, an open source content management system

Content available under CC-BY-SA CC

© by original authors

Powered by CentOS 6.5 (GNU/Linux), Varnish, and Drupal 6