Language Selection

English French German Italian Portuguese Spanish

Security and Proprietary Software

Submitted by Roy Schestowitz on Saturday 8th of May 2021 08:35:38 AM Filed under
Security
  • This Week In Security: BYOVD, Spectre Vx, More Octal Headaches, And ExifTool | Hackaday

    I learned a new acronym while reading about a set of flaws in the Dell BIOS update system. Because Dell has patched their driver, but hasn’t yet revoked the signing keys from the previous driver version, it is open to a BYOVD attack.

    BYOVD, Bring Your Own Vulnerable Driver, is an interesting approach to Windows privilege escalation. 64-bit versions of Windows have a security feature that blocks unsigned kernel drivers from the kernel. The exploit is to load an older, known-vulnerable driver that still has valid signatures into the kernel, and use the old vulnerabilities to exploit the system. The caveat is that even when a driver is signed, it still takes an admin account to load a driver. So what use is the BYOVD attack, when it takes administrative access to pull off?

    [...]

    The Exim mail server was started in 1995 as a Mail Transfer Agent for Unix machines. Qualys audited Exim, and the results weren’t pretty. Qualys calls the result 21Nails, as there are 21 serious vulnerabilities found in the effort, many of which existing as far back as the git history of the project. While the report doesn’t include PoC code, they will likely be quickly developed independently, so if you run Exim, go update your servers now.

  • Investment Scammer John Davies Reinvents Himself?
  • Stadia Exodus Continues As Product Head For Stadia Exits

    The troubling signs for Google's video game streaming platform Stadia continue. While I have to admit that I had really high hopes for Stadia, nothing about this has been smooth from launch to its current state of, well, who the hell knows what is going to happen to it. From a poor initial reception to questions about failed promises on performance, the conversation about Stadia quickly focused on the platform not offering much in the way of an actual game catalogue to play. Less than a year later, Google made this problem even worse by disbanding its own in-house game developers, leading to more fallout when Stadia could suddenly not support its own internally developed game.

  • UK Court Overturns 39 Convictions Of Post Office Workers Caused By Buggy Software

    Never underestimate the power of technology to destroy lives. Flawed software used for the last 20 years by the UK postal service resulted in dozens of wrongful criminal convictions which are only just now being overturned.

  • BT Smart Hub 2 router 'disrupting' home networks

    Users are complaining that any devices not linked to the same frequency, such as a phone and a speaker, are refusing to communicate with each other.

    BT is offering firmware updates to those affected.

  • U.S., U.K. Reveal Code Flaws Abused by SolarWinds [Crackers]

    The report contains technical resources about the group’s tactics, including breaching email in order to find passwords and other information to further infiltrate organizations, in addition to providing software flaws commonly exploited by the [crackers]. It also offers details about how network administrators can counter the attackers’ tactics.

  • In Epic v Apple, everybody is losing at the game of defining games

    What is the difference between an “app” and a “game?” This sounds like a stoner question but instead occupied a fair amount of the morning in Epic v. Apple. Roblox, explained Apple’s marketing manager Trystan Kosmynka, was an app. See, games have a beginning, an end, and challenges. “There’s experiences within Roblox that we did not look at as a game,” Kosmynka said. We did establish that Minecraft is a game, though, so that’s nice for Microsoft.

    Judge Yvonne Gonzalez Rogers did not understand this distinction and neither did I. But here’s the problem for Apple: if Roblox is a game, then it’s fairly easy for Epic to compare Fortnite to it. Also, looking up Roblox in the App Store after Kosmynka testified, it is categorized as a “game.”

»

Postmasters and Miscarriages of Justice

Submitted by Roy Schestowitz on Saturday 8th of May 2021 09:16:44 AM.
  • A Very British Case: Postmasters and Miscarriages of Justice

    There were figures such as Seema Misra, convicted for stealing £74,000 in cash from the Post Office branch under her stewardship in West Byfleet in 2010.  At the time, the press delighted in calling her the “pregnant thief”.  Her husband was assaulted by locals.  Della Robinson, who ran the Dukinfield, Greater Manchester Post Office, could not account for £17,000 by 2012.  She was suspended, reported to the police and faced a community service sentence.

    The reason for their convictions lay in the accounting nightmare produced by the Horizon system.  It had ominous beginnings, growing up from a contract between the computer company ICL, the Post Office and the Benefits Agency, all part of what were termed private finance initiatives (PFI).  Developed by Japanese company Fujitsu, Horizon featured a swipe card system for paying pensions and benefits via the counters of Post Office branches.  The venture proved calamitous, ailed by chronic mismanagement, weaknesses in the technology and general human incompetence.  The cost of that endeavour to the British taxpayer: £700 million.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

digiKam 7.7.0 is released

After three months of active maintenance and another bug triage, the digiKam team is proud to present version 7.7.0 of its open source digital photo manager. See below the list of most important features coming with this release. Read more

Dilution and Misuse of the "Linux" Brand

Samsung, Red Hat to Work on Linux Drivers for Future Tech

The metaverse is expected to uproot system design as we know it, and Samsung is one of many hardware vendors re-imagining data center infrastructure in preparation for a parallel 3D world. Samsung is working on new memory technologies that provide faster bandwidth inside hardware for data to travel between CPUs, storage and other computing resources. The company also announced it was partnering with Red Hat to ensure these technologies have Linux compatibility. Read more

today's howtos

  • How to install go1.19beta on Ubuntu 22.04 – NextGenTips

    In this tutorial, we are going to explore how to install go on Ubuntu 22.04 Golang is an open-source programming language that is easy to learn and use. It is built-in concurrency and has a robust standard library. It is reliable, builds fast, and efficient software that scales fast. Its concurrency mechanisms make it easy to write programs that get the most out of multicore and networked machines, while its novel-type systems enable flexible and modular program constructions. Go compiles quickly to machine code and has the convenience of garbage collection and the power of run-time reflection. In this guide, we are going to learn how to install golang 1.19beta on Ubuntu 22.04. Go 1.19beta1 is not yet released. There is so much work in progress with all the documentation.

  • molecule test: failed to connect to bus in systemd container - openQA bites

    Ansible Molecule is a project to help you test your ansible roles. I’m using molecule for automatically testing the ansible roles of geekoops.

  • How To Install MongoDB on AlmaLinux 9 - idroot

    In this tutorial, we will show you how to install MongoDB on AlmaLinux 9. For those of you who didn’t know, MongoDB is a high-performance, highly scalable document-oriented NoSQL database. Unlike in SQL databases where data is stored in rows and columns inside tables, in MongoDB, data is structured in JSON-like format inside records which are referred to as documents. The open-source attribute of MongoDB as a database software makes it an ideal candidate for almost any database-related project. This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the MongoDB NoSQL database on AlmaLinux 9. You can follow the same instructions for CentOS and Rocky Linux.

  • An introduction (and how-to) to Plugin Loader for the Steam Deck. - Invidious
  • Self-host a Ghost Blog With Traefik

    Ghost is a very popular open-source content management system. Started as an alternative to WordPress and it went on to become an alternative to Substack by focusing on membership and newsletter. The creators of Ghost offer managed Pro hosting but it may not fit everyone's budget. Alternatively, you can self-host it on your own cloud servers. On Linux handbook, we already have a guide on deploying Ghost with Docker in a reverse proxy setup. Instead of Ngnix reverse proxy, you can also use another software called Traefik with Docker. It is a popular open-source cloud-native application proxy, API Gateway, Edge-router, and more. I use Traefik to secure my websites using an SSL certificate obtained from Let's Encrypt. Once deployed, Traefik can automatically manage your certificates and their renewals. In this tutorial, I'll share the necessary steps for deploying a Ghost blog with Docker and Traefik.

More on Tux Machines: About ● Gallery ● Forum ● Blogs ● Search ● News ● RSS Feed

Part of Bytes Media ● Sister sites below.

TechBytes Techrights button

Powered by Drupal, an open source content management system

Content available under CC-BY-SA CC

© by original authors

Powered by CentOS 6.5 (GNU/Linux), Varnish, and Drupal 6