Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (edk2), Debian (webkit2gtk), Fedora (thunderbird), Oracle (bzip2, container-tools:ol8, edk2, go-toolset:ol8, libtiff, python-idna, python3.11, and python3.12), Slackware (expat), and SUSE (apache2, govulncheck-vulndb, grub2, java-1_8_0-openjdk, python3, python39, qemu, xorg-x11-server, and xwayland).
-
Integrity/Availability/Authenticity
-
Tor ☛ Defending the Tor network: Mitigating IP spoofing against Tor | The Tor Project
At the end of October, Tor directory authorities, relay operators, and even the Tor Project sysadmin team received multiple abuse complaints from their providers about port scanning. These complaints were traced back to a coordinated IP spoofing attack, where an attacker spoofed non-exit relays and other Tor-related IPs to trigger abuse reports aimed at disrupting the Tor Project and the Tor network.
Thanks to a joint effort from the Tor community, InterSecLab, and the support of Andrew Morris and the team at GreyNoise, the origin of these spoofed packets was identified and shut down on November 7th, 2024.
We want to reassure everyone that this incident had no effect on Tor users. While the attack had a limited impact on the Tor network - taking a few relays offline temporarily - it caused unnecessary stress and inconvenience for many relay operators who had to address these complaints. Although this attack targeted our community, IP spoofing attacks can happen with any online service.
-
-
Windows TCO
-
The Register UK ☛ No word from Microsoft on shock Windows Server 2025 installs
On November 5, Microsoft seemingly mislabeled the Windows Server 2025 upgrade with a globally unique identifier (GUID) for updates. The result was that some administrators' were faced with a surprise install of Windows Server 2025 thanks to patching software downloading and installing what was tagged as an update but instead turned out to be a whole new operating system.
-
The Record ☛ TSA floats new rules mandating cyber incident reporting for pipelines, railroads
The Transportation Security Administration proposed new rules this week that would codify existing temporary directives requiring pipeline and railroad operators to report cyber incidents and create cyber risk management (CRM) plans.
The rule would formalize several security directives issued by TSA since the ransomware attack on Colonial Pipeline in 2021.
-