Security Leftovers
-
LWN ☛ Security updates for Tuesday
Security updates have been issued by Debian (openjdk-17), Fedora (chromium, fastd, ovn, and yq), Mageia (libxml2 and redis), Oracle (gstreamer1-plugins-base, gstreamer1-plugins-good), Red Hat (buildah, bzip2, galera, mariadb, grafana, keepalived, libsoup, mariadb:10.11, mariadb:10.5, mingw-glib2, podman, python-jinja2, and rsync), SUSE (bind, ignition, java-11-openjdk, java-17-openjdk, krb5, libxml2, openssl-1_1, orc, python-asteval, rsync, and xrdp), and Ubuntu (harfbuzz, libndp, libvpx, and opencv).
-
Krebs On Security ☛ Who’s Behind the Seized Forums ‘Cracked’ & ‘Nulled’?
The FBI joined authorities across Europe last week in seizing domain names for Cracked and Nulled, English-language cybercrime forums with millions of users that trafficked in stolen data, hacking tools and malware. An investigation into the history of these communities shows their apparent co-founders quite openly operate an Internet service provider and a pair of e-commerce platforms catering to buyers and sellers on both forums.
-
Ubuntu ☛ The role of FIPS 140-3 in the latest FedRAMP guidance
There has long been a tension between the requirements for strictly certified FIPS crypto modules and the need to keep software patched and up to date with the latest security vulnerability fixes. The new guidance goes a ways to resolving this tension – and best of all, it aligns perfectly with how we’ve already been approaching FIPS module updates for Ubuntu.
-
Windows TCO / Windows Bot Nets
-
Wired ☛ Meet the Hired Guns Who Make Sure School Cyberattacks Stay Hidden
An investigation into more than 300 cyberattacks against US K–12 schools over the past five years shows how schools can withhold crucial details from students and parents whose data was stolen.
-