The sharing feature of the Jetpack plugin for WordPress is currently being exploited for the purpose of sending spam and possibly for DDOS attacks. FOSS…
Posts published in “Security”
FOSS Week in Review
Java is the target for half of all exploits
We’ve been saying for a couple of years now that Java isn’t safe and have been urging everyone who will listen to disable Java in the browser. As we’ve been saying this, comments to our articles on Java security have filled with folks wagging a finger and “reminding” us that Java is only a threat in the browser, that otherwise Java is safe.
That is wrong. The only time Java is safe is when it’s in a cup. According to an article published on IT World, researchers say that Java is now responsible for fully half of the exploits discovered in December.
FOSS Week in Review
Cops tracking phones sans warrants
It appears that the police in Tallahassee, Florida have been busy tracking folks by their cell phones without bothering to show up before a judge and ask for a warrant. Why would they violate the constitutional rights of their citizens this way? Evidently because they were using technology on loan and had signed a non-disclosure agreement.
According to Wired, this information came to light in an appeal of a sexual battery case dating back to 2008 in which a suspect was tracked using the technology to locate a phone that had been stolen from the victim. The police have admitted using the device 200 times, with no judge or warrant involved, since 2010. In a blog post made Monday, the ACLU said the device is “likely a Stingray made by the Florida-based Harris Corporation.” Evidently, the ACLU has long suspected that Harris has been loaning the devices to Florida police departments.
FOSS Week in Review
Botnet steals bitcoins
We figure that any currency that can’t be safely tucked into a mattress isn’t secure, so we haven’t been too quick to jump on the bitcoin bandwagon. Needless to say, we weren’t surprised on Monday when Reuters reported that there’s a botnet on the loose with the aim of stealing the virtual currency.
According to the Chicago based security firm Trustwave, hundreds of thousands of computers have been infected with “Pony” malware to form a botnet going after bitcoin and other virtual currencies. So far, at least 85 virtual wallets have been stolen.
FOSS Week in Review
The day we fought back
Tuesday, February 11th, The Day We Fight Back, has come and gone. Whether the event was a success, failure or fell somewhere in between depends on whom you read.
Surprisingly, the biggest naysayer was probably the New York Times, which started an article. “The Day the Internet Didn’t Fight Back,” with the line, “So much for mass protest.” It appears as if the Times’ metric for this judgement was the lack of participation by some sites which took part in the online SOPA protest a couple of years back.
At about 1 p.m. this afternoon the security company behind the WordFence plugin for WordPress issued a security advisory via email informing users of their plugin that WordPress sites are currently under a brute force attack.
“As of 11am eastern time this morning we are monitoring the largest distributed brute force attack on WordPress installations that we’ve seen to date. The real-time attack map on www.wordfence.com became so busy that we’ve had to throttle the amount of traffic we show down to 4% of actual traffic.
“A brute force attack is when an attacker tries many times to guess your username password combination by repeatedly sending login attempts. A distributed brute force attack is when an attacker uses a large number of machines spread around the internet to do this in order to circumvent any blocking mechanisms you have in place.”
Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux
There is a tablet in my house that blinks whenever my roommate has a message. I know this because for some reason it’s my job to keep it charged for her. It has front and back cameras. The built-in microphone and speakers are capable of holding a conversation in English–probably other languages as well. With what we know now, I must assume that the NSA has the ability to activate the cameras and microphone to run silently in the background, bypassing the light that indicates when the camera is in use.
The same is true of the other computers in my home, but to a lesser degree.
The desktop I’m using to write this article doesn’t have a camera or a microphone. Nor does the old Dell laptop that gets used occasionally around the house. My other laptop, a newer Gateway, is equipped with a built-in camera and microphone, but I’ve never managed to get the microphone to work under Bodhi Linux. Not that I’ve tried very hard. I don’t Skype or anything, so a microphone is of very little use to me.
This is probably a good thing as it means the NSA can’t watch or listen to me as I use my desktop or Dell and they can’t eavesdrop when I’m on the Gateway. They can only steal my bank passwords, learn where I store data online and what social networking accounts are connected with me.
Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux
Publishers of web sites using the WordPress platform who would like to participate in The Day We Fight Back on Tuesday might be interested in…
FOSS Week in Review
Canadians spy at airports
The more we see of the Snowden revelations the more we wonder, when did the English speaking world become a police state?
The latest news was reported January 30th by the Canadian Broadcasting Corporation (CBC), from which we learned that all the electronics eavesdropping hasn’t been being conducted solely by the U.S. and the Brits. The Canadians have had their hand in it too.
It seems that Communications Security Establishment Canada (CSEC), a Canadian spy agency, has been using the free Wi-Fi at “a major Canadian airport” to track wireless devices, which presumably would include laptops as well as phones and tablets. The surveillance would continue for days after visitors passed through the airport.
It looks as if Red Hat has some work cut out for them if they care what impression folks in the FOSS community have about them. If the results of our Red Hat &the NSA poll are any indication, some people aren’t convinced that the most commercially successful Linux distro on the planet has clean hands when it comes to the whole NSA mess.
A few weeks back, in response to what I thought (and still think) were unfounded allegations that Red Hat has been working with the NSA spying efforts by doing things like building back doors into RHEL, we ran a poll that asked the simple question, “Do you think Red Hat is cooperating with the NSA by building back doors into RHEL?” The poll went up on January 23rd and was ended this afternoon.
Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux