Press "Enter" to skip to content

Posts published in “Security”

Verizon Case Illustrates Why We Need a Linux Phone

There are plenty of reasons to be anticipating the arrival of GNU/Linux phones and tablets. Verizon Wireless has given us another.

On March 7, the FCC slapped a $1.35 million fine on Verizon in a privacy case, a move that’s being hailed as a victory by some privacy advocates. If so, it would seem to be a hollow victory. For starters, the fine is too low to be much of a deterrent against a company which last year had annual gross income of over $63 billion. But there is much more wrong with the agreement the carrier reached with the FCC than merely the price tag.

Verizon logoThe case revolves around Verizon’s use of a supercookie — a cookie that uses a variety of techniques to make it nearly impossible to remove or disable — which the carrier began placing on its customers’ phones in 2012. The cookie gathered information that combined a person’s Internet history — whether through browsers or apps — with their unique customer information. The company ran afoul of the law because of the way it shared the information it gleaned with third parties.

Top Websites Hit With Malware Ads

Some of the biggest online advertising networks this weekend served malware laden ads to some of the Internet’s highest trafficked websites.

Some of the most visited sites on the Internet began delivering malware laden ads this weekend. The sites affected included The New York Times, the BBC, MSN, and AOL. Those who visited a site delivering the ads are not at risk unless they clicked on an infected ad. After clicking, users are taken to another website which attempts to infect them with either Cryptowall ransomware or a trojan that gives the attackers control of the infected computer. The good news for FOSS Force readers is that the malware seems to only work against Windows, so GNU/Linux users are considered safe.

Cyber Security Malware

Dangerous TLDs, Ballmer’s Linux Love & More…

FOSS Week in Review

Two big open source conferences are coming up next week, while this week an automaker said it doesn’t have to pay attention to the GPL and the man credited with inventing email passed.

Although Microsoft mainly succeeded in its attempts to hijack the FOSS news scene this week by spreading open source love — better than spreading FUD, I guess — there was plenty of FOSS news happening away from the Redmond campus. Even Microsoft with all its billions, it seems, isn’t large enough to monopolize all of the news in the big, wide and wonderful world of FOSS.

Edward Snowden LibrePlanet 2016
Edward Snowden will be the opening keynote speaker, with Daniel Kahn Gillmor, at LibrePlanet 2016.

For starters, it’s conference season. Well, except for a lull in the dog days of summer, Linux and open source conferences are always in season, but there are a couple of big ones on the slate for next week.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

FSF Gives Nod to ThinkPenguin VPS Router

A router designed to ease the use of multiple devices through a virtual private network is the latest hardware project to receive FSF’s official blessing.

The people at the Free Software Foundation aren’t only working to keep software free and accessible, they’re also concerned with hardware freedom as well. We mention this because the FSF announced on Thursday that it’s awarded the Respects Your Freedom certification to ThinkPenguin’s Free Software Wireless-N Mini Router (TPE-R1100). On a post on the FSF website, Joshua Gay, the foundation’s licensing and compliance manager, wrote that the certification has been given to three other ThinkPenguin products, including another router. The certification signifies that the product meets FSF’s standards concerning “users’ freedom, control over the product, and privacy.”

Why Linux Distros Look Insecure Even Though They’re Not

The transparency of open software means that security vulnerabilities are visible and can’t be quietly swept under the rug.

Another bunch of scary security alerts from your favorite Linux distro has hit the front page of FOSS Force. It was the same last week and the week before, and will be the same next week and the week after.

Linux security

One FOSS-boosting friend claims the alerts are the result of “media sensationalism.” While it’s possible that there is a clickbait element to some of the reports (DROWN, anyone?), most of the reported vulnerabilities are real and serious, and we need to know about them.

Robin "Roblimo" Miller

Robin “Roblimo” Miller is a freelance writer and former editor-in-chief at Open Source Technology Group, the company that owned SourceForge, freshmeat, Linux.com, NewsForge, ThinkGeek and Slashdot, and until recently served as a video editor at Slashdot. Now he’s mostly retired, but still works part-time as an editorial consultant for Grid Dynamics, and (obviously) writes for FOSS Force.

More Linux Phones, More Mint Hack & Just Plain More…

FOSS Week in Review

As Linux Mint scrambles to get security back on track, numerous prototypes of Linux phones are on display and Ubuntu gathers awards at the Mobile World Conference in Barcelona.

What a week in the FOSS world. So much has happened since our last Week in Review that I think I’ll skip the idle chitchat about the weather and such and get straight to business. Well, I will take the time to tell you that it’s been damned cold in these parts and I’m more than ready for spring…

Linux Mint LogoThe Great 2016 Linux Mint Hack: The hack at one of the crown jewels of Linux distros has undoubtedly been the biggest story this week. I’ll not bore you by repeating details which most of you have probably already read by now, but will direct those of you who don’t know to FOSS Force’s coverage on Sunday, and to our report on Monday in which Freedom Penguin Matt Hartley helps me take a look at the nature of the crack/hack.

The good news is that things are slowly — very slowly — returning to normal for the Mint team. By midweek, things were under control enough that the switch could be flipped on Mint’s server, putting the website back online. On Thursday I had a very brief email discussion with the distro’s project leader Clem Lefebvre — “very brief” because Lefebvre was more than little busy at the time. He and his team are in up to their elbows, working to make sure that everything works and plays well with the hardening they’ve done to Mint’s server, as well as working overtime to find any niggling security issues. In other words, they have it all under control, even as they work to get it more under control.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Linux Mint: Anatomy of a Hack

The hackers who compromised the Linux Mint site on Saturday were evidently not the brightest stars in the dark web, but they managed to create a mess for the Mint crew to clear away.

Everybody understands that none of a stage magician’s tricks are real. The one thing that is real, and which a successful illusionist must practice to perfection, is the art of misdirection — which evidently turned out the be the trick under the sleeves of the cracker/hackers who were responsible for compromising ISO downloads of Linux Mint 17.3 Cinnamon on Saturday.

In the FOSS Force news article on the hack which ran Sunday, we said “the hackers modified the ISO of the Cinnamon edition of Linux Mint 17.3 (Rosa).” We now know that’s not quite true, or at least not in the way we meant. The hackers didn’t bust into the Mint server and modify the binaries waiting to be grabbed by the mirror sites for downloads. Instead, this was a case of misdirection.

The hackers had a copy of Mint with their malicious payload in place, packaged as an ISO image and sitting on a Bulgarian server they controlled, waiting to serve downloads of what is arguably the worlds most popular version of GNU/Linux. The intrusion at Mint was a quick in-and-out to change the URLs in the anchor tags on Mint’s download page for the 64-bit Cinnamon version of Linux Mint 17.3 “Rosa.” Afterwards, users who clicked on a link to download from, say, the Internet Solutions mirror in South Africa, were taken to the hackers’ server in Bulgaria. Let the download begin. Wham, bam, thank you mam.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Linux Mint Hacked: ISO for 17.3 Cinnamon Edition Modified

An intrusion of the Linux Mint server on Saturday makes downloads performed on Saturday of version 17.3 Cinnamon potentially vulnerable.

Linux Mint project leader Clem Lefebvre revealed in a blog post today that the popular Linux distribution’s servers were hacked on Saturday. During the “brief” intrusion, the hackers modified the ISO of the Cinnamon edition of Linux Mint 17.3 (Rosa) and also gained access to the distro’s forum database. Only this particular ISO is affected; other editions or releases are considered safe. Only ISO’s downloaded Saturday are potentially vulnerable.

FreeBSD, Variants Not Affected by Recent GNU Bug

Larry the BSD Guy

The glibc security vulnerability that Linux developers have been scrambling to patch does not affect *BSD.

Much has been made about a vulnerability in a function in the GNU C Library. And searching far and wide over the Internet, there was little — actually nothing — I could find regarding how this affected BSD variants.

However, you can rest easy, BSDers: Not our circus, not our monkeys.

Dag-Erling Smørgrav, a FreeBSD developer since 1998 and a former FreeBSD Security Officer, writes in his blog that “neither FreeBSD itself nor native FreeBSD applications are affected.”

Larry Cafiero

Larry Cafiero, a.k.a. Larry the Free Software Guy, is a journalist and a Free/Open Source Software advocate. He is involved in several FOSS projects and serves as the publicity chair for the Southern California Linux Expo. Follow him on Twitter: @lcafiero

Microsoft Kidnaps Windows, Malware Everywhere & More…

FOSS Week in Review

The big Linux conference down in the land of Oz just completed and there are no really big shows on the agenda until Atlanta’s Great Wide Open opens its great doors wide in March. Everybody here in North Carolina, which I call home, is on the road, hanging out in Baghdad-by-the-Bay waiting to see how well the Panthers play in fog and trying to pretend to be old hats at having a pro home team worth the effort of a root or two.

You’d think it would be quiet around here, but it’s not. As always, it’s one thing after another, and as a coworker often often says, I’m getting too old for this. I could tell you stories, but I’m not. What I am going to tell you is the high points of this week in FOSS…

If you’re a Windows user, which most of you reading FOSS Force aren’t, then Microsoft wants to hijack your machine. It seems that the company that’s been spending millions — and has been buying into every free and open source conference it can find and a few it can’t — to get the word out that “Microsoft has changed,” hasn’t. If you happen to be unlucky enough to be using Windows 7, 8 or 8.1, you’re probably beginning to realize this right about now.

Windows users might be well advised to think about unplugging their computers from the Internet when they’re not around to keep an eye on things or they’re likely to wake-up in the morning, or return home from work, to find they’re running Windows 10 instead of whatever version they know and love.

Christine Hall

Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux

Readers Say ‘No’ to Antivirus on Linux

The FOSS Force Poll

A few weeks back when Ken Starks wrote an anecdotal column on an experience with a false positive from Avast antivirus on GNU/Linux, we started thinking. We run antivirus on our LAMP servers with the intent of protecting poor suckers on Windows, but on our Linux desktops and laptops? Pretty much, no. Some of us had tried the open source ClamAV at one time or another, mainly out of curiosity, but none of us had stuck with it. To our knowledge, until Starks wrote his column none of us even knew anybody who had ever run proprietary AV on Linux boxes.

antivirus can be picked like a lock
By Rudolf Simon [CC BY 3.0 ]
That was a far cry from our Windows days — and it would be a fair assumption to say that everyone here at one time or another relied on Windows as their primary operating system. In those days, the first thing we’d do with a new or new used box was download and install AVG, Avast or Symantec, and maybe even throw in a third party firewall such as Zone Alarm, just to be on the safer side.

Did any of it work? Who knows? But as an old friend of ours used to say, “We have to do something, even if it’s wrong.”

Breaking News: