Security » CUDUWUDU – Tech & Computer blog

Evaluating Linux desktop security

first_main_article” class=”article readability=”57″>

This is called a study that echo MuySeguridad our fellow, whose sentence is none other than Linux desktop security could be much better . We will not repeat here what I can read in the above link, but we will give some specific detail.

xEvaluando Linux desktop security

short, all this begins with a recognized security expert IOActive class=”notranslate”> has discovered more than 60 potential security holes ., All related to your desktop.

class=”notranslate”> are many times you are going to read the word sojourn desktop entry, then X.Org problems ranging from a Gclib, or GNOME and KDE . And not everything that has published a precaution found. That’s why we take a look at Assessing the Linux Desktop’s Security (PPT, 74 pages) is quite interesting, though not too understand what is there if one is not versed in computer codes.

For example, it highlights a problem with Qt with your developers disagree, so we have no problem to be published. Who is right here? or security expert Qt developers? As I say, is just one example, but there are many more, and no one thinks that this is something that affects a single distribution, desktop environment or application, because it is widespread.

By contrast, other problems have been reported and are solved or way of being, and many others remain unknown. There’s a bit of everything here. But do not be alarmed or shocked, although the author of the study stops short of recommending the use of dietlibc or uClibc detriment of glibc, which considers (free translation) “a monster superhinchado stale code.”

In short, navel-gazing it does not apply to software, whether free or proprietary. There are errors in all creation and you should put more attention on it , always taking as a reference the bonded labor. So we are left with the final note left on MuySeguridad: need to check if the model of development makes a difference in the resolution of these problems, or not. Today rock some self-criticism.

yarpp-related-none” class=”yarpp-related

No related posts.

Linus: UEFI is not security, but control

class=”article first_main_article” readability=”73″>Do you remember those two

polemics which we fought us? As a going to be impossible, since the discussion has continued in crescendo, leaving details of interest and the father of Linux once again showing its character and attention, putting the user first: Linux will jump through hoops of Microsoft’s Secure Boot . And point.

Linus: UEFI is not security, but control

that you walk a little clueless, start the story at the beginning, when it was revealed that Windows 8 would incorporate secure boot feature using UEFI, which basically serve as a replacement to existing and decrepit after BIOS upgrade system security, preventing software startup unsigned and potentially dangerous .

What’s wrong with the above? That the vast majority of computers sold in the world come with Windows pre-installed, and Microsoft is signing keys UEFI security on devices with its operating system . In short and possibilities “unofficial” apart, who would like to install a Linux distribution on your newly bought computer with Windows 8 could not, at least a priori.

As you can imagine, the mess was monumental, even though from Microsoft were quick to calm down. The official solution passed through reliable Linux distributions that go through the hoop Microsoft , requesting certified keys for this purpose. From there, each went his way distribution, Fedora being the most active in this respect (the first to pay the license to generate their own keys, offering them to other community GNU / Linux). Even the Linux Foundation came into play.

So, the problem was gone, and in fact the latest releases of the most popular distros already support Microsoft’s Secure Boot . Without thier, although the problem was gone, you could do something to improve the implementation of Microsoft’s UEFI (stating the distinction and repetition) in GNU / Linux, preventing developers work distros if firms included directly into the kernel . That’s at least what he must have thought the Red Hat engineer who dared last week with the request. But …

fuck u linus Linus: UEFI is not security, but control

Linux

response and know not (more details at the link). What if Red Hat wanted, could deploy your kernel, but not the kernel he keeps . Mainly because it is not a standard, but a “thing” that Microsoft’s own security will not but control . To make matters worse, Microsoft, only certification authority for now, just sign binary . Once again …

fuck u linus Linus: UEFI is not security, but control

And again you can imagine the response of Linus (expletives included, of course). But in addition to take fire from his mouth, the distinguished finlandéis took something of his genius-productive in the sense of the word, and suggested some changes, “ instead of trying to please Microsoft, see how we can increase security really “(we will look and see if something interesting comes out of there). The discussion, however, continues, now spread throughout the network

And what is it? In that while Linus send, “it” is not within the Linux code . Or at least not as it will now arise. And how does that affect users of GNU / Linux? anything . Why I rewrite on a subject that neither going nor coming to using GNU / Linux and also can not explain or understand without technical knowledge of many lack? Because now the end has been imposed, would be the answer. But I have not very clear.

Security hole discovered in the Linux kernel

class=”article first_main_article” readability=”41″>According

published MuySeguridad our fellow last night, has discovered a vulnerability in the kernel Linux by which an attacker could gain root access . Affected versions are Linux 3.3 onwards .

computer security hole discovered bug in the Linux kernel

Apparently, the hole is in the kernel networking code , and has not been heard of him until this past weekend appeared online an exploit with which “take advantage “.

Among

vulnerable to this flaw distributions are Fedora 17 and Ubuntu 18 or Ubuntu 12.10 and 12.04.2. In contrast, Red Hat and SUSE Linux have already patched their kernels . The solution for the rest will surely come in the coming days as a patch, because the ultimate solution will have to wait until the release of Linux 3.9.

As a side note, in the original article there are two very significant comments. The first vulnerability blames open source Linux , I understand that under the reasoning that to be accessible to everyone, you can find and exploit bugs.

The second comment suggests that precisely because Linux open source has been discovered so quickly the problem . Although the kernel 3.3 is launched almost a year ago.

What is your opinion?

Blizzard confirmed security filtering on Battle.net

620x239 806XLAR0SYE01281041826716 Blizzard confirmed on Battle.net security leak

Blizzard president Mike Morhaime, reported that the Battle.net service suffered a security leak . The platform stores affected much of the user information, including personal and financial data related to the most popular videogames.

However, the most important information (real name, billing address, card number credit) NOT have been compromised by the head of the intrusion.

“This week our security team detected an access illegal and unauthorized our internal network here at Blizzard. Quickly take action to close such access and started working with security agencies and defense experts to investigate what happened, “, Morhaime wrote on the official blog of the company.

The president of Blizzard, the data accessed during filtration were as follows:

Email addresses global users of Battle.net,

The answer to the question of security of players using U.S. servers. According to Morhaime, this affects users in Latin America, North America, Australia, New Zealand and Southeast Asia. Versions “cryptographically riots” of Battle.net users passwords using U.S. servers. We must clarify that they are not the actual keys, but encrypted versions.

alone does not serve to gain access to the accounts . Anyway recommend that users change Battle.net keys and any other service you access using the same password (or similar). To change your password must be entered at this link. If you have further questions can consult this comprehensive FAQ.