Security Archives - IB Computing https://ibcomputing.com/category/security/ IB Computing - Daily updates of web development Fri, 02 Nov 2018 18:55:11 +0000 en-US hourly 1 https://wordpress.org/?v=6.7.5 https://i0.wp.com/ibcomputing.com/wp-content/uploads/2018/01/cropped-ibwelcome.png?fit=32%2C32&ssl=1 Security Archives - IB Computing https://ibcomputing.com/category/security/ 32 32 141546849 Mozilla Privacy Month Campaign Highlights https://ibcomputing.com/mozilla-privacy-month-campaign/ https://ibcomputing.com/mozilla-privacy-month-campaign/#respond Wed, 31 Jan 2018 16:16:08 +0000 https://ibcomputing.com/?p=1006 Mozilla celebrated International Data Privacy Day by launching Privacy Month campaign in the month of January to spread awareness about the importance of data privacy …

The post Mozilla Privacy Month Campaign Highlights appeared first on IB Computing.

]]> Mozilla celebrated International Data Privacy Day by launching Privacy Month campaign in the month of January to spread awareness about the importance of data privacy and protection. Mozilla Privacy Month campaign is a community led initiative which was originated by Mozilla India in 2016 and is intended to be a global campaign each year. Mozilla Privacy Month campaign helps communities from all over the world to come together to learn, share and spread awareness about current trends and future issues for privacy and steps that we can take against privacy infringements.

31 Privacy tips in the form of one tweet on each day of January month, that was the major highlight of the Mozilla Privacy Month Campaign 2018. Here we are presenting you the 31 valuable Privacy tips provided by Mozilla India in a single post mainly for those who missed the live tweets from @MozillaIN.

Mozilla Privacy Month Campaign Highlights

The post Mozilla Privacy Month Campaign Highlights appeared first on IB Computing.

]]> https://ibcomputing.com/mozilla-privacy-month-campaign/feed/ 0 1006 Linux Kernel 4.15 Released With Spectre & Meltdown Patches https://ibcomputing.com/linux-kernel-4-15-released/ https://ibcomputing.com/linux-kernel-4-15-released/#respond Mon, 29 Jan 2018 07:34:00 +0000 https://ibcomputing.com/?p=897 Linus Torvalds announced the release of the Linux kernel 4.15 series on 28th January 2018, the first major version release with patches against the Meltdown …

The post Linux Kernel 4.15 Released With Spectre & Meltdown Patches appeared first on IB Computing.

]]>

Linus Torvalds announced the release of the Linux kernel 4.15 series on 28th January 2018, the first major version release with patches against the Meltdown and Spectre security vulnerabilities.

Linux kernel 4.15 has been in development since the last two months. The new release arrives late by one week than the actual expected date. The kernel developers were under extreme pressure to redesign the kernel against the infamous Meltdown and Spectre attacks which resulted in the slowest Linux kernel release since 2011.

After a release cycle that was unusual in so many (bad) ways, this
last week was really pleasant. Quiet and small, and no last-minute
panics, just small fixes for various issues. I never got a feeling
that I’d need to extend things by yet another week, and 4.15 looks
fine to me.

Linux kernel 4.15 is reportedly the first kernel series that is fully patched against the Meltdown and Spectre hardware security vulnerabilities. But unofrutnately the patches are only available for the x86 and PowerPC (PPC) architectures. Linux kernel 4.15 is expected in the stable repositories of major GNU/Linux distros soon.

Also, it is worth pointing out that it’s not like we’re “done” with
spectre/meltdown.

Linus was so angry with the Intel developers last week such that he didn’t even hesitate to use the F word publicly.

As it is, the patches are COMPLETE AND UTTER GARBAGE.

They do literally insane things. They do things that do not make
sense. That makes all your arguments questionable and suspicious. The
patches do things that are not sane.

WHAT THE F*CK IS GOING ON?

And that’s actually ignoring the much _worse_ issue, namely that the
whole hardware interface is literally mis-designed by morons.

Linux Kernel 4.15 Released with Spectre & Meltdown Patches
Linux Kernel 4.15 Released with Spectre & Meltdown Patches

What’s new in the Linux Kernel 4.15 release

  • Meltdown and Spectre patches for the x86 and PowerPC (PPC) architectures.
  • Support for RISC-V architecture
  • Support for the User-Mode Instruction Prevention feature on Intel CPUs
  • A new cgroupv2-enabled CPU controller for better CPU usage restrictions.
  • Support for AMD Secure Encrypted Virtualization
  • Improved video support for AMD GPUs.
  • Added modesetting to the AMDGPU open-source graphics driver for supported AMD Radeon GPUs.
  • Improved power usage for machines with SATA Link Power Management feature.
  • Various updates regarding networking, filesystems, grpahics, drivers and more.

Anyway, while spectre/meltdown has obviously been the big news this
release cycle, it’s worth noting that we obviously had all the
*normal* updates going on too, and the work everywhere else didn’t
just magically stop, even if some developers have been distracted by
CPU issues. In the *big* picture, 4.15 looks perfectly normal, with
two thirds of the full 4.15 patch being about drivers, and even the
arch updates are dominated by the arm DTS diffs, not by CPU bug
mitigation.

So the news cycle notwithstanding, the bulk of the 4.15 work is all
the regular plodding “boring” stuff. And I mean that in the best
possible way. It may not be glamorous and get the headlines, but it’s
the bread and butter of kernel development, and is in many ways the
really important stuff.

Download Linux Kernel 4.15

Those who aren’t patient enough can download Linux Kernel 4.15 from kernel.org and compile the sources right now. Otherwise you can wait until the new release arrives in your GNULinux distro’s official repository which is expected soon in the light of Spectre and Meltdown hardware security vulnerabilites.

The post Linux Kernel 4.15 Released With Spectre & Meltdown Patches appeared first on IB Computing.

]]> https://ibcomputing.com/linux-kernel-4-15-released/feed/ 0 897 What is Data Privacy Day and Why it Matters https://ibcomputing.com/data-privacy-day-matters/ https://ibcomputing.com/data-privacy-day-matters/#respond Sun, 28 Jan 2018 17:50:53 +0000 https://ibcomputing.com/?p=884 Data Privacy Day is an international effort to create awareness about the importance of respecting privacy, safeguarding data and enabling trust. It is observed on …

The post What is Data Privacy Day and Why it Matters appeared first on IB Computing.

]]>

Data Privacy Day is an international effort to create awareness about the importance of respecting privacy, safeguarding data and enabling trust. It is observed on January 28 every year. Data Privacy Day was initiated by the Council of Europe in 2007 and is now observed by more than 50 countries including US, Canada, India and most of the European countries.

Data Privacy Day aims to raise awareness about the importance of protecting the privacy of personally identifiable information online. The educational focus has expanded over the last years from individuals to include families, consumers and businesses. Data Privacy Day encourages companies to comply with privacy laws and data protection regulations. Data Privacy Day also promotes developing technologies that give individuals more control over their personal information.

Our personal data are being processed each and every second in the modern digital world where data is the new oil. This is where Data Privacy Day matters as individuals are generally unaware about the risks related to the protection of their personal data and about their privacy rights. More importantly most people still think that their private data are of no use to anyone.

Data Privacy Day Matters - Stay Safe Online
January 28 – Data Privacy Day – Stay Safe Online

On this occassion of the tenth anniversary of Data Privacy Day, ibcomputing.com would like to share with you some notable online services that help you to understand the need of data privacy and also to protect your personal data.

Social Cooling

SocialCooling.com is one of the best online resources that helps us understand the need of data privacy.

LIKE OIL LEADS TO GLOBAL WARMING…

DATA LEADS TO SOCIAL COOLING!

Surveillance Self-Defense

Surveillance Self-Defense by Electronic Frontier Foundation (EFF) provides you great tips, tools and how-tos for safer online communications.

Modern technology has given those in power new abilities to eavesdrop and collect data on innocent people. Surveillance Self-Defense is EFF’s guide to defending yourself and your friends from surveillance by using secure technology and developing careful practices.

Prism Break

Prism Break project helps us to opt out of global data surveillance programs like PRISM, XKeyscore and Tempora.

Help make mass surveillance of entire populations uneconomical! We all have a right to privacy, which you can exercise today by encrypting your communications and ending your reliance on proprietary services.

PrivacyTools.io

PrivacyTools.io is a socially motivated website that provides information for protecting your data security and privacy.

You are being watched. Private and state-sponsored organizations are monitoring and recording your online activities. privacytools.io provides knowledge and tools to protect your privacy against global mass surveillance.

The complete source code of PrivacyTools.io website is available on GitHub.

Data Detox Kit

Data Detox Kit is presented to you by Tactical Technology Collective in parternship with the Mozilla foundation. Data Detox Kit is part of the Tactical Tech’s Me and My Shadow project that helps you control your data traces, see how you’re being tracked, and find out more about the data industry. It was produced for The Glass Room London in 2017. Data Detox is an 8-day plan with each day having a different focus and ends with a daily challenge that helps you protect your privacy online. You could also complete the challenges in one day if you aren’t patient enough to wait 8 days!

 

Know about more projects and services that help to raise awareness as well as to take actions regarding privacy protection? Please do share with us and other fellow readers through comments. Thanks.

Happy Data Privacy Day!

The post What is Data Privacy Day and Why it Matters appeared first on IB Computing.

]]> https://ibcomputing.com/data-privacy-day-matters/feed/ 0 884 Spectre and Meltdown Delaying New Linux Kernel Release https://ibcomputing.com/spectre-meltdown-delaying-new-linux-kernel-release/ https://ibcomputing.com/spectre-meltdown-delaying-new-linux-kernel-release/#respond Mon, 22 Jan 2018 15:21:53 +0000 https://ibcomputing.com/?p=647 Linux 4.15 is the first Linux Kernel version to reach ninth release candidate since 2011, thanks to Spectre and Meltdown. Instead of the expected release …

The post Spectre and Meltdown Delaying New Linux Kernel Release appeared first on IB Computing.

]]> Linux 4.15 is the first Linux Kernel version to reach ninth release candidate since 2011, thanks to Spectre and Meltdown. Instead of the expected release date, 21st January 2018, Linux 4.15 will be delayed by at least one week. The new release is expected on 28th January. The previous Linux Kernel release, v4.15-RC8, came with many patches against the two critical hardware vulnerabilities, Meltdown and Spectre. Linus Torvalds recently criticized Intel publicly for writing PR blurbs that say everything works as designed instead of accepting their mistakes.

Or is Intel basically saying “we are committed to selling you shit
forever and ever, and never fixing anything”?

Because if that’s the case, maybe we should start looking towards the
ARM64 people more.

 

Spectre and Meltdown delaying new Linux kernel release
Meltdown and Spectre – Critical Hardware Security Vulnerabilities

 

Here’s the official announcement from Linus Torvalds, regarding the delay in new Linux Kernel release, through the mailing list:

I really really wanted to just release 4.15 today, but things haven’t
calmed down enough for me to feel comfy about it, and Davem tells me
he still has some networking fixes pending. Laura Abbott found and
fixed a very subtle boot bug introduced this development cycle only
yesterday, and it just didn’t feel right to say that we’re done.

So I’m doing an rc9 instead. I don’t particularly like to, but I like
it even less releasing something that doesn’t seem baked enough.

Some people have already started sending me pull requests for 4.16
(generally because they aren’t expecting to be online next week and
expected the merge window to open). I appreciate it, and I’ll keep
them queued up, I just won’t start applying them quite yet.

Anyway, rc9 is mostly arch updates (x86, arm, powerpc, mips) and
drivers (gpu, networking and md). And some core networking. And then
there’s various random misc fallout (tracing, bpf, and new selftests)

I really expect no more delays after this. We’ve had rc9’s before, but
they have been pretty rare (the last one was 3.1-rc9 back in 2011 –
that release went all the way to rc10, and I really don’t think we’ll
do that this time _despite_ all the CPU bug mitigation craziness).

Linus

 

As Linus already mentioned, the last Linux kernel release with more than eight Release Candidates was Linux 3.1 in 2011. Linux 3.1 even got a tenth RC. But since Linus said that there won’t be more delay, let’s hope that Linux 4.15 won’t reach the tenth RC and will release the final version on January 28th. Meanwhile, Linux kernel 4.15 RC9 is now available for download and testing.

The post Spectre and Meltdown Delaying New Linux Kernel Release appeared first on IB Computing.

]]> https://ibcomputing.com/spectre-meltdown-delaying-new-linux-kernel-release/feed/ 0 647 Firefox 58 Release; With Spectre and Meltdown Security Fixes https://ibcomputing.com/firefox-58-release-spectre-meltdown-security-fix/ https://ibcomputing.com/firefox-58-release-spectre-meltdown-security-fix/#comments Sun, 21 Jan 2018 11:41:47 +0000 https://ibcomputing.com/?p=592 Firefox 58 release is scheduled on January 23. With Firefox’s new streaming and tiering compiler, web pages will load faster than even their previous major …

The post Firefox 58 Release; With Spectre and Meltdown Security Fixes appeared first on IB Computing.

]]> Firefox 58 release is scheduled on January 23. With Firefox’s new streaming and tiering compiler, web pages will load faster than even their previous major release Firefox Quantum. Firefox Quantum was a major milestone in Firefox’s history, shipped with modern UI called Photon and a new core engine making it faster than ever.

A two-tiered compiler which makes the code compilation fifteen times faster than the current optimizing compiler will be the main attraction of the Firefox 58 release. With the latest compiler changes Firefox can now compile the code while it is being downloaded and in fact compiles faster than being downloaded, means the code will be executed as soon as it is downloaded.

Regarding security updates, the new release will contain fixes for Meltdown and Spectre timing attacks. Firefox was one of the first browsers to respond and release updates to Spectre and Meltdown attacks. Another bug like background sending crash reports without user opt-in has also been fixed.

The upcoming Firefox 58 release will also include other features like support for form autofill for credit cards and improved page render speed for Windows users. Also, Mac OS X users can be happy as WebVR will be enabled on Mac OS X.

Warning: You will not be able to downgrade your Firefox profile to previous versions anymore, for such cases new profiles should be made!

Firefox 58
Download Firefox 58.0 beta

Firefox 58 Release For Developers

  • The old Responsive Design Mode has been removed from Devtools.
  • A button to pause/play recording network traffic is now implemented on Network Monitor.
  • PerformanceNavigationTiming API has been implemented; it can be used to measure the time to load/unload a document.
  • Removed prefixed version of HTMLMediaElement.srcObject
  • Removed support for prefixed WebGL extensions.
  • TLS handshake timeout is implemented with the default value of 30seconds.
  • Firefox Android now supports “Add o home screen”.

How to download Firefox 58?

Firefox 58.0 beta can be downloaded from Mozilla repo or you can wait for the official stable releases. If you are a Linux user, you can either download, extract and run the Mozilla’s official image or wait till the new update comes to your distribution’s package repo.

The post Firefox 58 Release; With Spectre and Meltdown Security Fixes appeared first on IB Computing.

]]> https://ibcomputing.com/firefox-58-release-spectre-meltdown-security-fix/feed/ 1 592 OnePlus website hacked – Credit Card Information of 40000 customers leaked https://ibcomputing.com/oneplus-website-hacked-credit-card-information-40000-customers-leaked/ https://ibcomputing.com/oneplus-website-hacked-credit-card-information-40000-customers-leaked/#comments Sat, 20 Jan 2018 08:52:18 +0000 http://ibcomputing.com/?p=549 OnePlus website hacked! Mobile manufacturer company OnePlus has confirmed in a forum post that it’s been a prey to a Credit Card Hack. The hackers …

The post OnePlus website hacked – Credit Card Information of 40000 customers leaked appeared first on IB Computing.

]]> OnePlus website hacked! Mobile manufacturer company OnePlus has confirmed in a forum post that it’s been a prey to a Credit Card Hack. The hackers were able to inject some malicious JavaScript code into the website’s payment page, which allowed the attackers to extract the credit card numbers, expiration dates, and CVVs. As a result, it’s assumed that about 40,000 users’ credit card information is stolen. The leaked information is more than enough for anyone to commit transactions online using the credit cards information.

There were reports by several users on OnePlus forums that they doubt their credit cards were being charged without their knowledge; some Reddit users mentioned that they noticed their cards being used on betting websites.  A week later, the company confirmed that the users who purchased phones through their website between the middle of November 2017 and January 2018. 11 have been victims of a credit card information leak.

It seems they did not take care of the basic precautionary measures. The one plus site was hosting the payment page that accepts the users’ payment details on their own site – which is a flawed design by itself since OnePlus is not PCI compliant (Payment Card Industry). If attackers are somehow able to inject malicious code into the website, the users’ data will be at risk. Ideally, all the payment flow should happen through a third-party payment gateway which takes care of everything – from accepting the user input to encrypting the information securely and then processing the payment.

In their statement, the company stated the users who had used PayPal or saved their credit card information before November should not have been affected. The company has since disabled credit card payment option on their website and claims to have quarantined the affected server.

 

OnePlus website hacked - Credit Card Information of 40000 customers leaked
OnePlus Offical Website – https://oneplus.net/

 

Here is the complete statement from OnePlus:

Hi all,

We are deeply sorry to announce that we have indeed been attacked, and up to 40k users at oneplus.net may be affected by the incident. We have sent out an email to all possibly affected users.

1. What happened

One of our systems was attacked, and a malicious script was injected into the payment page code to sniff out credit card info while it was being entered.

  • The malicious script operated intermittently, capturing and sending data directly from the user’s browser. It has since been eliminated.
  • We have quarantined the infected server and reinforced all relevant system structures.

2. Who’s affected

  • Some users who entered their credit card info on oneplus.net between mid-November 2017 and January 11, 2018, may be affected.
    • Credit card info (card numbers, expiry dates and security codes) entered at oneplus.net during this period may be compromised.
    • Users who paid via a saved credit card should NOT be affected.
    • Users who paid via the “Credit Card via PayPal” method should NOT be affected.
    • Users who paid via PayPal should NOT be affected.
  • We have contacted potentially affected users via email.

3. What you can do

  • We recommend that you check your card statements and report any charges you don’t recognize to your bank. They will help you initiate a chargeback and prevent any financial loss.
  • For enquiries, please get in touch with our support team at https://oneplus.net/support.
  • If you notice any potential system vulnerabilities, please report them to [email protected]. This is a monitored inbox, but please note, we may not be able to respond to all reports.


4. What we are doing

We cannot apologize enough for letting something like this happen. We are eternally grateful to have such a vigilant and informed community, and it pains us to let you down.

We are in contact with potentially affected customers. We are working with our providers and local authorities to better address the incident. We are also working with our current payment providers to implement a more secure credit card payment method, as well as conducting an in-depth security audit. All these measures will help us prevent such incidents from happening in the future.

A big thank you to our forum user @superdutynick for bringing this incident to our attention!

Sincerely,
The OnePlus Team

As a mobile giant that is dealing with millions of users’ confidential data, they should conduct periodic, in-depth security audits, penetration testing and monitoring. Payment processing should be completely dealt with a reliable third-party service that does their job well. That way, even if the attackers are able to breach the company website, the damage would be minimized.

The post OnePlus website hacked – Credit Card Information of 40000 customers leaked appeared first on IB Computing.

]]> https://ibcomputing.com/oneplus-website-hacked-credit-card-information-40000-customers-leaked/feed/ 1 549 Latest Ubuntu breaks BIOS settings in Lenovo, Toshiba and Acer laptops https://ibcomputing.com/ubuntu-17-10-breaks-bios-settings-in-lenovo-toshiba-acer-laptops/ https://ibcomputing.com/ubuntu-17-10-breaks-bios-settings-in-lenovo-toshiba-acer-laptops/#respond Fri, 05 Jan 2018 09:00:18 +0000 http://ibcomputing.com/?p=123 If you are excited about installing latest Ubuntu, and you have the latest 17.10 ISO with you, you should wait for their updated release. A …

The post Latest Ubuntu breaks BIOS settings in Lenovo, Toshiba and Acer laptops appeared first on IB Computing.

]]> If you are excited about installing latest Ubuntu, and you have the latest 17.10 ISO with you, you should wait for their updated release. A kernel bug found in the latest Ubuntu release breaks BIOS settings in some machines. The bug was related to Intel-SPI drivers.

A list of identified machines that are affected by the bug are listed below.

LENOVO:

  • Lenovo B40-70
  • Lenovo B50-70
  • Lenovo B50-80
  • Lenovo Flex-3
  • Lenovo Flex-10
  • Lenovo G40-30
  • Lenovo G50-30
  • Lenovo G50-70
  • Lenovo G50-80
  • Lenovo S20-30
  • Lenovo U31-70
  • Lenovo Y50-70
  • Lenovo Y70-70
  • Lenovo Yoga Thinkpad (20C0)
  • Lenovo Yoga 2 11″ – 20332
  • Lenovo Z50-70
  • Lenovo Z51-70
  • Lenovo ideapad 100-15IBY

ACER:

  • Acer Aspire E5-771G
  • Acer Aspire ES1-111M-C1LE
  • Acer TravelMate B113
  • Acer Swift SF314-52 (Fixed by 4.14.9)
  • Acer Aspire E3-111-C0UM

TOSHIBA:

  • Toshiba Satellite S55T-B5233
  • Toshiba Satellite L50-B-1R7
  • Toshiba Satellite S50-B-13G

DELL:

  • Dell Inspiron 15-3531 (not fixed by 4.14.9)

HP:

  • HP 14-r012la

MEDIACOM:

  • Mediacom Smartbook 14 Ultra M-SB14UC

 

Ubuntu Downloads Blocked
Ubuntu warns not to download 17.10 ISO in their official site till the fix is updated.

Those who already installed Ubuntu 17.10 and affected by the bug are now unable to change/update their BIOS settings or change boot order, some are even unable to exit from the BIOS settings. Some reports say even booting the Ubuntu 17.10 live OS is corrupting the BIOS. Lenovo community support is now flooded with related reports and expensive solutions like replacing mother board or chip are being suggested.

Kernel version 4.13.0-21 fixes the issue, but the affected machines will still have to wait for a proper solution.

 

Well, how do I fix my laptop?

A user found a workaround by manually replacing the contents of first boot device (which was for him antergos_grub) with rEFInd. But removing the first partition using rEFInd will brick your system and make it unusable.

If you can boot to Ubuntu, launchpad has a fix for you. Download and install linux-image and restart your system, if it didn’t work reboot twice and check BIOS settings again. If that also didn’t work, install this image and repeat the above steps. After fixing the BIOS the new kernel packages aren’t needed and you can uninstall them. Here is another solution given in AskUbuntu, which is similar to the launchpad one.

Solutions are only applicable to those who can access a booted Linux from their affected device, no proper software level solutions are available as of now. It’s recommended to contact your nearest corresponding authorized service center if you don’t want to take more risks.

The post Latest Ubuntu breaks BIOS settings in Lenovo, Toshiba and Acer laptops appeared first on IB Computing.

]]> https://ibcomputing.com/ubuntu-17-10-breaks-bios-settings-in-lenovo-toshiba-acer-laptops/feed/ 0 123