The SELinux Developer Summit for 2008 has been announced. It will be held in Ottawa on the 22nd of July in conjunction with the Linux Symposium. This will be an open event for developers of SELinux and Flask/TE projects, as well as those with a strong technical interest. For more details, see the SELinux Developer Summit page.
Have you heard that the 2008 SELinux Developer Summit for 2008 is going to be held in Ottawa Canada? What do you think will come out of this Summit and are you planning on going?
Engineers from CoreLabs, the research arm of Core Security, discovered that an attacker could gain complete access to a host system by exploiting this vulnerability in VMware’s desktop software products. The vulnerability could allow an attacker to create or modify executable files on the host operating system.
One of the most interesting aspects of this vulnerability however, and one that comes up again and again, is that it abuses the shared folder access, a default setting.
One of the ways to fix it is to disable this setting. Why is this an "opt-out" security feature? Shouldn't sharing folders be an "opt-in" feature? Are there other examples that you can think of where the same pattern applies?
Security is always evolving and every day there's some new way to combat threats. This 'undercover' system, as it is being called seems like it an interesting step in a new direction - especially since it can help protect against people snooping over your shoulder!
Researchers have built a prototype authentication technique that could ultimately reduce the risk of attackers hacking users' credentials via a keylogger or spyware.
The so-called Undercover system, which was built by Carnegie Mellon University faculty members and students approaches authentication differently: It hides the authentication challenges rather than the user's input or password during the authentication process.
WordPress 2.3.3 is an urgent security release. If you have registration enabled a flaw was found in the XML-RPC implementation such that a specially crafted request would allow a user to edit posts of other users on that blog. In addition to fixing this security flaw, 2.3.3 fixes a few minor bugs. If you are interested only in the security fix, download the fixed version of xmlrpc.php and copy it over your existing xmlrpc.php. Otherwise, you can get the entire release here.
Also, there is a vulnerability in the WP-Forum plugin that is being actively exploited right now. If you are using this plugin, please remove it until an update is available from its author.
(IN)SECURE Magazine is a free digital security magazine in PDF format. In this issue you can read about malware, advanced social engineering, Internet terrorism, visualization tools for security analysis, wireless security, insider threat, fraud mitigation, and much more. Download your FREE copy today!
Linux.conf.au kicked off its main proceedings in Melbourne on Wednesday morning with a stark message from security guru Bruce Schneier: "When security companies give you cost justifications, they're complete bull@#&&."
And so begins what is, as always, a great piece of commentary on the overall nature of security and the problems that are derived from the gap between perceived security and real security. Read on....
Crispin Cowan, the Linux security expert behind StackGard, the Immunix Linux distro and AppArmor, has joined the Windows security team.
Originally posted by a blogger over at Microsoft. It's interesting though - what is making Microsoft go for Linux security professionals? Is there something inherently more effective about security developers with an Open Source background? Something else?
A survey by Sentrigo indicates that most Oracle database administrators do not apply the Critical Patch Updates that Oracle issues on a quarterly basis. Oracle designed its CPU program to help customers protect databases and other products against recently discovered security vulnerabilities. However, security patching is largely neglected as 67.5 percent of the respondents said they had never applied any Oracle CPU and that leaves many databases open to exploits.
Source: www.ratliff.net/blog - Open Source Security - Posted by Ryan Berens
Emily Ratliff, a blogger and "architect for Linux Security, Quality, and Support for IBM’s Linux Technology Center," lists her most pressing stories in open source security this week. Below is the list, click-through to her blog and check out her insight...
The Fedora Weekly News Issue 114 (dated Dec. 31, 2007) describes three “SELinux Rants” along with the response from the Fedora community.
Interview with Bruce Schneier called Bruce Almighty: Schneier preaches security to Linux faithful (dated Dec. 27, 2007)
11 open-source projects certified as secure
Data center robbery leads to new thinking on security is an interesting look at the data center break-in that occurred last October.
Source: ZDnet Open Source Blog - Posted by Ryan Berens
The recent awareness on Coverity's test on Open Source projects has been making the rounds non-stop in the past days. The issue at hand here is the inherent value in what Coverity is actually providing - that is, identifying bugs in software to improve its quality.
Coverity's model is certainly one way of addressing the quality of code in an open source project. In fact, it can be a very useful model. They stated that 11 of the projects were cleared based on their "rung" system, among other observations.
But the issue is that many venues are mangling the information. First they are not stating closed source bugs/problems. Obviously, you can't compare two sides by only counting the faults on one side. To be more clear, awareness of the # of bugs in open source projects has absolutely no bearing on the absolute value of problems relative to other closed-source projects. They are exclusive of each other. Not to mention the fact that more awareness of bugs may account for bad press, but can allow for better overall security (knowledge is power).
The real problem here is that many of those covering the story are portraying it in the worst way imaginable; and in some cases, they are outright inaccurate.
Case in point, the following comment was found on the open source blog at ZDNET regarding the Firebird project - its an example of how sometimes percpetion can be misconstrued...
