LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 20th, 2014
Linux Advisory Watch: October 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Latest News
We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.



Openwall Announce Community Resources: Oss-security, oCERT, Xvendor  17 April 2008 
Source: Openwall - Posted by Bill Keys   
The Solar Designer from the Openwall project announced some interesting news about their project. They are joined the oCERT project which is an important project for the Linux Security. Solar Designer is creator of the popular John the Ripper password cracker and has developed many of the Openwall projects. His is one of the key players in making open source security so successful. We have joined the oCERT project (the Open Source Computer Emergency Response Team), in two ways: I serve on the advisory board of oCERT, and Openwall is a registered public member of oCERT such that we can be sure to receive notification of vulnerabilities pertaining to our software (and, far more likely, to third-party software that we redistribute as a part of Openwall GNU/*/Linux) that will be handled via oCERT. Other Open Source projects are welcome to register with oCERT, too. (We're also a member of oss-security and vendor-sec, and are registered with the CERT/CC.) The website for oCERT is:
 
SELinux Developer Summit 2008 Announced  03 April 2008 
Source: SELinux News - Posted by Bill Keys   
The SELinux Developer Summit for 2008 has been announced. It will be held in Ottawa on the 22nd of July in conjunction with the Linux Symposium. This will be an open event for developers of SELinux and Flask/TE projects, as well as those with a strong technical interest. For more details, see the SELinux Developer Summit page. Have you heard that the 2008 SELinux Developer Summit for 2008 is going to be held in Ottawa Canada? What do you think will come out of this Summit and are you planning on going?
 
Critical VMWare Desktop Vulnerability Abuses Default Security Settings  27 February 2008 
Source: net-security.org - Posted by Ryan Berens   
Engineers from CoreLabs, the research arm of Core Security, discovered that an attacker could gain complete access to a host system by exploiting this vulnerability in VMware’s desktop software products. The vulnerability could allow an attacker to create or modify executable files on the host operating system.
One of the most interesting aspects of this vulnerability however, and one that comes up again and again, is that it abuses the shared folder access, a default setting.

One of the ways to fix it is to disable this setting. Why is this an "opt-out" security feature? Shouldn't sharing folders be an "opt-in" feature? Are there other examples that you can think of where the same pattern applies?
 
New Authentication Scheme Combats Keyloggers, Shoulder-Hacking  07 February 2008 
Posted by Ryan Berens   
Security is always evolving and every day there's some new way to combat threats. This 'undercover' system, as it is being called seems like it an interesting step in a new direction - especially since it can help protect against people snooping over your shoulder! Researchers have built a prototype authentication technique that could ultimately reduce the risk of attackers hacking users' credentials via a keylogger or spyware.

The so-called Undercover system, which was built by Carnegie Mellon University faculty members and students approaches authentication differently: It hides the authentication challenges rather than the user's input or password during the authentication process.
 
Urgent: WordPress Security Fix  05 February 2008 
Posted by Ryan Berens   
From the WordPress website:

WordPress 2.3.3 is an urgent security release. If you have registration enabled a flaw was found in the XML-RPC implementation such that a specially crafted request would allow a user to edit posts of other users on that blog. In addition to fixing this security flaw, 2.3.3 fixes a few minor bugs. If you are interested only in the security fix, download the fixed version of xmlrpc.php and copy it over your existing xmlrpc.php. Otherwise, you can get the entire release here.

Also, there is a vulnerability in the WP-Forum plugin that is being actively exploited right now. If you are using this plugin, please remove it until an update is available from its author.
 
(IN)SECURE Magazine Issue 15 has been released  05 February 2008 
Posted by Ryan Berens   
(IN)SECURE Magazine is a free digital security magazine in PDF format. In this issue you can read about malware, advanced social engineering, Internet terrorism, visualization tools for security analysis, wireless security, insider threat, fraud mitigation, and much more. Download your FREE copy today!
 
Bruce Schneier at LinuxConf AU  31 January 2008 
Source: ZDNET - Posted by Ryan Berens   
Linux.conf.au kicked off its main proceedings in Melbourne on Wednesday morning with a stark message from security guru Bruce Schneier: "When security companies give you cost justifications, they're complete bull@#&&."

And so begins what is, as always, a great piece of commentary on the overall nature of security and the problems that are derived from the gap between perceived security and real security. Read on....
 
Linux security guru joins Microsoft  22 January 2008 
Source: ZDnet.com - Posted by Ryan Berens   
Crispin Cowan, the Linux security expert behind StackGard, the Immunix Linux distro and AppArmor, has joined the Windows security team.
Originally posted by a blogger over at Microsoft. It's interesting though - what is making Microsoft go for Linux security professionals? Is there something inherently more effective about security developers with an Open Source background? Something else?
 
Most Oracle Database Pros Ignore Security Patches  14 January 2008 
Posted by LogError   
A survey by Sentrigo indicates that most Oracle database administrators do not apply the Critical Patch Updates that Oracle issues on a quarterly basis. Oracle designed its CPU program to help customers protect databases and other products against recently discovered security vulnerabilities. However, security patching is largely neglected as 67.5 percent of the respondents said they had never applied any Oracle CPU and that leaves many databases open to exploits.
 
Some Security Stories from the Week  11 January 2008 
Source: www.ratliff.net/blog - Open Source Security - Posted by Ryan Berens   
Emily Ratliff, a blogger and "architect for Linux Security, Quality, and Support for IBM’s Linux Technology Center," lists her most pressing stories in open source security this week. Below is the list, click-through to her blog and check out her insight...

  • The Fedora Weekly News Issue 114 (dated Dec. 31, 2007) describes three “SELinux Rants” along with the response from the Fedora community.
  • Interview with Bruce Schneier called Bruce Almighty: Schneier preaches security to Linux faithful (dated Dec. 27, 2007)
  • 11 open-source projects certified as secure
  • Data center robbery leads to new thinking on security is an interesting look at the data center break-in that occurred last October.
  • Top 10 security headlines from 2007.
  • Yahoo tests support for OpenID


Best Security Stories
 
<< Start < Prev 70 71 72 Next > End >>

Results 711 - 720 of 807
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
USB is now UEC (use with extreme caution)
iPhone Encryption and the Return of the Crypto Wars
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.