Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines.

LinuxSecurity.com Feature Extras:

Securing a Linux Web Server - With the significant prevalence of Linux web servers globally, security is often touted as a strength of the platform for such a purpose. However, a Linux based web server is only as secure as its configuration and very often many are quite vulnerable to compromise. While specific configurations vary wildly due to environments or specific use, there are various general steps that can be taken to insure basic security considerations are in place.

Peter Smith Releases Linux Network Security Online - Thanks so much to Peter Smith for announcing on linuxsecurity.com the release of his Linux Network Security book available free online. "In 2005 I wrote a book on Linux security. 8 years later and the publisher has gone out of business. Now that I'm free from restrictions on reproducing material from the book, I have decided to make the entire book available online."

  WordPress Sites Backdoored, Leaking Credentials (May 11)
 

WordPress site administrators just cannot come up for air.With a raft of WordPress vulnerabilities--most of them in plugins--to address, now comes word that a number of sites running the content management system have been compromised and are sending credentials via a backdoor to a criminal group.
  (May 13)
 

The Tor Project has shuttered its cloud proxy service citing security vulnerabilities, usability bugs and a lack of resources.Tor offers its users the capacity to surf the Web anonymously, bouncing traffic through a series of relay servers so that no observer at any point can tell where that user's traffic is traveling to or coming from. The Tor Cloud Project essentially offered a platform for creating network bridges within Amazon's Elastic Cloud Compute in order for users to evade censorship.
  (May 13)
 

Hackers have taken an interest in Elasticsearch, a popular enterprise search engine.A researcher based in Texas, whose own Elasticsearch server was hacked, today published results collated from a honeypot he built to get a sense of how widespread attacks are against the vulnerability that did in his server.
  Amateurs Produce Amateur Cryptography (May 12)
 

Anyone can design a cipher that he himself cannot break. This is why you should uniformly distrust amateur cryptography, and why you should only use published algorithms that have withstood broad cryptanalysis. All cryptographers know this, but non-cryptographers do not. And this is why we repeatedly see bad amateur cryptography in fielded systems.
  10 Security Questions To Ask A Cloud Service Provider (May 14)
 

As security teams try to help line-of-business users and other IT practitioners take advantage of cloud benefits as safely as possible, they're increasingly stepping into the role of trusted advisor. The scalability, flexibility, and convenience of software-as-a-service (SaaS), infrastructure-as-a-service (IaaS), and platform-as-a-service (PaaS) offerings frequently come at the cost of added risk to the business.
  New Linux rootkit leverages GPUs for stealth (May 11)
 

A team of developers has created a rootkit for Linux systems that uses the processing power and memory of graphics cards instead of CPUs in order to remain hidden.
  (May 12)
 

Password managers are a great way to supply random, unique passwords to a high number of websites. But most still have an Achilles' heel: Usually, a single master password unlocks the entire vault.
  Dan Kaminsky on VENOM (May 14)
 

Dennis Fisher talks with Dan Kaminsky about the VENOM bug, the value of virtual machine escapes, why everyone wants to make every bug the worst one of all time or just a bunch of hype and what the Avengers have to do with vulnerability disclosure.
  (May 13)
 

Cybercriminals take advantage of tens of thousands of insecure home routers distributed by ISPs (Internet Service Providers) and manufacturers to create large botnets for distributed denial-of-service (DDoS) attack purposes.
  For Venom security flaw, the fix is in: Patch your VM today (May 14)
 

Venom (Virtualized Environment Neglected Operations Manipulation), the recently discovered security hole in the open-source QEMU virtual machine hypervisor, has been fixed.
  (May 15)
 

The fact was, Green wasn't just your average Mormon grandpa. Over the past few months he had been handling customer service for the massive online enterprise called Silk Road. It was like a clandestine eBay, a digital marketplace for illicit trade, mostly drugs. Green, under the handle Chronicpain, had parlayed his extensive personal narcotics knowledge--he'd been on pain meds for years--into a paying gig working for the site.
  High-level, state-sponsored Naikon hackers exposed (May 18)
 

The activities of yet another long-running apparently state-sponsored hacking crew have finally been exposed.The Naikon cyber-espionage group has been targeting government, military and civil organisations around the South China Sea for at least five years, according to researchers at Kaspersky Lab.