Server Security

WordPress hardened with XSS, DoS and SSRF fixes

With the second security and maintenance release of WordPress 3.5, the developers of the popular open source blogging software have closed 12 bugs, seven of them security issues. In their announcement, the developers "strongly encourage" all users to update all their installations of the software to version 3.5.2 immediately.

• LinuxSecurity.com Team
• Jun 24, 2013

Can You Completely Secure Linux?

How does Red Hat go about building and developing a secure Linux operating system? That question was asked and answered at the Red Hat Summit this week by Josh Bressers, who heads the Red Hat Product Security Team.

• LinuxSecurity.com Team
• Jun 17, 2013

Create secure remote backups using Duplicity

Remote backup is an increasingly popular way to protect your files, and Duplicity makes it easy to implement a secure yet flexible backup system

• LinuxSecurity.com Team
• Jun 03, 2013

Pressure mounts for building in security during application development

Security has seldom been a priority in application development, but pressure from businesses stuck patching faulty software is having an impact on the industry.

• LinuxSecurity.com Team
• May 20, 2013

Too many admins spoil your security

We've all known for a long time that unnecessary use of elevated privileges is a bad thing. You shouldn't be logged in as an administrator while surfing the Internet or checking your email; in particular, you shouldn't do that stuff while logged onto a server as an admin. Your organization shouldn't have too many enterprise admins, domain admins, or server admins. We all have that.

• LinuxSecurity.com Team
• May 07, 2013

"Forget passwords!": Google joins FIDO

The FIDO Alliance, an organisation that aims to develop user-friendly password alternatives, has gainedPDF several new members and supporters this week. Google, NXP and CrucialTec have joined the Alliance's board of directors, taking seats alongside existing "Board Level" members.

• LinuxSecurity.com Team
• Apr 26, 2013

When Technology Overtakes Security

• LinuxSecurity.com Team
• Mar 21, 2013

Practicing safe DNS with Google

The Internet's a dangerous place for an innocent Web browser to be searching alone for the right Web page, so the Domain Name System Security Extensions (DNSSEC) was created to make searching safer. That's the good news. The bad news is that DNSSEC adoption has been lagging. Now, Google has announced that it's supporting DNSSEC in its Google Public DNS service.

• LinuxSecurity.com Team
• Mar 20, 2013

Kernel developer criticises Linux over security

A senior Linux kernel developer has pointed to an instance of what he calls a lax approach to security in the Linux kernel, citing the case of a serious vulnerability that is now more than a month old and is yet to be fixed.

• LinuxSecurity.com Team
• Feb 26, 2013

PCI Delivers Security Guidance as PCI-DSS 3.0 Looms

There is a big different between compliance and security. The PCI-DSS (Payment Council Industry Data Security Standard) is the measure against which e-commerce security is measured and it is now in the process of gearing up for a major update at the end of the year.

• LinuxSecurity.com Team
• Feb 04, 2013

The Importance of Securing a Linux Web Server

With the significant prevalence of Linux web servers globally, security is often touted as a strength of the platform for such a purpose. However, a Linux based web server is only as secure as its configuration and very often many are quite vulnerable to compromise.

• LinuxSecurity.com Team
• Jan 15, 2013

Apple Taps Noted Hacker for Security Team

Apple has tapped a a noted hacker for its security team. Wired reported that the company has hired Kristin Paget, who was part of a small team of hackers who helped lock down Windows Vista for Microsoft before that OS shipped.

• LinuxSecurity.com Team
• Dec 07, 2012

Linux Webserver Rootkit Attacks Internet Users

Rootkit.Linux.Snakso.a is designed to infect the Linux kernel version 2.6.32-5-amd64 and adds an iframe to all served web pages by the infected Linux server via the nginx proxy.

• LinuxSecurity.com Team
• Dec 03, 2012

Researchers Raving Over Remarkable Rootkit

One of the more advanced rootkits to have hit town in recent memory has got security researchers across the globe in a tizz, even though it hasn

• LinuxSecurity.com Team
• Nov 20, 2012

HTTPS Everywhere 3.0 supports more sites

The Electronic Frontier Foundation (EFF) has released a new version of its HTTPS Everywhere browser extension for Firefox that now supports encryption on even more web sites. The US digital rights advocacy organisation says that version 3.0 of its Firefox add-on, which automatically redirects users to more secure HTTPS connections when accessing certain web pages, now supports an additional 1,500 sites, more than twice as many as previous stable releases.

• LinuxSecurity.com Team
• Oct 09, 2012

NSA: Building a More Secure Android

It's no secret that Google's Android mobile operating system has had its share of security flaws. But what is less well-known is that the U.S. government's National Security Agency (NSA) is among the teams working to improve Android security.

• LinuxSecurity.com Team
• Aug 30, 2012

Create A Mac Zombie Army, Cheap: Hacker Emptor

Going once, going twice: The new NetWeird toolkit can be used to infect Apple OS X systems, converting Macs into zombies ready to do your botnet bidding, with prices starting at just $60.

• LinuxSecurity.com Team
• Aug 24, 2012

The Hack That Kept Me Awake at Night

If I've seemed a little bleary-eyed and inattentive this week you can blame Jim Fallows. Late on Tuesday night I read his post about gmail, which linked to Mat Honan's piece for Wired about the destruction of his (Honan's) digital life. I was then up most of the night implementing Jim's advice about improving my computer security. This is by no means the first warning Jim has issued.

• LinuxSecurity.com Team
• Aug 13, 2012

Fear not, Linux admins: There are TOOLS to help you

Most Linux distributions have a significant focus on security. This does not mean they are necessarily ready for production out of the box. Tools like SELinux, excellent firewall options, and robust access controls can make Linux exceptionally secure.

• LinuxSecurity.com Team
• Jul 23, 2012

Tech Journal: How to Keep Your Accounts Secure

They say the cloud is the future of computing. All your data and software programs, now known as web apps, will reside in the cloud and the computer itself will act as a

• LinuxSecurity.com Team
• Jun 14, 2012