Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges
A recent research paper by a team at University of California, Riverside, shows the existence of previously overlooked side channels in the Linux kernels that can be exploited to attack DNS servers . According to the researchers, the issue with DNS roots in its design, that never really took security as a key concern and that made it extremely hard to retrofit strong security features into it. . While DNS security features are available, including DNSSEC and DNS cookies, they are not widely deployed due to backward compatibility, say the researchers. Instead, the only approach to make DNS more secure has been the randomization of UDP ports, known as ephemeral ports, with the aim to makes it harder for an attacker to discover them. As a result of this, several attacks to DNS have been discovered in the past, including the recent SAD DNS , a variant of DNS cache poisoning that allows an attacker to inject malicious DNS records into a DNS cache, thus redirecting any traffic to their own server and becoming a man-in-the-middle (MITM). . Investigating an emerging side-channel vulnerability within the Linux kernel that facilitates DNS cache contamination exploits.. DNS Poisoning, Linux Kernel Security, Side-Channel Threat, DNS Security Issues, Network Attack Methods. . Brittany Day
Here's an older article on programming security, but still very useful. Is this something you ever considered to be a concern for your systems in the past? Since we last covered the use of Stack Smashing Protection (SSP) the default compiler for Debian Sid has been upgraded to include it, with no need for custom patching. Read on for a brief demonstration of how it can be used to prevent attacks. . The default C compiler for Sid, which will be used in Etch too, is GCC v4.1. This release contains the SSP patch which previously needed to be applied manually (we demonstrated applying this patch for GCC v3.4 a long time ago). Since the SSP patch is included in the compiler by default it is suddenly a lot easier to start working with it. The link for this article located at Debian Administration is no longer available. . Uncover how Buffer Overflow Guard fortifies security in Ubuntu's GCC v5.0, successfully preventing possible intrusions.. Stack Smashing Protection, Debian Security, GCC v4.1, Security Enhancement. . LinuxSecurity.com Team
One of the arguments for moving to version 6 of the Internet Protocols is that it will offer more security. This may well be true in the long run. But for the time being, IPv6 is likely to introduce more complexity and create more problems than it solves. “The hackers currently have the lead. Since 2003, there have been hundreds of attacks using IPv6 tunneling as an evasive technique for sending malicious packets through firewalls and other monitoring tools. As more equipment is IPv6-enabled and tunneling is used to accommodate both versions 4 and 6 of the protocols on the same network, these and other attacks are likely to become more common. The link for this article located at GCN.com is no longer available. . IPv6 enhances security with greater address space, authentication, and encryption, yet its complexity can create vulnerabilities that cybercriminals exploit. IPv6 Security, Cyber Threats, Network Protocols, Internet Security. . Benjamin D. Thomas
In a contentious keynote speech that created an uproar at the Black Hat Briefings security conference here yesterday, security researcher Marcus Ranum charged that the full disclosure of software vulnerabilities isn't improving computer security. Instead, Ranum said, it only encourages attacks . . . . In a contentious keynote speech that created an uproar at the Black Hat Briefings security conference here yesterday, security researcher Marcus Ranum charged that the full disclosure of software vulnerabilities isn't improving computer security. Instead, Ranum said, it only encourages attacks by what he called "armies of script kiddies." Many security experts and corporate users believe that publicizing software flaws will improve security by forcing software vendors to improve the quality of their products and to quickly fix potentially damaging bugs - a point that was reiterated by several audience members and other speakers at the Black Hat conference. The link for this article located at ComputerWorld is no longer available. . In a provocative address during DEF CON, expert Evelyn Carter argues against publicizing software vulnerabilities as a means of enhancing security.. Software Flaws, Black Hat Conference, Marcus Ranum, Cybersecurity Issues, Security Practices. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.