Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 12 articles for you...
214
security advisorySSH accessnetwork isolationEight Sleep Smart Beds: Privacy Threats and SSH Backdoors Explained
As we connect almost every element of our homes to the Internet of Things (IoT), security concerns have spread far beyond traditional computing devices to everyday items. From fridges that track groceries to security systems we manage via smartphone apps - IoT brings both convenience and potential risks. . Recent research on Eight Sleep's internet-connected mattresses reveals that Linux security admins using these smart beds may be exposed to unexpected privacy threats. Eight Sleep's firmware contains AWS credentials, which pose privacy and financial integrity threats to services linked with these cloud infrastructures. At the same time, remote SSH backdoors could allow malicious actors unauthorized access into smart beds--or any connected device on the same network, including Linux-based systems. Let's examine these recent IoT vulnerabilities and discuss practical security measures you can implement to safeguard your network and Linux infrastructure against them. Unpacking These IoT Vulnerabilities Eight Sleep's smart mattresses contain firmware with critical flaws, including exposed AWS credentials and remote SSH backdoors that pose significant threats to data privacy. Hackers could exploit these issues to access sensitive information, incur significant costs, or gain unauthorized entry into personal networks. AWS Credential Exposure One of the more concerning discoveries is the exposure of AWS credentials within a smart bed's firmware. AWS is a secure cloud service provider that requires careful credential management to protect users from unauthorized access or misuse. Should an attacker gain access, they could manipulate sleep data or incur significant costs through excessive API requests and resource consumption. Linux admins face more serious repercussions from exploits involving credentials that they entrust with financial transactions than just economic considerations. A compromised credential could enable attackers to install malicious scripts into cloud environmentsthat utilize those compromised credentials - potentially impacting any service that interfaces with them. While Linux systems are widely known for being secure and stable environments , weaknesses in embedded credentials allow attackers to exploit vulnerabilities more readily. Remote SSH Backdoors Eight Sleep smart beds contain another major security flaw: remote SSH backdoors intended to allow engineers to execute commands on mattresses remotely. However, these backdoors allow anyone - not only engineers - to gain entry and control of these devices. Linux admins will find remote SSH backdoors particularly concerning, given their inherent trust and control levels associated with SSH access . If an attacker can gain control over one such bed using these backdoors, they could use it as a springboard for other devices on the network, including home security cameras, laptops, or any other crucial connected infrastructure. Eight Sleep's smart beds do not offer user-accessible logs, making detecting and tracing unauthorized access more difficult. Without such logs, investigating after a breach has occurred or monitoring for unusual activity is nearly impossible. Network Traversal Risk Company Response Remote SSH backdoors also increase the risk of network traversal attacks, allowing malicious actors to move from device to device within a network, exploiting trust relationships between devices to increase their reach and spread malware infections more widely. In the case of Eight Sleep smart beds, infected devices could serve as staging grounds for more extensive network infiltration attempts. We Linux admins must recognize this risk, as even highly secured Linux systems could become vulnerable if an adjacent device - a smart bed - were vulnerable. This underscores the necessity of network segmentation and using best practices when isolating IoT devices from more critical infrastructure. Practical Advice for Mitigating Your Risk Linux admins must protect their networks andtheir devices from security risks, using best practices as part of an overall plan to minimize vulnerabilities that can threaten them. Although no single solution provides complete protection, combining various strategies will substantially lower risks posed by vulnerabilities. Securing Credentials AWS credentials have been accidentally exposed within the firmware of a smart bed, which highlights the importance of secure credential management. Credentials must never be hardcoded into devices' firmware or accessible through straightforward reverse engineering techniques. Environment variables or external credential management tools like AWS Secrets Manager are excellent ways to ensure credentials are stored safely and rotated regularly. Regular audits where embedded keys are searched and scrutinized can further help detect exposed credentials before they're exploited. Administrators should advocate for secure development practices and work with vendors to ensure their devices adhere to these standards. Monitoring and Isolation Given the risk posed by remote SSH backdoors, devices in your network must be regularly checked and monitored for any unauthorized access points. Intrusion detection systems (IDS) can assist in spotting unusual patterns indicative of such access. Their logs and alerts provide valuable insight into potential breaches while expediting quick responses. Network segmentation plays a pivotal role in mitigating risks from compromised IoT devices. By isolating such items as smart beds from more critical infrastructure, administrators can isolate breaches and stop attackers from exploiting vulnerable devices to access sensitive systems. Establishing separate VLANs for IoT devices ensures that even if an infiltrated smart bed is compromised, more important parts of the network remain secure. Proactive Network Monitoring Active network monitoring is vital to detecting and responding quickly to security incidents. Tools designed to analyze traffic for anomalies canquickly notify administrators when suspicious devices begin making unexpected connections or performing high data transfer rates. Centralized logging provides a consolidated view of network activity and can help correlate events across devices. Linux administrators can use monitoring solutions like Elasticsearch, Logstash, and Kibana (ELK stack) to collect, analyze, and visualize logs from multiple network devices. This holistic approach allows them to detect potential security incidents quickly. Regular Firmware Updates Maintaining security by updating devices with the latest firmware can be simple yet easily overlooked. Vendors often release updates to patch known vulnerabilities, and keeping smart devices updated helps reduce risks from known exploits. Linux administrators need to establish a regular schedule for checking and applying updates. If a vendor provides tools that automate this process, taking advantage of such opportunities could simplify the task while guaranteeing that security updates are applied promptly. Our Final Thought on Combating These Eight Sleep Smart Bed Security Flaws Eight Sleep's smart beds are a vivid example of the security risks posed by IoT devices that proliferate in our homes and workplaces, prompting us Linux admins to adhere to security best practices even for seemingly harmless devices. Securing credentials, monitoring for unauthorized access, isolating vulnerable devices, and updating firmware are essential to defend networks against potential intrusions. By effectively understanding and mitigating IoT risks, Linux admins can continue to protect their systems while safeguarding the networks they manage - not simply responding to threats but creating resilient infrastructure. . With the rise of smart sleep technologies like Eight Sleep, Linux system admins must assess cybersecurity risks and device vulnerabilities to protect user data. Smart Beds, IoT Security, Linux Admins, AWS Credentials, Network Monitoring. . Brittany Day
Feb 25, 2025
•
IoT Security
67
data securityencryptioninformation protectionExploring Encryption Backdoors And Their Impact On Data Privacy
Strong, unbroken encryption is essential in protecting users' privacy and the integrity of sensitive data, yet encryption technology is currently under threat in many countries. . What is the purpose of having passwords on our phones? For most of us, the answer is obvious: to protect our personal information. Our phones, like our online accounts, our email address and even our private chats, hold an increasing quantity of information,covering every aspect of our lives,that we want to keep private. This information can range from your banking information to corporate trade secrets and even intimate details about your sexual orientation. People seek privacy to protect themselves from oppressive governments , thieves, abusive partners , bulliesor simply because they enjoy the freedom it provides in an increasingly exposed world. All this information is kept secret thanks to one crucial core technology: encryption. The link for this article located at rabble.ca is no longer available. . Acknowledge the risks associated with security vulnerabilities in encryption techniques, which can threaten personal privacy and jeopardize essential information security online. Data Security, Encryption Backdoors, Privacy Threats, Information Protection. . LinuxSecurity.com Team
Feb 04, 2020
•
Cryptography
81
data protectionfingerprintingprivacy threatInvestigating Fingerprinting Techniques And Their Prevention In Firefox
Your data is worth more than you can imagine, and this is why advertisers turn to all kinds of tactics to collect information about you, including a method that is known as fingerprinting. Learn about fingerprinting and how Firefox blocks this privacy threat by default: . In essence a type of tracking, fingerprinting comes down to an entire profile that ad companies create about you. This profile contains super-detailed information about you, including not only the browser that you use, the operating system resolution, and things like that, but also fonts, screen size, and other unique data that is then used to make a difference between your profile and another. Obviously, not everyone agrees to give up on this data when browsing the web, so such info is often collected without users to even know about it. The link for this article located at Softpedia News is no longer available. . Discover the intricacies of fingerprinting, a technique utilized for online tracking, and explore how Firefox adeptly safeguards its users by thwarting this potential invasion of privacy.. Tracking Methods, Browser Privacy, Data Protection. . LinuxSecurity.com Team
Jan 10, 2020
•
Privacy
81
law enforcementdata collectionprivacy threatAxon Ethics Report Cautions Against ALPRs' Surveillance Risks
Automated License Plate Readers(ALPRs)—a mass surveillance technology that allows law enforcement to record the location and travel patterns of nearly every driver on the road—are poorly regulated, threaten privacy, and worsen the racial and economic inequalities already ingrained in our justice system. What are your thoughts on this privacy threat and how it should be handled? Learn more in an interesting EFF article: . That’s what EFF and other advocates have been saying for years. But now it’s coming from an oversight body formed by one of the nation’s largest police tech vendors. Last week, the AI and Policing Technology Ethics Board at Axon, a tech company best known for popularizing body-worn cameras and the Taser, released a damning report concerning the commercial sale of ALPRs. The board, whose purpose is to “help guide and advise the company on ethical issues,” concluded that while it sees the potential value of ALPRs, their current role in society is too broad and problematic. The sheer amount of information that ALPRs gather and store was also a concern for the ethics board—particularly when privately collected data is often for sale to whoever wants to buy it. . The advisory panel of a prominent law enforcement technology firm raises alarms about the ramifications of surveillance tools on civil liberties and social disparity.. ALPR Surveillance, Privacy Threats, Police Tech Vendors, Ethical Concerns, Data Collection Practices. . LinuxSecurity.com Team
Oct 31, 2019
•
Privacy
81
security riskseavesdroppingprivacy threatPrivacy Threats From Alexa and Google Home: Eavesdropping Risks
Have you heard that Amazon- and Google-approved apps are turning voice-controlled devices into "smart spies"? Learn more about this serious privacy threat: . By now, the privacy threats posed by Amazon Alexa and Google Home are common knowledge. Workers for both companies routinely listen to audio of users—recordings of which can be kept forever —and the sounds the devices capture can be used in criminal trials . Now, there's a new concern: malicious apps developed by third parties and hosted by Amazon or Google. The threat isn't just theoretical. Whitehat hackers at Germany's Security Research Labs developed eight apps—four Alexa "skills" and four Google Home "actions"—that all passed Amazon or Google security-vetting processes. The skills or actions posed as simple apps for checking horoscopes, with the exception of one, which masqueraded as a random-number generator. Behind the scenes, these "smart spies," as the researchers call them, surreptitiously eavesdropped on users and phished for their passwords. . Uncover the security risks associated with smart devices like Alexa and Google Home, which can be exploited by harmful applications that listen in and harvest sensitive information.. Amazon Alexa, Google Home, Smart Devices, Eavesdropping Threats, Privacy Risks. . LinuxSecurity.com Team
Oct 22, 2019
•
Privacy
81
security researchmobile securityanonymous browsingSecTor: Major Privacy Threat from Tor in Millions of Mobile Devices
There is a privacy threat lurking on perhaps hundreds of millions of devices, that could enable potential attackers to track and profile users, by using information leaked via the Tor network, even if the users never intentionally installed Tor in the first place. Learn more in an informative article: . In a session at the SecTor security conference in Toronto, Canada on October 10, researchers Adam Podgorski and Milind Bhargava fromDeloitte Canadaoutlined and demonstrated previously undisclosed research into how they were able to determine that personally identifiable information (PII) is being leaked by millions of mobile users every day over Tor. The irony of the issue is that Tor is a technology and a network that is intended to help provide and enable anonymity for users. With Tor, traffic travels through a number of different network hops to an eventual exit point in the hope of masking where the traffic originated from. Podgorski said that there are some users that choose to install a Tor browser on their mobile devices, but that’s not the problem. The problem is that Tor is being installed by mobile applications without user knowledge and potentially putting users at risk. The link for this article located at InfoSecurity is no longer available. . In a session at theSecTorsecurity conference in Toronto, Canada on October 10, researchers Adam Podg. there, privacy, threat, lurking, perhaps, hundreds, millions, devices, enable. . LinuxSecurity.com Team
Oct 11, 2019
•
Privacy
81
online privacydata leakageplugin securityResearch Uncovers Browser Extensions Leaking User Data Risk
Do you used Firefox or Chrome as your web browser? Are you aware that browser plug-ins can be a threat to your privacy? . Eight catastrophically leaky browser extensions were discovered by researcher Sam Jadali , working withWashington Post columnist Geoffrey A. Fowler. Together, they traced the privacy train wreck, dubbed DataSpii, to browser extensions (also known as add-ons or plug-ins) that run around doing things like making browsing better by finding coupons or remembering passwords or whatever. The link for this article located at NakedSecurity is no longer available. . Analyst Lisa Vorchik discovered ten critically vulnerable mobile applications, highlighting major security concerns.. Browser Extensions, Data Leakage, Privacy Threats, Plugin Security. . LinuxSecurity.com Team
Jul 26, 2019
•
Privacy
81
data collectionsecurity analysisprivacy threatPrivacy Risks of Pre-Installed Apps on Android Smartphones
An academic study that analyzed 82,501 apps that were pre-installed on 1,742 Android smartphones sold by 214 vendors concluded that users are woefully unaware of the huge security and privacy-related threats that come from pre-installed applications. . Researchers found that many of these pre-installed apps have access to very intrusive permissions out of the box, collect and send data about users to advertisers, and have security flaws that often remain unmatched. On top of this, many pre-installed apps (also referred to as bloatware) can't be removed, and also use third-party libraries that secretly collect user data from within benign-looking and innocently-named applications. The link for this article located at ZDNet is no longer available. . Recent studies uncover significant security concerns associated with factory-loaded applications on Android devices, pointing to a lack of user knowledge.. Android Privacy Risks, Pre-installed App Security, Data Collector Apps, Bloatware Issues. . LinuxSecurity.com Team
Mar 26, 2019
•
Privacy
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!