Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Organizations should combine the NVD and CISA KEV catalog to prioritize vulnerabilities effectively, focusing on managing real risks rather than being overwhelmed by theoretical scores and alert fatigue.. To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the NVD provides baseline technical metrics aligned with the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found -2 articles for you...
83
cyber threatsapplication securitymalwareSnowblind Malware: Understanding Seccomp Threats in Financial Apps
Cybersecurity threats continue to emerge regularly, and Promon's security team recently identified one such novel threat, Snowblind. This malware targets Android apps used for banking apps in Southeast Asia using an unconventional exploit method involving seccomp, a Linux kernel feature. Snowblind first surfaced through Promon partner i-Sprint's discovery and represents a significant shift in attack vectors in that region. . Let's examine this novel threat, how it works, and practical measures you can implement to mitigate risk. Understanding seccomp and Its Misuse To appreciate Snowblind fully, it is necessary first to understand seccomp . Short for "secure computing mode," this Linux kernel security facility restricts what system calls applications can execute - significantly reducing its attack surface by placing applications within a secure sandbox where only approved system calls may be executed. Introduced in 2005 and expanded further in 2012 with seccomp-bpf to enable more complex filtering rules through Berkeley Packet Filters (BPF) , seccomp has proven its worth as an application-level security feature since Android version 8 (Oreo). Seccomp now prevents apps from making particular off-limit system calls, thus protecting against potential exploits. Snowblind is the first recorded seccomp instance deployed as an attack vector. Instead of serving as an effective protection measure, seccomp is being leveraged as a weapon by clever malware that subverts established anti-tampering mechanisms like repackage detection, integrity checks, and obfuscation by exploiting seccomp's robust control over system calls. Snowblind's Operational Mechanics Snowblind works by infiltrating applications with malicious payloads and then repackaging them for distribution to users and security measures alike. Unlike other malware that directly modifies app code or works within virtualized environments, Snowblind uses seccomp to bypass defenses unnoticed. It alters host application filters to allowmalicious system calls while maintaining normal operations in terms of users and security measures. The risk in taking this approach lies in its subtlety and effectiveness: malware does not need to perform complex hacks on an app's functionality. Instead, it modifies runtime environment rules, making detection particularly challenging. Snowblind's primary targets are banking applications in Southeast Asia and their users. While its effect may seem limited in scope, using seccomp as an attack tool could inspire similar tactics globally and pose an existential threat to Android users worldwide. How Can I Combat Seccomp-based Threats? Understanding and countering this new threat requires several strategic and technical measures: Regular App Audits and Updates: It is vital to ensure that applications are regularly scanned for anomalies and updated to incorporate security patches. Enhance Application Behavior Monitoring: Implement tools that track and log runtime application behaviors, with particular attention paid to system call manipulation. Robust seccomp Profile Management: When setting up seccomp profiles, ensure they are as restrictive as possible regarding system calls allowed and that once set, they are inviolate. Educate Developers and Users: Raise awareness about this newly discovered exploit by teaching developers to employ safe coding practices while encouraging users to install apps from trusted sources. Our Final Thoughts on the Significance of Snowblind Malware Snowblind has transformed the cyber threat landscape by exploiting an integral security feature to launch system-level attacks. As attackers become more sophisticated in exploiting system components for breaches, cybersecurity must keep pace by being proactive and informed about implementing security measures. Adopting advanced technologies and strategies that anticipate and counteract emerging threats is vital against such innovative attacks. . The rise of Snowblind malware unveilssignificant security issues within the digital world, exploiting vulnerabilities via stealthy tactics to remain undetected. Snowblind Malware, Android Security, Seccomp Exploitation. . Anthony Pell
Jun 27, 2024
•
Hacks/Cracks
212
system managementapplication protectionlinux kernelSeccomp Profiles: Improving Kubernetes Security and Protection Techniques
Seccomp , which comes from "secure computing mode," is a built-in security feature in the Linux kernel that limits the system calls a process can make. Seccomp profiles in Kubernetes help minimize attack surfaces and prevent malicious code execution. . Let's explore how Seccomp profiles can enhance Kubernetes security and how you can enable them in your Kubernetes environment. What Is Seccomp & How Does It Improve Kubernetes Security? Advancing security needs have fueled the evolution of Seccomp, a feature that has become increasingly relevant since its introduction in the Linux kernel version 2.6.12 in 2005. Today, it is used beyond just Linux and Kubernetes, including in web browsers like Chrome and Firefox. Seccomp modes include block or allow and the newer filter mode, which offers filtering and fine-tuning security policies. Seccomp profiles offer protection in two key ways: exploiting vulnerabilities or compromising the supply chain . Attackers who gain code execution within a Kubernetes workload can potentially compromise the host (or node), exposing secrets and elevating privileges. If malicious code attempts to use a system call not part of its allowed set, Seccomp profiles can effectively block it, denying attackers the ability to access the host filesystem. How Can I Enable Seccomp in Kubernetes? There are two ways to enable Seccomp profiles in Kubernetes: pre-made and custom profiles. The former is convenient but less tailored to specific needs, whereas the latter offers fine-grained security measures with more complexity to create and maintain. Linux admins, infosec professionals, internet security enthusiasts, and sysadmins looking to implement Seccomp profiles in Kubernetes need a profound understanding of the application's system call needs. Our Final Thoughts on the Security Benefits of Seccomp Using Seccomp profiles in Kubernetes environments is essential for enhancing overall security posture. For Linux admins, infosec professionals, internet securityenthusiasts, and sysadmins seeking to improve the security for Kubernetes environments, Seccomp profiles are a critical feature to consider. As the adoption of Kubernetes continues to increase, so does the need to secure Kubernetes environments and prevent malicious actors from compromising them. . Investigate the role of Seccomp profiles in bolstering Kubernetes security and discover best practices for their effective implementation in your setup.. Kubernetes Security, Seccomp Profiles, Container Security, System Call Management, Linux Security. . Brittany Day
Feb 22, 2024
•
Cloud Security
78
web browserlinux kernellinux applicationGoogle Chrome 23: Enhanced Security Via Seccomp-BPF on Linux
Google was a bit slow in the beginning getting its Chrome browser ready for Linux. That's now changing as Google is now set to take advantage of an advanced Linux kernel feature that could well make Chrome on Linux more secure than any other OS.. Chrome 23 dev-channel now takes advantage of the Seccomp-BPF feature that debuted in the recent Linux 3.5 kernel. "Seccomp filtering provides a means for a process to specify a filter for incoming system calls," kernel develop Will Drewry wrote in a mailing list message. The link for this article located at Internet News is no longer available. . Explore the ways in which Chrome utilizes Seccomp-BPF to strengthen security measures on Linux with its newest enhancements.. Chrome Security, Seccomp BPF, Linux Kernel Features. . LinuxSecurity.com Team
Sep 12, 2012
•
Vendors/Products
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!