General Esm W900

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines.

LinuxSecurity.com Feature Extras:

- Social engineering is the practice of learning and obtaining valuable information by exploiting human vulnerabilities. It is an art of deception that is considered to be vital for a penetration tester when there is a lack of information about the target that can be exploited.

- When you’re dealing with a security incident it’s essential you – and the rest of your team – not only have the skills they need to comprehensively deal with an issue, but also have a framework to support them as they approach it. This framework means they can focus purely on what they need to do, following a process that removes any vulnerabilities and threats in a proper way – so everyone who depends upon the software you protect can be confident that it’s secure and functioning properly.

  (Jul 17)
 

The White House more or less doxed citizens, who took the time to submit feedback to the Presidential Advisory Commission on Election Integrity, by publishing 112 pages (pdf) of public comments without first redacting any personal information; some of the emailed comments were outraged, some commenters dropped f-bombs, one sent goatse, but they were published in full, including those that showed citizens' "email addresses, home addresses and phone numbers."
  (Jul 19)
 

Millions of IoT devices relying on widely used third-party toolkit gSOAP could face a zero-day attack, security firm Senrio disclosed Tuesday, which dubbed the vulnerability Devil's Ivy.
  (Jul 19)
 

In case someone manages to make a general purpose quantum computer one day, a group of IETF authors have put forward a proposal to harden Internet key exchange.
  (Jul 18)
 

A seven-year old vulnerability in Samba--an open-source implementation of the SMB protocol used by Windows for file and printer sharing--was patched last May but continues to be exploited. According to a security advisory released by the company, the vulnerability allows a malicious actor to upload a shared library to a writable share, causing the server to load and execute it.
  (Jul 18)
 

Data breaches and exposures all invite the same lament: if only the compromised data had been encrypted. Bad guys can only do so much with exfiltrated data, after all, if they can't read any of it.
  (Jul 17)
 

On Unix systems, random numbers are generated in a number of ways and random data can serve many purposes. From simple commands to fairly complex processes, the question "How random is random?" is worth asking.
  (Jul 20)
 

This year marks the 20th anniversary of Black Hat, the information security conference founded by Jeff Moss in 1997. What began as a single meetup in Las Vegas has expanded around the world to host events in the United States, Europe, and Asia.
  (Jul 17)
 

Managing an IT department at the best of times can be a struggle, and managing a security team has its own special challenges.But whatever you do, don't put an engineer, even your best, in charge, unless their people management skills are as good as their infosec knowhow.
  (Jul 20)
 

A Russian man who helped create and spread the notorious Citadel malware back in 2011 was sentenced Wednesday to five years in prison by a federal judge in Atlanta.
  (Jul 21)
 

Last Christmas, Nathan Seidle's wife gave him a second-hand safe she'd found on Craigslist. It was, at first glance, a strange gift. The couple already owned the same model, a $120 SentrySafe combination fire safe they'd bought from Home Depot. But this one, his wife explained, had a particular feature: The original owner had locked it and forgotten the combination. Her challenge to Seidle: Open it.
  (Jul 21)
 

The FBI has issued an advisory to businesses over a recent string of DDoS extortion attempts. The perpetrators are claiming to be affiliated with Anonymous or Lizard Squad, and their demands threaten sustained attacks unless a Bitcoin payment is made.
  (Jul 24)
 

Microsoft has unveiled a new bug hunting tool, named Microsoft Security Risk Detection, that's built to help customers find and eliminate bugs before attackers can seize on them.