Linux Security Week: November 12th, 2018

Hackers have published private messages from the compromised accounts of some 81,000 Facebook users and put them up for sale on the internet, according to a BBC News report.

FIFA President Gianni Infantino said in a statement to the press that the world football governing body's computer systems suffered a data breach for the second time this year. Moreover, both the Fédération Internationale de Football Association (FIFA) and Union of European Football Associations (UEFA) are both suspected of having suffered data breaches.

A team of security researchers has discovered another serious side-channel vulnerability in Intel CPUs that could allow an attacker to sniff out sensitive protected data, like passwords and cryptographic keys, from other processes running in the same CPU core with simultaneous multi-threading feature enabled.

There may not be any immediate evidence of Russia directly meddling with the US midterm elections, but the Department of Defense is apparently ready to strike back if it happens. Anonymous officials talking to the Center for Public Integrity and the Daily Beast say the Pentagon and intelligence agencies have agreed on the core terms of a retaliatory cyberattack in the event Russia tries a bold move.

Mark Z, how do you feel about orange? Like, say, in a jumpsuit style?Kidding! No court has found that you, the Facebook CEO, has purposefully misled the government about how your company did/did not protect consumers' data during, say, the multifaceted, ever-unfolding, Cambridge Analytica privacy debacle.

After Russia's misinformation campaign rattled the 2016 United States election season, scrutiny over this year's midterms has been intense. And while foreign cybersecurity threats have so far been relatively muted, an unclassified government report obtained by The Boston Globe this week indicates more than 160 suspected election-related incidents since the beginning of August, ranging from suspicious login attempts to compromised municipal networks.

Tuesday morning, as millions of Americans lined up at their polling places to participate in the often quite literally broken democratic process, a new Twitter account tweeted a link to a short manifesto: "today's voting machines are often insecure, not particularly easy-to-use, and so expensive that they're often used much longer than they were designed for and election officials are forced to hunt for replacement parts on eBay. The market has failed us."

An independent researcher who was disgruntled with traditional bug bounty methods took it upon himself to leak the details of an exploit in Oracle's Virtual Box without first informing Oracle.

The decision to make recreational cannabis legal in Ontario, Canada, has been fraught with problems and now has been tarnished by a data breach at Canada Post.

In April of 2015, IT staffers within the United States Office of Personnel Management (OPM), the agency that manages the government's civilian workforce, discovered that some of its personnel files had been hacked. Among the sensitive data that was exfiltrated were millions of SF-86 forms, which contain extremely personal information gathered in background checks for people seeking government security clearances, along with records of millions of people's fingerprints.

Hackers have exploited --and are currently continuing to exploit-- a now-patched zero-day vulnerability in a popular WordPress plugin to install backdoors and take over sites.

The Apache Software Foundation released an advisory addressing a vulnerability in Apache Struts which could allow a remote attacker to take control of an affected system.