You can run your RX 480 on Linux kernel 4.7

Subject: General Tech | July 25, 2016 - 01:12 PM |
Tagged: linux, kernel 4.7, security, rx 480, LoadPin

For now we are awaiting the benchmarks but with the release of this new kernel, Linux users will be able to run the new RX 480 from AMD.  The new kernel also contains a new security feature called LoadPin which ensures that kernel-loaded files come from within the same file system in an attempt to maintain security without requiring each file to be individually signed.  There were also some improvements made to network drivers along with several other changes which The Inquirer covers in their own unique manner.

linuxkernel.jpg

"Despite it being two weeks since RC7, the final patch wasn't all that big and much of it is trivial one- and few-liners. There's a couple of network drivers that got a bit more loving."

Here is some more Tech News from around the web:

Tech Talk

Source: The Inquirer

Ya, so our IoT enabled toasters need patching ... oh, only around 5 million, why is that a problem?

Subject: General Tech | July 20, 2016 - 12:45 PM |
Tagged: iot, security, amazon, Intel

The Register brings up the issue of IoT security once again today, this time looking at the logistics of patching and updating a fleet of IoT devices.  Amazon is focusing on dumb devices with a smart core, the physical device having the sensors required and a connection to the net to send all data to be processed in large database which would be much easier to maintain but does offer other security issues.  Intel on the other hand unsurprisingly prefers end devices with some smarts, such as their Curie and Edison modules, with a smarter gateway device sitting between those end devices and the same sort of large server based computing as Amazon. 

Intel's implementation may be more effective in certain enviroments than Amazons, El Reg uses the example of an oil rig, but would be more expensive to purchase and maintain.  Take a look at the article for a deeper look, or just imagine the horrors of pushing out a critical patch to 1000's of devices in an unknown state when you go live.

talkie-toaster.jpg

"Internet of Things (IoT) hype focuses on the riches that will rain from the sky once humanity connects the planet, but mostly ignores what it will take to build and operate fleets of things.

And the operational side of things could be hell."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Linux on a highway, I wanna ride it all night long

Subject: General Tech | July 14, 2016 - 01:28 PM |
Tagged: linux, iot, security, Automotive Grade Linux

Has the almost obscene lack of security in automobile software made you somewhat paranoid, even if you trust the Tesla autopilot?  Has the fact that a mere attempt to access your cars software could land you in jail turned you completely off of buying a car less than 10 years old?

How would you feel about a version of Linux controlling some of the features of your car?  That is exactly what the Linux Foundation is working on with the AGL project.  The hardware used will include DragonBoard, Wandboard, and Raspberry Pi and automobile manufacturers joining the project include  Ford, Subaru, Mazda, Mitsubishi, Toyota, Nissan, and Jaguar Land Rover.  So far the project only encompasses in-car entertainment but it does have the potential to grow beyond that.  Check out the story on Linux.com for more.

Automotive-Grade-Linux.jpg

"The Linux Foundation’s Automotive Grade Linux (AGL) project, which is developing a “Linux-based, open platform for the connected car,” announced the release of the second version of its Unified Code Base (UCB) distribution for in-vehicle infotainment (IVI)."

Here is some more Tech News from around the web:

Tech Talk

Source: Linux.com

Yes, some of your users phones are infected

Subject: General Tech | July 5, 2016 - 12:32 PM |
Tagged: security, Malware

Managing mobile devices in an enterprise environment is a nightmare, even with properly set up security polices and some sort of Mobile Device Manager.  Security firm Skycure recently estimated one in every 200 devices is infected with some form of malware, which seems a bit low especially considering that some the devices tested had 290 apps installed.  Infections of Android devices are most common but do not think for a moment that your iOS device is safe, it may only be half as likely to be compromised but it does indeed have serious vulnerabilities as well.  Drop by The Register for a look at the numbers of bad apps on various stores.

36e22fe6de9f2cf7acc3a2e1ced5f9e5.png

"Researchers found enterprises have three unique infection instances with devices sporting an eye-watering average of 290 apps a piece."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

More Examples of Why AV Software Can Be Bad

Subject: General Tech | July 5, 2016 - 02:13 AM |
Tagged: symantec, security

I know that I've mention this in the past, and I'm not advocating running no antivirus software, but it's good to remember that you're using high-privileged software to load untrusted data. While mistakes can happen in any reasonably complex software, some companies are more complacent than others, and some design choices fail to respect the trust you have in them. Symantec, as far as I know, has one of the better reputations of security companies, but this flaw is terrible.

fry-not-sure-if.jpg

Basically, to detect malware that has been obfuscated by executable compression, antivirus software unpacks it themselves and looks. Symantec's solution runs in the kernel, allowing any malware that targets it to have kernel permissions. They were also using “at least” seven-year-old forks of open source libraries. Well... crap.

The bugs have been privately disclosed to Symantec, and fixed before Google went public. If you have any Symantec, or their consumer brand, Norton, software, then make sure it's up to date. Consumer software will have the fix pushed through LiveUpdate, but some some products, like Symantec Endpoint Protection and Symantec Protection for SharePoint Servers might require administrator action.

Source: Google

Doctor, treat thyself .. or at least the hospital please

Subject: General Tech | June 29, 2016 - 01:36 PM |
Tagged: hospital, security, winxp, Malware

For the past few years we have heard about some rather horrific security vulnerabilities in hospitals and sadly this has not changed at all.  Indeed many hospitals are still on older, unsupported OSes such as WinXP that most security software no longer protects against the malware which was used.  In one case a hospital using centralised intrusion detection software, updated endpoint protection, and new model firewall was still compromised using very old malware. In most of the cases described by The Register it was personal data and medical records which were compromised but that doesn't mean the medical appliances and physical security systems are not also vulnerable to attack.

2011-06-23-gaza-il-e-02347.jpg

"Attackers have popped three prominent US hospitals, using deliberately ancient malware so old that it slips under the radar of modern security controls to compromise Windows XP boxes and gain network beacheads."

Here is some more Tech News from around the web:

Tech Talk

 

Source: The Register

You were to bring balance to the ads, not leave us in darkness HTML5

Subject: General Tech | June 24, 2016 - 12:59 PM |
Tagged: VPAID, VAST, security, Malware, javascript, html5, flash

Upsetting news today from GeoEdge, not only is HTML5 not going to prevent drive by infections from ads but it also turns out that Flash was nowhere near as responsible for these infections as we thought.  Hard to say which of those two facts is more upsetting but don't worry, you can still malign JavaScript.  The security problems actually stem from the two advertising standards used on the web, VAST and VPAID which are the vector of infection of the JavaScript code which runs to display the ad on your browser.  Follow the link from Slashdot for a detailed explanation of what is happening. 

images.jpg

"A study from GeoEdge, an ad scanning vendor, reveals that Flash has been wrongly accused of being the root cause of today's malvertising campaigns, but in reality, switching to HTML5 ads won't safeguard users from attacks because the vulnerabilities are in the ad platforms and advertising standards themselves."

Here is some more Tech News from around the web:

Tech Talk

Source: Slashdot

If you bought directly from Acer over the past year, double check your spam and email

Subject: General Tech | June 20, 2016 - 01:21 PM |
Tagged: acer, security

North American customers of Acer who bought directly from them between May 12, 2015 and April 28, 2016 may have had their credit card numbers compromised.  Their less than secure customer database contained customer names, addresses, card numbers, and three-digit security verification codes all of which have been siphoned off at least once.  If this breach effected your account Acer will be sending a notification to you, you can see an example at The Register if you want to be sure you are receiving a valid notification.  For those who have seen fraudulent charges already this will be too late to mitigate their pain but anyone who used Acer's online shop during that time period would do well to get their cards changed.

Acer_logo_new.jpg

"Acer's insecure customer database spilled people's personal information – including full payment card numbers – into hackers' hands for more than a year."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

Criminy, that's a nasty one! Near invisible infections via BITS

Subject: General Tech | June 9, 2016 - 12:41 PM |
Tagged: microsoft, BITS, security

BITS, the Microsoft Background Intelligent Transfer Service used for pushing out OS updates among other things can be turned to the dark side in a rather nasty way.  When cleaning up an infect network, security professionals stumbled upon a nasty discovery, a compromised machine with no sign of an infection vector except in the BITS database.  The malware came in through the usual channel but once installed it used a BITS task to clean up any traces of the installation from temp files and the registry and then delete itself, leaving an infected machine with almost no traces of where the infection came from or is residing.  The Register offers advice on how to check suspicious machines in their story.

service.jpg

"While working on a customer clean-up project, SecureWorks staff found that attackers had created self-contained BITS tasks that didn't appear in the registries of affected machines, and their footprints were limited to entries on the BITS database."

Here is some more Tech News from around the web:

Tech Talk

Source: The Register

What did we just tell you about bloatware?! Now ASUS Live Update is the risk of the day

Subject: General Tech | June 6, 2016 - 02:26 PM |
Tagged: asus, bloatware, security

After last week when several laptop OEMs, including Lenovo once again, were caught installing highly insecure bloatware on their laptop you might hope that this week would be different.  Sadly you would be mistaken as once again software preinstalled on laptops is in the news.  In this case it is ASUS Live Update which transmits requests for updates in plain text and does not check any software updates which come back for authenticity.  This of course leaves you wide open for man in the middle attacks, where someone posing as those update servers could feed you whatever installation files they desired.  As the pull quote from The Inquirer below states, removing it immediately would be a very good idea.

a6e6087353a6c593afc6327b758650a6.jpg

"My advice to anyone who purchased an Asus device: remove LiveUpdate. It's really that simple. If you're an IT administrator, find devices making periodic calls to Asus's domains and blackhole them, get the user to come and see you,"

Here is some more Tech News from around the web:

Tech Talk

Source: The Inquirer