friendica.prankgo.de

Search

Items tagged with: Security

Passenger Name Record: EU diskutiert Überwachung von Reisen per Zug, Bus und Schiff #Reisen #Datenschutz #Datensicherheit #EU #EuGH #Internet #PolitikRecht #Security
 
Zugang per Venenscan: Wenn das Freibad zum Hochsicherheitstrakt wird #Biometrie #Datensicherheit #Palmsecure #Scanner #Fujitsu #Security
 
Hacker-Attacke: Datenleck bei Freenet-Tochter Vitrado #Datenleck #Datenbank #Datenschutz #Datensicherheit #E-Commerce #Passwort #SQL #Freenet #Security #Wirtschaft
 
Bluetooth: Tracking trotz Trackingschutz möglich #Bluetooth #Datenschutz #Datensicherheit #MacOS #Tracking #iOS #Mac #Technologie #Security #Wissenschaft
 
Immer wieder rasten Kunden aus, wenn sie ihren Abfall nicht so entsorgen können, wie sie sich das vorgestellt haben. Ein Sicherheitsdienst soll das Problem lösen. #Recyclinghof #EBE #Entsorgung #Abfall #Security #Altenessen #NRW
 

Office 365 declared illegal in German schools due to privacy risks - no way for the German government to monitor cloud access by US authorities

This time around, the Hessian commissioner for Data Protection and Freedom of Information (HBDI) isn't just saying that schools would prefer not to use Microsoft, he's stating that their use of Office 365 is outright illegal. In August 2017, the HBDI ruled that Office 365 could legally be used by schools so long as the back end for the school accounts was stored in Microsoft's German-located cloud. A year later, Microsoft closed its German cloud datacenter, and schools migrated their accounts to the European cloud. Now, the HBDI states that the European cloud may offer access to US authorities; with no way for the German government to monitor such access; this makes use of that cloud illegal without specific consent being granted by its individual users.

In addition to the physical geography of the cloud, the HBDI is unhappy about telemetry in both Office 365 and Windows 10 itself. Neither can be disabled by end users or organizations, and the content of both remains undisclosed by Microsoft despite repeated inquiries. According to the HBDI, the only legal way around the murky provenance of the telemetry—and possible US state access to users' data—is by asking consent of the individual users.

See https://arstechnica.com/information-technology/2019/07/germany-threatens-to-break-up-with-microsoft-office-again/

#office365 #security
Office 365 declared illegal in German schools due to privacy risks

Bild/Foto
Microsoft's future in Germany is in question again.

https://gadgeteer.co.za/node/3356
 
Fehler 502: Cloudflare schämt sich für den vergangenen Ausfall #Cloudflare #Datensicherheit #DoS #Firewall #HTTP #WCO #Server #Internet #Security
 
Mitschnitte des Google Assistant: Google ermittelt gegen Mitarbeiter wegen Sicherheitsverstoß #GoogleAssistant #Datenschutz #Datensicherheit #GoogleHome #Privatsphäre #Spracherkennung #Google #AudioVideo #Security
 
If you have some knowledge in web security and Content Security Policy, would you mind having a look at https://dev.funkwhale.audio/funkwhale/funkwhale/merge_requests/826 ?

This is an attempt to harden the security of the web UI via a CSP (and some additional HTTP headers) and to reduce the attack surface in case of exploits.

#security #funkwhale #helpwanted
 
Microsoft: Sicherheitspatch für Windows 7 enthält Telemetrietool #Windows7 #Cookies #Datenschutz #Datensicherheit #Sicherheitslücke #Windows #Windows10 #Microsoft #Security
 
Malware: Zip-Bombe entpackt 46 MByte zu 4,5 Petabyte #Malware #Datensicherheit #Packer #Unix #Virus #Winrar #OpenSource #Security
 
CTRL-ALT-LED: Daten über die Tastatur-LEDs ausleiten #Security #Datensicherheit #Malware
 
OpenPGP: GnuPG verwirft Signaturen von Keyservern #OpenPGP #Datensicherheit #Efail #GPG #PGP #Verschlüsselung #Applikationen #Security
 
Bridge und Dreamweaver: Adobe muss keinen Flash-Bug beseitigen #Adobe #Datensicherheit #Patchday #Sicherheitslücke #Applikationen #Security
 
Medizin: Sicherheitslücken in Beatmungsgeräten #Medizin #Datenschutz #Datensicherheit #Sicherheitslücke #Techcrunch #Server #Security
 
Streaming: DRM-Systeme werden für illegale Webkopien geknackt #DRM #Datensicherheit #Streaming #Verschlüsselung #Internet #Security
 
TLS-Zertifikate: Mozilla vertraut Zertifikaten von Dark Matter nicht mehr #Spionage #Datensicherheit #NSA #TLS #Mozilla #Technologie #Applikationen #Internet #PolitikRecht #Security
 
Datenschutzbeauftragter: Schulen dürfen Office 365 nicht mehr verwenden #Office365 #Azure #CloudComputing #Datenschutz #Datensicherheit #Office #Microsoft #Applikationen #Security
 

9 Open Source Password Managers to Secure Yourself With

People use password managers so that they don’t have to remember all the usernames/passwords of the websites they visit. Instead, they can just remember 1 password, and then access all the other passwords whenever they need. In addition to that, this allows you as a user to increase the length and the complexity of the passwords you use, because now, you no longer have to remember them, so you can make your Facebook’s password something like 21#^#Y3#^2h281+_0H^I@F!##YU&^ with no problem.

Also, some password managers offer other features that you can use. E.g: Auto-fill (automatically fill the passwords when you open the URL in your browser), synchronization between devices, team storage (sharing passwords between multiple people), smartphone integration, various types & tools of encryption, emergency codes.. And so on.

Traditionally, there are many closed-source proprietary password managers, and there are those which are open source.

It is good to see some newer password managers in the list and not just the same old ones we are used to seeing - see
9 Open Source Password Managers to Secure Yourself With


#security #passwords
9 Open Source Password Managers to Secure Yourself With


Bild/Foto
Here's a good list of 9 open source password managers that you can use to secure your passwords. Using of these is a must, but which one would you choose?

https://gadgeteer.co.za/node/3350
 
Linux-Distributor: Canonicals Github-Konto gehackt #Canonical #Datensicherheit #Github #Hacker #Linux #Sicherheitslücke #Ubuntu #Internet #OpenSource #Security
 
DSGVO: 200 Millionen Euro Strafe für Datenleck bei British Airways #Datenleck #DSGVO #Datenschutz #Datensicherheit #Sicherheitslücke #Internet #Security
 
Endpoint Security: IT-Sicherheit ist ein Cocktail mit vielen Zutaten #Datensicherheit #BSI #BYOD #Malware #VPN #Security
 
Elektronische Beweismittel: Regierung sieht Grundrechte durch EU-Pläne gefährdet #EU #Bundesregierung #Cookies #DSGVO #Datenschutz #Datensicherheit #E-Privacy #Netzpolitik #Internet #Security
 
Logitech: Schwerwiegende Sicherheitslücken in kabellosen Tastaturen #Logitech #Datensicherheit #Eingabegerät #Passwort #Sicherheitslücke #Tastatur #Verschlüsselung #Security
 
Microsoft: Forbes hält Windows 10 weiterhin für eine Gefahrenzone #Windows10 #Datensicherheit #VPN #Windows #Microsoft #Security
 

OpenWRT 18.06.4 Released


If you run a local cable or DSL modem, or router/WiFi, you should check to see if your device can run OpenWRT, or consider replacing it with one that will. Installation can be a bit of an adventure, but if you're even modestly versed with bash prompt in Linux or MacOS, you should consider it.

The project has just released its latest update (the first in about six months), mostly consisting of security updates.

https://openwrt.org/releases/18.06/notes-18.06.4

Someone had asked at Hacker News what are the benefits? My answer:

Vastly more power and flexibility, with a highly usable Web interface (LUCI) and console access.

Regular updates.

Excellent documentation: https://openwrt.org/docs/start

And a whole set of packed applications and tools. There are about 6,000 packages in total, ranging from device-specific and kernel support to advanced applications such as media servers. Link below is just the larger apps.

https://openwrt.org/docs/guide-user/services/start

Re-romming my DSL modem (500 Mhz dual-core CPU, 64 MB RAM, 8 MB Flash), as advantages over stock vendor firmware, I get:
  • adblock
  • SSH access, rather than periodically-enabled telnet
  • remote logging capabilities. The ability to go back to see what went wrong and when can be incredibily useful.
  • Performance and activity monitoring.
  • Consistent interface with my router (also running OpenWRT).
  • Full-featured shell tools rathee than barebones Busybox versions, if I like.
  • Remote filesystems / additional storage.
Depending on your device(s) and capabilities, your modem, router, or other hardware can serve as a home server: NAS, UuuNextCloud, Webserver, VOIP services, media server, PXEBoot (useful for testing images/deployments), guest network(s), VPN, proxy servers, email, mesh networks, messaging, captive portals, and far more.

I also run a Turris Omnia WiFi Router, also running a version of OpenWRT. That's slightly more expensive than a most stock routers, at about US$300, though it's not much off comparably specced systems, and offers advanced features, most notably that it self-updates regularly, something OpenWRT doesn't otherwise do (and virtually no OEM vendors presently support). You can also add an mSATA hard drive (up to 500 GB storage), or build out an optional NAS enclosure (2 disks), or in conjunction with an external NAS offer backups and other services to your local network, as well as provide services either privately or publicly. I'm looking at media serving and a space to stash a growing research library.

#openwrt #networking #security #linux #broadband #dsl
 
7-Eleven: Supermarktkette stoppt Zahlungssystem nach einer Woche #Datenschutz #Datensicherheit #Hacker #Verbraucherschutz #Security
 
Datenleck: Smart-Home-Datenbank mit 2 Milliarden Einträgen im Internet #Datenleck #Datenschutz #Datensicherheit #IoT #Passwort #Sicherheitslücke #SmartHome #Security
 
PM Chahed cites security reasons for the niqab ban following a double suicide bombing in Tunis last month. #Tunisia #MiddleEast #Security
 
#pass is a modular #password manager.

pass utilizes existing and strong projects like GPG to #securely #encrypt your passwords. pass organizes passwords in folders, which allows for easy modification by many tools and programs, like browser extensions. pass is well integrated with Git, which can provide quality incremental backups if desired.

Website 🔗️: https://www.passwordstore.org/

apt 📦️: pass

#free #opensource #foss #fossmendations #security
 
Turkish authorities say the blast, which killed at least three people, appears 'terror-related' #MiddleEast #Turkey #Security
 
Virgin Atlantic: Akkupack fängt bei Transatlantikflug Feuer #Luftfahrt #Akku #Datensicherheit #Flugzeug #Security
 
Verschlüsseltes DNS: Falschmeldung in Propagandaschlacht um DNS über HTTPS #DNS #Datensicherheit #JSON #Malware #TLS #Technologie #Applikationen #Internet #Security
 
Gesundheitsdaten: Gesundheitsapps werden beliebter, trotz Datenschutzbedenken #Medizin #App #Datenschutz #Datensicherheit #Sicherheitslücke #Applikationen #Security
 
iPhone: Lücke in iOS ermöglicht Angriff via Textnachricht #Sicherheitslücke #iPhone #Datensicherheit #Tablet #iCloud #iPad #Apple #Applikationen #Security #Mobil
 
#AtomicFacepalm and #Shit #Security

I guess if their focus is to profit off of the users and resell collected data to others, security isn't a top priority.
 
Google: Juli-Sicherheitsupdate für Android ist da #Android #Datensicherheit #H265 #HEVC #Malware #Sicherheitslücke #Security
 
Bild/Foto

Avoid Intel and AMD Universal Backdoors


Only use computers certified to Respect Your Freedom (RYF)

The #Intel #Management #Engine is present on all Intel #desktop, #mobile ( #laptop ), and #server #systems since mid 2006. It consists of an #ARC #processor core (replaced with other processor cores in later generations of the ME), #code and #data #caches, a #timer, and a secure #internal #bus to which additional #devices are connected, including a #cryptography engine, internal #ROM and #RAM, #memory #controllers, and a direct memory access ( #DMA ) engine to access the host operating system’s memory as well as to reserve a region of protected external memory to supplement the ME’s limited internal RAM. The ME also has #network access with its own #MAC #address through an Intel #Gigabit #Ethernet #Controller. Its #boot program, stored on the internal ROM, loads a #firmware “manifest” from the PC’s SPI #flash #chip. This manifest is signed with a strong #cryptographic #key, which differs between versions of the ME firmware. If the manifest isn’t signed by a specific Intel key, the boot ROM won’t load and execute the firmware and the ME processor core will be halted.

The Active Management Technology ( #AMT ) application, part of the Intel “vPro” brand, is a #Web server and application code that enables #remote #users to #power on, power off, view information about, and otherwise manage the #PC. It can be used remotely even while the PC is powered off ( via #Wake-on-Lan ). Traffic is encrypted using #SSL / #TLS libraries, but recall that all of the major SSL/TLS implementations have had highly publicized vulnerabilities. The AMT application itself has known #vulnerabilities, which have been #exploited to develop #rootkits and #keyloggers and #covertly gain #encrypted #access to the management features of a PC. Remember that the ME has full access to the PC’s RAM. This means that an #attacker exploiting any of these vulnerabilities may gain access to everything on the PC as it runs: all open #files, all running #applications, all #keys pressed, and more.

ME firmware versions 4.0 and later (Intel 4 Series and later chipsets) include an ME application for audio and video DRM called “Protected Audio Video Path” (PAVP). The ME receives from the #host operating system an encrypted #media #stream and encrypted key, decrypts the key, and sends the encrypted media decrypted key to the #GPU, which then #decrypts the media. PAVP is also used by another ME application to draw an #authentication PIN pad directly onto the screen. In this usage, the PAVP application directly controls the graphics that appear on the PC’s screen in a way that the host #OS cannot detect. ME firmware version 7.0 on PCHs with 2nd Generation Intel Core #i3 / #i5 / #i7 (Sandy Bridge) CPUs replaces PAVP with a similar DRM application called “Intel Insider”. Like the AMT application, these DRM applications, which in themselves are defective by design, demonstrate the #omnipotent #capabilities of the ME: this #hardware and its proprietary firmware can access and #control everything that is in RAM and even everything that is shown on the #screen.

The Intel Management Engine with its #proprietary firmware has complete access to and control over the PC: it can power on or shut down the PC, read all open files, examine all running applications, track all keys pressed and #mouse movements, and even #capture or #display #images on the screen. And it has a network interface that is demonstrably #insecure, which can allow an attacker on the network to #inject #rootkits that completely compromise the PC and can report to the attacker all activities performed on the PC. It is a #threat to #freedom, #security, and #privacy that can’t be ignored.

Before version 6.0 (that is, on systems from 2008/2009 and earlier), the ME can be disabled by setting a couple of values in the SPI flash memory. The ME firmware can then be #removed entirely from the flash memory space. Libreboot does this on the Intel 4 Series systems that it supports, such as the Libreboot X200 and Libreboot T400. ME firmware versions 6.0 and later, which are found on all systems with an Intel #Core i3/i5/i7 CPU and a PCH, include “ME Ignition” firmware that performs some hardware #initialization and power management. If the ME’s boot ROM does not find in the SPI flash memory an ME firmware manifest with a valid Intel signature, the whole PC will shut down after 30 minutes.

Due to the signature verification, developing free #replacement firmware for the ME is basically impossible. The only entity capable of replacing the ME firmware is Intel. As previously stated, the ME firmware includes proprietary code licensed from third parties, so Intel couldn’t release the source code even if they wanted to. And even if they developed completely new ME firmware without third-party proprietary code and released its source code, the ME’s boot ROM would reject any modified firmware that isn’t signed by Intel. Thus, the ME firmware is both hopelessly proprietary and #tivoized.

For years, #coreboot has been #struggling against Intel. Intel has been shown to be extremely uncooperative in general. Many coreboot #developers, and #companies, have tried to get Intel to #cooperate; namely, releasing source code for the firmware components. Even #Google, which sells millions of #Chromebooks (coreboot preinstalled) have been #unable to #persuade them.

Even when Intel does cooperate, they still don’t provide source code. They might provide limited #information (datasheets) under #strict #corporate #NDA ( #non-disclosure #agreement ), but even that is not guaranteed. Even ODMs and IBVs can’t get source code from Intel, in most cases (they will just integrate the blobs that Intel provides).

In summary, the Intel #Management #Engine and its applications are a #backdoor with #total access to and control over the rest of the PC. The ME is a threat to freedom, security, and privacy, and the Libreboot project strongly recommends avoiding it entirely. Since recent versions of it can’t be removed, this means avoiding all #recent #generations of Intel hardware.

Recent Intel graphics chipsets also require firmware blobs


Intel is only going to get #worse when it comes to user freedom. Libreboot has no support recent Intel platforms, precisely because of the problems described above. The only way to solve this is to get Intel to #change their #policies and to be more #friendly to the free software #community. Reverse engineering won’t solve anything long-term, unfortunately, but we need to keep doing it anyway. Moving forward, Intel hardware is a non-option unless a #radical change happens within Intel.

Basically, all Intel hardware from year 2010 and beyond will never be supported by Libreboot. The Libreboot project is actively #ignoring all modern Intel hardware at this point, and focusing on #alternative platforms.

Why is the latest AMD hardware unsupported in Libreboot?


It is extremely unlikely that any post-2013 #AMD hardware will ever be supported in Libreboot, due to severe security and freedom #issues; so #severe, that the Libreboot project recommends avoiding all modern AMD hardware. If you have an AMD based system affected by the #problems described below, then you should get rid of it as soon as possible.

AMD Platform Security Processor (PSP)


This is basically AMD’s own version of the Intel Management Engine. It has all of the same basic security and freedom issues, although the #implementation is wildly different.

The Platform Security Processor (PSP) is built in on all Family 16h + systems (basically anything post-2013), and controls the main #x86 core #startup. PSP firmware is cryptographically signed with a strong key similar to the Intel ME. If the PSP firmware is not present, or if the AMD signing key is not present, the #x86 cores will not be #released from #reset, rendering the system #inoperable.

The PSP is an ARM core with TrustZone #technology, built onto the main CPU die. As such, it has the ability to #hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, #login data, #browsing #history, #keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM “features” to work as intended), which means that it has at minimum MMIO-based access to the #network controllers and any other PCI/PCIe peripherals installed on the #system.

In theory any #malicious entity with access to the AMD signing key would be able to install persistent #malware that could not be eradicated without an external flasher and a known good PSP image. Furthermore, multiple security vulnerabilities have been demonstrated in AMD #firmware in the #past, and there is every #reason to assume one or more zero day vulnerabilities are lurking in the PSP firmware. Given the extreme privilege level (ring -2 or ring -3) of the PSP, said vulnerabilities would have the ability to #remotely #monitor and control any PSP enabled machine completely outside of the user’s #knowledge.

A reliable way to avoid Intel and AMD’s universal backdoors is to use computers with such spyware effectively removed or disabled like the ones certified to Respect Your Freedom (RYF).

#NSA #spyware #spy #mass #surveillance #FSF #GNU #GNULinux #RYF #technology #laptops #CPU #processor #universal #backdoor #malware #Corei3 #Corei5 #Corei7
 
Revolutionary Guards' chief says Iran has 'closed the path' militarily, leaving US to pursue economic conflict. #Iran #RevolutionaryGuard #Security #HassanRouhani #UnitedStates #MiddleEast
 
- #unitoodailynews, #email, #security, #protonmail Online privacy is more than a PR campaign - ProtonMail blog https://t.co/E32GLHYghV -<br>
Bild/Foto<br>
- #Unitoo - Where #human #creativity plots the #possibilities of #technology -<br>
- #UnitooInc #News #Worldnews #tech #bot

Twitter: Unitoo on Twitter (Unitoo)

 
#unitoodailynews, #email, #security, #protonmail Online privacy is more than a PR campaign - ProtonMail blog
Don’t be fooled by Google’s fake privacy
 
Gunmen carry out car bomb attack and stole dozens of vehicles in Inates town near border with Mali. #Niger #Africa #Security
 
HNF-Nicolai SD1 Urban: Mit dem Pendelec ins Büro #E-Bike #Akku #Bosch #Datensicherheit #Elektromobilität #Nachhaltigkeit #SmartBike #Vorgelesen #Security
 
Microsoft: Das nächste große Windows-10-Update kommt im September #Windows10 #Datensicherheit #FallCreatorsUpdate #Windows #Microsoft #Security
 

In a world with rising ransomware costs, Nextcloud saves your business millions

Bild/FotoCan your company afford to pay $600.000 to recover its data and put its employees back to work?

What does it cost if your employees can’t work for a week? $50.000? $100.000? At what point will you decide to pay those who keep your data hostage?

You really have to ask yourself that. Because ransomware attacks are on the rise, their costs go up and they target companies more and more. While for consumers, virus scanners and frequent updates does the trick, a targeted attack against a business or government agency can rarely be stopped by such measures.

You MUST have a way to recover and save hundreds of thousands or even millions in costs in bribes, not to mention the even larger amount of money in lost productivity.

You need to think of recovery NOW


Of course, you can, after a week of handwringing and discussion, pay up. You might even have insurance which covers part of the costs. But that week of work is lost, and you probably spend a lot more time to recover.

Yes, if you use a file sync and share solution, be it Google Drive, Dropbox or even a self-hosted solution, you can recover. You can ask your employees to, file by file, go back to an older version. Or, if you self-host (smart!) you can set back a backup from before the first incidence of the ransomware attack. In the first case, your entire company spends a day or two clicking in a web UI to identify the last unencrypted version of their thousands of files and restoring them one by one. In the second case, you lose all changes since the date the first attack happened – at that point, you are probably better of paying the attackers.

The best ransomware recovery in the industry is right here


You’re caught between bad and worse? Did you know there is a solution for your problems? Lucky you if you were running Nextcloud at the time of the attack: your users can recover their files, all in the exact right version just before they were encrypted, in one click. No data loss at all!

This unique solution was developed by security researchers from the German University of Konstanz and automatically detects which files are part of a ransomware attack, allowing users to roll back the change easily. Better yet, using Nextcloud’s smart versioning system, the app is capable of performing the analysis after-the-fact, recovering files even though the app was not installed at the time of the attack.

Lake City just paid $460.000, last week Florida city paid $600.000. They are just two among thousands who pay, every week. Don’t be like them. Get Nextcloud up and running before you’re the target.
#blog, #business, #security
 
IT-Sicherheit: BSI erarbeitet neue Mindeststandards für Browser #BSI #Browser #Datensicherheit #Draft #Sicherheitslücke #TLS #Applikationen #Security
 
Network Time Security: Sichere Uhrzeit übers Netz #Security #Datensicherheit #HSTS #IETF #Sicherheitslücke #TLS #Server #Applikationen #Internet
 

Lest we forget Conficker - The Worm That Nearly Ate the Internet - It infected 10 million computers. So why did cybergeddon never arrive?

Just over 10 years ago, a unique strain of malware blitzed the internet so rapidly that it shocked cybersecurity experts worldwide. Known as Conficker, it was and remains the most persistent computer worm ever seen, linking computers with Microsoft operating systems globally, millions of them, to create a vast illicit botnet, in effect, a black-market supercomputer. That much power controlled by its unknown maker posed an existential threat not just to any enterprise connected to the web, but to the internet itself.

At its height, when it consisted of at least 10 million individual IP addresses, there were few computer networks in the world secure enough to withstand an attack from it. And yet it was used only once, to spread a relatively minor strain of “scareware” intended to frighten unsuspecting users into downloading fake antivirus software.

Surely something bigger was coming. But it never did. Why? Who created Conficker, and why bother if they were not going to use it?

Read more about what was pieced together and what happened to the suspected perpetrators at

#worms #security #virus

The New York Times: Opinion | The Worm That Nearly Ate the Internet (By MARK BOWDEN)



Bild/Foto
It infected 10 million computers. So why did cybergeddon never arrive?

https://gadgeteer.co.za/node/3326
 
Sign in with Apple: OpenID Foundation reagiert auf Apples Anmeldedienst #Apple #OpenID #Cookies #Datenschutz #Datensicherheit #Internet #Security
 
OpenPGP: Entwickler warnen davor, SKS-Keyserver weiter zu nutzen #OpenPGP #Datensicherheit #PGP #Spam #Verschlüsselung #Applikationen #Security
 
Later posts Earlier posts