friendica.prankgo.de

Search

Items tagged with: security

"Die Zeit der stillen Empörung im Server-Raum sollte vorbei sein. Jetzt ist es an der Zeit, die Konsole zu sperren, aufzustehen und das Büro zu verlassen."
https://www.heise.de/newsticker/meldung/Kommentar-Der-Diskurs-um-Digitalisierung-ist-kaputt-4473895.html
⚠️🆘
Über die digitale Inkompetenz europäischer #Politik. Exakt auch meine Meinung!
#security #cyber #OpenSource #EU
 

Конфиденциальность интернет серфинга под угрозой



Kazakhstan: MITM on all HTTPS traffic!


Bugzilla (MoFo):
Eugene 20 hours ago

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

Since today all Internet providers in Kazakhstan started MITM on all encrypted HTTPS traffic.

They asked end-users to install government-issued certificate authority on all devices in every browser: http://qca.kz/

Actual results:

MITM attack: https://i.imgur.com/rFEjXKw.jpg

Message from Internet provider, requires to install this CA: https://i.imgur.com/WyKjOug.jpg

Proofs: https://atlas.ripe.net/measurements/22372655/#!probes

Official site with root CA: http://qca.kz/

Links to certificates:
http://qca.kz/qazca.cer
http://qca.kz/qazca.pem
http://qca.kz/qazca.der

Expected results:

I think this CA should be blacklisted by Mozilla and Firefox should not accept it at all even user installed it manually.

This will save privacy of all Internet users in Kazakhstan.

I think both Mozilla and Google should intervene into this situation because it can create a dangerous precedent, nullifying all the efforts of encofcing HTTPS.

If Kazakhstan will succeed, more and more governments (eg. Russian Federation, Iran, etc.) will start global MITM attacks on their citizens and this is not good.

I think all CAs used for MITM attacks should be explicitly blacklisted both by Mozilla and Google to exclude even possibility of such attacks.

#security #privacy #freedom #mitm #https #spying #firefox #mozilla #browser #web #net #www #Kazakhstan #certificate #ca

MORE discussion: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114
 
Nice harsh overview about the issues with PGP, beyond the recent key spam attacks. #security #pgp
 
Passenger Name Record: EU diskutiert Überwachung von Reisen per Zug, Bus und Schiff #Reisen #Datenschutz #Datensicherheit #EU #EuGH #Internet #PolitikRecht #Security
 
Zugang per Venenscan: Wenn das Freibad zum Hochsicherheitstrakt wird #Biometrie #Datensicherheit #Palmsecure #Scanner #Fujitsu #Security
 
Hacker-Attacke: Datenleck bei Freenet-Tochter Vitrado #Datenleck #Datenbank #Datenschutz #Datensicherheit #E-Commerce #Passwort #SQL #Freenet #Security #Wirtschaft
 
Bluetooth: Tracking trotz Trackingschutz möglich #Bluetooth #Datenschutz #Datensicherheit #MacOS #Tracking #iOS #Mac #Technologie #Security #Wissenschaft
 
Immer wieder rasten Kunden aus, wenn sie ihren Abfall nicht so entsorgen können, wie sie sich das vorgestellt haben. Ein Sicherheitsdienst soll das Problem lösen. #Recyclinghof #EBE #Entsorgung #Abfall #Security #Altenessen #NRW
 

Office 365 declared illegal in German schools due to privacy risks - no way for the German government to monitor cloud access by US authorities

This time around, the Hessian commissioner for Data Protection and Freedom of Information (HBDI) isn't just saying that schools would prefer not to use Microsoft, he's stating that their use of Office 365 is outright illegal. In August 2017, the HBDI ruled that Office 365 could legally be used by schools so long as the back end for the school accounts was stored in Microsoft's German-located cloud. A year later, Microsoft closed its German cloud datacenter, and schools migrated their accounts to the European cloud. Now, the HBDI states that the European cloud may offer access to US authorities; with no way for the German government to monitor such access; this makes use of that cloud illegal without specific consent being granted by its individual users.

In addition to the physical geography of the cloud, the HBDI is unhappy about telemetry in both Office 365 and Windows 10 itself. Neither can be disabled by end users or organizations, and the content of both remains undisclosed by Microsoft despite repeated inquiries. According to the HBDI, the only legal way around the murky provenance of the telemetry—and possible US state access to users' data—is by asking consent of the individual users.

See https://arstechnica.com/information-technology/2019/07/germany-threatens-to-break-up-with-microsoft-office-again/

#office365 #security
Office 365 declared illegal in German schools due to privacy risks

Bild/Foto
Microsoft's future in Germany is in question again.

https://gadgeteer.co.za/node/3356
 
Fehler 502: Cloudflare schämt sich für den vergangenen Ausfall #Cloudflare #Datensicherheit #DoS #Firewall #HTTP #WCO #Server #Internet #Security
 
Mitschnitte des Google Assistant: Google ermittelt gegen Mitarbeiter wegen Sicherheitsverstoß #GoogleAssistant #Datenschutz #Datensicherheit #GoogleHome #Privatsphäre #Spracherkennung #Google #AudioVideo #Security
 
If you have some knowledge in web security and Content Security Policy, would you mind having a look at https://dev.funkwhale.audio/funkwhale/funkwhale/merge_requests/826 ?

This is an attempt to harden the security of the web UI via a CSP (and some additional HTTP headers) and to reduce the attack surface in case of exploits.

#security #funkwhale #helpwanted
 
Microsoft: Sicherheitspatch für Windows 7 enthält Telemetrietool #Windows7 #Cookies #Datenschutz #Datensicherheit #Sicherheitslücke #Windows #Windows10 #Microsoft #Security
 
Malware: Zip-Bombe entpackt 46 MByte zu 4,5 Petabyte #Malware #Datensicherheit #Packer #Unix #Virus #Winrar #OpenSource #Security
 
CTRL-ALT-LED: Daten über die Tastatur-LEDs ausleiten #Security #Datensicherheit #Malware
 
OpenPGP: GnuPG verwirft Signaturen von Keyservern #OpenPGP #Datensicherheit #Efail #GPG #PGP #Verschlüsselung #Applikationen #Security
 
Bridge und Dreamweaver: Adobe muss keinen Flash-Bug beseitigen #Adobe #Datensicherheit #Patchday #Sicherheitslücke #Applikationen #Security
 
Medizin: Sicherheitslücken in Beatmungsgeräten #Medizin #Datenschutz #Datensicherheit #Sicherheitslücke #Techcrunch #Server #Security
 
Streaming: DRM-Systeme werden für illegale Webkopien geknackt #DRM #Datensicherheit #Streaming #Verschlüsselung #Internet #Security
 
TLS-Zertifikate: Mozilla vertraut Zertifikaten von Dark Matter nicht mehr #Spionage #Datensicherheit #NSA #TLS #Mozilla #Technologie #Applikationen #Internet #PolitikRecht #Security
 
Datenschutzbeauftragter: Schulen dürfen Office 365 nicht mehr verwenden #Office365 #Azure #CloudComputing #Datenschutz #Datensicherheit #Office #Microsoft #Applikationen #Security
 

9 Open Source Password Managers to Secure Yourself With

People use password managers so that they don’t have to remember all the usernames/passwords of the websites they visit. Instead, they can just remember 1 password, and then access all the other passwords whenever they need. In addition to that, this allows you as a user to increase the length and the complexity of the passwords you use, because now, you no longer have to remember them, so you can make your Facebook’s password something like 21#^#Y3#^2h281+_0H^I@F!##YU&^ with no problem.

Also, some password managers offer other features that you can use. E.g: Auto-fill (automatically fill the passwords when you open the URL in your browser), synchronization between devices, team storage (sharing passwords between multiple people), smartphone integration, various types & tools of encryption, emergency codes.. And so on.

Traditionally, there are many closed-source proprietary password managers, and there are those which are open source.

It is good to see some newer password managers in the list and not just the same old ones we are used to seeing - see
9 Open Source Password Managers to Secure Yourself With


#security #passwords
9 Open Source Password Managers to Secure Yourself With


Bild/Foto
Here's a good list of 9 open source password managers that you can use to secure your passwords. Using of these is a must, but which one would you choose?

https://gadgeteer.co.za/node/3350
 
Linux-Distributor: Canonicals Github-Konto gehackt #Canonical #Datensicherheit #Github #Hacker #Linux #Sicherheitslücke #Ubuntu #Internet #OpenSource #Security
 
DSGVO: 200 Millionen Euro Strafe für Datenleck bei British Airways #Datenleck #DSGVO #Datenschutz #Datensicherheit #Sicherheitslücke #Internet #Security
 
Endpoint Security: IT-Sicherheit ist ein Cocktail mit vielen Zutaten #Datensicherheit #BSI #BYOD #Malware #VPN #Security
 
Elektronische Beweismittel: Regierung sieht Grundrechte durch EU-Pläne gefährdet #EU #Bundesregierung #Cookies #DSGVO #Datenschutz #Datensicherheit #E-Privacy #Netzpolitik #Internet #Security
 
Logitech: Schwerwiegende Sicherheitslücken in kabellosen Tastaturen #Logitech #Datensicherheit #Eingabegerät #Passwort #Sicherheitslücke #Tastatur #Verschlüsselung #Security
 
Microsoft: Forbes hält Windows 10 weiterhin für eine Gefahrenzone #Windows10 #Datensicherheit #VPN #Windows #Microsoft #Security
 

OpenWRT 18.06.4 Released


If you run a local cable or DSL modem, or router/WiFi, you should check to see if your device can run OpenWRT, or consider replacing it with one that will. Installation can be a bit of an adventure, but if you're even modestly versed with bash prompt in Linux or MacOS, you should consider it.

The project has just released its latest update (the first in about six months), mostly consisting of security updates.

https://openwrt.org/releases/18.06/notes-18.06.4

Someone had asked at Hacker News what are the benefits? My answer:

Vastly more power and flexibility, with a highly usable Web interface (LUCI) and console access.

Regular updates.

Excellent documentation: https://openwrt.org/docs/start

And a whole set of packed applications and tools. There are about 6,000 packages in total, ranging from device-specific and kernel support to advanced applications such as media servers. Link below is just the larger apps.

https://openwrt.org/docs/guide-user/services/start

Re-romming my DSL modem (500 Mhz dual-core CPU, 64 MB RAM, 8 MB Flash), as advantages over stock vendor firmware, I get:
  • adblock
  • SSH access, rather than periodically-enabled telnet
  • remote logging capabilities. The ability to go back to see what went wrong and when can be incredibily useful.
  • Performance and activity monitoring.
  • Consistent interface with my router (also running OpenWRT).
  • Full-featured shell tools rathee than barebones Busybox versions, if I like.
  • Remote filesystems / additional storage.
Depending on your device(s) and capabilities, your modem, router, or other hardware can serve as a home server: NAS, UuuNextCloud, Webserver, VOIP services, media server, PXEBoot (useful for testing images/deployments), guest network(s), VPN, proxy servers, email, mesh networks, messaging, captive portals, and far more.

I also run a Turris Omnia WiFi Router, also running a version of OpenWRT. That's slightly more expensive than a most stock routers, at about US$300, though it's not much off comparably specced systems, and offers advanced features, most notably that it self-updates regularly, something OpenWRT doesn't otherwise do (and virtually no OEM vendors presently support). You can also add an mSATA hard drive (up to 500 GB storage), or build out an optional NAS enclosure (2 disks), or in conjunction with an external NAS offer backups and other services to your local network, as well as provide services either privately or publicly. I'm looking at media serving and a space to stash a growing research library.

#openwrt #networking #security #linux #broadband #dsl
 
7-Eleven: Supermarktkette stoppt Zahlungssystem nach einer Woche #Datenschutz #Datensicherheit #Hacker #Verbraucherschutz #Security
 
Datenleck: Smart-Home-Datenbank mit 2 Milliarden Einträgen im Internet #Datenleck #Datenschutz #Datensicherheit #IoT #Passwort #Sicherheitslücke #SmartHome #Security
 
PM Chahed cites security reasons for the niqab ban following a double suicide bombing in Tunis last month. #Tunisia #MiddleEast #Security
 
#pass is a modular #password manager.

pass utilizes existing and strong projects like GPG to #securely #encrypt your passwords. pass organizes passwords in folders, which allows for easy modification by many tools and programs, like browser extensions. pass is well integrated with Git, which can provide quality incremental backups if desired.

Website 🔗️: https://www.passwordstore.org/

apt 📦️: pass

#free #opensource #foss #fossmendations #security
 
Turkish authorities say the blast, which killed at least three people, appears 'terror-related' #MiddleEast #Turkey #Security
 
Virgin Atlantic: Akkupack fängt bei Transatlantikflug Feuer #Luftfahrt #Akku #Datensicherheit #Flugzeug #Security
 
Verschlüsseltes DNS: Falschmeldung in Propagandaschlacht um DNS über HTTPS #DNS #Datensicherheit #JSON #Malware #TLS #Technologie #Applikationen #Internet #Security
 
Gesundheitsdaten: Gesundheitsapps werden beliebter, trotz Datenschutzbedenken #Medizin #App #Datenschutz #Datensicherheit #Sicherheitslücke #Applikationen #Security
 
iPhone: Lücke in iOS ermöglicht Angriff via Textnachricht #Sicherheitslücke #iPhone #Datensicherheit #Tablet #iCloud #iPad #Apple #Applikationen #Security #Mobil
 
#AtomicFacepalm and #Shit #Security

I guess if their focus is to profit off of the users and resell collected data to others, security isn't a top priority.
 
Google: Juli-Sicherheitsupdate für Android ist da #Android #Datensicherheit #H265 #HEVC #Malware #Sicherheitslücke #Security
 
Bild/Foto

Avoid Intel and AMD Universal Backdoors


Only use computers certified to Respect Your Freedom (RYF)

The #Intel #Management #Engine is present on all Intel #desktop, #mobile ( #laptop ), and #server #systems since mid 2006. It consists of an #ARC #processor core (replaced with other processor cores in later generations of the ME), #code and #data #caches, a #timer, and a secure #internal #bus to which additional #devices are connected, including a #cryptography engine, internal #ROM and #RAM, #memory #controllers, and a direct memory access ( #DMA ) engine to access the host operating system’s memory as well as to reserve a region of protected external memory to supplement the ME’s limited internal RAM. The ME also has #network access with its own #MAC #address through an Intel #Gigabit #Ethernet #Controller. Its #boot program, stored on the internal ROM, loads a #firmware “manifest” from the PC’s SPI #flash #chip. This manifest is signed with a strong #cryptographic #key, which differs between versions of the ME firmware. If the manifest isn’t signed by a specific Intel key, the boot ROM won’t load and execute the firmware and the ME processor core will be halted.

The Active Management Technology ( #AMT ) application, part of the Intel “vPro” brand, is a #Web server and application code that enables #remote #users to #power on, power off, view information about, and otherwise manage the #PC. It can be used remotely even while the PC is powered off ( via #Wake-on-Lan ). Traffic is encrypted using #SSL / #TLS libraries, but recall that all of the major SSL/TLS implementations have had highly publicized vulnerabilities. The AMT application itself has known #vulnerabilities, which have been #exploited to develop #rootkits and #keyloggers and #covertly gain #encrypted #access to the management features of a PC. Remember that the ME has full access to the PC’s RAM. This means that an #attacker exploiting any of these vulnerabilities may gain access to everything on the PC as it runs: all open #files, all running #applications, all #keys pressed, and more.

ME firmware versions 4.0 and later (Intel 4 Series and later chipsets) include an ME application for audio and video DRM called “Protected Audio Video Path” (PAVP). The ME receives from the #host operating system an encrypted #media #stream and encrypted key, decrypts the key, and sends the encrypted media decrypted key to the #GPU, which then #decrypts the media. PAVP is also used by another ME application to draw an #authentication PIN pad directly onto the screen. In this usage, the PAVP application directly controls the graphics that appear on the PC’s screen in a way that the host #OS cannot detect. ME firmware version 7.0 on PCHs with 2nd Generation Intel Core #i3 / #i5 / #i7 (Sandy Bridge) CPUs replaces PAVP with a similar DRM application called “Intel Insider”. Like the AMT application, these DRM applications, which in themselves are defective by design, demonstrate the #omnipotent #capabilities of the ME: this #hardware and its proprietary firmware can access and #control everything that is in RAM and even everything that is shown on the #screen.

The Intel Management Engine with its #proprietary firmware has complete access to and control over the PC: it can power on or shut down the PC, read all open files, examine all running applications, track all keys pressed and #mouse movements, and even #capture or #display #images on the screen. And it has a network interface that is demonstrably #insecure, which can allow an attacker on the network to #inject #rootkits that completely compromise the PC and can report to the attacker all activities performed on the PC. It is a #threat to #freedom, #security, and #privacy that can’t be ignored.

Before version 6.0 (that is, on systems from 2008/2009 and earlier), the ME can be disabled by setting a couple of values in the SPI flash memory. The ME firmware can then be #removed entirely from the flash memory space. Libreboot does this on the Intel 4 Series systems that it supports, such as the Libreboot X200 and Libreboot T400. ME firmware versions 6.0 and later, which are found on all systems with an Intel #Core i3/i5/i7 CPU and a PCH, include “ME Ignition” firmware that performs some hardware #initialization and power management. If the ME’s boot ROM does not find in the SPI flash memory an ME firmware manifest with a valid Intel signature, the whole PC will shut down after 30 minutes.

Due to the signature verification, developing free #replacement firmware for the ME is basically impossible. The only entity capable of replacing the ME firmware is Intel. As previously stated, the ME firmware includes proprietary code licensed from third parties, so Intel couldn’t release the source code even if they wanted to. And even if they developed completely new ME firmware without third-party proprietary code and released its source code, the ME’s boot ROM would reject any modified firmware that isn’t signed by Intel. Thus, the ME firmware is both hopelessly proprietary and #tivoized.

For years, #coreboot has been #struggling against Intel. Intel has been shown to be extremely uncooperative in general. Many coreboot #developers, and #companies, have tried to get Intel to #cooperate; namely, releasing source code for the firmware components. Even #Google, which sells millions of #Chromebooks (coreboot preinstalled) have been #unable to #persuade them.

Even when Intel does cooperate, they still don’t provide source code. They might provide limited #information (datasheets) under #strict #corporate #NDA ( #non-disclosure #agreement ), but even that is not guaranteed. Even ODMs and IBVs can’t get source code from Intel, in most cases (they will just integrate the blobs that Intel provides).

In summary, the Intel #Management #Engine and its applications are a #backdoor with #total access to and control over the rest of the PC. The ME is a threat to freedom, security, and privacy, and the Libreboot project strongly recommends avoiding it entirely. Since recent versions of it can’t be removed, this means avoiding all #recent #generations of Intel hardware.

Recent Intel graphics chipsets also require firmware blobs


Intel is only going to get #worse when it comes to user freedom. Libreboot has no support recent Intel platforms, precisely because of the problems described above. The only way to solve this is to get Intel to #change their #policies and to be more #friendly to the free software #community. Reverse engineering won’t solve anything long-term, unfortunately, but we need to keep doing it anyway. Moving forward, Intel hardware is a non-option unless a #radical change happens within Intel.

Basically, all Intel hardware from year 2010 and beyond will never be supported by Libreboot. The Libreboot project is actively #ignoring all modern Intel hardware at this point, and focusing on #alternative platforms.

Why is the latest AMD hardware unsupported in Libreboot?


It is extremely unlikely that any post-2013 #AMD hardware will ever be supported in Libreboot, due to severe security and freedom #issues; so #severe, that the Libreboot project recommends avoiding all modern AMD hardware. If you have an AMD based system affected by the #problems described below, then you should get rid of it as soon as possible.

AMD Platform Security Processor (PSP)


This is basically AMD’s own version of the Intel Management Engine. It has all of the same basic security and freedom issues, although the #implementation is wildly different.

The Platform Security Processor (PSP) is built in on all Family 16h + systems (basically anything post-2013), and controls the main #x86 core #startup. PSP firmware is cryptographically signed with a strong key similar to the Intel ME. If the PSP firmware is not present, or if the AMD signing key is not present, the #x86 cores will not be #released from #reset, rendering the system #inoperable.

The PSP is an ARM core with TrustZone #technology, built onto the main CPU die. As such, it has the ability to #hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, #login data, #browsing #history, #keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM “features” to work as intended), which means that it has at minimum MMIO-based access to the #network controllers and any other PCI/PCIe peripherals installed on the #system.

In theory any #malicious entity with access to the AMD signing key would be able to install persistent #malware that could not be eradicated without an external flasher and a known good PSP image. Furthermore, multiple security vulnerabilities have been demonstrated in AMD #firmware in the #past, and there is every #reason to assume one or more zero day vulnerabilities are lurking in the PSP firmware. Given the extreme privilege level (ring -2 or ring -3) of the PSP, said vulnerabilities would have the ability to #remotely #monitor and control any PSP enabled machine completely outside of the user’s #knowledge.

A reliable way to avoid Intel and AMD’s universal backdoors is to use computers with such spyware effectively removed or disabled like the ones certified to Respect Your Freedom (RYF).

#NSA #spyware #spy #mass #surveillance #FSF #GNU #GNULinux #RYF #technology #laptops #CPU #processor #universal #backdoor #malware #Corei3 #Corei5 #Corei7
 
Revolutionary Guards' chief says Iran has 'closed the path' militarily, leaving US to pursue economic conflict. #Iran #RevolutionaryGuard #Security #HassanRouhani #UnitedStates #MiddleEast
 
Gunmen carry out car bomb attack and stole dozens of vehicles in Inates town near border with Mali. #Niger #Africa #Security
 
HNF-Nicolai SD1 Urban: Mit dem Pendelec ins Büro #E-Bike #Akku #Bosch #Datensicherheit #Elektromobilität #Nachhaltigkeit #SmartBike #Vorgelesen #Security
 
Microsoft: Das nächste große Windows-10-Update kommt im September #Windows10 #Datensicherheit #FallCreatorsUpdate #Windows #Microsoft #Security
 
IT-Sicherheit: BSI erarbeitet neue Mindeststandards für Browser #BSI #Browser #Datensicherheit #Draft #Sicherheitslücke #TLS #Applikationen #Security
 
Network Time Security: Sichere Uhrzeit übers Netz #Security #Datensicherheit #HSTS #IETF #Sicherheitslücke #TLS #Server #Applikationen #Internet
 

Lest we forget Conficker - The Worm That Nearly Ate the Internet - It infected 10 million computers. So why did cybergeddon never arrive?

Just over 10 years ago, a unique strain of malware blitzed the internet so rapidly that it shocked cybersecurity experts worldwide. Known as Conficker, it was and remains the most persistent computer worm ever seen, linking computers with Microsoft operating systems globally, millions of them, to create a vast illicit botnet, in effect, a black-market supercomputer. That much power controlled by its unknown maker posed an existential threat not just to any enterprise connected to the web, but to the internet itself.

At its height, when it consisted of at least 10 million individual IP addresses, there were few computer networks in the world secure enough to withstand an attack from it. And yet it was used only once, to spread a relatively minor strain of “scareware” intended to frighten unsuspecting users into downloading fake antivirus software.

Surely something bigger was coming. But it never did. Why? Who created Conficker, and why bother if they were not going to use it?

Read more about what was pieced together and what happened to the suspected perpetrators at

#worms #security #virus

The New York Times: Opinion | The Worm That Nearly Ate the Internet (By MARK BOWDEN)



Bild/Foto
It infected 10 million computers. So why did cybergeddon never arrive?

https://gadgeteer.co.za/node/3326
 
Later posts Earlier posts