Show Notes: extras.show/37

The post 411 DevSecOps: Karthik Gaekwad | Jupiter Extras 37 first appeared on Jupiter Broadcasting.

Show Notes: linuxactionnews.com/121

The post Linux Action News 121 first appeared on Jupiter Broadcasting.

Show Notes: coder.show/343

The post Say My Functional Name | Coder Radio first appeared on Jupiter Broadcasting.

RSS Feeds:

MP3 Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

Become a supporter on Patreon:

— Show Notes: —

Follow Up

• Mike visits Tim

• Quiet PC, Quiet Computers: Virtually Silent Computer

Hoopla

Alexa has lost its voice as Amazon Web Services suffers widespread outage – The Verge

A regional outage impacting Amazon’s servers has led to Alexa becoming unresponsive on Echo products and other devices that support the assistant

Keyboardio: heirloom-grade keyboards for serious typists

We’ve placed an independently programmable RGB LED underneath each and every key on the keyboard. Out of the box, the Model 01 can breathe, glow and do cute rainbow fade animations with the best of them, but the neat part is that each and every one of those LEDs is end-user controllable. With just a few lines of code in the Arduino IDE, you can completely customize the light show.

• Keyboardio | WTR 44

The post Niche Busters | CR 298 first appeared on Jupiter Broadcasting.

HD Video Feed | MP3 Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Google Will Survive SESTA. Your Startup Might Not.

• Requires unreliastic levels of censorship by platforms; not even the big players will be able to comply 100%

• Proponents consider startups to be outliers, which “will be successfully prosecuted, civilly and criminally under this law”.

• Proponents are overstating the effectiveness of filtering

• Proposed standards actually discourage platforms from filtering

Companies Look to an Old Technology to Protect Against New Threats

• Tape is an old techology. It is also highly reliable and stable

• Tape sales are increasing

• Yep, backup to NAS is great, but do you have different versions of your data?

CBS’s Showtime caught mining crypto-coins in viewers’ web browsers

• This isn’t about CBS. It’s about the potential for abuse by website owners

• Code unlikely to be official sanctioned / added by CBS; mure more likely it was a malicious third party or insider.

• The email address associated with the mining account is personal, not corporate

• Ethical issues for content providers to figure out

Feedback

• Funny sounds throughout the show

• Cox checking for credit score

Round Up:

• One week after

• SEC Announces Enforcement Initiatives to Combat Cyber-Based Threats and Protect Retail Investors

• APFS AND HFS+ BENCHMARKS

• What’s New in PostgreSQL 10?

• a 160-terabits-per-second cable

The post Laying Internet Pipe | TechSNAP 339 first appeared on Jupiter Broadcasting.

HD Video Feed | MP3 Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

New password guidelines say everything we thought about passwords is wrong

• No more periodic password changes

• No more imposed password complexity

• Mandatory validation of newly created passwords against a list of commonly-used, expected, or compromised passwords.

• We recommend you use a password manager, use a different password on every login

• Rainbow tables used to convert hashes to passwords

Enterprise hard disks are faster and use more power, but are they more reliable?

• The enterprise disks also use more power: 9W idle and 10W operational, compared to 7.2W idle and 9W operational for comparable consumer disks.

• If you have one or two spindles, that’s no big deal, but each Backblaze rack has 20 “storage pods” with 60 disks each. An extra 2.2kW for an idle rack is nothing to sniff at.

• Other HGST models are also continuing to show impressive longevity, with three 4TB models and one 3TB model both boasting a sub-1 percent annualized failure rate.

Don’t trust OAuth: Why the “Google Docs” worm was so convincing

• Access to all your mail

• access to any of your google hangout chats

• access to all your contacts

• makes a good case for encryption/decryption at the client

• OAuth

Feedback

• Intel AMT bug

• bhyve VGA pass-through see also mailing list post

• Amazing, and keep it up!

• Borg Backup see Borg Documentation

  • Borg demonstration

• inexpensive, managed switches

Round Up:

• Why Security Backdoors are Bad (Common Sense Version)

• How to remote hijack computers using Intel’s insecure chips: Just use an empty login string

• Massive vulnerability in Windows Defender leaves most Windows PCs vulnerable

• NASA wants YOU (to make its Fortran code run faster)

The post All Drives Die | TechSNAP 318 first appeared on Jupiter Broadcasting.

We break down what we see as the top motivations, the big competitive move & what Microsoft is really saying about Android with their Xamarin acquisition.

Plus during the show Microsoft releases SQL server for Linux & we discuss how it all fits together in a larger plan.

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

MP3 Audio | OGG Audio | Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

Become a supporter on Patreon:

— Show Notes: —

Hoopa

Will Xamarin Pave The Way For Microsoft In Mobile?

​Why Microsoft’s Xamarin purchase is a blunder

That sounds like a great idea. It’s too bad it’s already been shown to be a flop several times over.

• FTC Approves Microsoft’s Acquisition Of Xamarin – MSPoweruser

Feedback

• Xamarin alternative… Q

The post The Xamarin Hand | CR 195 first appeared on Jupiter Broadcasting.

SourceForge sees downtime, and we examine their infrastructure, a new pervasive hackgroup has been exposed and their track record is fascinating.

Plus a Hacking Team Round up, a wide variety of audience questions, our answers & much, much more!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

SourceForge Downtime

• SourceForge suffered a large data corruption problem and was down for a number of days, slowly restoring services as they could
• “The Slashdot Media sites experienced an outage commencing last Thursday. We responded immediately and confirmed the issue was related to filesystem corruption on our storage platform. This incident impacted all block devices on our Ceph cluster. We consulted with our storage vendor when forming our next steps”
• As part of this, we learned a bit about the backends of sourceforge and slashdot
• Server platform is CentOS Linux.
• We use an Open Source virtualization platform and have in recent years achieved a 75%+ reduction in physical server count through widespread virtualization.
• We use an Open Source storage platform, Ceph, with spinning disks and SSD.
• The storage backing our services is a mix of ext4, XFS and NFS.
• Our backup solution is Open Source, backing on to popular cloud storage platforms.
• Our sites use Open Source database platforms including MongoDB and flavors of MySQL and PostgreSQL.
• We leverage scalable data solutions including Hadoop and ElasticSearch.
• Slashdot is backed by Perl. SourceForge is backed by Python. Both language stacks are entirely Open Source.
• And the SourceForge developer services are backed by the Apache Allura code base, which we Open Sourced and delivered to the Apache incubation process.
• “We’re prioritizing the project web service (used by many projects using custom vhosts), mailing lists, and the ability to upload data to our download service. Downloads (40+ TB of data)”
• Most Recent Update – Sourceforge Blog
• A Post mortem is expected once everything is restored

Black Vine Group behind Anthem breach

• In a report last week Symantec said it was Black Vine that broke into the health insurer “Anthem” system’s and stole more than 80 million patients records.
• The group has the resources to customize malware, and uses zero-day vulnerabilities in Microsoft Internet Explorer to launch watering-hole attacks.
• Black Vine’s malware Mivast, was used in the Anthem breach, according to Symantec.
• Anthem said the hack likely began in May 2014, but that it didn’t realize its systems had been compromised until January. The company, which is one of the largest health insurance providers in the U.S., disclosed the breach in February. Hackers made off with personal data including names, birth dates, member ID numbers and Social Security numbers.
• Like other Black Vine attacks, The Mivast malware was signed with a fake digital certificate. (more on that below)
• Since 2012 Black Vine has gone after other businesses that deal with sensitive and critical data, including organizations in the aerospace, technology and finance industries, according to Symantec. The majority of the attacks (82 percent) were waged against U.S. businesses.
• During its research, Symantec discovered Black Vine began using exploits around the same time as other hacking groups. Each group delivered different malware and went after certain organizations,
• The fact that they used the same exploits as other groups suggests the attackers relied on the same distribution network.
• One of the group’s first attacks came in December 2012 against gas turbine manufacturer Capstone Turbine, Symantec said.
• That hack used the IE exploit CVE-2012-4792 and delivered the Sakurel malware.
• Symantec noted that the malware was signed with a digital certificate attributed to a company called Micro Digital, fooling Windows into believing the program was legitimate.
• In 2013 and 2014, Black Vine targeted companies in the aviation and aerospace industries. One third-party blog cited by Symantec noted that in 2013 specific employees at a global airline were sent spear phishing emails containing a URL that instructed them to download Hurix.
• Symantec claimed some Black Vine members have ties to Topsec, a Chinese IT security company, and the group has access to the Edlerwood framework
• PDF

Hacking Team Roundup:

• Hacking Team claims it always sold exploits and malware strictly within the law
• Hacking Team and Boeing planned Drones that would infect your computer via WiFi etc
• Microsoft issues patch for Windows Kernel 0-day leaked in Hacking Team breach
• Netragard, a company that buys and sells exploits, has decided to stop buying exploits after the fallout from the Hacking Team compromise
• FBI agents deceive judges, ignore time limits, don’t tell computer owners after they’ve been hacked, and don’t get ‘super-warrants’ for webcam snooping
• Hacking Team promises to rebuild its surveillance software
• An interview with Hacking Team’s CEO

FreeNAS Mini Review by Toms Hardware

Feedback:

• PfSense Kills SSDs?

• Recommended RAID for Random Read Performance

• Scale Out Storage over ZFS? – Like GlusterFS

• ssl ponderings

• SysAdmin Day Book Sale

• LINUX Unplugged 103 Multitrack Remaster – FEEDBACK REQUESTED

Round Up:

• Intel’s 3D memory is 1,000 times faster than modern storage
• “Dating” site Ashley Madison, which specialized in organizing discreet affairs, was compromised and is being extorted by the attackers. Attack was apparently motivated by the fact that the site charges a $19 fee to erase your personal information, and then apparently doesn’t actually erase it
• New FCC Rules May Prevent Installing OpenWRT on WiFi Routers
• Reported Samsung SSD TRIM bug was actually a bug in linux
• Google officially ends forced Google+ integration—First up: YouTube
• Author of DenDroid malware worked as white-hat intern at FireEye
• One of the people responsible for SWATting Krebs in 2013 has pled guilty
• Experian hit with a class action lawsuite over actions involving ID Theft Service

The post SourceForge's Downfall | TechSNAP 225 first appeared on Jupiter Broadcasting.

A renewed push to kill flash hits the web & we discuss the possible advantages for Linux users. A KDE user trying out Gnome for a week & the real issues he touches on.

Plus your take on openSUSE’s big changes & follow up to our take on it.

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed | WebM Torrent Feed

Become a supporter on Patreon:

Buy a LUP 100 Shirt!

Show Notes:

Catch Up:

• Linux Mint is boring

• What is the big deal about privacy?

TING

• Ting – mobile that makes sense

• Linux action show podcasts forces me to use non-free plugin

• Mozilla blocks Flash as Facebook security chief calls for its death

Linux Academy

• Linux Academy | Linux and AWS Online Training

A Week With GNOME As My Linux Desktop: What They Get Right & Wrong

Which brings up an important distinction between KDE and Gnome. Gnome feels like a product. It feels like a singular experience. When you use it, it feels like it is complete and that everything you need is at your fingertips. It feel’s like THE Linux desktop in the same way that Windows or OS X have THE desktop experience: what you need is there and it was all written by the same guys working on the same team towards the same goal.

• I spent the first five days of my week logging into Gnome manually– not turning on automatic login. On night of the fifth day I got annoyed with having to login by hand and so I went into the User Manager and turned on automatic login. The next time I logged in I got a prompt: “Your keychain was not unlocked. Please enter your password to unlock your keychain.” That was when I realized something… Gnome had been automatically unlocking my keychain—my wallet in KDE speak– every time I logged in via GDM. It was only when I bypassed GDM’s login that Gnome had to step in and make me do it manually.

  • it was at that moment that I realized it was such a simple thing that made the desktop feel so much more like it was working WITH ME. When I log into KDE via SDDM? Before the splash screen is even finished loading there is a window popping up over top the splash animation– thereby disrupting the splash screen– prompting me to unlock my KDE wallet or GPG keyring.

  • Software Managers! Something that has seen a lot of push in recent years and will likely only see a bigger push in the months to come. Unfortunately, it’s another area where KDE was so close… and then fell on its face right at the finish line.

  • Gnome Software is probably my new favorite software center, minus one gripe which I will get to in a bit. Muon, I wanted to like you. I really did. But you are a design nightmare. When the VDG was drawing up plans for you (mockup below), you looked pretty slick.

  • Then someone got around to coding you and doing your actual UI, and I can only guess they were drunk while they did it.

• Which brings up an important distinction between KDE and Gnome. Gnome feels like a product. It feels like a singular experience. When you use it, it feels like it is complete and that everything you need is at your fingertips. It feel’s like THE Linux desktop in the same way that Windows or OS X have THE desktop experience: what you need is there and it was all written by the same guys working on the same team towards the same goal.

• KDE doesn’t feel like cohesive experience. KDE doesn’t feel like it has a direction its moving in, it doesn’t feel like a full experience. KDE feels like its a bunch of pieces that are moving in a bunch of different directions, that just happen to have a shared toolkit beneath them.

• I know the KDE developers know design matters, that is WHY the Visual Design Group exists, but it feels like they aren’t using the VDG to their fullest.

• Will I still use Gnome after this week? Probably not, no. Gnome still trying to force a work flow on me that I don’t want to follow or abide by, I feel less productive when I’m using it because it doesn’t follow my paradigm.

DigitalOcean

• DigitalOcean: SSD Cloud Server, VPS Server, Simple Cloud Hosting

• Ubuntu-Powered Intel Compute Stick To Go On Sale This Week For $110

openSUSE Follow Up

onelostuser writes:

I don’t get why Noah and Chris are puzzled by what SuSE and OpenSuSE intend to do. The new distro will be to SLE what CentOS is to RHEL.
There will be Tumbleweed, the bleeding edge, always rolling distro that will be in much better shape than Rawhide because OpenSuSE actually expects people to use it as a desktop OS as opposed to “it’s rawhide so it’s borked”.

Then there will be OpenSUSE 42, based on the SLE sources. People will be able to use it such as others do with CentOS and I would be amazed if OpenSuSE and SuSE don’t make it extremely easy to switch from 42 to the enterprise version where they can sell people support on a subscription basis.

To me, it looks like a very smart move.

• rbrownsuse comments on SSH Authentication with YubiKey | LAS 373

• openSUSE pushback

Runs Linux from the people:

• Send in a pic/video of your runs Linux.
• Please upload videos to YouTube and submit a link via email or the subreddit.

Support Jupiter Broadcasting on Patreon

Post Show:

• Theme Download: xPoke/MetroMumble for Mumble 1.2.x
• Theme Download: MetroMumble for Mumble 1.3.x · Renamed to “Mumble Theme” (or you may want to download the master branch)
• Mumble Wiki page for the new Themes system – edited by producer Michael Tunnell (RottN) to now include Linux details.
• JB Mumble Setup Tutorial

The post Will Flash Be Trashed? | LINUX Unplugged 101 first appeared on Jupiter Broadcasting.

We visit with Red Hat at their home office & find out their long-term plans for CentOS, making Fedora more competitive & why they give away their biggest competitive advantage.

It’s a special edition of the big show!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | WebM Torrent | MP3 Audio | OGG Audio | YouTube | HD Torrent

RSS Feeds:

HD Video Feed | Large Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

The Linux Action Show Visits Red Hat

Brought to you by: System76

Red Hat, Inc. is an American multinational software company providing open-source software products to the enterprise community. Founded in 1993, Red Hat has its corporate headquarters in Raleigh, North Carolina, with satellite offices worldwide.

Our Red Hat Reps:

• Tom Callaway

• Brian Proffitt

• Joe Brockmeier

Red Hat’s stock hits 15-year high

The stock even briefly hit a high of $81.44, although it’s now trading at just above $79, still historically high. It hasn’t traded near $80 since the heady days of the internet bubble back in 2000, when it hit $135 and traded at over $100 for a couple of months.

But in 2015, the stock has been on a tear again, since the company has now delivered nine straight quarters of beats on both revenue and profits.

• Red Hat | The world’s open source leader

• Red Hat – Wikipedia, the free encyclopedia

• CentOS Project

• Fedora

• Support Jupiter Broadcasting on Patreon

Chris’s Twitter account has changed, you’ll need to follow!

Chris Fisher (@ChrisLAS) | Twitter

— CHRIS’ STASH —

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— NOAH’S STASH —

Noah’s Day Job

Altispeed Technologies

Contact Noah

noah [at] jupiterbroadcasting.com

Find us on Google+

• Chris
• Noah J. Chelliah
• Jupiter Broadcasting’s Page

Find us on Twitter

• Chris – ChrisLAS
• Noah – Kernellinux

Follow us on Facebook

• Jupiter Broadcasting on Facebook
• Noah – Kernellinux

Catch the show LIVE Sunday 10am Pacific / 1pm Eastern / 6pm UTC:

• https://jblive.tv
• Network Calendar

The post A Chat with Red Hat | LAS 370 first appeared on Jupiter Broadcasting.

Coming up this time on the show, we’ll be chatting with Antoine Jacoutot about how M:Tier uses BSD in their business. After that, we’ll be discussing the different release models across the BSDs, and which style we like the most. As always, answers to your emails and all the latest news, on BSD Now – the place to B.. SD.

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

Video | HD Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | HD Vid Feed | HD Torrent Feed

– Show Notes: –

Headlines

Optimizing TLS for high bandwidth applications

• Netflix has released a report on some of their recent activities, pushing lots of traffic through TLS on FreeBSD
• TLS has traditionally had too much overhead for the levels of bandwidth they’re using, so this pdf outlines some of their strategy in optimizing it
• The sendfile() syscall (which nginx uses) isn’t available when data is encrypted in userland
• To get around this, Netflix is proposing to add TLS support to the FreeBSD kernel
• Having encrypted movie streams would be pretty neat

Crypto in unexpected places

• OpenBSD is somewhat known for its integrated cryptography, right down to strong randomness in every place you could imagine (process IDs, TCP initial sequence numbers, etc)
• One place you might not expect crypto to be used (or even needed) is in the “ping” utility, right? Well, think again
• David Gwynne recently committed a change that adds MAC to the ping timestamp payload
• By default, it’ll be filled with a ChaCha stream instead of an unvarying payload, and David says “this lets us have some confidence that the timestamp hasn’t been damaged or tampered with in transit”
• Not only is this a security feature, but it should also help detect dodgy or malfunctioning network equipment going forward
• Maybe we can look forward to a cryptographically secure “echo” command next…

Broadwell in DragonFly

• The DragonFlyBSD guys have started a new page on their wiki to discuss Broadwell hardware and its current status
• Matt Dillon, the project lead, recently bought some hardware with this chipset, and lays out what works and what doesn’t work
• The two main show-stoppers right now are the graphics and wireless, but they have someone who’s already making progress with the GPU support
• Wireless support will likely have to wait until FreeBSD gets it, then they’ll port it back over
• None of the BSDs currently have full Broadwell support, so stay tuned for further updates

DIY NAS software roundup

• In this blog post, the author compares a few different software solutions for a network attached storage device
• He puts FreeNAS, one of our favorites, up against a number of opponents – both BSD and Linux-based
• NAS4Free gets an honorable mention as well, particularly for its lower hardware requirements and sleek interface
• If you’ve been thinking about putting together a NAS, but aren’t quite comfortable enough to set it up by yourself yet, this article should give you a good view of the current big names
• Some competition is always good, gotta keep those guys on their toes

Interview – Antoine Jacoutot – ajacoutot@openbsd.org / @ajacoutot

OpenBSD at M:Tier, business adoption of BSD, various topics

News Roundup

OpenBSD on DigitalOcean

• When DigitalOcean rolled out initial support for FreeBSD, it was a great step in the right direction – we hoped that all the other BSDs would soon follow
• This is not yet the case, but a blog article here has details on how you can install OpenBSD (and likely the others too) on your VPS
• Using a -current snapshot and some swapfile trickery, it’s possible to image an OpenBSD ramdisk installer onto an unmounted portion of the virtual disk
• After doing so, you just boot from their web UI-based console and can perform a standard installation
• You will have to pay special attention to some details of the disk layout, but this article takes you through the entire process step by step

Initial ARM64 support lands in FreeBSD

• The ARM64 architecture, sometimes called ARMv8 or AArch64, is a new generation of CPUs that will mostly be in embedded devices
• FreeBSD has just gotten support for this platform in the -CURRENT branch
• Previously, it was only the beginnings of the kernel and enough bits to boot in QEMU – now a full build is possible
• Work should now start happening in the main source code tree, and hopefully they’ll have full support in a branch soon

Scripting with least privilege

• A new scripting language with a focus on privilege separation and running with only what’s absolutely needed has been popular in the headlines lately
• Shell scripts are used everywhere today: startup scripts, orchestration scripts for mass deployment, configuring and compiling software, etc.
• Shill aims to answer the questions “how do we limit the authority of scripts” and “how do we determine what authority is necessary” by including a declarative security policy that’s checked and enforced by the language runtime
• If used on FreeBSD, Shill will use Capsicum for sandboxing
• You can find some more of the technical information in their documentation pdf or watch their USENIX presentation video
• Hacker News also had some discussion on the topic

OpenBSD first impressions

• A brand new BSD user has started documenting his experience through a series of blog posts
• Formerly a Linux guy, he’s tried out FreeBSD and OpenBSD so far, and is currently working on an OpenBSD desktop
• The first post goes into why he chose BSD at all, why he’s switching away from Linux, how the initial transition has been, what you’ll need to relearn and what he’s got planned going forward
• He’s only been using OpenBSD for a few days as of the time this was written – we don’t usually get to hear from people this early in on their BSD journey, so it offers a unique perspective

PC-BSD and 4K oh my!

• Yesterday, Kris Moore got ahold of some 4K monitor hardware to test PC-BSD out
• The short of it – It works great!
• Minor tweaks being made to some of the PC-BSD defaults to better accommodate 4K out of box
• PSA: This particular model monitor ships with DisplayPort set to 1.1 mode only, switching it to 1.2 mode enables 60Hz properly

Feedback/Questions

• Darin writes in
• Mitch writes in

Discussion

Comparison of BSD release cycles

• FreeBSD, OpenBSD, NetBSD and DragonFlyBSD

• Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv
• We’re still looking for some new interviews, so let us know if you’re interested in coming on the show (or have someone you’d like us to approach)
• If we have any listeners in Poland, there’s a new Polish BSD users group that’s just started up
• If you’re closer to Germany, there’s a local BSD installfest happening on May 15th in the Landshut area
• If neither of those locations are close to you, but India is, there’s the brand new New Delhi BSD users group as well
• Check the show notes for the links to all of those
• Lastly, the EuroBSDCon 2015 call for papers has been extended due to the massive amount of last-minute submissions, so now you’ve got until May 22nd to send in your ideas

The post Business as Usual | BSD Now 86 first appeared on Jupiter Broadcasting.

Adobe has a bad week, with exploits in the wild & no patch. We’ll share the details. Had your credit card stolen? We’ll tell you how.

Plus the harsh reality for IT departments, a great batch of questions, our answers & much much more!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

HD Video | Mobile Video | MP3 Audio | OGG Audio | YouTube | HD Torrent | Mobile Torrent

RSS Feeds:

HD Video Feed | Mobile Video Feed | MP3 Audio Feed | Ogg Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

— Show Notes: —

New flash zero day found being exploited in the wild, no patch yet

• The new exploit is being used in some versions of the Angler exploit kit (the new top dog, replacing former champ blackhole)
• The exploit kit currently uses three different flash exploits:
• CVE-2014-8440 – which was added to the exploit kit only 9 days after being patched
• CVE-2015-0310 – Which was patched today
• and a 3rd new exploit, which is still being investigated
• Most of these exploit kits rely on reverse engineering an exploit based on the patch or proof of concept, so the exploit kits only gain the ability to inflict damage on users after the patch is available
• However, a 0 day where the exploit kit authors are the first to receive the details, means that even at this point, researchers and Adobe are not yet sure what the flaw is that is being exploited
• Due to a bug in the Angler exploit kit, Firefox users were not affected, but as of this morning, the bug was fixed and the Angler kit is now exploiting Firefox users as well
• Additional Coverage – Krebs On Security
• Additional Coverage – PCWorld
• Additional Coverage – Malware Bytes
• Additional Coverage – ZDNet

How was your credit card stolen

• Krebs posts a write up to answer the question he is asked most often: “My credit card was stolen, can you help me find out how”
• Different ways to get your card stolen, and your chance of proving it:
• Hacked main street merchant, restaurant (low, depends on card use)
• Processor breach (nil)
• Hacked point-of-sale service company/vendor (low)
• Hacked E-commerce Merchant (nil to low)
• ATM or Gas Pump Skimmer (high)
• Crooked employee (nil to low)
• Lost/Stolen card (high)
• Malware on Consumer PC (very low)
• Physical record theft (nil to low)
• “I hope it’s clear from the above that most consumers are unlikely to discover the true source or reason for any card fraud. It’s far more important for cardholders to keep a close eye on their statements for unauthorized charges, and to report that activity as quickly as possible.”
• Luckily, since most consumers enjoy zero liability, they do not have to worry about trying to track down the source of the fraud
• With the coming change to Chip-and-Pin in the US, the liability for some types of fraud will shift from the banks to the retailers, which might see some changes to the way things are done
• Banks have a vested interest in keeping the results of their investigations secret, whereas a retailer who is the victim of fraudulent cards, may have some standing to go after the other vendor that was the source of the leak
• Machine Learning for Fraud Detection

15% of business cloud accounts are hacked

• Research by Netskope, a cloud analysis company, finds that only one in ten cloud apps are secure enough for enterprise use
• In their survey, done using network probes, gateways, and other analysis techniques (rather than asking humans), they found that the average large enterprise uses over 600 cloud applications
• Many of these applications were not designed for enterprise use, and lack features like 2 factor authentication, hierarchical access control, “group” features, etc
• The report also found that 8% of files uploaded to cloud storage provides like Google Drive, Dropbox, Box.com etc, were in violoation of the enterprises’ own Data Loss Prevention (DLP) policies.
• The downloading numbers were worst, 25% of all company files in cloud providers were shared with 1 or more people from outside the company. 12% of outsiders had access to more than 100 files.
• Part of the problem is that many “cloud apps” used in the enterprise are not approved, but just individual employees using personal accounts to share files or data
• When the cloud apps are used that lack enterprise features that allow the IT and Security teams to oversee the accounts, or when IT doesn’t even know that an unapproved app is being used, there is no hope of them being able to properly manage and secure the data
• Management of the account life cycle: password changes, password resets, employees who leave or are terminated, revoking access to contractors when their project is finished, etc, is key
• If an employee just makes a dropbox share, adds a few other employees, then adds an outside contractor that is working on a project, but accidently shares all files instead of only specific project files, then fails to remove that person later on, data can leak.
• When password resets are managed by the cloud provider, rather than the internal IT/Security team, it makes it possible for an attacker to more easily use social engineering to take over an account
• Infographic
• Report

Feedback:

• ZFS me timbers

• Allan’s Modified Lenovo

• Sharing a large movie collection over the internet

• RAID alternatives for a bug

Round Up:

• Yes, Every Freeware Download Site is Serving Crapware (Here’s the Proof)
• CERT-UK offers a new best practices guide to combat social engineering
• FBI seeks to legally hack you if you are using TOR or a VPN
• Java patches 19 security holes (13 with 10/10 exploitability score). Make sure you are running at least 7u75 or 8u31
• NSA says it has proof DPRK was behind Sony hack, because they had already hacked the DPRK
• Government health care website quietly sharing personal data
• Steam shell script bug causes it to rm -rf /
• NSA Preps America for Future Battle
• Diary of an NSA Intern
• Password reuse causes spike in Hotel Rewards fraud
• The Sorry State of In-Flight Wi-Fi
• Technical mistake, not terrorist DDoS downed french media websites
• Blackhat, the movie, gets the technobabble mostly right
• All you need is a clipboard, or a stethoscope

The post Dude Where's My Card? | TechSNAP 198 first appeared on Jupiter Broadcasting.

We’ll tell you about the VMware flaw so bad, the solution is to just turn the service off & we now have more details on a major Windows flaw.

Plus new research discovers that up to 81% of Tor users could be de-anonymized, a great batch of your networking questions & much, much more!

Thanks to:

• Get Paid to Write for DigitalOcean

Become a supporter on Patreon:

— Show Notes: —

Why the VMWare TPS flaw is a big deal

• VMWare recently disclosed a vulnerability in its line of virtualization products (vSphere, ESXi, etc)
• VMWare has a feature called TPS (“Transparent Page Sharing”), which basically provides deduplication of memory between virtual machines
• When two or more virtual machines have an identical 4k block of memory, only 1 block of physical memory on the host is actually used
• VMs may have many common blocks if they are running the same OS and Applications, especially if the VMs are clones of each other
• “Experimental implementations show that using this method, it is possible to run over 50 Windows XP VMs with 1GB of RAM each on a physical machine with just 16GB of RAM”
• VMWare Whitepapers of TPS for ESXi 3 and vSphere 5
• The TPS feature is not new, it has shipped in VMWare since 2006, and is on by default
• “Why is this a big deal? Because a virtualized architecture demands VM isolation, this is the most important security requirement for virtualization. Each VM guest running on a host must not be allowed in any way to access another VM guest. They must be kept in separate locked rooms with only the hypervisor possessing the keys to access all of them”
• “VMware appears to be down-playing it as it obviously exposes a chink in their virtual armor, they have issued a KB article describing the vulnerability and giving guidance on how customers can disable TPS on their hosts. VMware doesn’t name the specific source that found the vulnerability in the KB article, they simply refer to it as “an academic paper””
• THE “Academic Paper” — Wait a minute! A fast, Cross-VM attack on AES
• “This work exploits resource sharing in virtualization software to build a powerful cache-based attack on AES. We demonstrate the vulnerability by mounting Cross-VM Flush+Reload cache attacks in VMware VMs to recover the AES keys of OpenSSL 1.0.1 running inside the victim VM. Furthermore, the attack works in a realistic setting where different VMs are located on separate cores. The modified flush+reload attack we present, takes only in the order of seconds to minutes to succeed in a cross-VM setting. Therefore long term co-location, as required by other fine grain attacks in the literature, are not needed. The results of this study show that there is a great security risk to OpenSSL AES implementation running on VMware cloud services when the deduplication is not disabled.”
• The paper describes a technique in which an attacker with access to a VM on the same physical machine, even if it is not on the same CPU Core, could recover the SSL/TLS private key from a web server running Apache+OpenSSL in a victim VM
• This would then allow the attacker to impersonate that site, possibly allowing them to successfully phish or otherwise gain sensitive information from end users
• “All versions of vSphere back to VI3 are vulnerable to the exploit but VMware is only patching the 5.x versions of vSphere as the 4.x versions are no longer officially supported as of May 2014”. “Note these patches only disable TPS which is currently enable by default, they do nothing to fix the vulnerability, it will most likely take VMware some time to figure out how to make TPS work in a way that cannot be exploited”

WinShock – What that Microsoft SChannel vulnerability was

• SChannel is Microsofts tool similar to OpenSSL. “SChannel is used by anything leveraging built-in SSL and TLS this includes IIS, Active Directory, OWA, Exchange, Internet Explorer, and Windows Update.”
• The vulnerability allows remote code execution, so it especially severe, and users should patch immediately if they have not already done so
• An attacker can send specially crafted malicious packets, which are not properly checked for validity, and the victim machine may execute commands included in that message, allowing the attacker to take full control of the machine
• Rapid7 Blog: Is MS14-066 another Red alert?
• Rapid7 takes pains to clarify that this is not on the same level as Heartbleed, Shellshock, Poodle, or other recent vulnerabilities of that scale, mostly because this was privately disclosed to Microsoft, and is not being actively exploited in the wild
• No one knows the details of the problem yet, and there are no proof-of-concept exploits
• “Details surrounding the vulnerability are vague, but Microsoft has indicated that there are no known exploits in the wild and the development of exploit code will be challenging. This vulnerability is reported to affect all Windows servers and clients, and while it’s unlikely to be exploited today, it should be patched as soon as possible given the possibility of remote code execution.”

New research discovers that up to 81% of tor users could be de-anonymized by new traffic analysis techniques

• “Research undertaken between 2008 and 2014 suggests that more than 81% of Tor clients can be ‘de-anonymised’ – their originating IP addresses revealed – by exploiting the ‘Netflow’ technology that Cisco has built into its router protocols, and similar traffic analysis software running by default in the hardware of other manufacturers.”
• “The technique depends on injecting a repeating traffic pattern – such as HTML files, the same kind of traffic of which most Tor browsing consists – into the TCP connection that it sees originating in the target exit node, and then comparing the server’s exit traffic for the Tor clients, as derived from the router’s flow records, to facilitate client identification.”
• “To achieve acceptable quality of service, [Tor attempts] to preserve packet interarrival characteristics, such as inter-packet delay. Consequently, a powerful adversary can mount traffic analysis attacks by observing similar traffic patterns at various point
• “Traffic analysis of this kind does not involve the enormous expense and infrastructural effort that the NSA put into their FoxAcid Tor redirects, but it benefits from running one or more high-bandwidth, high-performance, high-uptime Tor relays”
• The technical involves getting the user to download a file, large enough that it takes a few minutes over which the flow of data can be manipulated and observed (this could be as easy as injecting an oversized images into a website, where the user does not see it)
• By having the server that is sending the image modulate the bandwidth of the TCP connection in question, shifting every 20 seconds between 1 mbit (about the max you would expect to be able to get over tor), 50 kbit, 300 kbit, and then 100 kbit, it created a unique enough pattern of traffic, that tor preserved, that the same pattern could be observed on the entry node that the tor user was connected to
• By collecting Netflow type data (start and end time, source and destination ip, number of packets, number of bytes), from the source (or exit node) and the entry node (or a router in front of the entry node or the end user), and correlated the data, researchers were able to identify the real ip address of the tor user that connected to their server

Feedback:

• How to prevent a “man-in-the-browser attack” to my lastpass account ?

• pfSense and vlans

• Masque attack

• Looking for some DDOS protection tool, what do you use, how did you configured it?

Round Up:

• Let’s Encrypt
• WhatsApp adds end-to-end encryption using TextSecure
• Apple Disables Trim Support On 3rd Party SSDs In OS X
• The upside of accidently hiring a hacker
• SUSE Linux Enterprise Live Patching Now Available
• Government Employees and Contractors responsible for most government data breaches
• FTC shuts down massive “PC cleaner” scam
• The problem with Android on big tablets
• Amnesty, EFF, Privacy International Put Out Free Anti-Surveillance Tool
• New York to roll out gigabit wifi and touch screen ‘information stations’ in place of old pay phones

The post Tor Vibrations | TechSNAP 190 first appeared on Jupiter Broadcasting.

HP is breaking up, Facebook wants to be your wallet & Bill Gates thinks Bitcoin is better than cash.

Plus what is going on with Bitcoin? And are you ready for autonomous Linux powered drone boats?

Direct Download:

MP3 Audio | OGG Audio | Video | HD Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Hewlett-Packard Plans to Break in Two – WSJ

Hewlett-Packard plans to separate its personal-computer and printer businesses from its corporate hardware and services operations, the latest attempt by the technology company to improve its fortunes by breaking itself in two.

The company intends to announce the move on Monday, people familiar with the plan said. It is expected to make the split through a tax-free distribution of shares to stockholders next year, said one of the people.

If the division goes off as planned, it would give rise to two publicly traded companies, each with more than $50 billion in annual revenue.

The impending move, first reported Sunday by The Wall Street Journal, set off a round of speculation in the industry about whether the separation could lead to more deal making.

In 2012, under current H-P Chief Executive Meg Whitman, the company reorganized itself to combine the PC business with its more profitable printer operation, helping pave the way for the current plan.

Ms. Whitman is slated to be chairman of the PC and printer business, to be known as HP Inc., and CEO of the other company, to be called Hewlett-Packard Enterprise, said one of the people familiar with the plan. Current lead independent director
Patricia Russo will be chairman of the enterprise company, while Dion Weisler,
an executive in the PC and printer operation, is to be CEO of that business, this person said.

Hacked Screenshots Show Friend-To-Friend Payments Feature Hidden In Facebook Messenger | TechCrunch

Facebook Messenger is all set up to allow friends to send each other money. All Facebook has to do is turn on the feature, according to screenshots and video taken using iOS app exploration developer tool Cycript by Stanford computer science student Andrew Aude.

Facebook CEO Mark Zuckerberg said on the company’s Q2 earnings call that “over time there will be some overlap between [Messenger] and payments. […] The payments piece will be a part of what will help drive the overall success and help people share with each other and interact with businesses.” However, he urged Wall Street not to get too foamy at the mouth because it may be awhile since “there’s so much groundwork for us to do.”

He urged analysts and investors to revise their estimates of Facebook’s revenue if they expected this to come quickly. “To the extent that your models or anything reflect that we might be doing that, I strongly encourage you to adjust that, because we’re not going to. We’re going to take the time to do this in the way that is going to be right over multiple years” Zuckerberg concluded.

Bill Gates: Bitcoin Is ‘Better Than Currency’

After long remaining mostly mum on Bitcoin, Microsoft’s co-founder Bill Gates has spoken. At a financial-services industry conference in Boston, he threw his weight behind the controversial crypto currency. Well, at least as a low-cost payments solution. … “Bitcoin is exciting because it shows how cheap it can be,” he told Erik Schatzker during a Bloomberg TV’s Smart Street show interview yesterday (video). “Bitcoin is better than currency in that you don’t have to be physically in the same place and, of course, for large transactions, currency can get pretty inconvenient.” … While he seems relatively bullish on how inexpensive transacting in Bitcoin can be, Gates isn’t singing the praises of its anonymity. The billionaire alluded in an oblique, somewhat rambling fashion to some of the more nefarious anonymous uses associated with Bitcoin.

• Gates talks Nadella and how Office needs to be dramatically better

The conversation then switched to new Microsoft CEO Satya Nadella and whether this is something the Windows maker should be focusing on, and how Gates feels the new man in charge is doing in his job. Although Gates stated that he’s “very happy with what he’s doing,” curiously he went on to say that he believes the company needs to make Microsoft Office dramatically better. We’re not sure exactly what that means, but Gates was very animated about it, and he’s apparently making sure the company heeds this advice.

BG: Certainly, Microsoft should do as well or better, but of all the things Microsoft needs to do in terms of making people more productive in their work, helping them communicate in new ways. It’s a long list of opportunities Microsoft has to innovate, and taking Office and making it dramatically better would be really high on the list, that’s the kind of thing that I’m trying to make sure they move fast on. I’m very happy with what he’s doing. I see a new sense of energy. There’s a lot of opportunity there. Some things the company isn’t the leader on, and he sees he needs to change that.

• Live USD/BTC

US Navy Develops Robot Boat Swarm To Overwhelm Enemies

“Jeremy Hsu reports that the US Navy has been testing a large-scale swarm of autonomous boats designed to overwhelm enemies. In the test, large ship that the Navy sometimes calls a high-value unit, HVU, is making its way down the river’s thalweg, escorted by 13 small guard boats. Between them, they carry a variety of payloads, loud speakers and flashing lights, a .50-caliber machine gun and a microwave direct energy weapon or heat ray. Detecting the enemy vessel with radar and infrared sensors, they perform a series of maneuvers to encircle the craft, coming close enough to the boat to engage it and near enough to one another to seal off any potential escape or access to the ship they are guarding. They blast warnings via loudspeaker and flash their lights. The HVU is now free to safely move away.

Rear Adm. Matthew Klunder, chief of the Office of Naval Research (ONR), points out that a maneuver that required 40 people had just dropped down to just one. “Think about it as replicating the functions that a human boat pilot would do. We’ve taken that capability and extended it to multiple [unmanned surface vehicles] operating together within that, we’ve designed team behaviors,” says Robert Brizzolara. The timing of the briefing happens to coincide with the 14-year anniversary of the bombing of the USS Cole off the coast of Yemen that killed 17 sailors. It’s an anniversary that Klunder observes with a unique sense of responsibility. “If we had this capability there on that day. We could have saved that ship. I never want to see the USS Cole happen again.”

The post Facebank | Tech Talk Today 70 first appeared on Jupiter Broadcasting.

Early builds of SteamOS have landed, and we wonder what the larger implications are. Plus our thoughts on Microsoft\’s clear challenges, the problem with Qt Creator, and betting on the future.

Plus your feedback, our thoughts on cloud build services, and much more!

Thanks to:

• Help the DigitalOcean community by submitting articles and get paid $50 per published piece!

Direct Download:

MP3 Audio | OGG Audio | Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

— Show Notes: —

Feedback

• Caffeine and UI Testing

• bug tracking

• Automated UI testing utility – Image based pixel diffing algorithm to detect rendered differences

• Mobile Devopment

+Dmitri’s Email

Hoopla:

• The Linux Action Show Covers SteamOS

• SteamOS

Book of the Week

• The Next 100 Years: A Forecast for the 21st Century Audiobook | George Friedman | Audible.com

• Predator Nation

The post The SteamOS Conspiracy | CR 80 first appeared on Jupiter Broadcasting.

It’s a mailbag special with a hidden message. Mike and Chris discuss burnout a bit more, the pitfalls of bad Q&A, automated UI testing, and the open source projects we’re thankful for this year.

Thanks to:

• Help the DigitalOcean community by submitting articles and get paid $50 per published piece!

Direct Download:

MP3 Audio | OGG Audio | Video | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | Video Feed | Torrent Feed | iTunes Audio | iTunes Video

• Jupiter Broadcasting 2014 Limited Shirt

• Support Jupiter Broadcasting Page

Feedback

• Burned Out, Pulling apps, and contracts

• Battle of the IDEs

• Software/Code Quality Driven Down by the Man

• Automated UI Testing0

• Node Frustration

• Suggestion Community based CR – Mumble edition

Book of the Week

[asa]B00G8UL474[/asa]

Follow the hosts and the show:

• FingertipTech on Twitter

• Email the show

• Join the Coder Radio Subreddit
• Live Monday 9am PST
• Music by: Ronald Jenkees
• Mike on Twitter
• Mike on Google+
• Mike’s website
• Chris on twitter
• Chris on Google+

The post Code Your Enthusiasm | CR 78 first appeared on Jupiter Broadcasting.

We take a look at Painful Math, Canadian robotic rovers, using the Kinect in science, updates on spacecraft, stories, and Curiosity, viewer feedback, and as always take a peek back into history and up in the sky this week.

Direct Download:

MP3 Download | Ogg Download | Video | YouTube

RSS Feeds:

MP3 Feed | Ogg Feed | iTunes Feed | Video Feed

Support the Show:

[asa]B008QZ5PY2[/asa]
[asa]0345529413[/asa]