LVM – Jupiter Broadcasting

Lenovo & HP are caught injecting malware even after you format the drive, Ubiquiti Networks is socially engineered out of 46 million & are we entering the era of Security Research Prohibition? We debate.

Plus a great batch of your questions, our answers, a rocking round up & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Lenovo and HP caught injecting Malware even after your wipe the machine

A user on the Ars Technica forums discovered the malware being installed on his freshly re-formatted computer
How is that possible, the entire disk was erased…
Well, it turns out Microsoft has a solution for that, the “Windows Platform Binary Table
Details on Microsoft’s “Windows Platform Binary Table”
An area in the bios where you can stick some files, and they will be run with ‘SYSTEM’ privileges, after Windows (8+) starts
They have access to the file system, even if the disk is encrypted with bitlocker, because the code is run after the file system is mounted
“Microsoft’s Windows Platform Binary Table WPBT feature allows PC manufacturers and corporate IT to inject drivers, programs and other files into the Windows operating system from the motherboard firmware. The WPBT is stored in the firmware, and tells Windows where in memory it can find an executable called a platform binary to run. Said executable will take care of the job of installing files before the operating system starts.”
“During operating system initialization, Windows will read the WPBT to obtain the physical memory location of the platform binary,” Microsoft’s documentation states. “The binary is required to be a native, user-mode application that is executed by the Windows Session Manager during operating system initialization. Windows will write the flat image to disk, and the Session Manager will launch the process.”
“The LSE (Lenovo Service Engine) makes sure C:\Windows\system32\autochk.exe is Lenovo’s variant of the autochk.exe file; if Microsoft’s official version is there, it is moved out of the way and replaced. The executable is run during startup, and is supposed to check the computer’s file system to make sure it’s free of any corruption.”
“Lenovo’s variant of this system file ensures LenovoUpdate.exe and LenovoCheck.exe are present in the operating system’s system32 directory, and if not, it will copy the executables into that directory during boot up. So if you uninstall or delete these programs, the LSE in the firmware will bring them back during the next power-on or reboot.”
In the Microsoft documentation, they try to make it clear:
“The primary purpose of WPBT is to allow critical software to persist even when the operating system has changed or been reinstalled in a “clean” configuration … Because this feature provides the ability to persistently execute system software in the context of Windows, it becomes critical that WPBT-based solutions are as secure as possible and do not expose Windows users to exploitable conditions.”
Which is funny, because the entire WPBT feature, “exposes Windows users to exploitable conditions”
“Secure as possible? Not in this case: security researcher Roel Schouwenberg found and reported a buffer-overflow vulnerability in the LSE that can be exploited to gain administrator-level privileges.”
“After Lenovo learned of this bug in April, it dawned on the company that its LSE was falling foul of Microsoft’s security guidelines for using the powerful WPBT feature. Two months later, in June, it pulled the whole thing: the LSE software is no longer included in new laptops.”
Luckily, if you are not running Windows 8 or higher, your computer is not affected
Note: This has been observed on desktop computers too, not just laptops
Note Well: This is a “feature” of Windows, so every computer with Windows 8 or higher is actually vulnerable to having malicious code injected, there just might not be any code in your firmware, currently.
Microsoft say: “If partners intentionally or unintentionally introduce malware or unwanted software though the WPBT, Microsoft may remove such software through the use of anti-malware software. Software that is determined to be malicious may be subject to immediate removal without notice.”
However, since the file that gets executed only ever exists in memory, Microsoft’s malware scanner won’t find the WPBT binary, only the malware it drops into your system
Lenovo used Windows anti-theft feature to install persistent crapware
Lenovo Busted For Stealthily Installing Crapware Via BIOS On Fresh Windows Installs

Ubiquiti Networks loses 46 million in cyber bank heist

“Networking firm Ubiquiti Networks Inc. disclosed this week that cyber thieves recently stole $46.7 million using an increasingly common scam in which crooks spoof communications from executives at the victim firm in a bid to initiate unauthorized international wire transfers”
So, pretend to be the boss, and get a secretary, or the finance department to approve expenses or transfers
The attack was disclosed as part of the company’s quarterly filings with the SEC
“This fraud resulted in transfers of funds aggregating $46.7 million held by a Company subsidiary incorporated in Hong Kong to other overseas accounts held by third parties,” Ubiquiti wrote. “As soon as the Company became aware of this fraudulent activity it initiated contact with its Hong Kong subsidiary’s bank and promptly initiated legal proceedings in various foreign jurisdictions. As a result of these efforts, the Company has recovered $8.1 million of the amounts transferred.”
“The swindle that hit Ubiquiti is a sophisticated and increasingly common one targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments”
“Ubiquiti didn’t disclose precisely how it was scammed, but CEO fraud usually begins with the thieves either phishing an executive and gaining access to that individual’s inbox, or emailing employees from a look-alike domain name that is one or two letters off from the target company’s true domain name. For example, if the target company’s domain was “example.com” the thieves might register “examp1e.com” (substituting the letter “L” for the numeral 1) or “example.co,” and send messages from that domain.”
“The FBI’s advisory on these scams urges businesses to adopt two-step or two-factor authentication for email, where available, and/or to establish other communication channels — such as telephone calls — to verify significant transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media, as attackers perpetrating these schemes often will try to discover information about when executives at the targeted organization will be traveling or otherwise out of the office.”
“Unlike traditional phishing scams, spoofed emails used in CEO fraud schemes are unlikely to set off spam traps, because these are targeted phishing scams that are not mass e-mailed. Also, the crooks behind them take the time to understand the target organization’s relationships, activities, interests and travel and/or purchasing plans.”
These won’t be your typical phishing emails for of broken english and bad punctuation
These will be highly researched scams designed to make you think you are communicating with the real person
“On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software, such as Dyre and ZeuS. But in many ways, the BEC attack is more versatile and adept at sidestepping basic security strategies used by banks and their customers to minimize risks associated with account takeovers. In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the BEC scam the crooks trick the victim into doing that for them.”
Even two factor auth can be defeated here, because you are tricking someone into doing the transfer for you

We may be entering the era of Security Research Prohibition

As if the Oracle nonsense last week was not bad enough, the Wassenaar Arrangement threatens to send us into the dark ages
“The U.S. implementation of the rules, which govern the export of so-called intrusion software among other things, has been criticized sharply by lawyers, security researchers, and software vendors, who say that the proposed rules are too vague and threaten to chill legitimate security research and other activities.”
“The rules that we got on May 20 are confusing to say the least. The Commerce Department didn’t have any experience with these kind of rules,” Nate Cardozo, a staff attorney at the EFF, said during a panel on Wassenaar at the Black Hat conference here Thursday. “They are really horrendously vague.”
“The Bureau of Industry and Security at the Commerce Department proposed the rules in May and opened up a 60-day comment period. Many security researchers and attorneys submitted comments, and the BIS has said it will revise the rules and open them up for public comment again, a somewhat unusual move.“
“The Wassenaar rules have been compared in many circles to the export controls on encryption software that came into effect in the 1990s in the U.S. There is an important lesson to be drawn from the way the crypto controls were handled.“ “We should learn how much those controls did the opposite of what was intended, which is weakening the security of the Internet as a whole”
“Because the BIS rules as currently written are so vague about what constitutes intrusion software, things such as Metasploit and other common offensive tools could be regulated. And even sharing information about your own security research with a co-worker in another country could cause issues. Researchers are quite wary of these vagaries and worry that their day-to-day work may be restricted.“

Feedback:

Round Up:

The post Export Grade Vulnerabilities | TechSNAP 228 first appeared on Jupiter Broadcasting.

btrfs Meltdown | LINUX Unplugged 87

chris — Tue, 07 Apr 2015 17:53:49 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

After yet another gotcha takes down a critical Linux workstation, is it officially time to consider avoiding btrfs when it matters?

Plus what happened to the Evolve OS project & why they are now called Solus.

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Pre-Show:

The best HDMI operating system sticks | ZDNet

Catch Up:

CoreOS today announced a new $12 million round of funding as well as a new product called Tectonic that is based on the Google Kubernetes open-source project for container orchestration.

Kubernetes by Google

DigitalOcean

DigitalOcean: SSD Cloud Server, VPS Server, Simple Cloud Hosting

Dell XPS 13 (2015) developer edition now available – runs Ubuntu 14.04 SP1

LinuxFest Northwest 2015

Bellingham, WA • April 25th & 26th

Holy cookies I did it..

I created a Jupiter Broadcasting Meetup group. I was inspired by the idea of how nice it would be to have a rough idea of how many folks will be making it out to LFNW. Just to help with planning.

tl;dr

Going to LFNW 2015: LFNW 2015 – Jupiter Broadcasting Meetup please register, thaaaank you.
Want to attend future JB events in Seattle, or your area? Join our group: Jupiter Broadcasting Meetup (Seattle, WA) – Meetup
Contact | LinuxFest Northwest 2015

TING

Ting – mobile that makes sense

The Death of Chris’ #1 Rig

Another btrfs snafu… glad I am sitting this one out

Stable kernel version 3.19.1+ can cause a deadlock at mount time

workaround: boot with older kernel, or run btrfs-zero-log to clear the log (beware of the consequences)

fix: scheduled for 3.19.4, or apply 9c4f61f01d269815bb7c37.

also affected: 3.14.35+, 3.18.9+

Versions from 3.15 up to 3.16.1 suffer from a deadlock that was observed during heavy rsync workloads with compression on, it’s recommended to use 3.16.2 and newer

Fedora Server 22 Is Using The XFS File-System By Default

The server edition of Fedora 22 is using the XFS file-system by default rather than EXT4.

Using the XFS file-system as the default within an LVM has been part of the Fedora Server technical spec while with Fedora 22 it’s finally happened. The default layout for Fedora Server 22 installations is using XFS atop LVM while /boot is outside the LVM setup.

XFS: There and back … and there again?

Software RAID and LVM – ArchWiki

Linux Academy

Linux Academy | Linux and AWS Online Training

This is not an April Fools post We will be required to change the name

We will be required to change the name of the Evolve OS project, to avoid unnecessary legal action.

Evolve OS Changes Names to Solus, an Old Community Favorite – Softpedia

Solus Project – Community – Google+

European Trade Mark and Design Network – Home

Runs Linux from the people:

Send in a pic/video of your runs Linux.
Please upload videos to YouTube and submit a link via email or the subreddit.

Support Jupiter Broadcasting on Patreon

The post btrfs Meltdown | LINUX Unplugged 87 first appeared on Jupiter Broadcasting.

Meet the Dockers | LINUX Unplugged 16

chris — Tue, 26 Nov 2013 18:02:01 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A new version of Docker was just released, we bring on the CTO and Founder of Docker to chat about the big features all Linux users can look forward to.

Plus building the perfect Linux workstation, your feedback, and much more!

Thanks to:

Help the DigitalOcean community by submitting articles and get paid $50 per published piece!

Direct Download:

RSS Feeds:

Show Notes:

FU

Go Dock Yourself

Docker 0.7 runs on all Linux distributions – and 6 other major features

Docker 0.7 is finally here! We hope you\’ll like it. On top of countless bug fixes and small usability improvements, it introduces 7 major features since 0.6.0

Disadvantages from moving away from AUFS?
- Is there a slight performance overhead with lvm?
- btrfs? Add btrfs driver by alexlarsson · Pull Request #65 · shykes/docker
What people have already built using Docker

Docker is a powerful tool for many different use cases. Here are some great early use cases for Docker, as described by members of our community.

Getting Started Docker Tutorial

This hands-on tutorial is 100% online, so you don\’t need to install a thing. In about 10-15 minutes you\’ll be familiar with the basic
Docker commands.

Mail Sack:

Linux back in my day

The post Meet the Dockers | LINUX Unplugged 16 first appeared on Jupiter Broadcasting.

Fedora 17 Review | LAS | s22e01

chris — Sun, 27 May 2012 13:04:08 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Is Fedora the crazy dancing hippy of Linux distributions? Or just two guys with one Hat? Tune in to find out!

PLUS: Our thoughts on Linux Mint 13 and how to stash your home folder on it’s own partition!

AND SO MUCH MORE!

All this week on, The Linux Action Show!

Thanks to:

GoDaddy.com

Limited time offer:

New customers 25% off your entire order, code: 25MAY8
Expires: May 31, 2012

Want to save money on your entire order? Use our code LINUX and save 10%!

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes:

Runs Linux:

This Cadillac Is Powered by Linux

Android Pick:

Poop Salary
Thanks ToasterJ!
Android Picks so far thanks to Madjo in the IRC Chat room!

News:

Fedora 17 Review:

The Fedora 17 release criteria: “The install completes, the installed system works”
LVM out of the box + Solid advanced installation options are nice to see compared to Ubuntu
No Chromium? Is this the 1930s?
GNOME 3.4
Linux Kernel 3.3
Top features for “desktop” users of Fedora 17
ABRT back-trace de-duplication service to reduce the number of duplicate bug reports submitted automatically upon experiencing a crash
A tool for customizing fonts on a per language-basis on desktops using fontconfig
Haskell Platform 2011.4
Support for EXT4 file-systems beyond 16 terabytes in size
A Non-Uniform Memory Alignment Daemon
Virtualization sandbox support
Supporting OpenStack’s Quantum virtual networking service
Fedora now uses the Unified structure of organizing the file system. It means, that several directories like “/bin”, “/lib” and “/sbin” have been moved to “/usr/bin” etc. respectively.

What’s Bryan Doin?

Chris’ Stash:

Security Theater Critics | Unfilter

Find us on Google+

Find us on Twitter:

Matt’s How-to:

Dedicated Home Partitioning

As you discussed during the howto segment, there is a bit flexibility to setting up your partitions. When setting up partitions for Ubuntu, I recommend the following setup.

Choose Try Ubuntu, then run Gparted.
If you have two drives attached, you will have two drives available from the pull down menu. Select the one you wish to use for your / and swap.
Right click select on the unallocated space, choose new.
With the new dialog open, choose the Ext4 file system, Extended partition, and place swap in the label. For the partition size, choose double the amount of your RAM. If you have 2 Gbs of RAM (2048 Mbs), then make the swap 4 Gbs. This will make you suspending your PC much smoother and lessen the likelihood of system crashing on resume. Leave the other options alone, click Add.
Still with the system drive selected, next you’ll right click on the unallocated space and choose new.
For the partition size, choose the remainder of the space available for that drive. This will be the larger unallocated space available, of the two visible. Select Primary partition, and place / in the label. Leave the other options alone, click Add.
Now go back to top right of Gparted and toggle the second drive you’ve decided to use as a /home partition.
For the partition size, choose the remainder of the space available for that drive. This will be the larger unallocated space available, of the two visible. Select extended partition, and place /home in the label. Leave the other options alone, click Add.
With all of this done, click the green check mark at the top of Gparted. This will apply all of your settings changes.
Start the installer. Click on continue until you come to the Erase everything or Something Else options. Choose Something Else.
You will now see different partitions laid out before you. Below the drive designations, you will see actual “free space” areas, broken up into three sections. The smallest, is your swap. The other two will be your / and /home options.
The smallest free space, should be at the top of the list. Click it, then click on Add.
The only option you change here is the pulldown menu to select Swap Area. Then click Ok.
The next free space in the list, should be the one I designated as the system partition. Click it, then click on Change. The only options you change here is the Use As Ext4, toggle format and the pulldown menu to select to / . Click Ok.
The last one in the list, is going to be for /home. Click it, then click on Add. Now select the mount point as /home. Click Ok. NOTE: The home partition should only be selected to format is it’s brand new. For future installs, you will want to click on it in this dialog, make sure format is NOT selected, in the future.
Make sure at the bottom of the dialog box, you’ve chosen to place the bootloader in the system selected hard drive. While we can also rely on the /boot option in partitioning, it’s rarely used for home systems.
Now choose Install Now. You’re all done!

Follow the network on Facebook:

Jupiter Broadcasting on Facebook

Jupiter Broadcasting Forum:

Jupiter Colony

Catch the show LIVE Sunday 10am Pacific / 5pm UTC:

The post Fedora 17 Review | LAS | s22e01 first appeared on Jupiter Broadcasting.

Easy LVM | LAS | s18e08

chris — Sat, 24 Sep 2011 17:25:20 +0000

Want to stack your Linux box full of hard drives? Join them into one giant pool of storage? It’s easy, we’ll show you how to combine two drives, or even hundreds!

Plus – Is Microsoft trying keep Linux off PC’s with Windows 8? We discuss!

And so much more!

All this week on, The Linux Action Show!

Thanks to:

GoDaddy.com Use our codes LINUX to save 10% at checkout, or LINUX20 to save 20% on hosting!

Direct Episode Download Links:

[ad#shownotes]

Episode Show Notes:

News:

LVM Easy:

A LVM Frontend for KDE
Using system-config-lvm
Format your drives as a Physical volume (PV) then you can add that raw storage to a volume group.
Then create logical volumes, and these will show up as drive devices. Format these with your file system of choice.
Chris often creates his home directory on a logical volume, for future growth!
Logical Volume Manager Overview
FreeBSD GEOM

Find us on Google+

Chris
Allan

Find us on Twitter:

Follow the network on Facebook:

Jupiter Broadcasting on Facebook

Catch the show LIVE at 10am on Sunday:

https://jblive.tv

The post Easy LVM | LAS | s18e08 first appeared on Jupiter Broadcasting.

Linux Home Server Build PT2 | The Linux Action Show! s13e03

chris — Sun, 15 Aug 2010 15:36:34 +0000

This week on, The Linux Action Show!

It’s round two of our Linux Home Server build project, and we’ve got the recipe you need to create an AWESOME LINUX SERVER!

THEN – We cut through all the STANK around Oracle suing Google and killing OpenSolaris. Is Oracle the new enemy of open source? We discuss!

All this week on, The Linux Action Show!

Thanks to GoDaddy.com for sponsoring this week’s show! Use our codes LINUX to save 10% at checkout, or LINUX20 to save 20% on hosting!

Direct Download Links

[ad#shownotes]

Our iPhone App:
Grab The Linux Action Show! App for your iPhone or iPod touch here!

This Week’s Show Notes:

Runs Linux:

The Axon, Runs Linux

Use our GoDaddy.com CODE: ACTION199 to get a $1.99 domain!

There ARE a limited number of uses, so act sooner rather than later.

Android Pick:

Google Chrome to Phone

TweetDeck Beta

Illumination Software Creator “Name Your Price” Sale

News:

Oracle sues Google over Android and Java

Google’s response: We are disappointed Oracle has chosen to attack both Googleand the open-source Java community with this baseless lawsuit,” Google said in a statement to Mashable earlier today. “The open-source Java community goes beyond any one corporation and works every day to make the web a better place. We will strongly defend open-source standards and will continue to work with the industry to develop the Android platform.”
Check our great Buzz feed discussion on this

Oracle Kills OpenSolaris

Ubuntu 10.10’s New Installs Supports Codecs & Driver Install

Check out the awesome ASCIIQuarium

Chris’ media server software pick

Bryan’s media server software pick

Download:

The post Linux Home Server Build PT2 | The Linux Action Show! s13e03 first appeared on Jupiter Broadcasting.

LVM – Jupiter Broadcasting

Our Fragmented Favorite | LINUX Unplugged 358

Linux Hardware Love | LINUX Unplugged 356

Linux Action News 74

Episode Links: linuxactionnews.com/74

This is How You Should Store Your Data | Ask Noah Show 87

Export Grade Vulnerabilities | TechSNAP 228

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Feedback:

Round Up:

btrfs Meltdown | LINUX Unplugged 87

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Pre-Show:

Catch Up:

tl;dr

Runs Linux from the people:

Meet the Dockers | LINUX Unplugged 16

Direct Download:

RSS Feeds:

Show Notes:

FU

Go Dock Yourself

Mail Sack:

Fedora 17 Review | LAS | s22e01

Thanks to:

Direct Download:

RSS Feeds:

Support the Show:

Show Notes:

Runs Linux:

Runs Linux:

Android Pick:

Universal Pick:

Random Distro Of The Day

Linux Action Show Subreddit

Search our past picks:

News:

Fedora 17 Review:

What’s Bryan Doin?

Chris’ Stash:

Find us on Google+

Find us on Twitter:

Matt’s How-to:

Follow the network on Facebook:

Jupiter Broadcasting Forum:

Catch the show LIVE Sunday 10am Pacific / 5pm UTC:

Easy LVM | LAS | s18e08

Direct Episode Download Links:

Episode Show Notes:

News:

LVM Easy:

Find us on Google+

Find us on Twitter:

Follow the network on Facebook:

Catch the show LIVE at 10am on Sunday:

Linux Home Server Build PT2 | The Linux Action Show! s13e03

Direct Download Links

This Week’s Show Notes:

Download:

Episode Links:

linuxactionnews.com/74