Mac ransomware KeRanger has flaws that could let users recover files

The KeRanger file-encrypting ransomware program for Mac OS X contains crypto flaws that could allow users to recover their files without paying cybercriminals.According to researchers from antivirus firm Bitdefender, KeRanger is based on another ransomware program, called Linux.Encoder, that first appeared in November and targeted Linux-based Web servers.The first three versions of Linux.Encoder had flaws in their cryptographic implementations that allowed the Bitdefender researchers to create tools that could be used to decrypt files affected by the malicious program.To read this article in full or to leave a comment, please click here

Kernel Programming 101 – Creating your own Linux Kernel Module


Have you ever wanted to write your own kernel module? This multi-part blog post will talk about creating your first kernel module, using the proc file system, gathering and updating statistics and will cover topics such as your kernel as a menu items to menuconfig, setting defaults in the kernel config, registering network callbacks for specific types of packets taking Cisco CDP as an example and some tips-tricks in writing and debugging kernel code.  A lot of my own learning has been through blogs and experiments. One source that is really great and does summarize a lot of what my blog will talk about and more is TLDP (The Linux Documentation Project).

Today programming involving systems  is about providing the flexibility and pace for software development by providing user space APIs that interact with the linux kernel through system calls. This approach also provides the abstraction needed to carve out the complexity in direct kernel programming. So before we dive into kernel programming-101, lets answer this question - Why Kernel Programming

When there's need to perform operations without  cpu cycles wastage and/or reduce user space copy overheads, kernel programming suits the bill. Taking networking and linux networking stack as Continue reading

The Simple Leads to the Spectacular

 

Steve Kerr, head coach of the record setting Golden State Warriors (my local Bay Area NBA basketball team), has this to say about what the team needs to do to get back on track (paraphrased):

What we have to get back to is simple, simple, simple. That's good enough. The simple leads to the spectacular. You can't try the spectacular without doing the simple first. Make the simple pass. Our guys are trying to make the spectacular plays when we just have to make the easy ones. If we don't get that cleaned up we're in big trouble. 

If you play the software game, doesn't this resonate somewhere deep down in your git repository?

If you don't like basketball or despise sports metaphors this is a good place to stop reading. The idea that "The simple leads to the spectacular" is probably the best TLDR of Keep it Simple Stupid I've ever heard.

Software development is fundamentally a team sport. It usually takes a while for this lesson to pound itself into the typical lone wolf developer brain. After experiencing a stack of failed projects I know it took an embarrassingly long time for me to Continue reading

Microsoft to court: Make Comcast give us the Windows-pirating subscriber’s info

In the legal arena, Microsoft is going after Comcast in order to unmask the person behind an infringing IP address which activated thousands of Microsoft product keys stolen from Microsoft’s supply chain.The Redmond giant wants the court to issue a subpoena which will force Comcast to hand over the pirating subscriber’s info. If the infringing IP address belongs to another ISP which obtained it via Comcast, then Microsoft wants that ISP’s info and the right to subpoena it as well.From 2012 to 2015, Microsoft maintains that an IP addy assigned to Comcast pinged its servers in Washington over 2,000 times during the software activation process. “Detailed information” such as the activation key and IP address activating Microsoft products is transmitted to Microsoft; it’s considered to be “voluntarily provided by users.”To read this article in full or to leave a comment, please click here

Microsoft wants your phone to wirelessly log you into your Windows 10 PC

The slow death of the password continues. Microsoft's following in the footsteps of Google’s Chrome OS with a handy-dandy new Windows 10 feature that eliminates the need to manually log in to your PC.The company's currently testing a refreshed Authenticator app for Windows 10 mobile called Phone Sign-in Beta. It looks like the app will continue to generate codes for multi-factor authentication, but the star feature of the upgraded app is a new feature that unlocks your PC with one tap when your phone is nearby, as The Verge first reported.To read this article in full or to leave a comment, please click here

Juniper, Lenovo converge for next gen data centers

Juniper Networks has allied with Chinese IT stalwart Lenovo to build converged, hyperconverged, and hyperscale data center infrastructure products for the enterprise and webscale markets.The non-exclusive arrangement comes as the hyperconvergence market – tight integration of compute, networking and storage into an overall software-defined IT fabric – is reaching warp speed. Cisco entered the market last week via an alliance with start-up Springpath; HPE disclosed plans for an offering this month; and leading start-ups Nutanix and SimpliVity are expanding their product lines, ecosystems and addressable markets.To read this article in full or to leave a comment, please click here

Riverbed delivers the hyper-converged edge

Hyper-converged infrastructure in the data center has been all the rage over the past few years. In the data center, hyper-convergence is a system with tightly integrated compute, storage, network and virtualization technology. Its main value proposition is to simplify the architecture of the data center and enables it to be controlled through software. Despite the strong value proposition of hyper-convergence, the technology has remained focused on the data center with little applicability to the branch. The irony of this is that branch offices are often the lifeblood of organizations and is where the majority of work is done. Despite the criticality of the branch, the technology deployed in these locations is often old, inefficient and performs poorly and can often put businesses at risk. WAN outages cause application outages, which directly costs the organization money.To read this article in full or to leave a comment, please click here

Riverbed delivers the hyper-converged edge

Hyper-converged infrastructure in the data center has been all the rage over the past few years. In the data center, hyper-convergence is a system with tightly integrated compute, storage, network and virtualization technology. Its main value proposition is to simplify the architecture of the data center and enables it to be controlled through software. Despite the strong value proposition of hyper-convergence, the technology has remained focused on the data center with little applicability to the branch. The irony of this is that branch offices are often the lifeblood of organizations and is where the majority of work is done. Despite the criticality of the branch, the technology deployed in these locations is often old, inefficient and performs poorly and can often put businesses at risk. WAN outages cause application outages, which directly costs the organization money.To read this article in full or to leave a comment, please click here

Alpha Testing the AlphaLeon HTTP Bot

ASERT was initially alerted about an emerging threat called AlphaLeon by Deep & Dark Web intelligence provider Flashpoint in August 2015. It caught and kept our interest because it sounded like it could be a new “banker” malware family. While it took some time to find samples of the malware in the wild, this post […]

Alpha Testing the AlphaLeon HTTP Bot

ASERT was initially alerted about an emerging threat called AlphaLeon by Deep & Dark Web intelligence provider Flashpoint in August 2015. It caught and kept our interest because it sounded like it could be a new “banker” malware family. While it took some time to find samples of the malware in the wild, this post […]

Cheat: your portable memory bank

How often do you find yourself scratching your head, trying to remember a command that you knew by heart but just can’t remember when you need it most? It happens for me quite often. Probably because I am aging or may be there is too much stuff in my brain attic. But I found a solution […]

The best ways to Celebrate Pi Day 2016

It’s that time of year again: Pi Day! Image by Flickr/kok_sexton Pi enthusiasts around the world wait each year for March 14 to celebrate the mathematical constant that represents the ratio of a circle’s circumference to its diameter. Check out our tried and true tips for celebrating Pi Day, and be sure to check out our past year’s coverage for even more ideas.To read this article in full or to leave a comment, please click here

Don’t Touch My Mustache, Aruba!

dont-touch-my-mustache

It’s been a year since Aruba Networks became Aruba, a Hewlett-Packard Enterprise Company. It’s  been an interesting ride for everyone involved so far. There’s been some integration between the HPE Networking division and the Aruba teams. There’s been presentations and messaging and lots of other fun stuff. But it all really comes down to the policy of non-interference.

Don’t Tread On Me

HPE has done an admirable job of keeping their hands off of Aruba. It sounds almost comical. How many companies have acquired a new piece and then done everything possible to integrate it into their existing core business? How many products have had their identity obliterated to fit in with the existing model number structure?

Aruba isn’t just a survivor. It’s come out of the other side of this acquisition healthy and happy and with a bigger piece of the pie. Dominick Orr didn’t just get to keep his company. Instead, he got all of HPE’s networking division in the deal! That works out very well for them. It allows Aruba to help integrate the HPE networking portfolio into their existing product lines.

Aruba had a switching portfolio before the acquisition. But that was just an afterthought. It Continue reading

Microsoft patches remote code execution flaws in Windows, IE, Edge, Office

Microsoft has fixed 39 vulnerabilities in multiple Windows components, Internet Explorer, Edge, Office and .NET Framework, many of which allow for remote code execution.The patches are grouped in 13 security bulletins, five of which are rated critical and the rest as important.According to researchers from security vendor Qualys, systems administrators should prioritize the MS16-023 security bulletin for Internet Explorer, which covers 13 critical vulnerabilities that can be exploited over the Web to fully take control of computers.Windows 10 users who prefer Microsoft Edge to Internet Explorer should prioritize MS16-024 instead, which covers 11 vulnerabilities in Microsoft's new browser, 10 of them critical.To read this article in full or to leave a comment, please click here