Xen’s highly critical virtual machine escape flaw gets a fix

The Xen Project fixed several vulnerabilities in its popular virtualization software, including one that could allow potential attackers to break out of a virtual machine and gain control over the host system.Vulnerabilities that break the isolation layer between virtual machines are the most serious type for a hypervisor like Xen, whose main goal is to allow running multiple VMs on the same hardware in a secure manner.The Xen patches released Thursday fix a total of nine vulnerabilities, but the privilege escalation one identified as CVE-2015-7835 is the most serious one.It stems not from a traditional programming error, but from a logic flaw in how Xen implements memory virtualization for PV (paravirtualized) VMs. PV is a technique that enables virtualization on CPUs that don't support hardware-assisted virtualization.To read this article in full or to leave a comment, please click here

Galaxy Release 1.1.1

We’re back again with a quick update to Galaxy. In the last release we did some cool things to make searching roles much easier. This release is a mini release focused on fixing a few bugs and adding minor enhancements we couldn’t squeeze into the last cycle.

Galaxy issues are tracked publicly at https://github.com/ansible/galaxy-issues. Here are the issues addressed in release 1.1.1:

#88 Role Data Should Show Last Modified Instead of Created Date

#86 `ansible-galaxy -r roles.txt` - Incorrect Example

#84 README.md Fails to Render When it Contains a Variable String Like

#82 "Sign in" Option Should Appear on Home Page Header

#81 Better Filter for RHEL/Centos -> EL in Platform Search

#53 Adding a Role Called "Ansible" Results in Un-named Role

#14 Add Galaxy support for Debian Jessie

#9 Periods in Role Names Cause Installs to Fail

Fuzzy Searching

As part of fixing issue #81, Better Filter for RHEL/Centos -> EL in Platform Search, we changed the way the new role filtering works. A lot of times you know what you’re looking for, and don’t want to wait for autocomplete suggestions. For example, you might be looking for a Platform value of ‘centos’. Typing Continue reading

UK police arrest second teenager over TalkTalk hacking

UK police have arrested a second teenager in their investigation of an attack on the website of telecommunications operator TalkTalk that may have exposed the personal data of millions of customers.The arrest of the 16-year-old boy in Feltham, England, on Thursday follows the arrest Monday afternoon of a 15-year-old boy in County Antrim, Northern Ireland.Both boys were arrested on suspicion of offenses under the Computer Misuse Act, and have been released on bail. Thursday's arrest followed a search of homes in Feltham and Liverpool, police said. No arrest was made at the address in Liverpool.To read this article in full or to leave a comment, please click here

Optimizing Traffic Engineering with NorthStar Controller on Software Gone Wild

Content providers were using centralized traffic flow optimization together with MPLS TE for at least 15 years (some of them immediately after Cisco launched the early MPLS-TE implementation in their 12.0(5)T release), but it was always hard to push the results into the network devices.

PCEP and BGP-LS all changed that – they give you a standard mechanism to extract network topology and install end-to-end paths across the network, as Julian Lucek of Juniper Networks explained in Episode 43 of Software Gone Wild.

Read more ...

Man whose iPhone passcode DOJ wanted Apple to bypass enters guilty plea

Jun Feng, a defendant in a criminal case, has entered a guilty plea, removing pressure from a New York court to decide quickly whether Apple is required to aid investigators by bypassing his iPhone 5s passcode.Feng had been indicted on three counts related to the possession and distribution of methamphetamine. The U.S. Department of Justice had asked the U.S. District Court for the Eastern District of New York for an expedited decision so as to secure evidence in a trial scheduled to begin on Nov. 16.But on Thursday, DOJ informed the court that Feng has entered a guilty plea. "The government persists in the application pending before the Court, but in view of the guilty plea, no longer requests expedited treatment," U.S. Attorney Robert L. Capers wrote in a letter to Magistrate Judge James Orenstein.To read this article in full or to leave a comment, please click here

Wi-Fi’s Whipping Boy Complex

If you’ve ever attended a large conference or exhibition, chances are everyone whined about the Wi-Fi. But the truth is, a lot of the time, it’s not Wi-Fi’s fault at all. While there is a litany of Wi-Fi-specific deployment options...

Cryptowall ransomware revenue may flow to one group

Just one cybercriminal group may be collecting the revenue from Cryptowall 3.0, a malicious program that infects computers, encrypts files and demands a ransom, according to a new study released on Thursday.The finding comes from the Cyber Threat Alliance (CTA), an industry group formed last year to study emerging threats, with members including Intel Security, Palo Alto Networks, Fortinet and Symantec. Cryptowall is among several families of "ransomware" that have posed a growing danger to businesses and consumers. If a computer is infected, its files are scrambled with strong encryption.To read this article in full or to leave a comment, please click here

Creative foot-shooting with Go RWMutex

Hi, I'm Filippo and today I managed to surprise myself! (And not in a good way.)

I'm developing a new module ("filter" as we call them) for RRDNS, CloudFlare's Go DNS server. It's a rewrite of the authoritative module, the one that adds the IP addresses to DNS answers.

It has a table of CloudFlare IPs that looks like this:

type IPMap struct {  
    sync.RWMutex
    M map[string][]net.IP
}

It's a global filter attribute:

type V2Filter struct {  
    name       string
    IPTable    *IPMap
    // [...]
}

Mexican Standoff CC-BY-NC-ND image by Martin SoulStealer

The table changes often, so a background goroutine periodically reloads it from our distributed key-value store, acquires the lock (f.IPTable.Lock()), updates it and releases the lock (f.IPTable.Unlock()). This happens every 5 minutes.

Everything worked in tests, including multiple and concurrent requests.

Today we deployed to an off-production test machine and everything worked. For a few minutes. Then RRDNS stopped answering queries for the beta domains served by the new code.

What. That worked on my laptop™.

Here's the IPTable consumer function. You can probably spot the bug.

func (f *V2Filter) getCFAddr(...) (result []dns.RR) {  
    f. Continue reading

IDG Contributor Network: Users fail to identify phishing attacks, study says

Computer users don't spend enough time looking for phishing indicators, says a new study based on tracking eye movement and brain activity.Users fail "at detecting phishing attacks even when they are mentally engaged in the task and subconsciously processing real sites differently from fake sites," Nitesh Saxena, one of the University of Alabama at Birmingham scientists involved in the study, said in an article on the university's website. The scientists want to find a way to track subconscious detection of phishing and get users to recognize attacks consciously.To read this article in full or to leave a comment, please click here

Worth Reading: Cloud Access Security Brokers

Widespread enterprise adoption of public cloud applications like Office 365 has not come without security and compliance concerns. Most cloud apps function like a black box, providing little visibility or control over the handling of sensitive data. … a cloud access security broker (CASB) provides a way to encrypt the data using keys that you control. A CASB also provides a central point for monitoring and managing access to those resources. via the csa

The post Worth Reading: Cloud Access Security Brokers appeared first on 'net work.

IDG Contributor Network: 4 considerations for minimizing (or eliminating) your mean time to innocence

Your users are complaining: some system is down or slow. You need to determine if the problem is under your control or if the fault lies with a third party, such as your ISP or a SaaS provider. The time it takes to figure that out is your MTTI: "Mean Time to Innocence."At the recent O'Reilly Velocity show in New York City, my colleague, Phil Stanhope, talked about this topic. He pointed out a few important reasons why determining MTTI is so much more complex now than it was 10+ years ago. The Internet is increasingly complex and routinely experiences outages, instabilities, and attacks. While cloud providers, CDNs, and acceleration services may claim to be "always up," that doesn't mean that they're "always reachable." In fact, they are almost certainly experiencing a constant rate of low-level failure that is largely outside IT's control and is still affecting users. Therefore, getting to MTTI is harder than ever.To read this article in full or to leave a comment, please click here

10 enterprise IT firsts

O PioneersImage by Baker County Tourism/FlickrWe think of IT as an essential corporate function today, driven by desire for profits. But computers largely emerged out of government- and university-funded research, much of it initially driven in the 1940s by the effort to win World War II -- in Britain, to break Nazi codes, and in the U.S., to produce artillery firing tables.To read this article in full or to leave a comment, please click here

Google Fiber eyed for three more cities: Oklahoma City, Jacksonville and Tampa

Google's crusade to light up U.S. cities with gigabit speed Google Fiber has expanded to potentially include Oklahoma City and Jacksonville and Tampa, Florida.In a blog posted Wednesday, Google said it invited the capital city of Oklahoma and the two Florida cities to "explore" bringing faster fiber to their communities.In September, Google also invited San Diego and Irvine, Calif., and Louisville, Ky., to explore bringing Google Fiber to their communities.+ ALSO ON NETWORK WORLD How Google Fiber is disrupting the broadband deployment model +To read this article in full or to leave a comment, please click here

Hackers infect MySQL servers with malware for DDoS attacks

Hackers are exploiting SQL injection flaws to infect MySQL database servers with a malware program that's used to launch distributed denial-of-service (DDoS) attacks.Security researchers from Symantec found MySQL servers in different countries infected with a malware program dubbed Chikdos that has variants for both Windows and Linux.This Trojan is not new and was first documented in 2013 by incident responders from the Polish Computer Emergency Response Team (CERT.PL). At that time the malware was being installed on servers after using brute-force dictionary attacks to guess SSH (Secure Shell) login credentials.However, the new attacks observed by Symantec abuse the user-defined function (UDF) capability of the MySQL database engine. UDF allows developers to extend the functionality of MySQL with compiled code.To read this article in full or to leave a comment, please click here

Stop CISA!

I've been following cybersecurity legislation for a number of years, including all the proceedings with the Cybersecurity Information Sharing Act (CISA). After much deliberation, I believe that CISA remains fundamentally flawed and needs a lot more work before it becomes the law of the land. To be clear, I understand and support the basic objective CISA seeks to promote. Real-time threat intelligence sharing and analysis could help public and private sector organizations proactively react to emerging cyber-threats, mitigating risk and/or minimizing the potential damages associated with devastating data breaches (i.e. Anthem, OMB, Sony Pictures, Target, etc.).To read this article in full or to leave a comment, please click here

1 … 3,181 3,182 3,183 3,184 3,185 … 3,755