Free badge program helps determine the security of open source software

The Core Infrastructure Initiative (CII), a project managed by The Linux Foundation that aims to improve the security of critical open source projects, issued its first round of CII Best Practices Badges. Early badge earners include Curl, GitLab, the Linux kernel, OpenBlox, OpenSSL, Node.js and Zephyr. This is a free program that seeks to determine security, quality and stability of open source software. The CII Best Practices online app enables developers to quickly determine whether … More

Bangladesh Bank hackers compromised SWIFT software with bespoke malware

Bit by bit, indications about how the attackers who targeted Bangladesh’s central bank managed to take off with some $80 milllion (of the nearly $1 billion they aimed for) via fraudulent transfers are coming to light. First it was established that second-hand, cheap networking equipment that collects next to no network data, and the lack of a firewall between the bank’s SWIFT facility and the rest of the network, helped the attackers pull off the … More

Over 3 million servers running outdated JBoss software open to attack

Spurred by the recent discovery that the Samas (aka SamSam) ransomware is being spread via compromised servers running out-of-date versions of Red Hat’s JBoss server software, Cisco Talos researchers have begun scanning the Internet for machines that might be at risk. They found approximately 3.2 million vulnerable machines, but also a considerable number of those that are already compromised: 2,100 backdoors have been already been installed across nearly 1600 IP addresses. Another way into the … More

Software tools and services used to achieve ISO 27001

With high profile breaches becoming almost a daily occurrence in the media, many organizations are now turning to the ISO 27001 information security standard to help them stay out of the press and prove to their customers that they take security seriously. Even with a strong management commitment, adoption can be difficult and time-consuming unless smart choices are made. Many organizations are unsure of what’s available to help them implement and get certified in quick … More

The state of the cloud and the Software-Defined Data Center

We’ve long been moving toward cloud-based and virtualized infrastructures, but in some ways 2016 might just be the year in which the Software-Defined Data Center (SDDC) really becomes a fixture in corporate America, according to HyTrust. There’s belief that optimal SDDC strategies and deployment can drive up virtualization ratios and server optimization. All this because even though data breaches will surely happen, concerns over security and compliance will be far less an obstacle. SDDC: Positive … More

Opera Software founder launches Vivaldi, a new browser

After more than one year in public development and millions of downloads, Vivaldi today released the first major release of its desktop browser: Vivaldi 1.0. The UI uses React and JavaScript, as well as Node.js. The core of the browser uses Chromium, ensuring pages render quickly and accurately. “We share the same core code as Chrome (Chromium) but we are very different with handling the privacy of our users. First of all, our business model … More

Tor Project exploring ways to keep its software and users safe

In view of the recent legal battle between the FBI and Apple regarding phone encryption, and this article revealing that there have been many instances where the US Department of Justice demanded source code and private encryption keys from tech companies, the Tor Project decided to voice their support for Apple, and to outline their current protections against their software being backdoored, as well as their active work on adding new ones. “For all of … More

OS X ransomware found bundled with legitimate software

Palo Alto researchers have discovered the first fully functional ransomware aimed at Mac users. The malware, dubbed KeRanger, has been found on Friday (March 4), bundled into the Mac version of the popular open source Transmission BitTorrent client, and made available for download on the Transmission developers’ official website. The website now sports an alert on the main page, saying that everyone running version 2.90 of Transmission on OS X should immediately upgrade to and … More

Weak default credentials, command injection bug found in building operation software

A vulnerability in servers programmed with Schneider Electric’s StruxureWare Building Operation software can be exploited by a low-skilled, remote attacker to gain access to the servers and make changes that could affect a building’s security. What’s more, the software was also shipped with weak default user credentials that administrators weren’t required to change when setting up the system. StruxureWare Building Operation software provides integrated monitoring, control and management of energy, HVAC, lighting and fire safety. … More

Critical Glibc flaw opens Linux distros, other software and devices to compromise

A critical bug has been found to open an unimaginable number of computers, networking and other connected devices to attacks that can result in complete system compromise. Discovered independently by Google and Red Hat researchers, the bug resides in the GNU C Library (aka “glibc”), the open-source implementation of the C and C++ programming language libraries. Glibc is incorporated in practically every major Linux distribution, many embedded systems, devices like routers, many small-device projects, and … More