Web Security Archives - CVTF Studios.net https://cvtfstudios.net/category/web-security/ Webhosting in the city Wed, 30 Jun 2021 12:28:07 +0000 en-US hourly 1 Let’s Encrypt Revoking 3 Million TLS Certificates https://cvtfstudios.net/lets-encrypt-revoking-3-million-tls-certificates/ https://cvtfstudios.net/lets-encrypt-revoking-3-million-tls-certificates/#respond Wed, 04 Mar 2020 12:55:35 +0000 https://cvtfstudios.net/?p=68248 The most popular free certificate signing authority Let's Encrypt is going to revoke more than 3 million TLS certificates within the next 24 hours that may have been issued wrongfully due to a bug in its Certificate Authority software. The bug, which Let's Encrypt confirmed on February 29 and was fixed two hours after discovery, [...]

The post Let’s Encrypt Revoking 3 Million TLS Certificates appeared first on CVTF Studios.net.

]]>

The most popular free certificate signing authority Let’s Encrypt is going to revoke more than 3 million TLS certificates within the next 24 hours that may have been issued wrongfully due to a bug in its Certificate Authority software.

The bug, which Let’s Encrypt confirmed on February 29 and was fixed two hours after discovery, impacted the way it checked the domain name ownership before issuing new TLS certificates.

As a result, the bug opened up a scenario where a certificate could be issued even without adequately validating the holder’s control of a domain name.

The Certification Authority Authorization (CAA), an internet security policy, allows domain name holders to indicate to certificate authorities (CAs) whether or not they are authorized to issue digital certificates for a specific domain name.

Let’s Encrypt considers domain validation results good only for 30 days from the time of validation, after which it rechecks the CAA record authorizing that domain before issuing the certificate. The bug — which was uncovered in the code for Boulder, the certificate signing software used by Let’s Encrypt — is as follows:

“When a certificate request contained N domain names that needed CAA rechecking, Boulder would pick one domain name and check it N times.” In other words, when Boulder needed to parse, for example, a group of 5 domains names that required CAA rechecking, it would check one domain name 5 times as opposed to checking each of the 5 domains once.

The company said the bug was introduced as part of an update back in July 2019.

This means that Let’s Encrypt might have issued certificates that it shouldn’t have in the first place, as a result of which it’s revoking all the TLS certificates that were affected by the bug.

The development comes as Let’s Encrypt project announced last week that it had issued its one-billionth free TLS certificate since its launch in 2015.

SSL error page

Let’s Encrypt said 2.6 percent of approximately 116 million active certificates are affected — about 3,048,289 — out of which about one million are duplicates of other affected certificates.

Affected website owners have until 8PM UTC (3PM EST) March 4 to manually renew and replace their certificates, failing which visitors to the websites will be greeted with TLS security warnings — as the certificates are revoked — until the renewal process is complete.

It’s worth noting that the certificates issued by Let’s Encrypt are valid for a period of 90 days, and ACME clients such as Certbot are capable of automatically renewing them.

But with Let’s Encrypt revoking all impacted certificates, website admins will have to perform a forced renewal to prevent any interruptions.

Besides using the tool https://checkhost.unboundtest.com/ to check if a certificate needs replacement, Let’s Encrypt has put together a downloadable list of affected serial numbers, allowing subscribers to check if their websites rely on an affected certificate.

 

Have something to say about this article? Comment below or share it with us on Facebook, Twitter or our LinkedIn Group.

The post Let’s Encrypt Revoking 3 Million TLS Certificates appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/lets-encrypt-revoking-3-million-tls-certificates/feed/ 0 Crypto-Mining Supply Chain Attack Hits UK Gov’t websites https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/ https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/#respond Mon, 12 Feb 2018 15:08:57 +0000 https://cvtfstudios.net/?p=3567 This entry was posted in General Security, WordPress Security on February 11, 2018 by Mark Maunder . In the past 24 hours, Security researcher Scott Helme discovered that a third party accessibility plugin called ‘Browsealoud’ had their servers compromised. The plugin relies on a website including Javascript in their content in order to work. [...]

The post Crypto-Mining Supply Chain Attack Hits UK Gov’t websites appeared first on CVTF Studios.net.

]]>

This entry was posted in General Security, WordPress Security on February 11, 2018 by Mark Maunder .

In the past 24 hours, Security researcher Scott Helme discovered that a third party accessibility plugin called ‘Browsealoud’ had their servers compromised. The plugin relies on a website including Javascript in their content in order to work. This compromise resulted in over 4,000 websites serving up cryptomining malware.

The malware uses site visitor CPUs to mine for Monero cryptocurrency. The sites that use Browsealoud included the UK Information Commissioner’s office, UK National Health Service websites, an Australian provincial government website and many more.

Texthelp is the company that makes the Browsealoud plugin. They are reporting that their product was infected for four hours, affecting sites that use the Browsealoud plugin before it was take offline. The product remains offline while they investigate.

Cryptomining Attacks On The Rise

In November we wrote about a WordPress plugin that was banned for including cryptomining code, specifically CoinHive code that mines Monero currency. In that case, if a website used the banned plugin, any visitor to the site would see their browser CPU resources exploited to mine Monero and the proceeds were aggregated using CoinHive and sent to the plugin owner. Back then I included a video showing how CPU fan speed increases as the workload increases from Monero mining.

In December of last year, we wrote about a massive Monero cryptomining attack campaign that targeted WordPress.

Scott reports that this campaign also used CoinHive code to mine Monero and send the proceeds back to the attacker.

Supply Chain Attacks Have Wide Impact

On January 2nd of this year, my colleague Dan Moen wrote about the emerging threat of supply chain attacks. He had mentioned to me that, in light of the rise in supply chain attacks we saw in 2017 targeting WordPress, it is quite likely that 2018 is going to see a large number of these kinds of attacks affecting site owners and we had better get the word out, which we did.

As Dan wrote in January, “In the software industry, a supply chain attack exploits a trusted relationship between software vendors or authors and their customers.”. In that post we were focused on discussing the risk of compromised plugins affecting thousands of WordPress sites.

This is another kind of supply chain attack that affects the “trusted relationship between software vendors or authors and their customers”. You trust a service distributing Javascript to maintain site security. If that service is compromised, it affects any website using that code – potentially thousands of websites. As is the case with WordPress plugins, Javascript supply chain attacks allow a malicious actor to compromise thousands of websites with a single hack.

In the case of Browsealoud, the incident could have been much worse. The attacker could have stolen credentials from government websites in multiple countries. Instead, they simply exploited the CPU resources of site visitors to mine Monero cryptocurrency.

How To Protect Your Site and Site Visitors From JS Supply Chain Attacks

There is an easy way to protect yourself against Javascript supply chain attacks using a security feature called Subresource Integrity, or SRI. If you are including javascript code from an external source using the <SCRIPT> tag, simply include an ‘integrity’ attribute which will cause browsers to not load the script if it is modified from the original version.

Normally you’ll include a script like this:

To secure your site against JS supply chain attacks, change it to:

Making this change is easy. You can visit this page to generate a hash and the inclusion code from a script URL.

The ‘integrity’ attribute contains a ‘hash’ that uniquely identifies the content of the script. If that content changes, the browser can recognize that it has changed and will refuse to load the script. This gives site owners back control over what they load from remote servers, by refusing to load code that has changed from the original version.

You should be aware that once you use SRI and include a hash for your scripts, if the vendor changes the script, it will not load. This has the benefit of protecting your site visitors if a hacker compromises the vendor site and injects malware into the javascript that you are loading. But it also has the side effect that if a vendor updates their code at that same URL, your script will no longer load.

Some legacy vendors may rely on the ability to update their code at a URL whenever they please and have your site simply load the new code without you taking action. If a vendor includes a version number in the script URL, as in the jQuery URL above, then you probably don’t have to worry about this. But if the URL is something like //example.com/source/code/lives/here.js and there is no version specified, then check with the vendor to find out whether they will be updating the script you are using. They may need to notify you when they perform updates to avoid service interruptions.

In general I would avoid any vendor that insists on the ability to remotely update code without you making a change to your website code. It’s a security risk, as this case illustrates.

Javascript Supply Chain Attacks Are Real-Time

The thing that differentiates a JS supply chain attack from other forms is that, once the attacker installs their malicious code, victims are instantly affected. No action is required by the site administrator or site visitors. Code is being loaded per visit from the compromised server and the moment a code change is made, it is active in victim browsers.

This is different from application supply chain attacks or WordPress plugin supply chain attacks. An application supply chain attack needs a compromised application to be distributed before it exploits users. Desktop or mobile users need to upgrade to the new version before they are effected. Even if an auto-update is pushed out by the attacker somehow, there will be some delay before it is effective.

A WordPress plugin supply chain attack needs site owners to update to the new compromised plugin version before it is active. Javascript supply chain attacks are instantly active and being loaded by site visitors as soon as the attacker saves the file to the distribution web server. That is why it is critically important to use SRI for all external scripts on your site.

Please spread the word about the risk of Javascript supply chain attacks and how to mitigate them using Subresource Integrity or SRI.

Did you enjoy this post? Share it!

The post Crypto-Mining Supply Chain Attack Hits UK Gov’t websites appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/feed/ 0 15000 compromised servers https://cvtfstudios.net/15000-compromised-servers-used-mine-various-cryptocurrencies/ https://cvtfstudios.net/15000-compromised-servers-used-mine-various-cryptocurrencies/#respond Thu, 04 Jan 2018 17:56:38 +0000 https://cvtfstudios.net/?p=3546 Swati Khandelwal Technical Writer, Security Blogger and IT Analyst. She is a Technology Enthusiast with a keen eye on the Cyberspace and other tech related developments. Link: https://thehackernews.com/2017/05/cryptocurrency-mining-botnet.html A new botnet consisting of more than 15,000 compromised servers has been used to mine various cryptocurrencies, earning [...]

The post 15000 compromised servers appeared first on CVTF Studios.net.

]]>
Swati - Hacking News
Technical Writer, Security Blogger and IT Analyst.
She is a Technology Enthusiast with a keen eye on the Cyberspace and other tech related developments.
Link: https://thehackernews.com/2017/05/cryptocurrency-mining-botnet.html

A new botnet consisting of more than 15,000 compromised servers has been used to mine various cryptocurrencies, earning its master around $25,000 per month.

Mining cryptocurrencies can be a costly investment, as it requires an enormous amount of computing power, but cybercriminals have found an easy money-making solution.

Dubbed BondNet, the botnet was first spotted in December 2016 by GuardiCore researchers, who traced back the botnet malware developer, using online handle Bond007.01, to China.

According to the GuardiCore researchers, Bond007.01 is currently using BondNet for mining cryptocurrencies
— primarily Monero, but also ByteCoin, RieCoin, and ZCash
— but they warn that the hacker could easily take full control of compromised servers for malicious purposes, like mounting Mirai-style DDoS attacks.

BondNet’s Botnet Infrastructure

One thing that’s worth noticing is that the botnet operator does not use all infected machines for mining cryptocurrencies. The operator has built its botnet infrastructure of compromised servers with various roles:

1. Some infected machines serve as scanning servers to check for vulnerable systems on the Internet by going through a list of IP addresses with open ports that have been compiled with the WinEggDrop TCP port scanner.

2. Some servers are used as file servers to host the mining software.

3. Other infected servers are turned into command-and-control (C&C) servers after they have been equipped with a fork of goup — a small open source HTTP server written in Golang.

“Building an attack infrastructure on top of victim machines helps conceal the attacker’s true identity and origin of the attack,” the GuardiCore researchers explained in their report published Thursday.

“It also provides high availability infrastructure, which is very helpful when relying on compromised servers, providing infinite backup options in case one of the servers fails or loses connectivity to the internet.”

BondNet has already infected more than 15,000 server machines at major institutions around the world, including high-profile global companies, universities, and city councils, while the majority of them runs Windows Server 2008 R2.

Additionally, the BondNet botnet adds around 500 new machines to its network each day, and an approximately the same number of servers are delisted.

Here’s How to Detect the Threat and How to Mitigate:


To prevent your machines from getting hacked, server admins are advised to secure their systems by regularly applying security patches for all software, updating the firmware, and employing stronger passwords.

Meanwhile, GuardiCore has also provided network and file indicators of compromise systems to help server administrators check whether their machines are among compromised ones.

The researchers have also released a detection & cleanup tool (registration is required to download it) to help admins find and remove BondNet bots from their servers, as well as instructions on how to clean the system manually, without using the script.

The post 15000 compromised servers appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/15000-compromised-servers-used-mine-various-cryptocurrencies/feed/ 0 Two critical vulnerabilities in Foxit Reader https://cvtfstudios.net/two-critical-vulnerabilities-in-foxit-reader/ https://cvtfstudios.net/two-critical-vulnerabilities-in-foxit-reader/#respond Tue, 03 Oct 2017 11:50:23 +0000 http://cvtfstudios.net/?p=3505 Using Foxit Reader? You might be vulnerable to network breaches Desktop Central | August 25, 2017 | 2 min read Cybersecurity and cyberattacks have become prominent topics lately. No matter how much you secure your network, vulnerabilities continue to emerge for different operating systems and applications. Most recently, security professionals have discovered two critical vulnerabilities [...]

The post Two critical vulnerabilities in Foxit Reader appeared first on CVTF Studios.net.

]]> Using Foxit Reader? You might be vulnerable to network breaches
Desktop Central | August 25, 2017 | 2 min read

Cybersecurity and cyberattacks have become prominent topics lately. No matter how much you secure your network, vulnerabilities continue to emerge for different operating systems and applications. Most recently, security professionals have discovered two critical vulnerabilities in a third-party PDF reading application called Foxit Reader. These vulnerabilities allow hackers to execute arbitrarily-defined code on a user‘s computer when Foxit Reader is used without Safe Reading Mode enabled.

Two critical zero–day vulnerabilities

On August 17th, researchers Steven Seeley and Ariele Caltabiano discovered two vulnerabilities in Foxit Reader:

1. CVE-2017-10951, which acts as a command injection bug that resides in the app.launchURL function and executes strings provided by hackers. This vulnerability is mainly due to improper validation.

2. CVE-2017-10952, which exists in the saveAs function and allows hackers to execute an arbitrarily–specified file on user computers. If the arbitrary file is modified, then hackers can modify anything on the end user’s computer. Steven Seeley has tested a proof of concept and published it on Zero Day Initiative.

How can you keep Foxit Reader safe?

1.Take precautions: Avoid downloading attachments from email addresses you don’t know. Opening a PDF from a nefarious sender could compromise your entire system.

2.Manually change settings: Whether you’re using Foxit Reader or Foxit Phantom PDF, go to the settings menu and enable Safe Reading Mode and uncheck Enable JavaScript Actions.

3.Employ automatic patch management: Doing all the ground work manually is tiresome and complicated, especially since the number of vulnerabilities per application continually increases. Regularly updating your network is one of the best ways to remain free from zero-day vulnerabilities. Stay vigilant by employing patch management software like Desktop Central, which manages and deploys patches automatically.

How can ManageEngine help?

ManageEngine offers two types of support for these Foxit Reader vulnerabilities:

1.Patch deployment

Desktop Central can patch Windows, Mac, Linux, and over 250 third-party applications, all from a central location. We have released an update specifically for Foxit products to automatically enable Safe Reading Mode in Foxit PDF applications.

2.Registry configuration

With Desktop Central, you can deploy specific registry configurations, including the Foxit-specific keys below, to managed computers.

Key for enabling Safe Reading Mode:
HKEY_CURRENT_USER\Software\Foxit Software\Foxit Reader 8.0\Preferences\TrustManager
bSafeMode=1 (Enable Safe Reading Mode)
bSafeMode=0 (Disable Safe Reading Mode)

Key for unchecking Enable JavaScript Actions:
HKEY_CURRENT_USER\Software\Foxit Software\Foxit Reader 8.0\Preferences\Others
bEnableJS=1 (Enable JavaScript Actions)
bEnableJS=0 (Disable JavaScript Actions)

Start using Desktop Central today to evade vulnerabilities and breaches happening across any third–party application.
Related posts :

The post Two critical vulnerabilities in Foxit Reader appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/two-critical-vulnerabilities-in-foxit-reader/feed/ 0 Update of WordPress to 4.8 https://cvtfstudios.net/update-wordpress-4-8/ https://cvtfstudios.net/update-wordpress-4-8/#respond Fri, 09 Jun 2017 16:05:56 +0000 http://cvtfstudios.net/?p=3471 WordPress 4.8 “Evans” Posted June 8, 2017 by Matt Mullenweg. Filed under Releases. An Update with You in Mind Gear up for a more intuitive WordPress! Version 4.8 of WordPress, named “Evans” in honor of jazz pianist and composer William John “Bill” Evans, is available for download or update in your WordPress dashboard. New features in 4.8 add [...]

The post Update of WordPress to 4.8 appeared first on CVTF Studios.net.

]]> WordPress 4.8 “Evans”
Posted June 8, 2017 by Matt Mullenweg. Filed under Releases.

An Update with You in Mind

Gear up for a more intuitive WordPress!

Version 4.8 of WordPress, named “Evans” in honor of jazz pianist and composer William John “Bill” Evans, is available for download or update in your WordPress dashboard. New features in 4.8 add more ways for you to express yourself and represent your brand.

Though some updates seem minor, they’ve been built by hundreds of contributors with you in mind. Get ready for new features you’ll welcome like an old friend: link improvements, three new media widgets covering images, audio, and video, an updated text widget that supports visual editing, and an upgraded news section in your dashboard which brings in nearby and upcoming WordPress events.

Exciting Widget Updates


Image Widget

Adding an image to a widget is now a simple task that is achievable for any WordPress user without needing to know code. Simply insert your image right within the widget settings. Try adding something like a headshot or a photo of your latest weekend adventure — and see it appear automatically.

Video Widget

A welcome video is a great way to humanize the branding of your website. You can now add any video from the Media Library to a sidebar on your site with the new Video widget. Use this to showcase a welcome video to introduce visitors to your site or promote your latest and greatest content.

Audio Widget

Are you a podcaster, musician, or avid blogger? Adding a widget with your audio file has never been easier. Upload your audio file to the Media Library, go to the widget settings, select your file, and you’re ready for listeners. This would be a easy way to add a more personal welcome message, too!

Rich Text Widget

This feature deserves a parade down the center of town! Rich-text editing capabilities are now native for Text widgets. Add a widget anywhere and format away. Create lists, add emphasis, and quickly and easily insert links. Have fun with your newfound formatting powers, and watch what you can accomplish in a short amount of time.

The post Update of WordPress to 4.8 appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/update-wordpress-4-8/feed/ 0 What is the best Linux Distributions for Hacking and Penetration Testing in 2016 https://cvtfstudios.net/best-linux-distributions-hacking-penetration-testing-2016/ https://cvtfstudios.net/best-linux-distributions-hacking-penetration-testing-2016/#respond Tue, 02 Aug 2016 21:09:04 +0000 http://cvtfstudios.net/?p=3441 Last updated August 1, 2016 By Munif Tanjim- https://itsfoss.com Looking for best Linux to learn hacking? Whether you want to pursue a career in Information Security or you are already working as a security professional or if you are just interested in this specific field of knowledge, a decent Linux distro that suits your purpose [...]

The post What is the best Linux Distributions for Hacking and Penetration Testing in 2016 appeared first on CVTF Studios.net.

]]> kali-wp-june-2014_1920x1200_F
Last updated By – https://itsfoss.com

Looking for best Linux to learn hacking?

Whether you want to pursue a career in Information Security or you are already working as a security professional or if you are just interested in this specific field of knowledge, a decent Linux distro that suits your purpose is a must.

There are countless Linux distros for various purposes. Some are designed for specific tasks in mind and others are for different interfaces.

We have seen weird Ubuntu distributions in an older article. But, today we are going to have a look at a list of some of the best Linux distro to learn hacking and Penetration Testing.

Before we see the best Linux distros for hackers, I would recommend you to check for online hacking courses at our ITSFOSS shop.

Best Linux hacking distros in 2016

I have basically listed out various Linux distributions focusing on security. These Linux distros provide various tools that are needed for assessing networking security and other similar tasks. List is in no particular order.

Kali Linux

Kali Linux is the most widely known Linux distro for ethical hacking and penetration testing. Kali Linux was developed by Offensive Security taking on the mantle of BackTrack.

The post What is the best Linux Distributions for Hacking and Penetration Testing in 2016 appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/best-linux-distributions-hacking-penetration-testing-2016/feed/ 0 Fortinet SSH Backdoor Found In Firewalls https://cvtfstudios.net/3399-2/ https://cvtfstudios.net/3399-2/#respond Thu, 21 Apr 2016 12:35:29 +0000 http://cvtfstudios.net/?p=3399     January 14, 2016 So the Fortinet SSH Backdoor, apparently it’s just a management authentication issue. Sorry, what’s that? It looks like a passphrase based admin level access login via SSH to me personally. Which is scary. They are adamantly shouting from rooftops that it was not planted by a 3rd party (NSA? Like [...]

The post Fortinet SSH Backdoor Found In Firewalls appeared first on CVTF Studios.net.

]]>  

Fortinet SSH Backdoor Found In Firewalls

 

January 14, 2016

So the Fortinet SSH Backdoor, apparently it’s just a management authentication issue. Sorry, what’s that? It looks like a passphrase based admin level access login via SSH to me personally.

Which is scary.

They are adamantly shouting from rooftops that it was not planted by a 3rd party (NSA? Like Juniper..) or any kind of malicious activity.

Enterprise security vendor Fortinet has attempted to explain why its FortiOS firewalls were shipped with hardcoded SSH logins.

It appears Fortinet’s engineers implemented their own method of authentication for logging-into FortiOS-powered devices, and the mechanism ultimately uses a secret passphrase. This code was reverse-engineered by persons unknown, and a Python script to exploit the hole emerged on the Full Disclosure mailing list this week.

Anyone who uses this script against vulnerable firewalls will gain administrator-level command-line access to the equipment. After some outcry on Twitter and beyond, Fortinet responded by saying it has already killed off the dodgy login system.

“This issue was resolved and a patch was made available in July 2014 as part of Fortinet’s commitment to ensuring the quality and integrity of our codebase,” a spokeswoman told El Reg.

“This was not a ‘backdoor’ vulnerability issue but rather a management authentication issue. The issue was identified by our product security team as part of their regular review and testing efforts. After careful analysis and investigation, we were able to verify this issue was not due to any malicious activity by any party, internal or external.”

In a security advisory dated today, Fortinet explained that the issue affects FortiOS versions 4.3.0 to 4.3.16 and 5.0.0 to 5.0.7. This covers FortiOS builds from between November 2012 and July 2014, and it’s certainly possible that some slack IT admins haven’t updated the software since then.

It was actually patched by Fortinet in July 2014, but with edge devices like Firewalls – they don’t often get updated as it usually causes network downtime. So I’d guess there are plenty of firewalls out there very vulnerable to this, which basically gives you full admin access.

You can find the ‘exploit’ script in Python here: SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7

It’s also possible that even if they did update in a timely fashion, their devices could have been breached before the fix was issued.

The login method is used by FortiManager, a tool for controlling any number of Fortinet devices from a central system.

If you are running older code and can’t upgrade, the firewall maker suggests a couple of workarounds. Managers can disable admin access via SSH and use the web interface instead, or the console browser applet for command-line access. If you really need SSH access, then version 5.x can restrict access to SSH to a minimal set of authorized IP addresses.

Whether you call it a backdoor or a “management authentication issue,” it’s still a pretty major issue for some sysadmins, and they are unlikely to be happy about the news.

One significant part of Fortinet’s statement was the assertion that this didn’t come from an external party. Ever since the Juniper backdooring security vendors have been at pains to avoid any suggestion that they are allowing intelligence agencies access to their products.

In the meantime, if you are using FortiOS then make sure the fimrware is up to date. The news of this hole will have the malicious hacking community aflutter and many are no doubt already scanning for vulnerable targets.

There are some work arounds, what I’d personally like to see though is more transparency about the process and decisions made that led to this code being on production firewalls. How does this even happen?

And how did they only find it during scheduled review and testing? What kind of testing/QA/CI process do they have?

It all sounds rather fishy to me.

Source: The Register

The post Fortinet SSH Backdoor Found In Firewalls appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/3399-2/feed/ 0 How to Use SSH Pipes on Linux https://cvtfstudios.net/use-ssh-pipes-linux/ https://cvtfstudios.net/use-ssh-pipes-linux/#respond Sun, 20 Mar 2016 13:35:02 +0000 http://cvtfstudios.net/?p=3319 Like most commands on Linux, SSH can be used with input/output redirection via |Unix Pipe. SSH can be used with this pipeline too. The basic concept here is understanding how the Unix pipeline works. When you understand the way pipes work, you can get seriously creative. This article covers what happens when you combine Unix [...]

The post How to Use SSH Pipes on Linux appeared first on CVTF Studios.net.

]]>

Like most commands on Linux, SSH can be used with input/output redirection via |Unix Pipe. SSH can be used with this pipeline too. The basic concept here is understanding how the Unix pipeline works.
When you understand the way pipes work, you can get seriously creative. This article covers what happens when you combine Unix pipes and SSH. It should be noted that since Unix pipes can be just about anything, there are no doubt going to be commands not on this list would also be useful.

Understanding the Unix Pipeline

Pipes on Unix (and by extension, Linux) are used to chain programs together and make them work together. For example, using cat, you can show the contents of a file, but if you used a pipe, you could chain the cat command to the more command to make the file easier to read through.

cat file1 | more

 

The basic idea here is this: program1 fileX | program2. It’s not just limited to one file and two programs, though. Piping can get about as advanced as you need it to be with as many modifiers as you can think of.

Note: Some types of pipes can be done without using the |. Some may use > instead.

The post How to Use SSH Pipes on Linux appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/use-ssh-pipes-linux/feed/ 0 Apple Engineers Might Quit If Ordered To Unlock iPhone For FBI https://cvtfstudios.net/apple-engineers-might-quit-if-ordered-to-unlock-iphone-for-fbi/ https://cvtfstudios.net/apple-engineers-might-quit-if-ordered-to-unlock-iphone-for-fbi/#respond Fri, 18 Mar 2016 15:49:19 +0000 http://cvtfstudios.net/?p=3270                 Even if law enforcement wins the case, it could still lose. Michael Grothaus 03.18.16 7:15 AM https://www.fastcompany.com/3058040/fast-feed/apple-engineers-might-quit-if-ordered-to-unlock-iphone-for-fbi There's a new challenge to law enforcement's effort to get Apple to unlock one of the San Bernardino shooter’s phones. The government faces off against Apple in court on Tuesday [...]

The post Apple Engineers Might Quit If Ordered To Unlock iPhone For FBI appeared first on CVTF Studios.net.

]]>

 

 

 

 

 

 

 

 

Even if law enforcement wins the case, it could still lose.

Michael Grothaus 03.18.16 7:15 AM
https://www.fastcompany.com/3058040/fast-feed/apple-engineers-might-quit-if-ordered-to-unlock-iphone-for-fbi

There’s a new challenge to law enforcement’s effort to get Apple to unlock one of the San Bernardino shooter’s phones. The government faces off against Apple in court on Tuesday to argue that the company must comply with a previous court order to bypass the security features built into iOS and also build a version of iOS with a back door accessible to the government. Apple has been strongly opposed to the order and now several key Apple engineers are saying they could simply quit the company instead of being forced to work to weaken the security of software and devices they helped build, reports the New York Times.

“Apple employees are already discussing what they will do if ordered to help law enforcement authorities,” reports the Times. “Some say they may balk at the work, while others may even quit their high-paying jobs rather than undermine the security of the software they have already created, according to more than a half-dozen current and former Apple employees.”

By choosing to quit instead of work on building what Apple is referring to as “GovtOS,” several legal experts told the Times, Apple and the engineers that choose to leave the company could likely avoid accusations of being in contempt of court. Indeed, Apple has already argued in its legal filings in the case that any conscription would curb an employee’s freedom of speech by forcing them to do things they consider offensive.

While quitting a job isn’t ideal for any employee, it’s not like these engineers would have trouble finding work elsewhere. “The fear of losing a paycheck may not have much of an impact on security engineers whose skills are in high demand,” notes the Times. “Indeed, hiring them could be a badge of honor among other tech companies that share Apple’s skepticism of the government’s intentions.”

Apple has said that if it is ordered to build “GovtOS” it would likely take six to 10 Apple engineers a month to do so. Sources told the Times that the team would need to be made up of very specific engineers in Apple across its hardware, software, and services division. And while Apple currently doesn’t have a GovtOS team assembled, the specific members of the team are obvious.

“They include an engineer who developed software for the iPhone, iPad and Apple TV. That engineer previously worked at an aerospace company. Another is a senior quality-assurance engineer who is described as an expert ‘bug catcher’ with experience testing Apple products all the way back to the iPod. A third likely employee specializes in security architecture for the operating systems powering the iPhone, Mac and Apple TV,” the Times reports.

Of course, these Apple employees could simply refuse to comply with the order instead of quitting, but in doing so, say legal sources, those employees and Apple could then be found in contempt of court.

But if every engineer Apple needed for GovtOS quit “Apple could demonstrate that this happened to the court’s satisfaction, then Apple could not comply and would not have to,” Joseph DeMarco, a former federal prosecutor, told the Times. “It would be like asking my lawn guy to write the code.”

This is, of course, all theoretical, for now. No one knows what the outcome of Apple’s legal battle with the FBI will be or how long and drawn out the fight will be. But if worse comes to worst, the FBI may still not get what it wants.

“It’s an independent culture and a rebellious one,” Jean-Louis Gassée, a former engineering manager at Apple, told the Times. “If the government tries to compel testimony or action from these engineers, good luck with that.”

The post Apple Engineers Might Quit If Ordered To Unlock iPhone For FBI appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/apple-engineers-might-quit-if-ordered-to-unlock-iphone-for-fbi/feed/ 0 FaceBooks Messenger’s app lets people send their location to friends and it defaults to sending a location with all messages https://cvtfstudios.net/facebooks-messengers-app-lets-people-send-their-location-to-friends-and-it-defaults-to-sending-a-location-with-all-messages/ Wed, 19 Aug 2015 10:10:53 +0000 http://www.cvtfradio.net/?p=2941 'Marauders Map' lets you track friends using FB Messenger: Tool plots a precise location each time someone uses the site Harvard student has created a digital 'Marauder's Map' that uses location data from Facebook Messenger to pinpoint an individual's movements Relies on people sharing their location by default in [...]

The post FaceBooks Messenger’s app lets people send their location to friends and it defaults to sending a location with all messages appeared first on CVTF Studios.net.

]]>

‘Marauders Map’ lets you track friends using FB Messenger: Tool plots a precise location each time someone uses the site

  • Harvard student has created a digital ‘Marauder’s Map’ that uses location data from Facebook Messenger to pinpoint an individual’s movements
  • Relies on people sharing their location by default in messages
  • Map was designed to highlight how much data is leaked from Facebook 

By Sarah Griffiths for MailOnline

Published: 14:02, 28 May 2015 | Updated: 16:26, 28 May 2015

Harry Potter may have had a magical paper ‘Marauder’s Map’ but now there’s a digital equivalent that can pinpoint your friends’ locations using information from Facebook.

The extension loads when the Messages tab is opened and ‘scrapes’ the page for location data to show the movement of friends with a startling degree of accuracy.

While some people may see the map as a useful tool, it serves to highlight how much data Facebook’s messaging service shares – and could leave individuals open to stalking, for example.

Earlier this year, a developer created a browser extension dubbed 'Marauder's Map'. The extension loaded when a person opened their Messages tab and 'scraped' the page for location data to show the movement of friends with a startling degree of accuracy

The post FaceBooks Messenger’s app lets people send their location to friends and it defaults to sending a location with all messages appeared first on CVTF Studios.net.

]]>