ICT Security-Sécurité PC et Internet

Google has released details of a high-severity flaw affecting the Bluetooth stack in the Linux kernel versions below Linux 5.9 that support BlueZ.

Linux 5.9 was just released two days ago and Intel is recommending in its advisory for the high-severity Bluetooth flaw, CVE-2020-12351, to update the Linux kernel to version 5.9 or later. 

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Bluetooth

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=Linux

While Linux malware was once sitting on the fringes of the malware ecosystem, today, new Linux threats are being discovered on a weekly basis.

The latest finding comes from Intezer Labs. In a report shared with ZDNet this week, the company analyzed Doki, a new backdoor trojan they spotted part of the arsenal of an old threat actor known for targeting web servers for crypto-mining purposes.

The threat actor, known as Ngrok because of its initial penchant for using the Ngrok service for hosting control and command (C&C) servers, has been active since at least late 2018.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Sudo is a very popular, very simple Unix-system sysadmin application. It enables users to switch identities for the purpose of running a single command. Usually, but not always, it lets you run a command as the root, system administrator, user. Sudo's easy to abuse, but it's so darn useful, until it's not. A recently discovered sudo bug once more spells out why you should be wary of this command. 

In this latest security hole, CVE-2019-18634, Apple Information Security researcher Joe Vennix discovered that if the "pwfeedback" option is enabled in your sudoers configuration file, any user, even one who can't run sudo or is listed in the sudoers file, can crack a system.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Lazarus, an advanced persistent threat (APT) group, has expanded its reach with the development and use of a Trojan designed to attack Linux systems. 

The APT, suspected to hail from North Korea, has previously been connected to global cyberattacks and malware outbreaks including the infamous WannaCry rampage, the $80 million Bangladeshi bank heist, and a new campaign impacting financial institutions worldwide. 

Recent reports suggest that Lazarus has become a customer of Trickbot, a criminal enterprise that is offering the state-sponsored threat actors access to infected systems alongside a collection of hacking tools. 

Lazarus may be willing to purchase tools from others but may also be capable of creating its own, such as in the case of a new Remote Access Trojan (RAT) spotted by researchers from Netlab 360. 

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Thousands of web servers have been infected and had their files encrypted by a new strain of ransomware named Lilocked (or Lilu).

Infections have been happening since mid-July, and have intensified in the past two weeks, ZDNet has learned.

Based on current evidence, the Lilocked ransomware appears to target Linux-based systems only.

First reports date to mid-July, after some victims uploaded the Lilocked ransom note/demand on ID Ransomware, a website for identifying the name of the ransomware that infected a victim's system.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=RANSOMWARE

The IT security researchers at Check Point have identified a new malware called SpeakUp targeting Linux and macOS – The new findings prove that there has been a surge in malware attacks against Linux and Apple devices.

SpeakUp is a new backdoor Trojan that is being distributed by cybercriminals through a malicious new campaign designed to target servers running six different Linux versions and macOS systems. The malware manages to target multiple previously identified security flaws and can evade antivirus programs effectively.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security/

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

https://www.scoop.it/t/securite-pc-et-internet/?&tag=crypto+malware

Another day, another Linux community with malware woes.

Last time it was Gentoo, a hard-core, source-based Linux distribution that is popular with techies who like to spend hours tweaking their entire operating sytem and rebuilding all their software from scratch to wring a few percentage points of performance out of it.

That sort of thing isn’t for everyone, but it’s harmless fun and it does give you loads of insight into how everything fits together.

That sets it apart from distros such as ElementaryOS and Mint, which rival and even exceed Windows and macOS for ease of installation and use, but don’t leave you with much of a sense of how it all actually works.

This time, the malware poisoning happened to Arch Linux, another distro we’d characterise as hard-core, though very much more widely used than Gentoo.

Three downloadable software packages in the AUR, short for Arch User Respository, were found to have been rebuilt so they contained what you might (perhaps slightly unkindly) refer to as zombie downloader robot overlord malware.

Bots or zombies are malware programs that call home to fetch instructions from the crooks on what to do next.

Hacker erlangen Zugriff auf Gentoo-Code in Github
Der Quellcode der Linux-Distribution Gentoo könnte kompromittiert sein: Das Entwicklerteam berichtet von einem Hack der gesamten Github-Organisation, in der Repositories abgelegt sind. Davon unberührt sein sollen die Backup-Dateien, die das Team auf eigener Infrastruktur hostet.

Learn more / En savoir plus / Mehr erfahren:

 https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Eine Sicherheitslücke im Tor-Browser ist geschlossen worden. (Bild: David Bates/Golem.de)

LINUX UND MAC:

Tor-Browser-Exploit verrät IP-Adresse einiger Nutzer
Unter bestimmten Voraussetzungen verrät der Tor-Browser die unverschleierte IP-Adresse der Nutzer. Betroffen sind nur Mac und Linux-Versionen des Firefox-Bundles, in der täglichen Nutzung dürfte der Fehler nur wenige Personen betreffen.

Das Tor-Projekt hat ein Notfallupdate für die Linux- und Mac-Versionen des Tor-Browser-Bundles veröffentlicht. Unter bestimmten Umständen verraten die beiden betroffenen Versionen die reale IP-Adresse der Nutzer und machen somit die angestrebte Anonymität kaputt. Die Windows-Version des Tor-Browsers, die Tails-Distribution und der im Alpha-Test befindliche Tor-Browser mit Sandboxing sollen nicht betroffen sein.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=TOR

Une note de sécurité du Kaspersky Lab, sur sa plateforme SecureList, met en garde contre un malware multiplateforme qui se répand via Facebook Messenger.

Pratiquement, le malware vous envoie un message sur Messenger, sous l'identité d'un ami...

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Facebook

A new sample of TrickBot has been discovered which checks the screen resolution of victim's machines in order to see if the malware is running inside a virtual machine.

In order to protect themselves and their systems when analyzing malware, security researchers often do so in a virtual machine. As a result of this, malware often employs anti-VM techniques to detect whether or not it is running in a virtual machine.

The anti-VM techniques used by malware include looking for particular processes, windows services, machine names and checking network card MAC addresses or CPU features.

Mittels automatisierter Tests, so genanntem Fuzzing, haben Sicherheitsforscher insgesamt 26 Programmierfehler in USB-Treibern entdeckt. 18 davon betreffen verschiedene Linux-Kernelversionen; wiederum zehn dieser Linux-Bugs erhielten aufgrund von ihnen ausgehender hoher Sicherheitsrisiken CVE-Nummern. Vier weitere Bugs betreffen Windows 8 und 10, drei stecken in macOS 10.15 Catalina und einer im freien BSD-Derivat FreeBSD 12.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=USB

A team of cybersecurity researchers has disclosed a new severe vulnerability affecting most Linux and Unix-like operating systems, including FreeBSD, OpenBSD, macOS, iOS, and Android, that could allow remote 'network adjacent attackers' to spy on and tamper with encrypted VPN connections.

The vulnerability, tracked as CVE-2019-14899, resides in the networking stack of various operating systems and can be exploited against both IPv4 and IPv6 TCP streams.
Since the vulnerability does not rely on the VPN technology used, the attack works against widely implemented virtual private network protocols like OpenVPN, WireGuard, IKEv2/IPSec, and more, the researchers confirmed.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=VPN

Im WLAN-Treiber für den Einsatz von Realtek-Chips unter Linux findet sich ein Programmierfehler, der eine kritische Sicherheitslücke in Form eines Pufferüberlaufs im Kernel öffnet. Damit lässt sich in aller Regel Code einschleusen und ausführen. Der Sicherheitsforscher Nicolas Waisman hat den Fehler entdeckt und reichlich unkonventionell "mal eben einfach" auf Twitter veröffentlicht.

Betroffen von dem Fehler CVE-2019-17666 sind Systeme auf Linux-Basis, die Realtek-Chips einsetzen. Dazu gehören unter Umständen auch Android-Handys; jedenfalls findet sich der problematische Code auch in Googles Android-Sourcen. Auch WiFi-Router etwa auf Basis von OpenWRT könnten Opfer des Treiber-Bugs werden. Für einen Angriff muss lediglich WLAN eingeschaltet sein.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

A security researcher has published proof-of-concept (PoC) code for a vulnerability in the KDE software framework. A fix is not available at the time of writing.

The bug was discovered by Dominik "zer0pwn" Penner and impacts the KDE Frameworks package 5.60.0 and below.

The KDE Frameworks software library is at the base of the KDE desktop environment v4 and v5 (Plasma), currently included with several Linux distributions such as Kubuntu, openSUSE, OpenMandriva, Chakra, KaOS, and others.

HOW THE VULNERABILITY WORKS
The vulnerability occurs because of the way the KDesktopFile class (part of KDE Frameworks) handles .desktop or .directory files.

Penner discovered that he could create malicious .desktop and .directory files that could be used to run malicious code on a user's computer.

When a user opens the KDE file viewer to access the directory where these files are stored, the malicious code contained within the .desktop or .directory files executes without user interaction -- such as running the file.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

HiddenWasp is unique for Linux-based malware in that it targets systems to remotely control them.

A new strain of malware targeting Linux systems has been identified by researchers. The malware, dubbed HiddenWasp, is believed to be used as part of a second-stage attack against already-compromised systems and is composed of a rootkit, trojan and deployment script.

“The ratio of Linux treats has increased significantly over the years” said Nacho Sanmillan, a security researcher at Intezer Labs who analyzed the malware. “However, the majority of [Linux] malware is either tied to IoT, DDoS bots or cryptominers.”

Sanmillan said what’s unique about HiddenWasp is some of the evasion techniques implemented in the malware and that it contains rootkit used to hide the main trojan implant. “Rootkits are not artifacts commonly seen deploy along simple Linux malware.”

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Malware targeting Linux users may not be as widespread as the strains targeting the Windows ecosystem, but Linux malware is becoming just as complex and multi-functional as time passes by.

The latest example of this trend is a new trojan discovered this month by Russian antivirus maker Dr.Web. This new malware strain doesn't have a distinctive name, yet, being only tracked under its generic detection name of Linux.BtcMine.174.

The trojan itself is a giant shell script of over 1,000 lines of code. This script is the first file executed on an infected Linux system. The first thing this script does is to find a folder on disk to which it has write permissions so it can copy itself and later use to download other modules.

Once the trojan has a foothold on the system it uses one of two privilege escalation exploits CVE-2016-5195 (also known as Dirty COW) and CVE-2013-2094 to get root permissions and have full access to the OS.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Neue Versionen der 7er-, 8er- und 9er-Reihe des Anwendungsservers Apache Tomcat bringen unter anderem zwei dringliche Security-Fixes mit.

Die Apache Software Foundation hat Updates für mehrere Versionen des Open-Source-Webservers und Webcontainers Apache Tomcat veröffentlicht. Laut einem Sicherheitshinweis des US-CERT schließen sie unter anderem zwei Lücken, deren Schweregrad die Apache-Entwickler als "Important" einstufen.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Tomcat

Data breaches are always bad news, and this one is peculiarly bad.

Gentoo, a popular distribution of Linux, has had its GitHub repository hacked.

Hacked, as in “totally pwned”, taken over, and modified; so far, no one seems to be sure quite how or why.

That’s the bad news.

Fortunately (we like to find silver linings here at Naked Security):

The Gentoo team didn’t beat around the bush, and quickly published an unequivocal statement about the breach.

The Gentoo GitHub repository is only a secondary copy of the main Gentoo source code.

The main Gentoo repository is intact.

All changes in the main Gentoo repository are digitally signed and can therefore be verified.

As far as we know, the main Gentoo signing key is safe, so the digital signatures are reliable.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Canoncinal vient d’annoncer la disponibilité de correctifs pour 26 vulnérabilités recensées dans le noyau d’Ubuntu 14.04 (Trusty Tahr). Cette version qui est sortie depuis avril 2014 bénéficie d’un support Long Term Support abrégé LTS (pour support à long terme en français) ce qui fait qu’elle est prise en charge par l’équipe de développement pendant cinq ans (pour les versions bureau et serveur), soit jusqu’en avril 2019.

Dans cette récente annonce, l’entreprise rapporte parmi les failles corrigées qu’une vulnérabilité d’écriture hors limites existait dans le système de fichiers Flash-Friendly (f2fs) du noyau Linux. Cette faille qui a été consignée sous la référence CVE-2017-0750 pourrait être exploitée par un attaquant pour construire un système de fichiers malveillant qui, lorsqu’il est monté, peut provoquer un déni de service (panne du système) ou éventuellement exécuter du code arbitraire.

À côté de cette faille, une situation de concurrence débouchant sur une faille use-after-free a été découverte dans la fonction snd_pcm_info du sous-système ALSA PCM sur le noyau Linux. Cette situation de compétition rapportée par l’équipe de sécurité d’Ubuntu pourrait être utilisée par une personne malveillante pour obtenir des privilèges non autorisés à travers des vecteurs non spécifiés et provoquer une panne du système ou éventuellement exécuter du code arbitraire. Cette faille portant le code CVE-2017-0861 a été classée à un niveau élevé de sévérité selon la version 3 de CVSS Severity.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

Sometimes old fixed bugs come back to bite us. That's the case with CVE-2017-1000253, a Local Privilege Escalation Linux kernel bug.

This is a problem with how the Linux kernel loaded Executable and Linkable Format (ELF) executables. If an ELF application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack. This could cause memory corruption. Then, an otherwise unprivileged local user with access to a Set owner User ID (SUID) or otherwise privileged flawed PIE binary, could gain higher-level user privileges.


Qualys, a security company, worked out a way to exploit this hole. By smashing the PIE's .dynamic section with a stack-based string operation, they found they could force the ld.so dynamic linker to load and execute their own shared library.

This security hole may sound complicated, but it's relatively easy to exploit. Since it could give an ordinary user super-user privileges it's potentially very dangerous.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux