Rookie coding mistake prior to Gab hack came from site’s CTO

Over the weekend, word emerged that a hacker breached far-right social media website Gab and downloaded 70 gigabytes of data by exploiting a garden-variety security flaw known as an SQL injection. A quick review of Gab’s open source code shows that the critical vulnerability—or at least one very much like it—was introduced by the company’s chief technology officer.

The change, which in the parlance of software development is known as a “git commit,” was made sometime in February from the account of Fosco Marotto, a former Facebook software engineer who in November became Gab’s CTO. On Monday, Gab removed the git commit from its website. Below is an image showing the February software change, as shown from a site that provides saved commit snapshots.

The commit shows a software developer using the name Fosco Marotto introducing precisely the type of rookie mistake that could lead to the kind of breach reported this weekend. Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement a programming idiom that protects against SQL injection attacks.

Developers: Sanitize user input

This idiom allows programmers to compose an SQL query in a safe way that “sanitizes” the inputs that website visitors enter into search boxes and other web fields to ensure that any malicious commands are stripped out before the text is passed to backend servers. In their place, the developer added a call to the Rails function that contains the “find_by_sql” method, which accepts unsanitized inputs directly in a query string. Rails is a widely used website development toolkit.

“Sadly Rails documentation doesn’t warn you about this pitfall, but if you know anything at all about using SQL databases in web applications, you’d have heard of SQL injection, and it’s not hard to come across warnings that find_by_sql method is not safe,” Dmitry Borodaenko, a former production engineer at Facebook who brought the commit to my attention wrote in an email. “It is not 100% confirmed that this is the vulnerability that was used in the Gab data breach, but it definitely could have been, and this code change is reverted in the most recent commit that was present in their GitLab repository before they took it offline.”

Ironically, Fosco in 2012 warned fellow programmers to use parameterized queries to prevent SQL injection vulnerabilities. Marotto didn’t respond to an email seeking comment for this post. Attempts to contact Gab directly didn’t succeed.

Revisionist history

Besides the commit raising questions about Gab’s process for developing secure code, the social media site is also facing criticism for removing the commits from its website. Critics say the move violates terms of the Affero General Public License, which governs Gab’s reuse of Mastodon, an open source software package for hosting social networking platforms.

Critics say the removal violates terms that require forked source code be directly linked from the site. The requirements are intended to provide transparency and to allow other open source developers to benefit from the work of their peers at Gab.

Gab had long provided commits at https://code.gab.com/. Then, on Monday, the site suddenly removed all commits—including the ones that created and then fixed the critical SQL injection vulnerability. In their place, Gab provided source code in the form of a Zip archive file that was protected by the password “JesusChristIsKingTrumpWonTheElection” (minus the quotation marks).

Representatives from the Mastodon project didn’t immediately respond to an email asking if they shared the critics’ concerns.

Besides questions about secure coding and license compliance, the Gab git commits also appear to show company developers struggling to fix their vulnerable code. The image below shows someone using the username “developer” trying unsuccessfully to fully fix the code containing the SQL injection vulnerability.

Thread participants respond by sarcastically pointing out the difficulty the developer seemed to be having.

Gab’s security breach and behind-the-scenes handling of code before and after the incident provide a case study for developers on how not to maintain the security and code transparency of a website. The lesson is all the more weighty given that the submission used the account of Gab’s CTO, who among all people should have known better.

https://arstechnica.com/?p=1746422

Google Patches Critical Remote Code Execution Vulnerability in Android

Google this week announced the release of patches for 37 vulnerabilities as part of the Android security updates for March 2021, including a fix for a critical flaw in the System component.

Tracked as CVE-2021-0397 and affecting Android 8.1, 9, 10, and 11 releases, the security issue could allow an attacker to execute code remotely on a vulnerable device.

“The most severe of these issues is a critical security vulnerability in the System component that could enable a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process,” Google explains.

The bug was addressed as part of the 2021-03-01 security patch level, which also brings patches for nine other issues, including six more in the System component, one affecting Android runtime, and two impacting Framework.

All of these flaws were rated high severity, with their exploitation leading to remote code execution (three bugs), elevation of privilege (five issues), and information disclosure (one vulnerability).

A total of 27 other security holes were addressed as part of the 2021-03-05 security patch level, including one in Kernel components, four in Qualcomm components, and 22 in Qualcomm closed-source components.

The issues were rated high severity, except for five bugs in the Qualcomm closed-source components, which feature a severity rating of critical.

Google’s March 2021 Android Security Bulletin also makes reference to a vulnerability included in Project Mainline components, namely CVE-2021-0390, which affects Wi-Fi.

This week, Google also announced the release of security patches for 43 vulnerabilities affecting Pixel devices. The bugs impact Framework (6), Media framework (5), System (11), Kernel components (19), Qualcomm components (1), and Qualcomm closed-source components (1).

The issues could lead to elevation of privilege, information disclosure, and denial of service. Eight of the bugs were rated high severity, with the remaining 35 considered moderate risk.

Pixel devices running a security patch level of 2021-03-05 or later have fixes for all bugs included in the March 2021 Android Security Bulletin and Pixel Update Bulletin.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/8eGhe7jHUx8/google-patches-critical-remote-code-execution-vulnerability-android

New ‘Unc0ver’ Jailbreak Uses Vulnerability That Apple Said Was Exploited

Unc0ver jailbreak exploits CVE-2021-1782

The latest version of the Unc0ver jailbreak leverages a vulnerability that Apple said had been exploited before it released a patch in January.

Jailbreaks remove restrictions and give users greater control over their iPhone or iPad. The developers of the jailbreak named Unc0ver recently announced the availability of version 6.0.0, which they claim works on all versions of iOS between 11.0 and 14.3 on many iPhones and iPads, including the iPhone 12 Pro launched a few months ago.

Unc0ver developers say the jailbreak is “designed to be stable” and it preserves the security layers implemented by Apple.

Unc0ver does not work on devices running iOS 14.4. That version of the operating system, released by Apple in late January, patches CVE-2021-1782, a kernel vulnerability that can be exploited for privilege escalation.

CVE-2021-1782 is one of the three vulnerabilities that Apple said “may have been actively exploited” at the time when it released the patches. All three flaws had been reported to Apple by an anonymous researcher. The tech giant has not made public any information regarding the attacks exploiting these vulnerabilities.

The developers of the Unc0ver jailbreak said on Twitter that they wrote their “own exploit based on CVE-2021-1782 for unc0ver to achieve optimal exploit speed and stability.”

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/B60_7wfX6Rk/new-unc0ver-jailbreak-uses-vulnerability-apple-said-was-exploited

Suspected Chinese APT Group Targets Power Plants in India

Security researchers at Recorded Future have spotted a suspected Chinese APT actor targeting a wide range of critical infrastructure targets in India, including power plants, electricity distribution centers and Indian seaports.

Recorded Future, a threat-intelligence firm based in Somerville, Mass., said the wave of targeted attacks appear to coincide with the ongoing territorial conflict between India and China.

The company’s analysts applied the “RedEcho” moniker to this threat actor and warned that the group has strong infrastructure and victim overlaps with the notorious APT41/Barium actor.

Despite these overlaps with known APT actors, Recorded Future said it will contrinue to track the group as a distinct actor because there isn’t enough evidence to firmly attribute the activity to a singular group.

[ Learn more about threats to industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series ]

From about the middle of 2020 onwards, Recorded Future said it captured telemetry showing a steep rise in the use of known APT command-and-control servers “to target a large swathe of India’s power sector.”

A detailed technical report from Recorded Future said 10 distinct Indian power sector organizations were targeted, including 4 of the 5 Regional Load Despatch Centres (RLDC) responsible for operation of the power grid. Other targets identified included two unidentified Indian seaports.

The company’s threat hunters identified 21 IP addresses among the list of targets in India, noting that they all qualify as critical infrastructure in India.

List of suspected victims of RedEcho campaign targeting Indian critical infrsastructure

The researchers also noticed the targeting of a high-voltage transmission substation and a coal-fired thermal power plant.

“The targeting of these critical power assets offer limited economic espionage opportunities, but pose significant concerns over potential pre-positioning of network access to support other Chinese strategic objectives,” the company added.

Recorded Future has released IOCs and mitigation guidance to help organizations look for signs of malicious activity on corporate networks.

Previous Columns by SecurityWeek News:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/uWSoU2G1Yls/suspected-chinese-apt-group-targets-power-plants-india

Hard-coded key vulnerability in Logix PLCs has severity score of 10 out of 10

Hardware that is widely used to control equipment in factories and other industrial settings can be remotely commandeered by exploiting a newly disclosed vulnerability that has a severity score of 10 out of 10.

The vulnerability is found in programmable logic controllers from Rockwell Automation that are marketed under the Logix brand. These devices, which range from the size of a small toaster to a large bread box or even bigger, help control equipment and processes on assembly lines and in other manufacturing environments. Engineers program the PLCs using Rockwell software called Studio 5000 Logix Designer.

On Thursday, the US Cybersecurity & Infrastructure Security Administration warned of a critical vulnerability that could allow hackers to remotely connect to Logix controllers and from there alter their configuration or application code. The vulnerability requires a low skill level to be exploited, CISA said.

The vulnerability, which is tracked as CVE-2021-22681, is the result of the Studio 5000 Logix Designer software making it possible for hackers to extract a secret encryption key. This key is hard-coded into both Logix controllers and engineering stations and verifies communication between the two devices. A hacker who obtained the key could then mimic an engineering workstation and manipulate PLC code or configurations that directly impact a manufacturing process.

“Any affected Rockwell Logix controller that is exposed on the Internet is potentially vulnerable and exploitable,” said Sharon Brizinov, principal vulnerability researcher at Claroty, one of three organizations Rockwell credited with independently discovering the flaw. “To successfully exploit this vulnerability, an attacker must first obtain the secret key and have the knowledge of the cryptographic algorithm being used in the authentication process.”

Brizinov said that Claroty notified Rockwell of the vulnerability in 2019. Rockwell didn’t disclose it until Thursday. Rockwell also credited Kaspersky Lab and Soonchunhyang University researchers Eunseon Jeong, Youngho An, Junyoung Park, Insu Oh, and Kangbin Yim.

The vulnerability affects just about every Logix PLC Rockwell sells, including:

CompactLogix 1768
CompactLogix 1769
CompactLogix 5370
CompactLogix 5380
CompactLogix 5480
ControlLogix 5550
ControlLogix 5560
ControlLogix 5570
ControlLogix 5580
DriveLogix 5560
DriveLogix 5730
DriveLogix 1794-L34
Compact GuardLogix 5370
Compact GuardLogix 5380
GuardLogix 5570
GuardLogix 5580
SoftLogix 5800

Rockwell isn’t issuing a patch that directly addresses the problems stemming from the hard-coded key. Instead, the company is recommending that PLC users follow specific risk mitigation steps. The steps involve putting the controller mode switch into run, and if that’s not possible, following other recommendations that are specific to each PLC model.

Those steps are laid out in an advisory Rockwell is making available to customers, as well as in the above-linked CISA advisory. Rockwell and CISA also recommend PLC users follow standard security-in-depth security advice. Chief among the recommendations is ensuring that control system devices aren’t accessible from the Internet.

Security professionals universally admonish engineers to place critical industrial systems behind a firewall so they aren’t exposed to the Internet. Unfortunately, engineers struggling with high workloads and limited budgets often don’t heed the advice. The latest reminder of this came earlier this month when a municipal water treatment plant in Florida said that an intruder accessed a remote system and tried to lace drinking water with lye. Plant employees used the same TeamViewer password and didn’t put the system behind a firewall.

If Logix PLC users are segmenting industrial control networks and following other best practices, it’s likely that the risk posed by CVE-2021-22681 is minimal. And if people haven’t implemented these practices, hackers probably have easier ways to hijack the devices. That said, this vulnerability is serious enough that all Logix PLC users should pay attention to the CISA and Rockwell advisories.

Claroty has issued its own writeup here.

https://arstechnica.com/?p=1745776

Unprotected Private Key Allows Remote Hacking of Rockwell Controllers

Industrial organizations have been warned this week that a critical authentication bypass vulnerability can allow hackers to remotely compromise programmable logic controllers (PLCs) made by industrial automation giant Rockwell Automation.

The vulnerability, tracked as CVE-2021-22681 with a CVSS score of 10, was independently reported to Rockwell by researchers at the Soonchunhyang University in South Korea, Kaspersky, and industrial cybersecurity firm Claroty.

Advisories for this flaw were published this week by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Rockwell (account required). Claroty has also released a blog post with a high-level description of its findings.

The vulnerability impacts Studio 5000 Logix Designer (formerly RSLogix 5000), the popular design and configuration software for PLCs, as well as over a dozen CompactLogix, ControlLogix, DriveLogix, Compact GuardLogix, GuardLogix, and SoftLogix controllers.

The problem is related to the Logix Designer software using a private cryptographic key to verify communications with controllers. This key is not sufficiently protected, allowing a remote, unauthenticated attacker to bypass the verification mechanism and connect to the controller by mimicking an engineering workstation.

Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series

Once they have connected to the PLC, an attacker on the targeted organization’s network — or malware — can upload malicious code to the controller, download information from the device, or install new firmware. Claroty pointed out that exploitation of the vulnerability could directly impact a manufacturing process.

Claroty said it reported the issue to Rockwell back in 2019. It’s unclear when the others informed the vendor about the vulnerability.

Rockwell has advised customers to implement mitigations to reduce the risk of exploitation, including putting controllers into “Run mode,” deploying CIP Security to prevent unauthorized connections, and updating the controller firmware. It has also shared information for detecting potentially malicious changes and making general security improvements.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Vz21-z3pjmA/unprotected-private-key-allows-remote-hacking-rockwell-controllers

Code-execution flaw in VMware has a severity rating of 9.8 out of 10

Stock photo of a glowing red emergency light

Hackers are mass-scanning the Internet in search of VMware servers with a newly disclosed code-execution vulnerability that has a severity rating of 9.8 out of a possible 10.

CVE-2021-21974, as the security flaw is tracked, is a remote code-execution vulnerability in VMware vCenter server, an application for Windows or Linux that administrators use to enable and manage virtualization of large networks. Within a day of VMware issuing a patch, proof-of-concept exploits appeared from at least six different sources. The severity of the vulnerability, combined with the availability of working exploits for both Windows and Linux machines, sent hackers scrambling to actively find vulnerable servers.

“We’ve detected mass scanning activity targeting vulnerable VMware vCenter servers (https://vmware.com/security/advisories/VMSA-2021-0002.html),” researcher Troy Mursch of Bad Packets wrote.

Mursch said that the BinaryEdge search engine found almost 15,000 vCenter servers exposed to the Internet, while Shodan searches revealed about 6,700. The mass scanning is aiming to identify servers that have not yet installed the patch, which VMware released on Tuesday.

Unfettered code execution, no authorization required

CVE-2021-21972 allows hacker with no authorization to upload files to vulnerable vCenter servers that are publicly accessible over port 443, researchers from security firm Tenable said. Successful exploits will result in hackers gaining unfettered remote code-execution privileges in the underlying operating system. The vulnerability stems from a lack of authentication in the vRealize Operations plugin, which is installed by default.

The flaw has received a severity score of 9.8 out of 10.0 on the Common Vulnerability Scoring System Version 3.0. Mikhail Klyuchnikov, the Positive Technologies researcher who discovered the vulnerability and privately reported it to VMware, compared the risk posed by CVE-2021-21972 to that of CVE-2019-19781, a critical vulnerability in the Citrix Application Delivery Controller.

The Citrix flaw came under active attack last year in ransomware attacks on hospitals, and according to a criminal indictment filed by the Justice Department, in intrusions into game and software makers by hackers backed by the Chinese government.

In a blog post earlier this week, Klyuchnikov wrote:

In our opinion, the RCE vulnerability in the vCenter Server can pose no less a threat than the infamous vulnerability in Citrix (CVE-2019-19781). The error allows an unauthorized user to send a specially crafted request, which will later give them the opportunity to execute arbitrary commands on the server. After receiving such an opportunity, the attacker can develop this attack, successfully move through the corporate network, and gain access to the data stored in the attacked system (such as information about virtual machines and system users). If the vulnerable software can be accessed from the Internet, this will allow an external attacker to penetrate the company’s external perimeter and also gain access to sensitive data. Once again, I would like to note that this vulnerability is dangerous, as it can be used by any unauthorized user.

The researcher provided technical details here.

CVE-2021-21972 affects vCenter Server versions 6.5, 6.7, and 7.01. Users running one of these versions should update to 6.5 U3n, 6.7 U3l, or 7.0 U1c as soon as possible. Those who can’t immediately install a patch should implement these workarounds, which involve changing a compatibility matrix file and setting the vRealize plugin to incompatible. Admins who have vCenter servers directly exposed to the Internet should strongly consider curbing the practice or at least using a VPN.

https://arstechnica.com/?p=1745264

The Race to Find Profits in Securing Email

Email Security Competition Heats Up

NEWS ANALYSIS — More than 17 years after Bill Gates’s famous declaration that the spam problem was close to being solved for good, the corporate inbox continues to be a lucrative target for malicious hackers. Now, a wave of well-funded email security startups are emerging to take another stab at securing the entry point for almost all major cyber attacks.

Email security specialists Armorblox on Thursday announced a new $30 million venture capital funding round, joining a growing list of well-heeled startups taking a stab addressing one of cybersecurity’s most difficult problems: keeping malicious hackers out of corporate mailboxes.

Armorblox, based in Sunnyvale, Calif., has now banked a total of $46.5 million to position itself nicely to continue to shave away at market share from incumbents like Proofpoint, Mimecast and Forcepoint.

The company says it will use the new funding to build out its engineering and data science teams and double down on its bet that the magic of machine learning can effectively address the kinds of targeted email attacks that hit businesses of all sizes.

Armorblox sells a platform that connects over APIs and analyzes thousands of signals to understand the context of email communications. Security teams can use the data from the platform to block targeted phishing attacks, protect sensitive PII and PCI, and automate remediation of user-reported email threats.

While the overuse of “ML/AI” buzzwords can ruin any attempt at properly discussing ML/AI capabilities, Armorblox CEO DJ Sampath is bullish on leveraging natural language understanding, deep learning, traditional machine learning, and detection techniques to organize signals across identity, behavior and language. “If legacy email protection controls are padlocks, think of Armorblox as a fingerprint scanner,” he said.

Sampath believes this approach also helps with the tricky problem of remediation where defenders walk the tightrope between safety and employee productivity.

He is betting that “context-aware threat detection” will be much more reliable and efficient than today’s collection of threat deeds, metadata and one-shot detection tools built into incumbent email security offerings.

With cybersecurity-related spending hitting astronomical numbers and massive security data lakes now providing revenues for tech companies, Armorblox has bigger ambitions in a data-centric, post-pandemic, work-from-home world.

Sampath isn’t shy about his company’s aspirations to find treasure in use-cases beyond cybersecurity: “We believe that the ability to create a single system that can combine a universal understanding of all content and a proper catalog of contextualized interactions with the data can serve a variety of purposes far beyond just detecting cases of intellectual property misuse over email or business email compromise scenarios.”

Armorblox isn’t alone with heady big-data ambitions but it will be a long slog against dozens of well-funded startups, entrenched incumbents and headwinds from the cloud email providers themselves — Microsoft (Office 365/Teams), Google (GSuite/VirusTotal/GCloud).

Microsoft and Google provide the developer APIs that allow “inside-out” security technologies to bake detection and other logic into email traffic flows but, as is clear lately, the bigger tech vendors have their own cybersecurity business ambitions.

Another early-stage email security play worth watching is Material Security, a company that came out of stealth last June with $22 million in funding from Andreessen Horowitz and a roster of CISOs publicly backing its inline approach to integrate two-factor authentication to attachment recovery.

Material Security, the brainchild of ex-Dropbox engineers Ryan Noon, Abhishek Agrawal and Chris Park, offers security teams the ability to redact sensitive content in email — even older archived mail — and make them available only after a two-factor verification step. This lets the company market in the leak prevention, ATO (account takeover), phishing herd immunity and other visibility and admin controls.

Separately, a wide range of companies have received funding to play in the multi-billion dollar email security pond. These include Agari ($85 million raised), Valimail ($84 million raised), Area 1 ($82 million raised), Abnormal ($74 million), Avanan ($41 million), Inky ($32 million), and GreatHorn ($22 million).

Industry watchers expect the email security market to reach $6 billion by 2024, driven mostly by the rapid COVID-related digital transformation.

• Abnormal Security Raises $50 Million

• Avanan Raises $25 Million in Series B Funding

• Email Security Firm GreatHorn Raises $13 Million

• FireEye Adds New Features to Email Security Product

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. Ryan is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends. He is a regular speaker at cybersecurity conferences around the world.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/z_E9qaXcx4E/race-find-profits-securing-email

Cisco Patches Severe Flaws in Network Management Products, Switches

Cisco this week released patches for over a dozen vulnerabilities affecting multiple products, including three critical bugs impacting its ACI Multi-Site Orchestrator, Application Services Engine, and NX-OS software.

The most severe of these issues is a flaw in an API endpoint of ACI Multi-Site Orchestrator (MSO), which could allow a remote attacker to bypass authentication. The vulnerability is tracked as CVE-2021-1388 and features a CVSS score of 10.

Due to the improper validation of tokens, an attacker could send crafted requests to receive a token with administrator-level privileges that they could then use to authenticate to the API on affected MSO devices.

According to Cisco, ACI MSO running software version 3.0 is vulnerable, but only if deployed on an Application Services Engine (it can also be deployed as VMs on a hypervisor).

Cisco also addressed two unauthorized access bugs in Application Services Engine, namely CVE-2021-1393 and CVE-2021-1396, but only the former has a severity rating of critical (CVSS score 9.8). An attacker could exploit these bugs to gain privileged access to host-level operations, access device information, modify configurations, or create diagnostic files.

Due to insufficient access controls in the Data Network, an attacker could access a privileged service by exploiting CVE-2021-1393, or could access a specific API when exploiting CVE-2021-1396. Only Application Services Engine release 1.1 is vulnerable and no workarounds exist for these bugs.

Also featuring a CVSS score of 9.8, the third critical flaw that Cisco patched this week (CVE-2021-1361) affects Nexus 3000 and Nexus 9000 series switches. Affecting the NX-OS software, the issue could be exploited remotely to manipulate arbitrary files with root privileges, without authentication.

“A successful exploit could allow the attacker to create, delete, or overwrite arbitrary files, including sensitive files that are related to the device configuration. For example, the attacker could add a user account without the device administrator knowing,” Cisco explains.

Nexus 3000 series switches and Nexus 9000 series switches in standalone NX-OS mode are affected, if they are running NX-OS software release 9.3(5) or release 9.3(6).

Cisco says it is not aware of these vulnerabilities being exploited in the wild and advises customers to install the released patches as soon as possible.

Two high-severity issues that Cisco patched in NX-OS software this week could lead to cross-site request forgery (CSRF) and denial-of-service (DoS), while two others patched in Nexus 9000 series fabric switches could lead to unauthorized access to the infrastructure VLAN, or to DoS, respectively.

Cisco also addressed several medium-severity flaws in the FXOS and NX-OS software, Nexus 9000 series fabric switches, and AnyConnect Secure Mobility Client. A DoS issue in AnyConnect Secure Mobility Client remains under investigation with no workarounds available, Cisco says.

Details on all of these security bugs can be found on Cisco’s security portal.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/JJlV5gT4gHc/cisco-patches-severe-flaws-network-management-products-switches

Google Funds Linux Kernel Security Development

Google and the Linux Foundation this week announced the prioritizing of funds to allow long-time Linux kernel maintainers Gustavo Silva and Nathan Chancellor to focus on improving the security of the platform.

With this funding, Silva and Chancellor will dedicate their work to improving kernel security, as well as to associated initiatives, so that the open source software project remains sustainable in the long run.

The pervasive Linux operating system, according to a recent report from the Linux Foundation’s Open Source Security Foundation (OpenSSF) and the Laboratory for Innovation Science at Harvard (LISH), needs additional work on security.

Linux had over 20,000 contributors and one million commits as of August 2020, and thousands of developers work on maintaining and improving its kernel.

Working on the Linux kernel for four and a half years, Nathan Chancellor started contributing to mainline Linux two years ago, under the ClangBuiltLinux project, which focuses on Linux kernel building using Clang and LLVM compiler tools.

The funding will allow Chancellor to dedicate his efforts to identifying and resolving bugs found with Clang/LLVM compilers, as well as on integration systems to ensure the continuity of this work. Next, leveraging these compilers, he will start adding features to the kernel.

Gustavo Silva has been delivering kernel patches for more than ten years and is an active member of the Kernel Self Protection Project (KSPP). Since 2017, he’s been among the top five most active kernel developers, with more than 2,000 commits in mainline.

Silva is already working on eliminating classes of buffer overflows, is proactively developing mechanisms to eliminate entire classes of vulnerabilities, and is also seeking to address vulnerabilities before they hit the mainline.

“Ensuring the security of the Linux kernel is extremely important as it’s a critical part of modern computing and infrastructure. It requires us all to assist in any way we can to ensure that it is sustainably secure,” said David A. Wheeler, director of open source supply chain security at the Linux Foundation.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Judl3fnr4io/google-funds-linux-kernel-security-development