NEWS

Linus Torvalds Takes a Break, Apologizes

In an unexpected move, Linus Torvalds, the creator of the Linux kernel, is taking a break from the kernel as he reflects on his behavior on the Linux Kernel Mailing List (LKML).

He made this announcement on LKML, "I am going to take time off and get some assistance on how to understand people's emotions and respond appropriately."

Torvalds admitted, "I need to change some of my behavior, and I want to apologize to the people that my personal behavior hurt and possibly drove away from kernel development entirely."

Although Torvalds is generally very friendly towards users, he is known for using strong language and sometimes insulting comments when discussing technical issues with Linux kernel maintainers and developers.

Unlike other managers, Torvalds doesn't have the power to encourage or discourage his team members by demoting them or withholding bonuses. His choices are limited. However, his frustration towards his team needs a different kind of venting; personal attacks have proved to be demotivating. Many talented developers have quit the kernel.

The kernel community has been vocal about it and admitted that there is no place for this behavior. It will be interesting to see a changed Torvalds when he returns from his break.

Torvalds announcement accompanied the release of a newly revamped Code of Conduct to support a positive work environment for all kernel participants.

Chinese Spy Chip in US Servers?

A Bloomberg report (https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies) claims that Chinese spy chips were found on the hardware used by Department of Defense (DoD), CIA, and Navy warships.

According to Bloomberg, the chip, smaller than a grain of rice, was allegedly installed by manufacturing subcontractors in China.

The report said that "the chips allowed the attackers to create a stealth doorway into any network that included the altered machines."

The hardware in question is sold by Elemental Technologies (now owned by Amazon) and assembled by Supermicro.

Bloomberg reported that, during an audit before acquiring Elemental Technologies, Amazon found some troubling issues with the hardware and reported it to US authorities. The report also mentioned Apple and said the company's security team found the additional chips on hardware that the company was using in its servers.

All the companies mentioned in the report, including Amazon, Apple, and Supermicro, have refuted the report.

"It's untrue that AWS knew about a supply chain compromise, an issue with malicious chips, or hardware modifications when acquiring Elemental," said Amazon in a statement to Bloomberg. Apple said they never "found malicious chips, 'hardware manipulations' or vulnerabilities purposely planted in any server." Supermicro strongly rejects the story, stating that they remain unaware of any such investigation.

Regardless of whether the story proves correct, the controversy generated by the Bloomberg report could add more heat to the trade war with China triggered by the Trump administration.

Is North Korea Hacking US ATM Machines?

In a joint alert, which includes agencies like the FBI, DHS, and Treasury, United States Computer Emergency Readiness Team (US-CERT) says they have identified malware and other indicators of compromise (IOCs) used by the North Korean government in an Automated Teller Machine (ATM) cash-out scheme (https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity).

Dubbed Hidden Cobra, the group behind the scheme uses malicious Windows executable applications, command-line utility applications, and other files to perform transactions and interact with financial systems, including the switch application server.

The US-CERT report states that the Hidden Cobra group likely used Windows-based malware to explore a bank's network to identify the payment switch application server. According to a report in Hacker News, a switch applications server is "…an essential component of ATMs and Point-of-Sale [PoS] infrastructures that communicates with the core banking system to validate user's bank account details for a requested transaction."

When a customer uses a card in an ATM or PoS machine, the system asks the bank's switch application server to validate the transaction. Hidden Cobra compromises the switch application servers and validates the payment with a fake but legitimate-looking affirmative response. The ATM releases the money requested by the user.

US-CERT recommends banks make two-factor authentication mandatory before any user can access the switch application server and use best practices to protect their networks.

More Online

Linux Magazine

http://www.linux-magazine.com

ADMIN HPC

http://hpc.admin-magazine.com/

An Introduction to Python SymPy * Stefano Rizzi

SymPy is a computer algebra system (CAS) written in the Python programming language. In this article, I use SymPy first on an algebraic function and then on Fourier's equation to explore some calculations about heat conduction.

ADMIN Online

http://www.admin-magazine.com/

PowerShell Add-On Security Modules * Thomas Wiefel

Numerous PowerShell add-on modules provide security and attack functions for penetration tests and forensic analyses, to help admins search for vulnerabilities in their networks.

Highly Available Storage Virtualization * Roland Döllinger

Implementing highly available SAN data storage virtualization.

Continuous Upgrades for Windows 10 * Matthias Wessner

The new Windows 10 update strategy, called an in-place upgrade, requires some manual adjustments for third-party components, as well as accommodations for multilingual and non-English enterprises.

ADMIN DevOps Focus

http://www.admin-magazine.com/DevOps

Securing Kubernetes * Chris Binnie

The fast pace of Kubernetes development can create and plug security vulnerabilities on the fly; the Kubernetes Auto Analyzer configuration analyzer tool automates the review of Kubernetes installations against CIS Benchmarks.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News