Linux Kernel Continues to Offer Mitigation for Spectre Mitigation

Usually, you want to mitigate all possible vulnerabilities unless you are talking about Meltdown and Spectre which are a class or family of dozens of vulnerabilities. But what sys admins hate more than these vulnerabilities are mitigations offered to these vulnerabilities (https://www.zdnet.com/article/linux-kernel-gets-another-option-to-disable-spectre-mitigations/). Some of these mitigations have a massive impact on performance, while not offering any significant protection.

Gauging the pros and cons, sys admins have gone as far as asking the Linux kernel community to give them an option to disable these mitigations (https://www.phoronix.com/scan.php?page=news_item&px=Global-Switch-Skip-Spectre-Melt). The Linux kernel community always listens.

Linux Kernel 4.15 added the ability for sys admins to disable the kernel's built-in mitigations for the Spectre v2 vulnerability, then Linux Kernel 4.17 offered the option to disable all mitigations for Spectre v4, and now Linux Kernel 4.19 allows admins to disable mitigations for Spectre v1.

You may or may not trust the NSA, but they have a very decent guide on GitHub (https://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance) to help keep up with all Spectre-related vulnerabilities.

SpeakUp Trojan Targets Linux Servers

Researchers at Check Point have found a new Trojan called SpeakUp that's infecting Linux servers. SpeakUp exploits known vulnerabilities in Linux and is targeting servers in China.

According to Check Point, "SpeakUp acts to propagate internally within the infected subnet, and beyond to new IP ranges, exploiting remote code execution vulnerabilities. In addition, SpeakUp presented the ability to infect Mac devices with the undetected backdoor" (https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/).

The Trojan has spread beyond China and is fast spreading across East Asia and Latin America. It's not sparing even AWS-hosted Linux servers. Check Point said six Linux distributions and macOS are vulnerable, but they didn't name exactly which six Linux distributions.

SpeakUp's initial infection vector targets a known vulnerability in ThinkPHP and then uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor. After executing the script to install the backdoor, it deletes the file to remove any evidence.

Check Point warns that while the initial payload of SpeakUp is mining, it poses a much bigger threat. "The threat actor behind this campaign can at any given time deploy additional payloads, potentially more intrusive and offensive. It has the ability to scan the surrounding network of an infected server and distribute the malware."

KDE Plasma 5.15 Beta Arrives

The KDE community has announced its first release of 2019 – Plasma 5.15 Beta. One of the major highlights of the beta release is increased focus on usability and productivity.

The KDE community has teamed up with the Visual Design Group (VDG) contributors to get feedback on all the paper cut bugs in the software to create an intuitive and consistent workflow for users.

The release has enhanced integration with third-party technologies like GTK and Firefox, so users can choose the apps they like without worrying about a subpar experience.

Massive improvements have been made to the Discover software management tool, something similar to App Store. Users can now perform the distribution upgrade within Discover. It also offers fine-grained control over which packages users want to update.

Discover also now supports app extensions offered with Flatpak packages and lets you choose which ones to install.

If you are a KDE Plasma user, you can test the beta and provide the community with feedback. Some of the best beta distributions to try are openSUSE Tumbleweed, Arch Linux, and KDE neon.