NEWS
NEWS

Updates on technologies, trends, and tools
Firefox Finally Gets Tracking Protection
The Mozilla foundation has announced the arrival of Firefox 42 for Windows, Mac, Linux, and Android. The arrival of a new Firefox is hardly big news (the project releases a new version approximately every six weeks), but number 42 is significant for including a feature that has long been advocated (and debated) in the Firefox community: built-in protection from ad tracking.
According to the Firefox team, "We first added Private Browsing to Firefox to give you control over your privacy locally by not saving your browser history and cookies when you close a private window. However, when you browse the Web, you can unknowingly share information about yourself with third parties that are separate from the site you're actually visiting, even in Private Browsing mode on any browser. Until today. Private Browsing with Tracking Protection in Firefox for Windows, Mac, Android and Linux actively blocks content like ads, analytics trackers, and social share buttons that may record your behavior without your knowledge across sites."
Another interesting new feature of the latest release is tab audio indicators, an audio mini-control that is visible on the tab, so you can change the volume or mute the sound for a web page without placing the page in the foreground.
See the blog post by Mozilla VP Nick Nguyen for more on Firefox 42.
New Password Looter Tool Steals Passwords from a Password Manager
If attackers are on your system, saving your passwords in a password vault is no protection. A new application called Keefarce, which was created by New Zealand developer Denis Andzakovic, steals passwords from the KeePass password manager tool. An attacker who gains access to a system could use Keefarce to output all the user's online passwords to an easily accessible file.
Keefarce does not attack the KeePass encryption system directly but, instead, uses DLL injection to get the KeePass application to export usernames and passwords to a cleartext CSV file. The attack lifts the passwords out of memory in as intended to run when the user has logged in and "unlocked" the password manager.
As the story in Ars Technica points out, KeePass developers have long warned that no password manager is safe when the system itself is compromised. Tools such as key loggers have been harvesting passwords for years on compromised systems. The distinguishing feature of Keefarce is its convenience – you can scoop up all the user's passwords at once.
Experts point out that KeePass is by no means the only password manager tool that is susceptible to this kind of attack, and many believe that storing your passwords in a password vault is still a good policy if it allows you to maintain more unique and less-crackable passwords – just make sure you don't get owned.
Over a Million Websites Are Still Using SHA-1
Faulty hash algorithm persists, despite efforts by experts to raise awareness. A study by the security firm Netcraft has determined that more than a million websites are still using SSL certificates based on the SHA-1 hashing algorithm, which is known to be insecure. Several high-profile companies are among the list of organizations that still use the discredited SHA-1.
Security experts have known for a few years that SHA-1 is vulnerable to attack, with the only question being how much does it cost to attack it? According to a report in the Register, in 2012, it was estimated that a successful attack on SHA-1 would cost $173,000 in compute time by 2017. Netcraft reports the attack can now be accomplished with $75-$120K in Amazon EC2 compute resources.
Although such as rate would rule out script kiddies and various small-time hackers, a $75,000 investment to hack a corporate network is well within the budget of many criminal and government espionage organizations.
All networks are strongly advised to upgrade to certificates based on SHA-2 and SHA-3-family algorithms.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
OpenMandriva Lx 23.03 Rolling Release is Now Available
OpenMandriva "ROME" is the latest point update for the rolling release Linux distribution and offers the latest updates for a number of important applications and tools.
-
CarbonOS: A New Linux Distro with a Focus on User Experience
CarbonOS is a brand new, built-from-scratch Linux distribution that uses the Gnome desktop and has a special feature that makes it appealing to all types of users.
-
Kubuntu Focus Announces XE Gen 2 Linux Laptop
Another Kubuntu-based laptop has arrived to be your next ultra-portable powerhouse with a Linux heart.
-
MNT Seeks Financial Backing for New Seven-Inch Linux Laptop
MNT Pocket Reform is a tiny laptop that is modular, upgradable, recyclable, reusable, and ships with Debian Linux.
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.