NEWS
NEWS
Updates on technologies, trends, and tools
Firefox Finally Gets Tracking Protection
The Mozilla foundation has announced the arrival of Firefox 42 for Windows, Mac, Linux, and Android. The arrival of a new Firefox is hardly big news (the project releases a new version approximately every six weeks), but number 42 is significant for including a feature that has long been advocated (and debated) in the Firefox community: built-in protection from ad tracking.
According to the Firefox team, "We first added Private Browsing to Firefox to give you control over your privacy locally by not saving your browser history and cookies when you close a private window. However, when you browse the Web, you can unknowingly share information about yourself with third parties that are separate from the site you're actually visiting, even in Private Browsing mode on any browser. Until today. Private Browsing with Tracking Protection in Firefox for Windows, Mac, Android and Linux actively blocks content like ads, analytics trackers, and social share buttons that may record your behavior without your knowledge across sites."
Another interesting new feature of the latest release is tab audio indicators, an audio mini-control that is visible on the tab, so you can change the volume or mute the sound for a web page without placing the page in the foreground.
See the blog post by Mozilla VP Nick Nguyen for more on Firefox 42.
New Password Looter Tool Steals Passwords from a Password Manager
If attackers are on your system, saving your passwords in a password vault is no protection. A new application called Keefarce, which was created by New Zealand developer Denis Andzakovic, steals passwords from the KeePass password manager tool. An attacker who gains access to a system could use Keefarce to output all the user's online passwords to an easily accessible file.
Keefarce does not attack the KeePass encryption system directly but, instead, uses DLL injection to get the KeePass application to export usernames and passwords to a cleartext CSV file. The attack lifts the passwords out of memory in as intended to run when the user has logged in and "unlocked" the password manager.
As the story in Ars Technica points out, KeePass developers have long warned that no password manager is safe when the system itself is compromised. Tools such as key loggers have been harvesting passwords for years on compromised systems. The distinguishing feature of Keefarce is its convenience – you can scoop up all the user's passwords at once.
Experts point out that KeePass is by no means the only password manager tool that is susceptible to this kind of attack, and many believe that storing your passwords in a password vault is still a good policy if it allows you to maintain more unique and less-crackable passwords – just make sure you don't get owned.
Over a Million Websites Are Still Using SHA-1
Faulty hash algorithm persists, despite efforts by experts to raise awareness. A study by the security firm Netcraft has determined that more than a million websites are still using SSL certificates based on the SHA-1 hashing algorithm, which is known to be insecure. Several high-profile companies are among the list of organizations that still use the discredited SHA-1.
Security experts have known for a few years that SHA-1 is vulnerable to attack, with the only question being how much does it cost to attack it? According to a report in the Register, in 2012, it was estimated that a successful attack on SHA-1 would cost $173,000 in compute time by 2017. Netcraft reports the attack can now be accomplished with $75-$120K in Amazon EC2 compute resources.
Although such as rate would rule out script kiddies and various small-time hackers, a $75,000 investment to hack a corporate network is well within the budget of many criminal and government espionage organizations.
All networks are strongly advised to upgrade to certificates based on SHA-2 and SHA-3-family algorithms.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Gnome 47.2 Now Available
Gnome 47.2 is now available for general use but don't expect much in the way of newness, as this is all about improvements and bug fixes.
-
Latest Cinnamon Desktop Releases with a Bold New Look
Just in time for the holidays, the developer of the Cinnamon desktop has shipped a new release to help spice up your eggnog with new features and a new look.
-
Armbian 24.11 Released with Expanded Hardware Support
If you've been waiting for Armbian to support OrangePi 5 Max and Radxa ROCK 5B+, the wait is over.
-
SUSE Renames Several Products for Better Name Recognition
SUSE has been a very powerful player in the European market, but it knows it must branch out to gain serious traction. Will a name change do the trick?
-
ESET Discovers New Linux Malware
WolfsBane is an all-in-one malware that has hit the Linux operating system and includes a dropper, a launcher, and a backdoor.
-
New Linux Kernel Patch Allows Forcing a CPU Mitigation
Even when CPU mitigations can consume precious CPU cycles, it might not be a bad idea to allow users to enable them, even if your machine isn't vulnerable.
-
Red Hat Enterprise Linux 9.5 Released
Notify your friends, loved ones, and colleagues that the latest version of RHEL is available with plenty of enhancements.
-
Linux Sees Massive Performance Increase from a Single Line of Code
With one line of code, Intel was able to increase the performance of the Linux kernel by 4,000 percent.
-
Fedora KDE Approved as an Official Spin
If you prefer the Plasma desktop environment and the Fedora distribution, you're in luck because there's now an official spin that is listed on the same level as the Fedora Workstation edition.
-
New Steam Client Ups the Ante for Linux
The latest release from Steam has some pretty cool tricks up its sleeve.