NEWS
NEWS
Linux Kernel continues to offer mitigation for Spectre Mitigation, SpeakUp Trojan targets Linux servers, KDE Plasma 5.15 beta arrives, Canonical announces latest Ubuntu Core for IoT, vulnerabilities found in Cisco routers, two new malware campaigns, and US government shutdown ties up $139.2 million in grant funding.
Linux Kernel Continues to Offer Mitigation for Spectre Mitigation
Usually, you want to mitigate all possible vulnerabilities unless you are talking about Meltdown and Spectre which are a class or family of dozens of vulnerabilities. But what sys admins hate more than these vulnerabilities are mitigations offered to these vulnerabilities (https://www.zdnet.com/article/linux-kernel-gets-another-option-to-disable-spectre-mitigations/). Some of these mitigations have a massive impact on performance, while not offering any significant protection.
Gauging the pros and cons, sys admins have gone as far as asking the Linux kernel community to give them an option to disable these mitigations (https://www.phoronix.com/scan.php?page=news_item&px=Global-Switch-Skip-Spectre-Melt). The Linux kernel community always listens.
Linux Kernel 4.15 added the ability for sys admins to disable the kernel's built-in mitigations for the Spectre v2 vulnerability, then Linux Kernel 4.17 offered the option to disable all mitigations for Spectre v4, and now Linux Kernel 4.19 allows admins to disable mitigations for Spectre v1.
You may or may not trust the NSA, but they have a very decent guide on GitHub (https://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance) to help keep up with all Spectre-related vulnerabilities.
SpeakUp Trojan Targets Linux Servers
Researchers at Check Point have found a new Trojan called SpeakUp that's infecting Linux servers. SpeakUp exploits known vulnerabilities in Linux and is targeting servers in China.
According to Check Point, "SpeakUp acts to propagate internally within the infected subnet, and beyond to new IP ranges, exploiting remote code execution vulnerabilities. In addition, SpeakUp presented the ability to infect Mac devices with the undetected backdoor" (https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/).
The Trojan has spread beyond China and is fast spreading across East Asia and Latin America. It's not sparing even AWS-hosted Linux servers. Check Point said six Linux distributions and macOS are vulnerable, but they didn't name exactly which six Linux distributions.
SpeakUp's initial infection vector targets a known vulnerability in ThinkPHP and then uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor. After executing the script to install the backdoor, it deletes the file to remove any evidence.
Check Point warns that while the initial payload of SpeakUp is mining, it poses a much bigger threat. "The threat actor behind this campaign can at any given time deploy additional payloads, potentially more intrusive and offensive. It has the ability to scan the surrounding network of an infected server and distribute the malware."
KDE Plasma 5.15 Beta Arrives
The KDE community has announced its first release of 2019 – Plasma 5.15 Beta. One of the major highlights of the beta release is increased focus on usability and productivity.
The KDE community has teamed up with the Visual Design Group (VDG) contributors to get feedback on all the paper cut bugs in the software to create an intuitive and consistent workflow for users.
The release has enhanced integration with third-party technologies like GTK and Firefox, so users can choose the apps they like without worrying about a subpar experience.
Massive improvements have been made to the Discover software management tool, something similar to App Store. Users can now perform the distribution upgrade within Discover. It also offers fine-grained control over which packages users want to update.
Discover also now supports app extensions offered with Flatpak packages and lets you choose which ones to install.
If you are a KDE Plasma user, you can test the beta and provide the community with feedback. Some of the best beta distributions to try are openSUSE Tumbleweed, Arch Linux, and KDE neon.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
News
-
KDE Plasma 6 Looks to Bring Basic HDR Support
The KWin piece of KDE Plasma now has HDR support and color management geared for the 6.0 release.
-
Bodhi Linux 7.0 Beta Ready for Testing
The latest iteration of the Bohdi Linux distribution is now available for those who want to experience what's in store and for testing purposes.
-
Changes Coming to Ubuntu PPA Usage
The way you manage Personal Package Archives will be changing with the release of Ubuntu 23.10.
-
AlmaLinux 9.2 Now Available for Download
AlmaLinux has been released and provides a free alternative to upstream Red Hat Enterprise Linux.
-
An Immutable Version of Fedora Is Under Consideration
For anyone who's a fan of using immutable versions of Linux, the Fedora team is currently considering adding a new spin called Fedora Onyx.
-
New Release of Br OS Includes ChatGPT Integration
Br OS 23.04 is now available and is geared specifically toward web content creation.
-
Command-Line Only Peropesis 2.1 Available Now
The latest iteration of Peropesis has been released with plenty of updates and introduces new software development tools.
-
TUXEDO Computers Announces InfinityBook Pro 14
With the new generation of their popular InfinityBook Pro 14, TUXEDO upgrades its ultra-mobile, powerful business laptop with some impressive specs.
-
Linux Kernel 6.3 Release Includes Interesting Features
Although it's not a Long Term Release candidate, Linux 6.3 includes features that will benefit end users.
-
Arch-Based blendOS Features Cool Trick
If you're looking for a Linux distribution that blends Linux, Android, and web apps together, blendOS might be what you're looking for.