Hackers break into two FreeBSD Project servers using stolen SSH keys

Intrusions on two machines within the FreeBSD.org cluster were detected on Nov. 11, the FreeBSD security team said Saturday. “The affected machines were taken offline for analysis. Additionally, a large portion of the remaining infrastructure machines were also taken offline as a precaution,” said a message on the project’s public announcements mailing list. The two compromised servers acted as nodes for the project’s legacy third-party package-building infrastructure, the FreeBSD Project said in an advisory posted on its website. The incident only affected the collection of third-party software packages distributed by the project and not the operating system’s “base” components, such as the kernel, system libraries, compiler or core command-line tools. The FreeBSD security team believes the intruders gained access to the servers using a legitimate SSH authentication key stolen from a developer, and not by exploiting a vulnerability in the operating system.

Source:
http://www.pcadvisor.co.uk/news/security/3411757/hackers-break-into-two-freebsd-project-servers-using-stolen-ssh-keys/?olo=rss

Posted in Internet, Linux, Security, Software | No Comments

Adobe to fix Flash Player on Patch Tuesdays

Adobe has changed its schedule for releasing Flash Player security updates to coincide with Microsoft’s Patch Tuesday schedule. “Microsoft and Adobe are now officially married,” joked Andrew Storms, director of security operations at nCircle Security, a software vendor, in an email. “They started dating when they decided to share the MAPP program,” and once Microsoft agreed to embed Flash into Internet Explorer 10, it was “inevitable” that Adobe would begin following Microsoft’s patch schedule, he said. Under MAPP, or the Microsoft Active Protections Program, Microsoft provides select security vendors with prepatch information to give them time to craft detection signatures for new exploits or malware. In July 2010, Adobe began using MAPP to deliver vulnerability information about its own products to security firms. Microsoft issues its security updates on the second Tuesday of each month. Until now, Adobe has released Flash bug fixes at irregular intervals. The lack of synchronization became an issue after Microsoft announced it would bake Flash Player into IE10 for Windows 8 and its tablet spin-off, Windows RT. Problems surfaced in September when Microsoft said it would not patch IE10 for at least six weeks, even though Adobe had issued updates the previous month that addressed at least one vulnerability that hackers were already exploiting.

Source:
https://www.computerworld.com/s/article/9233747/Adobe_to_fix_Flash_Player_on_Patch_Tuesdays?taxonomyId=17

Posted in Internet, Security, Software | No Comments

Ubuntu for Android

Ubuntu for Android

Posted in Hardware, Internet, Linux, Software | No Comments

IE10 now updates in the background like the rest of the browsers, by default.

Posted in Internet, Privacy, Security, Software, Windows | 1 Comment

Inappropriate Use of Adobe Code Signing Certificate

We recently received two malicious utilities that appeared to be digitally signed using a valid Adobe code signing certificate. The discovery of these utilities was isolated to a single source. As soon as we verified the signatures, we immediately decommissioned the existing Adobe code signing infrastructure and initiated a forensics investigation to determine how these signatures were created. We have identified a compromised build server with access to the Adobe code signing infrastructure. We are proceeding with plans to revoke the certificate and publish updates for existing Adobe software signed using the impacted certificate. This only affects the Adobe software signed with the impacted certificate that runs on the Windows platform and three Adobe AIR applications* that run on both Windows and Macintosh. The revocation does not impact any other Adobe software for Macintosh or other platforms.

Source:
http://blogs.adobe.com/asset/2012/09/inappropriate-use-of-adobe-code-signing-certificate.html

Posted in Internet, Security | No Comments