Linux Mint installation media briefly compromised:
I'm sorry I have to come with bad news. We were exposed to an intrusion today. It was brief and it shouldn't impact many people, but if it impacts you, it's very important you read the information below.
What happened? Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it.
Does this affect you? As far as we know, the only compromised edition was Linux Mint 17.3 Cinnamon edition. If you downloaded another release or another edition, this does not affect you. If you downloaded via torrents or via a direct HTTP link, this doesn't affect you either.
Finally, the situation happened today, so it should only impact people who downloaded this edition on February 20th.
More information:
Linux Mint Blog,
ycombinator,
reddit,
LWNIn a shocking move the Australian government has
transferred control of the MyGov portal to the DTO. This slap in the face to the mighty DHS comes after several months of serious problems with the online government portal after the Australian tax system, Centrelink, Medicare and other systems were changed to use MyGov as the central logon. Tens of thousands of Australians took to social media in 2015 to complain about the DHS portal after the ATO made using the portal mandatory for online tax returns. The problems were so bad that the ATO opened a backdoor allowing citizens to bypass the MyGov system. After spending millions to integrate two of the largest federal departments, Centrelink and Medicare, the step of removing MyGov from the hands of the DHS is an F on this year's report card.
As of Palemoon 25.6 a new option is available to
poison canvas data. This option is not enabled by default due to the performance cost. Users can enabled it in about:config by setting canvas.poisondata to true.
This browserleaks page has a technical writeup on how canvas data can be used to generate a fingerprint for a browser using a live example of browser fingerprinting code.
By now, most people feel comfortable conducting online financial transactions on the Web. The cryptographic schemes that protect online banking and credit card purchases have proven their reliability over decades. But right now, there is no effective way to prevent misuse of your data by the people authorized to access it, say for example a bank employee can still access your data, and frequently we are reading news about misuse of the data by the bank employees. i-e Once you share your data with the bank, Healthcare system or any other private company, for your online transactions, you don't have any control over who exactly is using or misusing your data.
http://news.mit.edu/2014/whos-using-your-data-httpa-0613Microsoft recently copped flak over forcing users to accept Windows 10 updates. Some users have reported serious problems from Windows 10 updates which included system failure. Now Google is following the same path. Google Play now has a term in the licencing agreement which allows Google to force update any software on Android devices. Without root access most users will be SOL to block or fix problems.
The relevant text reads:
Updates. You may need to install updates to Google Play or related Google software that we introduce from time to time to use Google Play and to access or download Content. Content originating from Google may communicate with Google servers from time to time to check for available updates to the Content and to the functionality of Google Play, such as bug fixes, patches, enhanced functions, missing plug-ins and new versions (collectively, "Updates"). Your use of the Content you have installed requires that you have agreed to receive such automatically requested Updates. If you do not agree to such automatically requested and received Updates then please do not use the Google Play store or install this Content.
Full terms at:
https://play.google.com/intl/en-us_au/about/play-terms.htmlAustralian company pin.net.au now refuses to process payments for VPN users. The software used by the pin.net.au rejects payments originating from a known VPN IP address as it is "high risk" and may be an attempt to conduct fraud. A pin.net.au representative has stated that users need to disable VPN software to make online purchases. The Australian government recently started logging internet and phone activity. Australian politicians have recommended using a VPN and other secure technology to ensure privacy online.
"Apparently these researchers
were paid by the FBI to
attack hidden services users in a broad sweep, and then sift through their data to find people whom they could accuse of crimes," Dingledine writes. "Such action is a violation of our trust and basic guidelines for ethical research. We strongly support independent research on our software and network, but this attack crosses the crucial line between research and endangering innocent users."
The Internet... Who Needs It?
"As a growing number of web users have become more security-conscious, there's been an explosion of VPNs and encryption tools and other security services for the Internet. But what about a device that lets you bypass the Internet entirely? That's the goal of RATS,[1] the Radio Transceiver System, an open source communication tool for the security-obsessed and/or the Internet-bereft."
"The RATS is simple: it's a small antenna that connects to computers by USB and lets them send encrypted messages and file transfers directly, via radio transmission. There are two obvious advantages to this: firstly, it doesn't rely on any network being up or even the power staying on - as long as your laptop has some batteries, you can send and receive - and secondly, it's a level of security and privacy that trumps most of what you can do on-line. Apart from being entirely separated from the Internet, it employs AES-256 encryption with a randomized salt so even the same message sent repeatedly will produce completely different encrypted data every time.
The range of the RATS antenna is about a kilometer in a city, but it can also be connected to superior antennas and, in areas with no obstacles, achieve ranges above 5km. Obviously this means it isn't suited to everything, but alongside the Internet it could be extremely powerful for certain local applications in urban neighborhoods, workplaces, and other situations where we normally use the robust global Internet just to send short messages to people within walking distance. But perhaps more than anything it could be a boon for people living under governments that censor and monitor on-line communications, allowing local groups to coordinate without so much as touching the compromised networks."
-
https://www.techdirt.com/blog/innovation/articles/20151031/07410132682/awesome-stuff-Internet-who-needs-it.shtml(Archived)
https://archive.is/XQxJm[1]
https://www.kickstarter.com/projects/1688986732/rats-chat-and-send-files-without-Internet/description(Archived)
https://archive.is/ly2mt