Posts by pc-fluesterer.info

It's 2021 and you can hijack a Cisco SD-WAN deployment with malicious IP traffic and a buffer overflow. Patch now

oh shit, another backdoor uncovered

who does believe this was not a backdoor?

Laptops given to British schools came preloaded with remote-access worm

Malware != vulnerability

not every malware relies on vulnerabilities. A vulnerability, if at all, you only need as part of an attack vector to infiltrate a system. But as well you can implement a RAT or whatever malware targeted and manually if you can get hold of the machine(s) in question. That doesn't employ a vulnerability.

OVH rises to Europe data sovereignty challenge (and AWS) with tape-as-a-service

OVH - isn't that the souce of many attacks?

OVH for me has a very bad taste. I run a website that is under attack frequently. XSS, SQL injection, malicious uploads, attempts to log in - you name it. My firewall logs the source of attacks; subsequently I block the entire address range of the provider concerned from future access.

About 10% of all attacks (worldwide) stem from OVH!

A very respectable provider ... :-(

What happens when a Chrome extension with 2m+ users changes hands, raises red flags, doesn't document updates? Let's find out

alternatives

not a fork, but alternatives. Brought to you by the chocolate factory: https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg?hl=en ((scroll down to "related"))

MX Linux is based on debian too

here applies the same as for LMDE (see other post): They rely on debian supplying 32-bit still, which in turn relies on the kernel development of course. Bit if sometime in the future Linux will drop 32-bit support you can still move to xBSD. :-)

go for LMDE

LMDE still is available 32-bit.

Alas it comes with cinnamon which is a resource hog - not particularly apt for weak HW. :-)

But fear not, you can easily install a slim DE such as MATE or XFCE.

BTDT.

LMDE will remain available 32-bit as long as debian will.

rtorrent is Unix (Linux) only

+1, but rtorrent is Linux only. Which shows that you are on the same wave I am. :-)

Ad-scamming, login-stealing Windows malware is hitting Chrome, Edge, Firefox, Yandex browsers, says Microsoft

Re: Windows....

Aiming for the WEAKEST target is what you do...

Re: OS?

WOT was caught spying.

Re: OS?

you forgot to supply the 'irony' flag. :-)

Re: UN-bundled goodness

well, why do you use that crap called Windows in the first place? For usual office stuff Linux is more than sufficient. At my customers very seldom I see a robust reason for Windows. There are some, yes, and there are solutions for that.

The patch that wasn't: Cisco emits fresh fixes for NTLM hash-spilling vuln and XSS-RCE combo in Jabber app

No! It's not jabber, it's applications

Jabber, or XMPP as we call it nowadays, is just a protocol. The protocol is not the culprit; it is beyond any suspicion. The culprit is faulty (or backdoored, to be precise) SW in the case of Cisco, or a malicious App in the case of Alcatel. But who uses Cisco in the first place? I for one would never ever use Cisco (nor any other US-supplied network gear), particularly not for XMPP.

Sopra Steria: Adding up outages and ransomware cleanup, Ryuk attack will cost us up to €50m

Linux is immune (was: Re: lesson learned?)

"Ransomware attacks exist on Linux as well as Windows" - WRONG.

Please give us one example - only one, pleeeease! - of an attack vector similar to those in the M$ biotope. A malware attack similar to those under Windows is IMPOSSIBLE against a Linux (or xBSD) desktop and network. You always need a maliciuos insider (such as 'evil maid') and/or severe blunder of system management.

Web servers are even more endangered. Why do the majority of web servers world wide run on Linux or xBSD? All successful attacks against Linux/xBSD web servers I know of were based on administrators errors (weak password and the like) and/or security holes in application SW (CMS, shop, database, ...). Which again is an administrative or system management error: Available patches not applied. NEVER was a weakness in the underlying OS Linux or xBSD part of the attack vector - in all cases I know of. Do you know better?

To make that clear: I am talking about the usual mass attacks. If you are target of a governmental "service" - they find their way sooner or later, so good luck! :-)

lesson learned?

and, lesson learned? Any inference?

Or just "more of the same"? So goes the American proverb: If brute force didn't solve your problem, you didn't use enough of it. ...

Ever thought of a change of paradigm?

Not only put money on prevention, but migrate to FOSS.

The revolution will not be televised because my television has been radicalised

is your TV a SAMSUNG by chance?

https://www.theregister.com/2020/09/30/samsung_smart_tv_ads/

Android without Google – and yes it has apps: The Reg talks to founder about the /e/ smartphone

Alternative: Shiftphone

should be mentioned here as well: https://shop.shiftphones.com/ with ShiftOS L (light).

Re: Can I just have an App that removes Google

rooting is NOT required! What you indeed have to do is UNLOCK the BOOTLOADER. That's a different beast. I for one run LineageOS with MicroG on two Sony XA2, one is rooted (mine) and the other isn't (my wifes).

Re: Can I just have an App that removes Google

rooting is NOT required! What you indeed have to do is UNLOCK the BOOTLOADER. That's a different beast. I for one run LineageOS with MicroG on two Sony XA2, one is rooted (mine) and the other isn't (my wifes).

French IT outsourcer Sopra Steria hit by 'cyberattack', Ryuk ransomware suspected

Re: "phishing attacks [..] tend to be very difficult for non-specialists to spot"

why not? Linux is immune against Conficker/Downadup and the like. ;-)

And even Windows CAN be hardened against USB attacks.

Well, yes, you have to do the hardening and actually do it before ...

Need a new computer for homeschooling? You can do worse than a sub-£30 2007 MacBook off eBay

Beware 32-bit!

The choice of Linux distros that are 32-bit capable will narrow as time proceeds. Mint 19.3, supported until April 2023, is available for 32-bit. The successor Mint 20 is not! And the basis for Mint 20, Ubuntu 2004, has several aspects not welcome (packet format 'snap' and the corresponding proprietary app-store is one of them).

I am in the process of migrating many machines (mine and customer's) running Mint to LMDE. That is based on debian directly without deviation over Ubuntu. LMDE 4 still is 32-bit capable. Only backlash is that currently it comes with DE Cinnamon which is a resource-hog, not quite apt for elderly machines. But just replace it by DE Mate an you're done. :-) Happy ever since ...

So, what exactly are you planning to do with this new PC? Windows Insiders face new questions during OOBE

Re: Confused

... and repeat that after each "upgrade" because your settings will be overwritten.

Global Privacy Control emerges as latest attempt to let netizens choose whether they want to be tracked online

Re: You know you’re doing privacy better when...

plus NoScript, uMatrix and the like.

Re: Another flag to be ignored

schools can't fight capitalism.

Re: They just don't get it........but maybe that's the point!!!

"Google et all already have enough money. they do not need any more."

... but the shareholders do! Greed is infinite.

Burning down the house! Consumer champ Which? probes smart plugs to find a bunch of insecure fire-risk tat

Re: What about the CE mark?

yes, I did. I bought a charger from a German merchant. ((Not even Amazon, as I NEVER buy there, for various reasons.)) The studs that go into the wall were too short an too small. In some receptacle the thing would work, in others not. It would build a loose contact, leading to danger of sparks an subesquent fire. Of course the charger had CE and a lot of further security tokens on it. I forwarded the dangerous thing to German authorities. But what's the use? German or even European authorities can only prosecute the merchant. They will never get hold of the Chinese manufacturer.

Sorry we shut you out, says Tutanota: Encrypted email service weathers latest of ongoing DDoS storms

Re: Best advert ever

yes, that's true, I forgot: tuta lacks notification. And free accounts not used for six months are deleted. So, advantage for proton. Still tuta has its place for "special" purposes. ;-)

yes, lavabit, mailbox.org and posteo all cost. Huge amounts such as 15$/year (lavabit) or 12€/year (the other two). For more money you get more features.

I for one have paid accounts with ALL providers mentioned (incl. tuta an proton). And I can say: They are worth every single cent!

Re: Best advert ever

tutanota is webmail only, no access w/ normal e-mail client. Same holds true for protonmail.ch, which I recommend as well.

Further recommendations w/ access by e-mail client: lavabit.com, mailbox.org, posteo.de (other languages available).

Party like it's 2004: Almost a quarter of Windows 10 PCs living with the latest update

Re: But it bricks dell computers!

"I would have said sorry, I don't do Windows..." - I always say: I do W7, I do W8.1, I do migration from W to Linux. But I don't do W-X, by no means!

Windows 7 goes dual screen to shriek at passersby: Please, just upgrade me or let me die

Why the hell does public sineage need underlying Windows?

a RasPi running Linux would be quite sufficient - and save energy!

All that Samsung users found on UK website after weird Find my Mobile push notification was... other people's details

get rid of S... bloat

I for one don't use Samsung because I don't want to support children's work and bloody raw materials. But if someone owns already a S... device and wants to dispose off the bloatware and espionage, the only way is to install a custom ROM. That is no rocket science; I have done it on several devices from various manufacturers. Not yet on a S... but it seems to be easier than with some others. The key is the SW Odin delivered by S. Here is a link to start from:

https://www.cyanogenmods.org/forums/topic/lineage-os-16-for-galaxy-s5/

hth.

get rid of S... bloat

I for one don't use Samsung because I don't want to support children's work or bloody raw material. Anyway, if someone has a Samsung device already and wants to get rid of bloatware and espionage, the only way out is a custom-ROM. I have done that on various Android devices, not yet on Samsung. But as far as the news go it seems to be a quite simple process, simpler than on other devices. The key is the SW Odin delivered by Samsung. Here an link to start from:

https://www.cyanogenmods.org/forums/topic/lineage-os-16-for-galaxy-s5/