Topic: Security – Ctrl blog

The entirely predictable problems with the Vulnonym naming scheme

2020-11-04T09:27:00Z

Security researchers increasingly give security vulnerabilities they discover a unique and memorable name and logo. Names (and cute logos) generate more exposure for the vulnerability and the researchers who found it. The Computer Emergency Response Team Coordination Center (CERT/CC) believes this naming trend invokes “fear, uncertainty, and doubt for vendors, researchers, and the general public.” To address the situation, it has introduced Vulnonyms: a system for automatically naming vulnerabilities. What could possibly go wrong?

TeamViewer RPM repo left door open for malicious packages

2020-11-02T15:50:00Z

Three months ago, I discovered a security vulnerability in TeamViewer RPM auto-updates on Linux. The vulnerability allowed an attacker-in-the-middle (AITM) to subvert the TeamViewer RPM package repository to install and execute arbitrary software with root permissions.

Google Authenticator enables device-transfers, but no export options

2020-05-26T18:31:00Z

You’ve probably seen calls to “secure your account” with a second-factor authentication (2FA) app all over the web. Online services promote it as a way to improve the security of your online account. After you’ve enabled 2FA, you need to know your username and password as well as a one-time use token (a four–six digit code) generated by your 2FA app.

How to back up your password manager

2020-02-17T19:25:00Z

Password managers aren’t infallible. They suffer service outages like every other service. Yet, password managers ask their customers to trust them completely. They’re a single point of failure and are difficult to back up.

Limit the impact of a security intrusion with systemd directives

2020-02-10T10:39:00Z

Three weeks ago, I wrote systemd service sandboxing and security hardening 101: an introduction to Linux security features for service processes managed by systemd.