Red Hat Enterprise Linux: An updated python-urllib3 package that fixes one bug is now available for Red
Hat Enterprise Linux 7.
Monthly Archives: August 2015
RHBA-2015:1531-1: kubernetes bug fix and enhancement update
Red Hat Enterprise Linux: Updated kubernetes packages that fix several bugs and add various enhancements
are now available for Red Hat Enterprise Linux 7 Extras.
RHBA-2015:1573-1: git bug fix update
Red Hat Enterprise Linux: Updated git packages that fix one bug are now available for Red Hat Enterprise
Linux 7.
Mr. Robot Review: v1ew-s0urce.flv
This week’s episode was pretty intense — although not so many hacks took place, this week focused on meaningful development of the show’s characters. The episode opened with a flashback to when Elliot and Shayla met; we now know where he got his fish and that he is the reason Shayla got involved with Vera. Then we move onto Angela, who has gone forward with her plan to get justice for her mom’s death, but she isn’t the only one on a mission. Tyrell continued in his fight to become CTO of E Corp – going a little too far (even for his own comfort) during his private time with Sharon, the wife of the newly-appointed E Corp CTO.
Despite the fact that there were no major hacks, there were a few interesting scenes I sat down to talk about with my colleague, Filip Chytry, security researcher at Avast.

Minute 10:30: Gideon tries to talk to Elliot about his grieving over Shayla. Elliot recalls how he got into web design by ripping off sites he liked by copying their source code and then modifying that code. He then wonders what it would be like if there were a “view source” option for people. We then see people in the AllSafe office walking around with signs around their necks that say things like “I love feet” or “I got a nose job”.
Stefanie: This scene with people walking around with their “source code” amused me. Do you think it would be a good idea if we could see people’s source code as easily as we can view website source codes? And I have to ask, what would your source code be Filip?
Filip: There is a saying, “some things are better left unsaid” and in this case I would say, “some things are better left unknown”. As we saw in the scene, some people’s source code is a little too private to be seen by the world and in the digital age,we share enough of our private lives that there is no need to go that far. As for my source code… I would rather not say, but I think it would involve sports, chocolate, or cars.
Stefanie: Do hackers ever leave clues or messages in their code?
Filip: Yes, they occasionally do! My colleague Jan analyzed Android malware, XBot, at the beginning of the year. In the code, the malware author left a clear and rather unpleasant message for antivirus companies. We guessed that he was a little bitter about us blocking his masterpieces.
Minute 25:40: Darlene is summoned for a meeting with Cisco. He is upset that she hacked him to contact White Rose from the Dark Army using his handle.
Stefanie: Darlene is such a rebel! Can you help me understand how she ended up communicating with the Dark Army using Cisco’s handle?
Filip: She hacked his router. She probably figured out which router he was using and exploited a vulnerability to get into the router. Today’s router security situation is similar to PCs in the 1990s — new router vulnerabilities are discovered every day. From there, she got ahold of his IP address by looking at his router’s past communication. Getting into the channel, which I am guessing is either a forum or chat, using his handle depends on how hidden the channel is, and if the “Dark Army” is involved, I am guessing this wasn’t very simple.
Stefanie: Wow! Routers are the center point of households nowadays, with Internet-connected devices all connecting to the router itself. What can people do to protect themselves?
Filip: It’s simple, really — they can use Avast’s Home Network Security scanner! Home Network Security exposes weak or default passwords, vulnerable routers, compromised Internet connections, and enabled, but not protected, IPv6. Home Network Security provides guidelines explaining how to fix vulnerabilities to make sure your network is fully protected…something Cisco (Darlene’s ex boyfriend on Mr. Robot, not the router manufacturer!) should consider doing. ![]()
Minute 38:05: Darlene goes to meet with fellow FSociety member, Trenton, to convince her to re-join the cause. Trenton asks Darlene if she has ever thought about which part of the FSociety scheme motivates her. Trenton then describes what she thinks motivates the other members: momentary anarchy, palling around, and fame.
Stefanie: What do you think motivates hackers?
Filip: Back in the day, hackers used be motivated by fame – hacking for the sake of proving something can be hacked –but the game has since changed. Hackers are now more motivated by financial gain and steal money from accounts, hold data hostage for ransom or steal customer data from major corporations to sell on the black market of the Internet. The days of famous hackers are basically over because nowadays, hackers want their identities to remain anonymous in order to keep committing cybercrime.
What did you think of the episode? Let us know in the comments below!
![]()
Microweber 1.0.3 Shell Upload
Microweber version 1.0.3 suffers from an authenticated arbitrary command execution vulnerability. The issue is caused due to the improper verification when uploading files in ‘/src/Microweber/functions/plupload.php’ script. This can be exploited to execute arbitrary PHP code by bypassing the extension restriction by putting the dot character at the end of the filename and uploading a malicious PHP script file that will be stored in ‘/userfiles/media/localhost/uploaded’ directory.
USN-2703-1: Cinder vulnerability
Ubuntu Security Notice USN-2703-1
5th August, 2015
cinder vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 15.04
Summary
Cinder could be made to access unintended files over the network by an
authenticated user.
Software description
- cinder
– OpenStack storage service
Details
Bastian Blank discovered that Cinder guessed image formats based on
untrusted data. An attacker could use this to read arbitrary files from
the Cinder host.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 15.04:
-
python-cinder
1:2015.1.0-0ubuntu1.1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart cinder to make all the
necessary changes.
References
USN-2704-1: Swift vulnerabilities
Ubuntu Security Notice USN-2704-1
5th August, 2015
swift vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary
Several security issues were fixed in Swift.
Software description
- swift
– OpenStack distributed virtual object store
Details
Rajaneesh Singh discovered Swift does not properly enforce metadata
limits. An attacker could abuse this issue to store more metadata than
allowed by policy. (CVE-2014-7960)
Clay Gerrard discovered Swift allowed users to delete the latest version
of object regardless of object permissions when allow_version is
configured. An attacker could use this issue to delete objects.
(CVE-2015-1856)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 15.04:
-
swift
2.2.2-0ubuntu1.3
- Ubuntu 14.04 LTS:
-
swift
1.13.1-0ubuntu1.2
- Ubuntu 12.04 LTS:
-
swift
1.4.8-0ubuntu2.5
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart swift to make
all the necessary changes.
References
USN-2705-1: Keystone vulnerabilities
Ubuntu Security Notice USN-2705-1
5th August, 2015
python-keystoneclient, python-keystonemiddleware vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
Summary
Keystone could be made to expose sensitive information over the
network.
Software description
- python-keystoneclient
– Client library for OpenStack Identity API - python-keystonemiddleware
– Client library for OpenStack Identity API
Details
Qin Zhao discovered Keystone disabled certification verification when
the “insecure” option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
man-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)
Brant Knudson discovered Keystone disabled certification verification when
the “insecure” option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
man-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 15.04:
-
python-keystonemiddleware
1.5.0-0ubuntu1.1
-
python-keystoneclient
1:1.2.0-0ubuntu1.1
- Ubuntu 14.04 LTS:
-
python-keystoneclient
1:0.7.1-ubuntu1.2
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart Keystone to make
all the necessary changes.
References
Microweber 1.0.3 Cross Site Request Forgery / Cross Site Scripting
Microweber version 1.0.3 suffers from cross site request forgery and stored cross site scripting vulnerabilities.
Smart cars – are they a danger to your safety?

Imagine that you’re cruising along at 112 kilometers per hour, confident in the stability and security of your brand new Jeep Cherokee. Suddenly, you begin to notice that the air conditioning has come on by itself. Next of all the music is increasing in volume and the windscreen wipers have taken on a life of their own. Finally, the engine cuts out.
This is what happened to Andy Greenberg, a journalist for Wired. Luckily for him though, two experts in computer security, Charlie Miller and Chris Valasek, had already warned him that this could happen.
From a distance of 15 kilometers, the two investigators were able to control the vehicle by taking advantage of a vulnerability in the navigation and entertainment system, Uconnect. Chrysler chose to cover over the problem with a blocker that the client had to download, but eventually they admitted that they had to recall up to 1.4 million vehicles.
The Internet of Things has come down heavily on the automotive industry. According to a report by Gartner, more than 150 million cars will be connected by 2020. However, the security of their systems is still a pending issue.
This isn’t the first time that these investigators have called on the manufacturers to pull up their socks. They have spent three years studying how to hack smart cars and have passed on their concerns to the lawmakers.
US Senators Richard Blumenthal and Ed Markey hope that a new law will establish a series of standards of protection to ensure the safety and privacy of the information of these vehicles. Markey commissioned a report which concluded that, with this technology, there are new vulnerabilities that could be exploited by cybercriminals. The study also said that most car manufacturers surveyed were not aware of potential security breaches in their vehicles.
Valasek and Miller are not the only ones studying the errors in these smart cars. Security expert Samy Kamkar will present the details of a new attack on the OnStar system for smart cars at the DefCon security conference. This new attack can locate the vehicle, unlock and even start the engine, all from a mobile phone app called Remote Link.
Kamkar has shown that with a cheap homemade device (it only cost him $100, about €91), it is possible to intercept the information being sent to the smartphone to locate, unlock and start the engine.

A few months ago we learned that a 14 year old was able to hack a smart car and wirelessly activate the wipers, the locking system and the lights, all with a homemade circuit.
“The safety of these cars is virtually nonexistent, it is at the same level of protection as the desktop computers that we had in the 80s. The basic requirements of authentication, confidentiality and integrity are not strong,” warned Andry Rakotonirainy, a researcher at the Accident Research Centre and Highway Safety at the Queensland University of Technology. According to this expert, while the technology continues to advance, so does the risk associated with it.
According to forecasts by Gartner, within five years we could all be driving a smart car, while Google reckons we’ll be occupying the passenger seat, as it expects to start selling its famous autonomous cars that year. The FBI has already warned, in an internal report, of the danger that cybercriminals can pose to the safety of autonomous cars by making them ignore traffic lights and speed limits, or to even schedule car bombs.
Despite the advantages of our cars being connected to the Internet, such as allowing us to publish on social networks or to listen to internet radio, this wireless connection has opened up a new range of vulnerabilities. We better hope that car manufacturers begin to consider security from the current design of smart cars and future autonomous cars to prevent any cybercriminal from locating our vehicle and making a fool of us by, hopefully, just messing with our windscreen wipers.
The post Smart cars – are they a danger to your safety? appeared first on MediaCenter Panda Security.