Post Valentine's Day Massacre

As the result of a Freedom of Information Act (FOIA) request, you can now take the NSA's course on python, for beginners. They describe the training materials as lightly redacted. Even training materials contain information you aren't cleared for. State secrets. Espionage aids. Venom with Python - a free course.

I wouldn't download any training materials, if I were you.




8 things users do that make security pros miserable.

1. breathe
2. touch computers

The Free Software Foundation sent Microsoft an empty hard drive, demanding the source code to Windows 7. Microsoft responded immediately, saying they were sending the source code down via Santa Claus.

Lenovo, HP, Dell periphals face unpatched firmware bugs

10 "Sweyntooth" Bluetooth bugs found

Microsoft Confirms Windows 10 KB4524244 Issues and Pulls the Update

Windows 10 users affected by new shutdown bug - how to fix

del c:\*.*

Linux   

4 ways to generate a strong pre-shared key

How to set up IPsec-based VPN with Strongswan on Debian and Ubuntu

Useful console services

Practical example of du and awk commands

Put hands under armpits. Run around saying AWK AWK

How to zoom tmux panes for better text visibility

Intel's Clear Linux kicking butt in tests

How to chown recursively

Put Passwords in the Cloud. What's the worst that could happen?

Lastpass has been down for days. Staff is hard to reach or denying there's an issue on Twitter.


Citrix ships patch for VPN vuln



600 computers taken down in Volusia County Public Library system cyberattack.
50 back up.


Hans Andersson online payment portal hacked, info stealer injected for 2 months.


More than 500k telnet credentials for IoT devices leaked.
This is a biggie.


Apple is genuinely concerned about your privacy. Except if the FBI asks.




LINUX


Official Kubuntu laptop goes on sale.
Starting at $2395, I'd buy a good laptop and load Xubuntu, as I've done since my first laptop.


Locking and unlocking accounts

Apple Sleight of Hand

Security Dude Brian Krebs discovered the iPhone 11 sent location data even when the service was disabled. Apple said they didn't see any problems. Now Apple says the chip necessitates constant location checks.

Bulldookey.


A bug in the way unix-flavored systems handle TCP connections could put VPN users at risk of having their encrypted traffic hijacked.

Affects "most" Linux distros, along with Android, iOS, macOS, FreeBSD, and OpenBSD.


New Mac malware hides behind a fake crypto trading platform called Union Crypto Trader.  Probably North Korean Lazarus group.


VPN is going away - check out Zero Trust


Really good piece on why the user isn't a consideration in software.
Nor is privacy. Surprise - it's Google! Not surprise: don't use Chrome or any browser based on Chrome.



Have a fun weekend. We'll be back Monday, with another slate of specially curated (the ones I came across) stories. Remember: tell your friends about ThermionicMalware. Better yet, tell people you don't like. Reproduction of this blog is prohibited without express written consent of the Backyard Underwriter Liability Lobby of Swingset Hueristics, Investigative Trade (BULLSHIT).