Hello everyone and welcome to a week of Linux news for the 29th January 2017.
I would like to start this week with an amazing Raspberry Pi case, it's a mini version of
a Super Nintendo called the Super Pi case. This really takes me back to my childhood.
I’ve always wanted to put a computer inside an old SNES console. Too bad the British version
is slightly too small for a mini ITX motherboard. I guess a Raspberry Pi would have been a good
alternative though.
The cartridges aren’t just for show here in the Super Pi case, they hold an operating
system, and we can see an example of Retro Pi and Kodi cartridges.
Wow. Shut up and take my money! Oh but it's not for sale.
Onwards to something we can actually buy. Asus have created an alternative to the Raspberry
Pi, called the Tinker Board. Or some very long code number, which it is actually called.
At £55 it is about £25 more expensive than a Raspberry Pi, however its specs are more
powerful: It contains an Arm Cortex A17 CPU running
at 1.8GHz, ARM Mali-T764 GPU, and 2GB of DDR3 memory.
The Mali GPU is capable of carrying out HEVC H265 decoding at 4K.
Nice, I wonder if it can bitstream Dolby True HD and DTS HD? Probably not. So thats a deal
breaker for me.
The dimensions are 8.5 by 5.3 cm.
At the moment there is only a custom Debian distribution, which appears to have been put
together by Asus themselves. If the Tinker Board takes off, then maybe we will see other
custom Linux distributions?
Spanish computer maker Slimbook have released a new laptop with KDE Neon. Huh strange choice.
As much as I like KDE Neon, it’s not really a Linux distribution I would recommend for
the average user because it's so minimal and sparse.
Although it would be so nice to purchase an OEM product without ten tons of shite pre-installed.
Specs seem reasonable enough. We have an option of Intel i5 or i7 CPU.
2.3GHz or 2.5GHz respectively. Both are dual core CPU’s.
4GB, 8GB, or 16GB DDR3 RAM. Solid state disk option of 120GB, 250GB, or 500GB
13.3” 1080 LED screen
Dimensions are 33 x 22 x 1.8 cm and it weighs 1.3 KG
They offer keyboard layout in Spanish, English, French or German.
Prices start from 729 Euros (£620 / 780 USD)
The KDE Slimbook is available to pre-order from today via the Slimbook website.
Shipping is currently aiming at about mid-March 2017.
Wine has hit version 2.0 The release represents over a year of development
effort and around 6,600 individual changes. The main highlights are the support for Microsoft
Office 2013, and 64-bit support on macOS.
There are a huge number of other changes, and I’ll leave a link to the full release
notes in the video description.
I see they are moving towards a new time-based, annual release schedule.
It implies that some features that are being worked on but couldn't be finished in time.
Huh releasing an upgrade for the sake of it regardless of whether it is ready or not?
Well I hope it doesn’t backfire for them.
Ubuntu 17.04 Alpha 2 has been released. This milestone features images for Lubuntu,
Kubuntu, Ubuntu MATE, Ubuntu Kylin, Ubuntu GNOME, and Ubuntu Budgie - all the derivatives.
I don’t think I’ll bother looking at the Alpha builds as I have quite a few things
in my to do list.
An easily exploitable security flaw has been found in Systemd v228. I’m not going to
dwell on this one too long because it’s only a local root exploit, and can not be
triggered over the Internet. The flaw was quietly fixed in Systemd v229,
and that is the version currently in use in Ubuntu 16.04 LTS.
There is a very trivial proof of concept exploit available, so that does bump up the overall
CVSS risk score, on the other hand it is only a local exploit.
I recommend you get your system updates done at some point, but there is no reason to stop
this video and run off in a panic.
Dr Web have written a report on a new Linux trojan called Linux.Proxy.10.
The Trojan is designed to set up a SOCKS5 proxy server on the infected system. To distribute
the Trojan, cybercriminals log in to the vulnerable devices via SSH. There is a list of vulnerable
devices, as well as the logins and passwords that go with them, which is stored on a server
belonging to the cybercriminals.
It’s a password guessing attack against well I expect mostly Internet of Tat devices,
err I mean Internet of Things.
Doctor Web security researchers have succeeded in counting the number of devices infected
with Linux.Proxy.10: as of January 24, 2017, it runs into the several thousands.
I wonder why they didn’t give an exact quantity?
Sadly it doesn’t surprise me, I’ve seen how aggressive Mirai scanning is for TCP ports
23 and 2323 (both SSH ports). A vulnerable Linux IoT device will be compromised within
a couple of minutes of being exposed to the outside world without Firewall protection.
It's the current year and 200,000 systems are still susceptible to Heartbleed more than
two years and 9 months after the huge vulnerability was disclosed.
That’s shocking, patches have been available in all Linux distributions for a long time,
I guess some people either don’t have control of their servers, or can’t be bothered with
updates?
The vulnerability (CVE-2014-0160) that established the practice of branding bugs lived up to
its reputation: the tiny flaw in OpenSSL allows anyone to easily and quietly plunder vulnerable
systems, stealing passwords, login cookies, private crypto-keys, and much more.
Shodan boss John Matherly says about 200,000 services remain Heartbleed-exploitable thanks
to unpatched OpenSSL instances.
Leading the way with most number of exploitable services is the United States with 42,000,
distantly followed by South Korea with 15,000, and China with 14,000.
There are quite a few charts on Shodan, but the one I find interesting is the Top Operating
systems No mention of Linux kernel 4, I suspect that
it because kernel version 4 came out around a similar time to Heartbleed, and therefore
the OS wouldn’t be vulnerable, or would be new enough for patching.
I see Linux 2.6 and 2.4 are in the list. Linux 2.4 dates between 2001 and 2003.
Linux 2.6 dates between 2003 and 2011.
Who is still running a Linux distribution which is that old?
Avast antivirus decided to block download of KDE Neon User and LTS ISO files due to
detection of a virus within the vmlinuz and vmlinuz.efi.
(laugh) What the compressed kernel executable which
is essential for a live Linux system. Sure that's a deadly virus.
The issue has been reported to Avast Customer Care team, they've confirmed the issue and
have escalated it to their Virus Lab for further analysis and resolution.
Good old false positives from Antivirus companies. It's not the first, and won’t be the last,
but right now it has made Avast look foolish.
As if that wasn’t insulting enough for KDE Neon, Google recently marked the Polish download
mirror as unsafe in Google Safebrowsing. Google Safebrowsing is used in Chrome, Chromium
and Firefox, and probably a few of the other smaller open source browsers.
That concludes the week of Linux news. Thanks for watching and I’ll see you all later.