Enlarge (credit: Christiaan Colen ) Google researchers have discovered at least three software bugs in a widely used software package that may allow hackers to execute malicious code on vulnerable devices running Linux, FreeBSD, OpenBSD, NetBSD, and macOS, as well as proprietary firmware. Dnsmasq , as the package is known, provides code that makes it easier for networked devices to communicate using the domain name system and the Dynamic Host Configuration Protocol . It’s included in Android, Ubuntu, and most other Linux distributions, and it can also run on a variety of other operating systems and in router firmware. A blog post published Monday by security researchers with Google said they recently found seven vulnerabilities in Dnsmasq, three of which were flaws that allowed the remote execution of malicious code. One of the code-execution flaws, indexed as CVE-2017-14493, is a “trivial-to-exploit, DHCP-based, stack-based buffer overflow vulnerability.” Combined with a separate information leak bug Google researchers also discovered, attackers can bypass a key protection known as address space layout randomization, which is designed to prevent malicious payloads included in exploits from executing. As a result, exploits result in a simple crash, rather than a security-compromising hack. By chaining the code-execution and information leak exploits together, attackers can circumvent the defense to run any code of their choosing. Read 2 remaining paragraphs | Comments
See more here:
Code-execution flaws threaten users of routers, Linux, and other OSes
Remember that “kill switch” which shut down the WannCry ransomware? An anonymous reader quotes Motherboard: Over Friday and Saturday, samples of the malware emerged without that debilitating feature, meaning that attackers may be able to resume spreading ransomware even though a security researcher cut off the original wave. “I can confirm we’ve had versions without the kill switch domain connect since yesterday, ” Costin Raiu, director of global research and analysis team at Kaspersky Lab told Motherboard on Saturday… Another researcher confirmed they have seen samples of the malware without the killswitch. Read more of this story at Slashdot. 
Amazon is taking a tough stance against vendors who sell fully-loaded Kodi boxes and other “pirate” media players through its platform. From a report: The store now explicitly bans media players that “promote” or “suggest” the facilitation of piracy. Sellers who violate this policy, of which there are still a few around, risk having their inventory destroyed. While Kodi itself is a neutral platform, millions of people use third-party add-ons to turn it into the ultimate pirate machine. In some cases, the pirate add-ons are put onto the devices by vendors, who sell these “fully-loaded” boxes through their own stores or marketplaces such as Amazon. The ecommerce giant appears to be well aware of the controversy, as it recently published an updated policy clarifying that pirate media players are not permitted on the platform. Merely ‘suggesting’ that devices can be used for infringing purposes is enough to have them delisted. Read more of this story at Slashdot. 
After a North Korean system administrator misconfigured its nameserver allowing anyone to query it and get the list of the domains that exist for .kp, it was revealed that the secretive country only has 28 websites. That’s 28 websites for a country with nearly 25 million people. Naturally, the story was published all across the web, including on Reddit, which resulted in a high number of users visiting North Korea’s websites. Mirror.co.uk reports: When a list of North Korea’s available websites was posted on Reddit, the surge of visitors to the reclusive state’s online offering overloaded the servers. North Korea runs a completely locked-down version of the internet that consists of only 28 “websites” that the population is allowed to view. However, a technical slip-up allowed a GitHub user to work their way into the country’s computer network and view the websites from the outside. As the GitHub user puts it: “One of North Korea’s top level name servers was accidentally configured to allow global [Domain Name System] transfers. This allows anyone who performs [a zone transfer request] to the country’s ns2.kptc.kp name server to get a copy of the nation’s top level DNS data.” Pretty soon, links to all the websites were posted on Reddit, where thousands of visitors took the opportunity to see what the web looks like from Pyongyang. Reddit’s surge of traffic isn’t the first time North Korea’s internet has been knocked out. In 2014, the country suffered a distributed denial of service (DDoS) attack that was believed to have originated from the U.S. Redditor BaconBakin points out that while North Korea has 28 websites, GTA V has 83 websites. They added, “I think it’s safe to say that San Andreas is more technologically advanced than North Korea.” Read more of this story at Slashdot.