Post Syndicated from xkcd.com original https://xkcd.com/2976/

Post Syndicated from Talks at Google original https://www.youtube.com/watch?v=bxjFU9o3f-8

Post Syndicated from corbet original https://lwn.net/Articles/986906/

Version
24.8 of the LibreOffice office suite has been released. Changes
include the ability to filter identifying information from exported files,
easier creation of cross reference, better control over hyphenation, a
number of new spreadsheet functions, accessibility improvements, and more.

Post Syndicated from Rapid7 original https://blog.rapid7.com/2024/08/22/preparing-for-unknown-risks-how-to-better-prepare-for-risks-you-cant-see-yet/

As security professionals we’re used to dealing with unknowns and unpredictability. We understand that it’s impossible to always know what’s around the corner. It’s not just about external threats and the big breaches splashed across the news headlines. On one hand, we’re combating threat actors attempting to steal information, money or simply trying to cause havoc. On the other, we’re trying to better understand employee behaviour amidst the myriad of applications they use on a daily basis; always vigilant for any suspicious activity. And while it certainly makes our jobs interesting, unpredictability runs contrary to how the organisations we protect prefer to operate.

Predicting what’s going to happen in our cyber world is nearly impossible.  A greater challenge is explaining this to stakeholders and conveying how difficult it is to get (and stay) one step ahead of threat actors. We’re paid to understand this, yet  it can often feel like shooting in the dark when anticipating the next strike.

Senior leadership teams thrive on certainty and predictability. So how do you plan and manage this?

Focus on what you can control

Ultimately, you can only control what’s in front of you.:he tools, applications and services the business uses to operate. While this might seem obvious, many people spend a considerable amount of time and energy on things that can’t influence.

Your time is best spent focusing on what’s visible and within reach. Begin by identifying the crown jewels of your organisation — understanding the scope of your environment and what exactly you’re protecting. Then, implement controls and monitor for abnormalities.

Regularly conduct comprehensive risk assessments and vulnerability scans to identify potential weaknesses in your organisation’s IT infrastructure. This helps uncover existing vulnerabilities and potential entry points for cyber threats, particularly in areas where the ‘crown jewels’ are held!

Leverage threat modelling

Threat modelling provides very useful analysis, unique to your organisation. Various factors determine your threat model including industry, compliance and regulations and finally, customers. Using your threat model as a guide, you can get a clear picture of the unique risks your business faces and design controls around those. These insights can also inform your approach to Table Top Exercises, preparing you for potential incidents.

While predicting a threat actor’s next steps is challenging, gathering and understanding this information through these exercises can enhance your ability to anticipate future threats. Afterall, identifying unknowns is crucial.

With a clear focus on what you’re protecting, you’re now able to analyse and draw learnings from past events, which is often a good predictor of future occurrences.  While threat actors are often portrayed as volatile and unpredictable (and this is true in some cases), they’re only human – and humans are creatures of habit. Recognizing patterns in their behaviour can provide valuable insights.

This is where threat intelligence gathering is extremely useful. Make sure you stay informed about the latest cyber threats and attack trends by monitoring reputable sources of threat intelligence. Placing yourself in a position to better understand what trends and patterns have occurred in the past, may help you better predict the types of threats or vulnerabilities your organisation could be subject to in the future.

How Rapid7 can help – Threat Command

Threats can come from any direction. Rapid7’s Threat Command scans the clear, deep, and dark webs for potential dangers before they affect your organisation. It provides contextualised alerts on threats affecting your business, proactively researching malware, tactics, techniques, and procedures (TTPs), phishing scams, and other threat actors. Threat Command replaces point solutions with an all-in-one external threat intelligence, digital risk protection, indicators of compromise (IOCs) management, and remediation solution.

Find out more.

Proactive profiling

Conducting risk assessments, vulnerability scans and gathering threat intelligence helps you to understand the ‘cyber profile’ of your organisation. This preparation helps you anticipate the types of threats typically used against similar-sized organisations or those in your industry. There are trends and patterns that emerge., for example, our Ransomware Data Disclosure Report found that internal financial data was leaked 71% of the time in the healthcare and pharmaceutical sectors — more than in any other industry, including financial services.

Tailored strategies for different organisations

Threat actors focus on ‘big fish’ because they’re often  newsworthy and recognizable – threat actors have egos too! Large organisations should consider strong encryption and network segmentation to contain potential threats. Prioritise data types for additional protection.

For smaller organisations, where an online presence is critical but public profile is lower, backup and recovery are essential. This is in case  systems are locked or shut down. Ensure software and systems are up-to-date with the latest security patches to prevent threats exploiting known vulnerabilities. Automate this process to keep it off the to-do list.

Building a detailed picture of your data and crown jewels allows you to reduce risks and build cyber resilience, identifying potential unknowns along the way.

How Rapid7 can help – Managed Detection and Response

Managed Detection and Response (MDR) services accelerate your team’s incident-response capabilities with end-to-end service. Acting as a seamless extension of your team, our experts monitor your business 24/7/365.. They leverage proprietary technology and analytics to keep your business safe against advanced threats. You can also gain access to our award winning VRM technology to perform unlimited scans to your in-scope environment to spot vulnerabilities before they’re exploited by threat actors.

Find out more.

Communication is key

But don’t forget — communication is key. Organisations crave  predictability and cybersecurity can often appear to be a ‘black box’ to those unfamiliar with  it. Transparent lines of communication and regular updates means you can paint a clear picture of potential risks that could impact your business (not to mention the business benefits of investing in security).

Proactivity is essentia. With so much happening in our field, it can be tempting to simply react and respond to what’s going on around us. However, demanding weekly updates with your stakeholders and keeping them informed of your work will make managing a crisis more bearable. This way, if something unpredictable happens, it won’t be a complete surprise, and you’ll be better prepared to manage it and your senior leaders.

Post Syndicated from daroc original https://lwn.net/Articles/985853/

On July 30, Al Viro sent

a patch set to the linux-fsdevel mailing list with a
comprehensive cover letter explaining his
recent work on ensuring that the kernel’s internal representation of
file descriptors are used correctly in the kernel.
File descriptors are ubiquitous; many system calls
need to handle them. Viro’s review
identified a few existing bugs, and may prevent more in the future. He also had
suggestions for ways to keep uses consistent throughout the kernel.

Post Syndicated from BeardedTinker original https://www.youtube.com/watch?v=c6YADFZJ01s

Post Syndicated from corbet original https://lwn.net/Articles/986844/

Matthew Garrett describes
the role of the Secure Boot Advanced Targeting mechanism and how it
played into the recent Windows upgrade problems.

So why is this suddenly relevant? SBAT was developed
collaboratively between the Linux community and Microsoft, and
Microsoft chose to push a Windows update that told systems not to
trust versions of grub with a security generation below a certain
level. This was because those versions of grub had genuine security
vulnerabilities that would allow an attacker to compromise the
Windows secure boot chain, and we’ve seen real world examples of
malware wanting to do that.

Post Syndicated from jake original https://lwn.net/Articles/986841/

Security updates have been issued by AlmaLinux (.NET 8.0, bind, bind9.16, curl, edk2, firefox, gnome-shell, grafana, jose, krb5, libreoffice, mod_auth_openidc:2.3, orc, pcs, poppler, python-setuptools, python-urllib3, python3.11-setuptools, python3.12-setuptools, thunderbird, tomcat, and wget), Fedora (webkitgtk), SUSE (apache2, glib2, and roundcubemail), and Ubuntu (kernel, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15,
linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15,
linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm,
linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm,
linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle,
linux-raspi, linux, linux-aws, linux-azure, linux-bluefield, linux-gcp, linux-gcp-5.4,
linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm,
linux-oracle, linux-oracle-5.4, linux-raspi, linux-xilinx-zynqmp, linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-ibm,
linux-lowlatency, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency,
linux-oem-6.8, linux-oracle, linux-raspi, linux, linux-aws, linux-kvm, linux-lts-xenial, linux, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-aws, linux-aws-hwe, linux-bluefield, linux-hwe-5.15, linux-raspi-5.4, and qemu).

Post Syndicated from Nikita Cano original https://blog.cloudflare.com/wildcard-rules

Back in 2012, we introduced Page Rules, a pioneering feature that gave Cloudflare users unprecedented control over how their web traffic was managed. At the time, this was a significant leap forward, enabling users to define patterns for specific URLs and adjust Cloudflare features on a page-by-page basis. The ability to apply such precise configurations through a simple, user-friendly interface was a major advancement, establishing Page Rules as a cornerstone of our platform.

Page Rules allowed users to implement a variety of actions, including redirects, which automatically send visitors from one URL to another. Redirects are crucial for maintaining a seamless user experience on the Internet, whether it’s guiding users from outdated links to new content or managing traffic during site migrations.

As the Internet has evolved, so too have the needs of our users. The demand for greater flexibility, higher performance, and more advanced capabilities led to the development of the Ruleset Engine, a powerful framework designed to handle complex rule evaluations with unmatched speed and precision.

In September 2022, we announced and released Single Redirects as a modern replacement for the URL Forwarding feature of Page Rules. Built on top of the Ruleset Engine, this new product offered a powerful syntax and enhanced performance.

Despite the enhancements, one of the most consistent pieces of feedback from our users was the need for wildcard matching and expansion, also known as globbing. This feature is essential for creating dynamic and flexible URL patterns, allowing users to manage a broader range of scenarios with ease.

Today we are excited to announce that wildcard support is now available across our Ruleset Engine-based products, including Cache Rules, Compression Rules, Configuration Rules, Custom Errors, Origin Rules, Redirect Rules, Snippets, Transform Rules, Web Application Firewall (WAF), Waiting Room, and more.

Understanding wildcards

Wildcard pattern matching allows users to employ an asterisk `(*)` in a string to match certain patterns. For example, a single pattern like `https://example.com/*/t*st` can cover multiple URLs such as `https://example.com/en/test`, `https://example.com/images/toast`, and `https://example.com/blog/trust`.

Once a segment is captured, it can be used in another expression by referencing the matched wildcard with the `${<X>}` syntax, where `<X>` indicates the index of a matched pattern. This is particularly useful in URL forwarding. For instance, the URL pattern `https://example.com/*/t*st` can redirect to `https://${1}.example.com/t${2}st`, allowing dynamic and flexible URL redirection. This setup ensures that `https://example.com/uk/test` is forwarded to `https://uk.example.com/test`, `https://example.com/images/toast` to `https://images.example.com/toast`, and so on.

Challenges with Single Redirects

In Page Rules, redirecting from an old URI path to a new one looked like this:

• Source URL: `https://example.com/old-path/*`

• Target URL: `https://example.com/new-path/$1`

In comparison, replicating this behaviour in Single Redirects without wildcards required a more complex approach:

• Filter: `(http.host eq “example.com” and starts_with(http.request.uri.path, “/old-path/”))`

• Expression: `concat(“/new-path/”, substring(http.request.uri.path, 10)) (where 10 is the length of /old-path/)`

This complexity created unnecessary overhead and difficulty, especially for users without access to regular expressions (regex) or the technical expertise to come up with expressions that use nested functions.

Wildcard support in Ruleset Engine

With the introduction of wildcard support across our Ruleset Engine-based products, users can now take advantage of the power and flexibility of the Ruleset Engine through simpler and more intuitive configurations. This enhancement ensures high performance while making it easier to create dynamic and flexible URL patterns and beyond.

What’s new?

1) Operators “wildcard” and “strict wildcard” in Ruleset Engine:

• “wildcard” (case insensitive): Matches patterns regardless of case (e.g., “test” and “TesT” are treated the same, similar to Page Rules).

• “strict wildcard” (case sensitive): Matches patterns exactly, respecting case differences (e.g., “test” won’t match “TesT”).

Both operators can be applied to any string field available in the Ruleset Engine, including full URI, host, headers, cookies, user-agent, country, and more.

This example demonstrates the use of the “wildcard” operator in a Web Application Firewall (WAF) rule applied to the User Agent field. This rule matches any incoming request where the User Agent string contains patterns starting with “Mozilla/” and includes specific elements like “Macintosh; Intel Mac OS “, “Gecko/”, and “Firefox/”. Importantly, the wildcard operator is case insensitive, so it captures variations like “mozilla” and “Mozilla” without requiring exact matches.

2) Function `wildcard_replace()` in Single Redirects:

In Single Redirects, the `wildcard_replace()` function allows you to use matched segments in redirect URL targets.

Consider the URL pattern `https://example.com/*/t*st` mentioned earlier. Using `wildcard_replace()`, you can now set the target URL to `https://${1}.example.com/t${2}st` and dynamically redirect URLs like `https://example.com/uk/test` to `https://uk.example.com/test` and `https://example.com/images/toast` to `https://images.example.com/toast`.

3) Simplified UI in Single Redirects:

We understand that not everyone wants to use advanced Ruleset Engine functions, especially for simple URL patterns. That’s why we’ve introduced an easy and intuitive UI for Single Redirects called “wildcard pattern”. This new interface, available under the Rules > Redirect Rules tab of the zone dashboard, lets you specify request and target URL wildcard patterns in seconds without needing to delve into complex functions, much like Page Rules.

How we built it

The Ruleset Engine powering Cloudflare Rules products is written in Rust. When adding wildcard support, we first explored existing Rust crates for wildcard matching.

We considered using the popular `regex` crate, known for its robustness. However, it requires converting wildcard patterns into regular expressions (e.g., `*` to `.*,` and `?` to `.`) and escaping other characters that are special in regex patterns, which adds complexity.

We also looked at the `wildmatch` crate, which is designed specifically for wildcard matching and has a couple of advantages over `regex`. The most obvious one is that there is no need to convert wildcard patterns to regular expressions. More importantly, wildmatch can handle complex patterns efficiently: wildcard matching takes quadratic time – in the worst case the time is proportional to the length of the pattern multiplied by the length of the input string. To be more specific, the time complexity is O(p + ℓ + s ⋅ ℓ), where p is the length of the wildcard pattern, ℓ the length of the input string, and s the number of asterisk metacharacters in the pattern. (If you are not familiar with big O notation, it is a way to express how an algorithm consumes a resource, in this case time, as the input size changes.) In the Ruleset Engine, we limit the number of asterisk metacharacters in the pattern to a maximum of 8. This ensures we will have good performance and limits the impact of a bad actor trying to consume too much CPU time by targeting extremely complicated patterns and input strings.

Unfortunately, `wildmatch` did not meet all our requirements. Ruleset Engine uses byte-oriented matching, and `wildmatch` works only on UTF-8 strings. We also have to support escape sequences –  for example, you should be able to represent a literal * in the pattern with `\*`.

Last but not least, to implement the `wildcard_replace() function` we needed not only to be able to match, but also to be able to replace parts of strings with captured segments. This is necessary to dynamically create HTTP redirects based on the source URL. For example, to redirect a request from `https://example.com/*/page/*` to `https://example.com/products/${1}?page=${2}`, you should be able to define the target URL using an expression like this:

wildcard_replace(
http.request.full_uri, 
"https://example.com/*/page/*", 
"https://example.com/products/${1}?page=${2}"
)

This means that in order to implement this function in the Ruleset Engine, we also need our wildcard matching implementation to capture the input substrings that match the wildcard’s metacharacters.

Given these requirements, we decided to build our own wildcard matching crate. The implementation is based on Kurt’s 2016 iterative algorithm, with optimizations from Krauss’ 2014 algorithm. (You can find more information about the algorithm here). Our implementation supports byte-oriented matching, escape sequences, and capturing matched segments for further processing.

Cloudflare’s `wildcard crate` is now available and is open-source. You can find the source repository here. Contributions are welcome!

FAQs and resources

For more details on using wildcards in Rules products, please refer to our updated Ruleset Engine documentation:

• Ruleset Engine Operators

• Ruleset Engine Functions

We value your feedback and invite you to share your thoughts in our community forums. Your input directly influences our product and design decisions, helping us make Rules products even better.

Additionally, check out our `wildcard crate` implementation and contribute to its development.

Conclusion

The new wildcard functionality in Rules is available to all plans and is completely free. This feature is rolling out immediately, and no beta access registration required. 

We are thrilled to offer this much-requested feature and look forward to seeing how you leverage wildcards in your Rules configurations. Try it now and experience the enhanced flexibility and performance. Your feedback is invaluable to us, so please let us know in community how this new feature works for you!

Post Syndicated from LastWeekTonight original https://www.youtube.com/watch?v=u2ii0DCREzA

Post Syndicated from The Atlantic original https://www.youtube.com/watch?v=fok1pOrJR5w

Post Syndicated from corbet original https://lwn.net/Articles/985783/

The LWN.net Weekly Edition for August 22, 2024 is available.