Red Hat Announced Beta of Red Hat Enterprise Linux (RHEL) 6.3

Red Hat Announced Beta of Red Hat Enterprise Linux 6.3

Just over four months after the release of Red Hat Enterprise Linux (RHEL) 6.2, developer at RedHat has made a beta of version of RHEL 6.3 available. This beta includes a broad set of updates to the existing feature set and also provides rich new functionality particularly in the areas of virtualization, scalability, storage, file systems, and security. As always, the Red Hat Enterprise Linux 6.3 beta delivers new hardware enablement made possible by our strong relationships with our strategic hardware partners. This beta release has been designed for optimized performance, scalability, and reliability to cater to the diverse workloads running in physical, virtual and cloud environments.

Key Features in the Red Hat Enterprise Linux 6.3 Beta:-

Virtualization-

• A new tool called Virt-P2V that facilitates the conversion of physical Windows or Red Hat Enterprise Linux systems into virtual images to be deployed as KVM guests inside Red Hat Enterprise Linux or Red Hat Enterprise Virtualization.

• Stronger compliance with Payment Card Industry Data Security Standards (PCI-DSS), including the ability to perform secure wipes of virtual machine disks.

• The ability to perform live volume resizing, improving the overall availability of virtualized guests.

Scalability-

• The maximum number of virtual CPUs (vCPUs) has been increased from 64 to 160, which lets you run larger CPU-intensive workloads on the Red Hat Enterprise Linux platform. VMware ESX 5.0 currently support 32 vCPUs.

• The maximum supported memory configuration for KVM guests has been increased from 512GB to 2TB.

File Systems-

• GFS2 enhancements that create faster read-write capabilities for specific use cases.

• Support of O_Direct in FUSE (Filesystem in User Space), which can provide improved performance for certain workloads.

• Simplified configuration and administration for the file system. Integration of automount capability with System Security Services Daemon (SSSD) provides centralized management of configuration data and the ability to improve performance through caching and load balancing. (This feature is a Technology Preview.)

Storage-

• Red Hat Enterprise Linux 6.3 provides full support for Fibre Channel over Ethernet (FCoE) Target. This feature, which was previously provided as a Technology Preview, allows customers to present their Red Hat Enterprise Linux servers as FCoE storage devices. This feature complements the FCoE Initiator support that was delivered in Red Hat Enterprise Linux 6.0.

• The Logical Volume Manager (LVM) now provides support for RAID levels 4, 5, and 6. (Previously, support for these RAID levels was provided through the MD subsystem.) This expanded LVM RAID support simplifies overall storage administration by consolidating all management functions, such as creating volumes, resizing volumes, deploying RAID, taking snapshots, etc., into a single interface. (This feature is a Technology Preview.)

• The LVM now provides the ability to create thin provisioned logical volumes. Previously, storage was allocated when the volume was created, and needed to be monitored for space consumption and expanded manually. In Red Hat Enterprise Linux 6.3, storage is allocated as required, allowing volumes to expand up to the requested size on demand without intervention. (This feature is a Technology Preview.)

Security-

• Availability of a two-factor authentication mechanism, enhancing the overall security available to lock down Red Hat Enterprise Linux environments and enabling compliance with industry standards such as PCI-DSS.

• Expansion of the Advanced Encryption Standard (AES) to provide particular benefits for system performance on multi-processor machines.

Identity Management-

• With native support for netgroups and the services map in System Security Services Daemon (SSSD), Red Hat Enterprise Linux servers can be integrated into centralized systems -- such as Active Directory -- to manage system users.

• The addition of an automembership plug-in streamlines the administration of new users and hosts when they are added into the Identity Management system by automatically placing them into a predefined set of groups, speeding user and host provisioning.

• Performance improvements through session data caching, which lowers the overall load on authentication servers.

Hardware Enablement-

• Software bandwidth management for USB 3.0 for select Intel platforms is now available.

• Compiler optimization for Intel Xeon E5 processor family, which improves the result of string operations, is now included.

• Improvements to memory and I/O breakpoint execution operations within compiler tools are now included.

Developer Tools-

• With the introduction of OpenJDK 7, customers can develop and test with the latest version of open source Java.

To Download Red Hat Enterprise Linux 6.3 Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Red Hat Announced Beta of Red Hat Enterprise Linux (RHEL) 6.3"https://www.voiceofgreyhat.com/2012/04/red-hat-announced-beta-of-red-hat.html</a>

(LPS) Lightweight Portable Security

Lightweight Portable Security (LPS) creates a secure end node from trusted media on almost any Intel-based computer (PC or Mac). It is a LiveCD distro designed by the US Department of Defense to function as a secure end node, in other words, a safe environment from which to access the web or a remote desktop host. Since the focus is on security, LPS boots a thin Linux operating system from a CD or USB flash stick without mounting a local hard drive, while providing tools such as a web browser, a file manager in addition to few other small tools. Administrator privileges are not required; nothing is installed! LPS-Public is a safer, general-purpose solution for using web-based applications. The accredited LPS-Remote Access is only for accessing your organization’s private network and is available only on request. We requested for one and are yet to hear back from “them”.

This livecd is very useful for not for whole organisation but some departments whose employees are on the move or carry critical data in and out of the organisation. In fact there are two version of the lightweight portable securityFREE download. Their brief use is as follows: linux distro available for a

1. LPS-Public: It includes features designed to allow productive use of the Internet and CAC- or PIV-restricted Government websites from home or while traveling. LPS-Public comes preconfigured with a smart card-enabled Firefox web browser with Java and Flash support, Encryption Wizard-Public, a PDF viewer, a file browser, remote desktop software (Citrix, Microsoft or VMware View), SSH client, and the ability to use USB flash drives. This build does not contain any For Official Use Only (FOUO) material or any customized software. It is a very light distro and needs lesser RAM.
2. LPS-Public Deluxe: It adds OpenOffice software, which is a Microsoft Office-compatible suite of office applications, and Adobe Reader, which allows PDF files to be digitally signed. A bit heavier distribution, requiring about a Gigahertz of RAM.

LPS-Public allows general web browsing and connecting to remote networks. It includes a smart card-enabled Firefox browser supporting CAC and PIV cards, a PDF and text viewer, Java, and Encryption Wizard – Public. LPS-Public turns an untrusted system (such as a home computer) into a trusted network client. No trace of work activity (or malware) can be written to the local computer. Our initial working with the linux distro leads us to believe that after logon, you are taken to a desktop that is rendered via IceWM – the window manager for the X Window Systems. You can use a WiFi connection too, but understandably, there is no support for printers and sound. Surprisingly, given the notoriety the Adobe Flash plugins, the distro includes a fairly recent Firefox with the Flash plugin pre-loaded. It also includes a few more Firefox add-ons. You also get a Remote Desktop client to initiate RDP requests. Another interesting thing we observed is that if you plan on using smart cards and you think that it might not be compatible with LPS, worry not as it has the OEM’s firmware updater built in!

Features of LPS

1. LPS differs from traditional operating systems in that it isn’t continually patched.
2. LPS is designed to run from read-only media and without any persistent storage.
3. Any malware that might infect a computer can only run within that session.
4. A user can improve security by rebooting between sessions, or when about to undertake a sensitive transaction.

Download LPS from the following links:-

LPS-Public:

1. LPS-Public ISO version 1.2.2 (LPS-1.2.2_public.iso) here.
2. LPS-Public ZIP version 1.2.2 (LPS-1.2.2_public_iso.zip) here.

LPS-Public Delux:

1. LPS-Public Delux ISO version 1.2.2 (LPS-1.2.2_public_deluxe.iso) here
2. LPS-Public Delux ZIP version 1.2.2 (LPS-1.2.2_public_deluxe_iso.zip) here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">(LPS) Lightweight Portable Security"https://www.voiceofgreyhat.com/2011/07/lps-lightweight-portable-security.html</a>

Flashback.G Trojan Targeting Mac Users While Stealing Passwords

 Flashback.G Trojan Targeting Mac Users While Stealing Passwords

Remember earlier MAC Security Blog reported that the latest version, Flashback.D, has gotten a bit sneakier. First, it checks to see if the user is running Mac OS X in VMware Fusion. If so, it does not execute. It does this because many malware researchers test malware in virtual machines, rather than infect full installations, as it is easier to delete them and start over with clean copies. This means that security researchers analyzing and looking for this malware need to be running regular Macs.

 Yet again Mac users became the victim of another trojan. This new Trojan virus is capable of infecting their computers and stealing passwords to services such as Google, PayPal, online banking & so on. This virus is using a new installation method When a user visits a crafted web page, the new variant either tries to exploit two old security vulnerabilities or deploys a Java Applet which tries to trick the user into believing it has been certified by Apple. According to Mac Security Blog (Intego):- This new variant of the Flashback Trojan horse uses three methods to infect Macs. The malware first tries to install itself using one of two Java vulnerabilities. If this is successful, users will be infected with no intervention. If these vulnerabilities are not available – if the Macs have Java up to date – then it attempts a third method of installation, trying to fool users through a social engineering trick. The applet displays a self-signed certificate, claiming to be issued by Apple. Most users won’t understand what this means, and click on Continue to allow the installation to continue.
It is worth noting that Flashback.G will not install if VirusBarrier X6 is present, or if a number of other security programs are installed on the Mac in question. It does this to avoid detection. It seems that the malware writers feel it is best to avoid Macs where the malware might be detected, and focus on the many that aren’t protected.

Earlier also Mac users faced such attacks where OSX/Revir-B trojan was installed behind a PDF, and giving hackers remote access to MAC computers, not only Revier-B also Linux Tsunami trojan Called "Kaiten" targeted Mac OS users in 2011. Also another malware named "Devil Robber" which was also make MAC users victim while stealing their personal informations.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Flashback.G Trojan Targeting Mac Users While Stealing Passwords"https://www.voiceofgreyhat.com/2012/02/flashbackg-trojan-targeting-mac-users.html</a>

'Kali Linux' The Most Advanced & Stable Penetration Testing Distribution

From The Makers of BackTrack We Got 'Kali Linux' The Most Advanced & Stable Penetration Testing Distribution 

Fans of world famous penetration testing distribution 'BackTrack' can now taste another flavor as the developer at BackTrack and Offensive Security has introduced a new Linux distribution targets enterprise security, offering a suite of helpful tools for rigorous testing calling it "Kali Linux." In the official release note Offensive-Security claimed that Kali Linux is the most advanced, robust, and stable penetration testing distribution to date. From that note we also came to know that this new distribution is a product of seven years long knowledge and experience which make Kali Linux the “next generation” penetration testing distribution. Now lets look at the main features of Kali Linux at a glance: 

Kali Linux Features:-

Kali is a complete re-build of BackTrack Linux, adhering completely to Debian development standards. All-new infrastructure has been put in place, all tools were reviewed and packaged, and we use Git for our VCS.

• More than 300 penetration testing tools: After reviewing every tool that was included in BackTrack, we eliminated a great number of tools that either did not work or had other tools available that provided similar functionality.
• Free and always will be: Kali Linux, like its predecessor, is completely free and always will be. You will never, ever have to pay for Kali Linux.
• Open source Git tree: We are huge proponents of open source software and ourdevelopment tree is available for all to see and all sources are available for those who wish to tweak and rebuild packages.
• FHS compliant: Kali has been developed to adhere to the Filesystem Hierarchy Standard, allowing all Linux users to easily locate binaries, support files, libraries, etc.
• Vast wireless device support: We have built Kali Linux to support as many wireless devices as we possibly can, allowing it to run properly on a wide variety of hardware and making it compatible with numerous USB and other wireless devices.
• Custom kernel patched for injection: As penetration testers, the development team often needs to do wireless assessments so our kernel has the latest injection patches included.
• Secure development environment: The Kali Linux team is made up of a small group of trusted individuals who can only commit packages and interact with the repositories while using multiple secure protocols.
• GPG signed packages and repos: All Kali packages are signed by each individual developer when they are built and committed and the repositories subsequently sign the packages as well.
• Multi-language: Although pentesting tools tend to be written in English, we have ensured that Kali has true multilingual support, allowing more users to operate in their native language and locate the tools they need for the job.
• Completely customizable: We completely understand that not everyone will agree with our design decisions so we have made it as easy as possible for our more adventurous users tocustomize Kali Linux to their liking, all the way down to the kernel.
• ARMEL and ARMHF support: Since ARM-based systems are becoming more and more prevalent and inexpensive, we knew that Kali’s ARM support would need to be as robust as we could manage, resulting in working installations for both ARMEL and ARMHF systems. Kali Linux has ARM repositories integrated with the mainline distribution so tools for ARM will be updated in conjunction with the rest of the distribution. Kali is currently available for the following ARM devices:
• rk3306 mk/ss808
• Raspberry Pi
• ODROID U2/X2
• Samsung Chromebook

Kali is specifically tailored to penetration testing and therefore, all documentation on this site assumes prior knowledge of the Linux operating system. For more information, I would like to request you to visit the official website of Kali Linux. 

To Download Kali Linux (.iso, VMWare Image, Samsung Chromebook ARM, Odroid U2, Raspberry Pi & rk3306 mk/ss808) Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">'Kali Linux' The Most Advanced & Stable Penetration Testing Distribution"https://www.voiceofgreyhat.com/2013/03/KaliLinux-Most-Advanced-Pen-Testing-Distribution.html</a>

Anontune - New Social Music Platform By #Anonymous

Anontune - New Social Music Platform By #Anonymous 

After the launch of AnonBin, alternative of PasteBin now hacktvist group is reportedly putting together a social music platform that will surely ruffle the RIAA's feathers. The project is called Anontune, and is designed to pull songs from third-party sources like YouTube. Users can throw the songs into playlists and share them with friends. The Anontune service relies on executing a Java applet. "Unless you are extremely trusting or using VMWare, you should think very carefully about running code on your machine that was written by members of Anonymous,"

They insist that Anontune will not host copyrighted material and will not be streaming music or offering downloads of copyrighted material. Instead, they plan to focus on information and they compare the platform to a search engine. "The information can be used to play and centralize pervasive music across the Internet on one platform." It's unclear exactly how this site will operate, but Anonymous seems to think that the law will be on their side this.  "The idea is that if all songs were easily accessible and centralized on one user-friendly platform that it would be possible to hijack all current users of music piracy solutions," Anonymous describes in an Anontune white paper (pdf).

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Anontune - New Social Music Platform By #Anonymous"https://www.voiceofgreyhat.com/2012/04/anontune-new-social-music-platform-by.html</a>

Red Hat Enterprise Linux 6.4 Beta Released & Available For Download

Red Hat Enterprise Linux 6.4 Beta Released & Available For Download 

Red Hat the global leader in open source solutions released another update of its enterprise Linux (RHEL Version 6). Since Red Hat Enterprise Linux has been released, we have got several updates, including three beta release and three final release (RHEL 6.1, RHEL 6.2 & RHEL 6.3). Now the American software company added another beta, that is RHEL 6.4 and made it available for its customers. The beta release includes a broad set of updates to the existing feature set and provides rich new functionality in the areas of identity management, file system, virtualization, and storage as well as productivity tools. In their release note the RHEL Team said that -through collaboration with partners, customers and the open source community, we are committed to delivering technology that is tested and stable – including in the beta phase of development. Red Hat Enterprise Linux 6.4 demonstrates this commitment and has been designed for optimized performance, stability and flexibility to cater to today’s diverse workloads running in physical, virtual and cloud environments.

Key New Features & Enhancement :-

• Identity Management

System Security Services Daemon (SSSD) enhancements improve the interoperability experience with [Microsoft Active Directory] by providing centralized identity access control for Linux/Unix clients in a heterogeneous environment.

• File system

pNFS (Parallel NFS) client (file layout only) remains in technology preview, however now delivers performance improvements with the addition of Direct I/O for faster data access. This drives particular performance benefits for I/O intensive use cases including database workloads.

• Virtualization

Red Hat Enterprise Linux 6 now includes the Microsoft Hyper-V Linux drivers, which were recently accepted by the upstream Linux community, improving the overall performance of Red Hat Enterprise Linux 6 as a guest on Microsoft Hyper-V.

Installation support for VMware and Microsoft Hyper-V para-virtualization drivers. This new feature enhances the user deployment experience of Red Hat Enterprise Linux as a guest in either of these virtualization environments.

In this release, KVM virtualization virtio-scsi support, a new industry storage architecture, provides industry leading storage stack scalability.

• Management

The use of swap functionality over NFS enables more efficient read/write tradeoffs between local system memory and remote disks. This capability increases performance in very large, disk-less server farms seen in ISP and Web hosting environments.

Enhancement in c-groups delivers the ability to migrate multi-threaded applications without errors.

Optimized perf tool for the latest Intel processors

• Storage

New system log features identify mapping from block device name to physical device identifier – allowing an administrator to easily locate specific devices as needed.

• Productivity Tools

Microsoft interoperability improvements with Microsoft Exchange and calendar support in Evolution. Productivity functions, such as calendar support with alarm notification and meeting scheduling is improved.

Customers such as animation studios and graphic design houses now have support for the newer Wacom tablets.

Through this next beta release of Red Hat Enterprise Linux 6, Red Hat team is proud to deliver the highest quality open source enterprise platform. To download the beta release of Red Hat Enterprise Linux 6.4 click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Red Hat Enterprise Linux 6.4 Beta Released & Available For Download "https://www.voiceofgreyhat.com/2012/12/RedHat-Enterprise-Linux-6.4-Beta-Released.html</a>

Drupal.org Hacked ! More Than 967,000 Registered User Details Compromised

Drupal.org Hacked ! More Than 967,000 Registered User Details Compromised 

Drupal, one of the most famous and widely used open-source content management framework have fallen victim to cyber criminals. The Drupal Security Team and Infrastructure Team has discovered unauthorized access to account information on the official Drupal website and another site called groups.drupal.org. This security breach has exposed user names, country, and email addresses along with hashed passwords of more than 967,000 registered users on the Drupal.org. But still a matter of relief is that the breach failed to infiltrate the credit card details which was stored on the same server. According to security release unauthorized access was made via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. Drupal team have worked with the vendor to confirm it is a known vulnerability and has been publicly disclosed. They are still investigating and will share more detail when it is appropriate. Upon discovering the files during a security audit, the security team has already shut down the association.drupal.org website to mitigate any possible ongoing security issues related to the files. The Drupal Security Team then began forensic evaluations and discovered that user account information had been accessed via this vulnerability. The suspicious files may have exposed profile information like username, email address, hashed password, and country. In addition to resetting your password on Drupal.org, it is also recommending a number of measures (below) for further protection of your information, including, among others, changing or resetting passwords on other sites where you may use similar passwords. 

As a precautionary measure of the said security breach, Drupal Security Team has reset all Drupal.org account holder passwords and are requiring users to reset their passwords at their next login attempt. A user password can be changed at any time by taking the following steps. 

1. Go to https://drupal.org/user/password 
2. Enter your username or email address. 
3. Check your email and follow the link to enter a new password. It can take up to 15 minutes for the password reset email to arrive. If you do not receive the e-mail within 15 minutes, make sure to check your spam folder as well.

Counter Measures that Drupal has Taken to avoid such mishap is something followed- as attacks on high-profile sites (regardless of the software they are running) are common, Drupal strive to continuously improve the security of all Drupal.org sites. To that end, Drupal have taken the following steps to secure the Drupal.org infrastructure:

• Staff at the OSU Open Source Lab (where Drupal.org is hosted) and the Drupal.org infrastructure teams rebuilt production, staging, and development webheads and GRSEC secure kernels were added to most servers
• Drupal is scanning and have not found any additional malicious or dangerous files and making scanning a routine job in their process
• There are many subsites on Drupal.org including older sites for specific events. Drupal created static archives of those sites.

This security breach of Drupal which affected more than 967,000 users is giving us a remind of the decent history of breach where we have seen a slew of attacks against the following sites: Scribd, Guild Wars 2, Gamigo, Blizzard, Yahoo, LinkedIn, eHarmony, Formspring, Android Forums, Gamigo,  Nvidia,Blizzard, Philips, Zynga, VMWare, Adobe,  Twitter  New York Times, Apple and so on. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Drupal.org Hacked ! More Than 967,000 Registered User Details Compromised "https://www.voiceofgreyhat.com/2013/06/Drupal.org-Hacked-967000-User-at-Risk.html</a>

SUSE® Linux Enterprise 11 Service Pack 2 (SP2) Released

SUSE® Linux Enterprise 11 Service Pack 2 (SP2) Released
 

SUSE officially announced the general availability of SUSE® Linux Enterprise 11 Service Pack 2 (SP2). According to the official press release- With Service Pack 2, you get improved reliability, availability and serviceability and virtualization along with support for more third-party hardware. Because it's designed for interoperability and optimized for physical, virtual and cloud environments, SUSE Linux Enterprise Server paves the way for your future growth. It enables you to maximize the utilization of your existing IT resources and move easily from older physical servers to new, more powerful ones as they become available or your business needs change. SUSE Linux Enterprise Server is the most versatile and reliable Linux for mission-critical environments because we are committed to its continuous enhancement.

SUSE® Linux Enterprise 11 Service Pack 2 At a Glance:-
Improved Performance
Twenty percent faster through scheduler and memory management enhancements in the 3.0 Linux kernel:-

• Improved performance of compute and memory intensive workloads with support for transparent huge pages

• Faster network performance through transparent per-CPU load balancing on multi-queue devices

• Control groups enhancements—I/O throttling and memory cgroup controller optimization—for optimal performance

• 10x faster speeds with USB 3.0

Improved Reliability, Availability and Serviceability
Run SUSE Linux Enterprise Server with even greater confidence with these new features:-

• Support for new hardware RAS features, like CPU and memory off-lining

• btrfs support—improved services availability and data integrity with copy on write, integrated volume management, and checksums. New snapshot and rollback capabilities offer improved resilience

Better Security and Enhanced Hardware Support
Secure your environment, and grow rapidly—or at your own pace—with Service Pack 2 (SP2) enhancements that include:-

• Role based access controls in AppArmor®

• More powerful firewalls with faster packet filtering

• Support for fanotify—for improved support of third-party anti-virus solutions

• New drivers for over 500 of the latest CPUs, chipsets, networking devices and storage systems

More Robust Virtualization Capabilities
SP2 enables you to utilize resources more efficiently and migrate workloads to virtual and cloud environments with features such as:-

• Support for Linux Containers—high efficiency, low overhead OS virtualization

• Updated Xen 4.1 and KVM 0.15+ hypervisors

• Windows guest OS support in KVM

• Improved virtual machine guest OS performance with additional paravirtualized drivers for Xen, KVM, VMware vSphere and MSFT Hyper-V

For 60 Days Free 60-Day Evaluation Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">SUSE® Linux Enterprise 11 Service Pack 2 (SP2) Released"https://www.voiceofgreyhat.com/2012/03/suse-linux-enterprise-11-service-pack-2.html</a>

Adobe Confirms Data Breach, Hacker Leaked More Than 150,000 Customer Details

Adobe Confirms Data Breach, Hacker Leaked More Than 150,000 Customer Details 

Yet again Adobe, the American multinational computer software company had fallen victim of cyber attack. In September Adobe faced what it called a sophisticated cyber attack where hackers have breached Adobe server in order to compromise certificate to sign malware. As a move Adobe revoked those certificates on October 4th. After that massacre, here again one of Adobe's databases has been breached by a hacker and that it has temporarily taken offline the affected Connectusers.com website. The attacker who claimed responsibility for the attack, told that he used a SQL injection exploit in the breach. Adobe confirmed the breach and said that the hacker indeed managed to break into an Adobe server and copy the private credentials of approximately 150,000 users – including their names, email addresses and password hashes. Those affected accounts include Adobe customers, Adobe employees and partners along with U.S. military users including U.S. Air Force users, and users from Google, NASA, universities, and other companies. To prove the attack, the intruder, who goes by the name of "ViruS_HimA" and claims to be from Egypt, has released extracts from his haul on the Pastebin text hosting service. 

"It was an SQL Injection vulnerability -- somehow I was able to dump the database in less requests than normal people do," said ViruS_HimA. Users passwords for the Adobe Connect users site were stored and hashed with MD5, says the hacker, which made them "easy to crack" with freely available tools. And Adobe wasn't using WAFs on the servers, the hacker notes. "I just want to be clear that I'm not going against Adobe or any other company. I just want to see the biggest vendors safer than this," he told the press. "Every day we see attacks targeting big companies using Exploits in Adobe, Microsoft, etc. So why don't such companies take the right security procedures to protect them customers and even themselves?"

"Adobe is a very big company but they don't really take care of them security issues, When someone report vulnerability to them, It take 5-7 days for the notification that they've received your report!!" he wrote. "It even takes 3-4 months to patch the vulnerabilities!" 

While talking about such big cyber attacks, here we would like to give you reminder that in the last few months we have been a slew of attacks against the following sites: Guild Wars 2, Gamigo, Blizzard, Yahoo, LinkedIn, eHarmony, Formspring, Android Forums, Gamigo,  Nvidia,Blizzard, Philips, Zynga, VMWare, & so on. For all the latest on cyber security and hacking related stories; stay tuned with VOGH. 

-Source (Dark Reading, The-H)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Adobe Confirms Data Breach, Hacker Leaked More Than 150,000 Customer Details"https://www.voiceofgreyhat.com/2012/11/Hacker-Leaked-150000-Customer-Details-of-Adobe.html</a>

Cupid Media Network Breach Exposes 42 Million Passwords in Plain Text

Cupid Media Network Breach Exposes 42 Million Passwords in Plain Text (Uunencrypted)

Cupid Media one of the leading niche online dating network that have more than 35 large online dating website, faced a massive intrusion that effects more than 42 million of its registered users. From an exclusive report of Kerbs On Security we came to know that the breach was taken earlier in this year. Where the hackers managed to gain access into the crucial servers belongings to Cupid Media network. According to the managing director of Cupid Media, Mr Andrew Bolton - "In January we detected suspicious activity on our network and based upon the information that we had available at the time, we took what we believed to be appropriate actions to notify affected customers and reset passwords for a particular group of user accounts.” After a preliminary investigation it has been found that the purloined database of Australia-based niche dating service Cupid Media was found on the same server where hackers had amassed tens of millions of records stolen from Adobe. More than 42 million peoples' unencrypted names, dates of birth, email addresses and passwords have been found from the pinched database. I am very much wearied to see that a high value site like Cupid is unconcerned about the basic security counter measure. Even their confidential tables remained unencrypted which allows the hacker to gain the personal information in plain text. Like the Cupid Media security team, the registered users also found very much inadvertent and unaware of basic security measures. I am saying this because of the leaked passwords, almost two million picked "123456", and over 1.2 million chose "111111". "iloveyou" and "lovely" both beat out "password", and while 40,000 chose "qwerty", 20,000 chose the bottom row of the keyboard instead - yielding the password "zxcvbnm". 

Jason Hart of famous data protection firm Safenet said "The true impact of the breach is likely to be huge. Yet, if this data had been encrypted in the first place then all hackers would have found is scrambled information, rendering the theft pointless."

This security breach of Cupid Media reminds us  the decent history of breach where we have seen a slew of attacks against the following sites: Drupal.org  Scribd, Guild Wars 2, Gamigo, Blizzard, Yahoo, LinkedIn, eHarmony, Formspring, Android Forums, Gamigo,  Nvidia,Blizzard, Philips, Zynga, VMWare, Adobe,  Twitter,  New York Times, Apple and so on. While covering this story on behalf of VOGH, I am warning our readers across the globe to use strong alphanumeric passwords to avoid such disaster. Also the webmasters and security administrator are highly recommended to use salted encryption in their database to prevent fortuitousness cyber attack. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Cupid Media Network Breach Exposes 42 Million Passwords in Plain Text "https://www.voiceofgreyhat.com/2013/11/cupid-media-breach-exposes-42million-plaintext-passwords.html</a>

Red Hat Enterprise Linux (RHEL) 6.2 Beta Released

 

Beta for Red Hat Enterprise Linux 6.2 is now available. This beta includes a broad set of updates to the existing feature set and also provides rich new functionality particularly in the areas of performance and scaling, identity management, high availability, advanced storage, and networking. As always, this beta delivers new hardware enablement made possible by our strong relationships with our strategic hardware partners. This beta release has been designed for optimized performance, scalability and reliability to cater to the diverse workloads running in physical, virtual and cloud environments.
The key benefits for organizations working with this beta for Red Hat Enterprise Linux 6.2 are operational efficiency realized through enterprise management and monitoring, along with enhanced business agility through additional support for virtualized and clustered deployments.

Key functionality in this beta for Red Hat Enterprise Linux 6.2 are as follows:-

Performance and Scaling:-

• Kernel-level optimizations implemented in the process scheduler, networking, virtualization, and I/O subsystems.

• Faster creation of ext4 file systems and improved response times in XFS for certain workloads.

• Improved CPU controller scalability and enhanced resource management features to set processor utilization ceilings.

Identity Management:-

• Centralized identity management for the flexible management of users, roles, policies, and authentication services.

• New capabilities for the unification of Kerberos ticketing, DNS naming, user and group ids, and Linux systems policies into a single service.

High Availability:-

• Support for Red Hat Enterprise Linux 6 guests on VMware® hosts and comprehensive support for the GFS2 shared storage file system have been added to the High Availability Add-on Product, creating a more tightly integrated environment.

• Full support for the UDP-unicast protocol which reduces administration overhead, resulting in easier cluster deployment.

Advanced Storage:-

• World Wide Name (WWN), or World Wide Identifier (WWID), for storage devices making it easier to identify them during installation for users utilizing Storage Area Networks (SAN) and other advanced network topologies.

• Within production environments using infiniband – where high throughput and low latency are key requirements – Red Hat Enterprise Linux can now be purposed as an iSCSI initiator and storage server.

Networking:-

• Transmit Packet Steering (XPS) capabilities which improve network packet transmission throughput by 30%.

To See the Official Release Note of Red Hat Click Here

For Download Click Here

-News Source (RedHat)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Red Hat Enterprise Linux (RHEL) 6.2 Beta Released"https://www.voiceofgreyhat.com/2011/10/red-hat-enterprise-linux-rhel-62-beta.html</a>

Microsoft Hyper-V Now Supports Linux-based CentOS

Microsoft has added support for another Linux server distribution with its Hyper-V virtualization software, its latest move to compete better with virtualization market leader VMware.

Customers can now run the CentOS flavor of Linux as a guest operating system in supported Windows Server 2008 R2 Hyper-V environments, Sandy Gupta, general manager for marketing in Microsoft's Open Solutions Group, was due to announce at the Open Source Business Conference in San Francisco Monday.
Microsoft already supports Hyper-V environments that include Red Hat Enterprise Linux and Suse Linux Enterprise Server. It added CentOS because it's a popular distribution for hosting providers, a market Microsoft hopes to do well in.
The support is effective immediately, Gupta wrote in a blog post.
"This development enables our hosting partners to consolidate their mixed Windows + Linux infrastructure on Windows Server Hyper-V; reducing cost and complexity, while betting on an enterprise class virtualization platform," Gupta wrote.
Once contemptuous of open source, Microsoft has become more pragmatic about Linux in recent years. The company has realized it must interoperate with Linux and other OSes if it wants to do well in data centers, which are typically mixed environments.
"We've found that the Microsoft-only IT shop -- even in the smallest organizations -- is becoming a thing of the past," said Dan Olds, principal analyst at Gabriel Consulting Group. "It's important for Microsoft to recognize this fact of life and extend support to various Linux operating systems if they want Hyper-V to come out on top in the virtualization wars."
At the same time, Microsoft continues to assert that Linux and other open-source software products violate various patents that it holds.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Hyper-V Now Supports Linux-based CentOS"https://www.voiceofgreyhat.com/2011/05/microsoft-hyper-v-now-supports-linux.html</a>

FreeBSD & PC-BSD 9 Released !!

Hello BSD user I have 2 good news for you and that is both Free BSD & PC BSD 9 has been released. 

Brief About FreeBSD:-

FreeBSD is an advanced operating system for modern server, desktop, and embedded computer platforms. FreeBSD's code base has undergone over thirty years of continuous development, improvement, and optimization. It is developed and maintained by a large team of individuals. FreeBSD provides advanced networking, impressive security features, and world class performance and is used by some of the world's busiest web sites and most pervasive embedded networking and storage devices. For more information about this release click here.

Some Highlights:- 

• The FreeBSD Release Engineering Team is pleased to announce the availability of FreeBSD 9.0-RELEASE. This is the first release from the stable/9 branch, which improves on stable/8 and adds many new features.
• A new installer, bsdinstall(8) has been added and is the installer used by the ISO images provided as part of this release
• The Fast Filesystem now supports softupdates journaling
• ZFS updated to version 28
• Updated ATA/SATA drivers support AHCI, moved into updated CAM framework
• Highly Available Storage (HAST) framework
• Kernel support for Capsicum Capability Mode, an experimental set of features for sandboxing support
• User-level DTrace
• The TCP/IP stack now supports pluggable congestion control framework and five congestion control algorithm implementations available
• NFS subsystem updated, new implementation supports NFSv4 in addition to NFSv3 and NFSv2
• High Performance SSH (HPN-SSH)
• Flattened device tree (FDT), simplifying FreeBSD configuration for embedded platforms
• The powerpc architecture now supports Sony Playstation 3
• The LLVM compiler infrastructure and clang have been imported
• Gnome version 2.32.1, KDE version 4.7.3

To Download FreeBSD 9 Click Here

******

Brief About PC-BSD:-

PC-BSD is a user friendly desktop Operating System based on FreeBSD. Known widely for its stability and security in server environments, FreeBSD provides an excellent base on which to build a desktop operating system. PC-BSD uses a host of popular open source window managers and uses a custom-tailored application installer that puts popular applications in easy reach of users. For more information click Here

Some Highlights:-

• Based upon FreeBSD 9.0-RELEASE
• Support for installing a variety of Window Managers, such as KDE, GNOME, XFCE, LXDE and more!
• Improved PBI system, allows library sharing, binary diff updating, custom repositories, digital signing and more!
• Support for "freebsd-update" via the System Update GUI.
• New Control Panel, providing consistent configuration options across various Window Managers.
• Improved networking utilities, including wifi quick-connect.
• Enhanced "Life-Preserver" utility for doing off-site rsync backups of user data.
• New VirtualBox / VMware disk images, with integrated guest tools.
• Support for UFS+Journaling out of box
• New graphical boot options page
• Support for installation to BootCamp partitions on OSX systems.
• And much more!

To Download PC-BSD 9 Click Here

*****

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">FreeBSD & PC-BSD 9 Released !!"https://www.voiceofgreyhat.com/2012/01/freebsd-pc-bsd-9-released.html</a>

'Scribd' World's Largest Document Sharing Website Admits Security Breach

'Scribd' World's Largest Document Sharing Website Admits Security Breach 

Scribd- San Francisco-based document sharing site have fallen victim of cyber attack. Such kind of massacre is no doubt very much shameful for one of the world largest document sharing website which have more than 100 million of registered user. Like other largest companies, Scribd acknowledged the attack. In their official security announcement the company said that the operations team of Scribd have discovered and blocked suspicious activity on Scribd's network that appears to have been a deliberate attempt to access the email addresses and passwords of registered Scribd users. But the matter of relief is that only the 1% of its registered users have been affected during the hack. Immediately after this intrusion get spotted Scribd security team have emailed every user whose password was potentially compromised with details of the situation and instructions for resetting their password.  So, if you are a Scribd user and you did not receive such email from Scribd, then you are most likely unaffected.  If you still wish to check, you can use this web tool to determine if your account was among those affected. From the official announcement of Scribd, we came to know that the inertial investigation have already take place, which indicates that no content, payment and sales-related data, or other information were accessed or compromised. It has been  believed that the information accessed by the hackers was limited to general user information, which includes usernames, emails, and encrypted passwords.  Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). Most of the users were therefore unaffected by this; however, the analysis shows that a small percentage may have had their passwords compromised. In an abundance of caution, it has been highly recommended for those affected users to reset their password and to change their password on any other services they might have used it on. 

At conclusion of the note, Scribd team did serious apology to its users while saying -"we would like to sincerely apologize for our failure to live up to our users' expectations in this instance. We’re incredibly disappointed that this happened and are committed to doing everything we can to prevent this from happening again. We will work harder than ever to ensure that we deserve the trust that our users place in us." 

While talking about big cyber attacks against large companies we would like to remind you in the last year we have been a slew of attacks against the following sites: Guild Wars 2, Gamigo, Blizzard, Yahoo, LinkedIn, eHarmony, Formspring, Android Forums, Gamigo,  Nvidia,Blizzard, Philips, Zynga, VMWare, Adobe,  Twitter  New York Times, Apple and so on. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">'Scribd' World's Largest Document Sharing Website Admits Security Breach"https://www.voiceofgreyhat.com/2013/04/Scribd-Admits-Security-Breach.html</a>