{"id":261225,"date":"2016-08-11T18:30:11","date_gmt":"2016-08-11T18:30:11","guid":{"rendered":"http:\/\/rinf.com\/alt-news\/newswire\/linux-vulnerability-leaves-top-sites-wide-open-to-attackers\/"},"modified":"2016-08-11T18:30:11","modified_gmt":"2016-08-11T18:30:11","slug":"linux-vulnerability-leaves-top-sites-wide-open-to-attackers","status":"publish","type":"post","link":"http:\/\/rinf.com\/alt-news\/newswire\/linux-vulnerability-leaves-top-sites-wide-open-to-attackers\/","title":{"rendered":"Linux vulnerability leaves top sites wide open to attackers"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/cdn.rt.com\/files\/2016.08\/thumbnail\/57ac9b9ac46188c0718b45df.jpg\" \/><\/p>\n<p>        A flaw in the Linux operating system lets hackers inject malware into downloads and expose the identities of people using anonymizing software such as Tor \u2013 even for those who aren\u2019t using Linux directly. <\/p>\n<div>\n<p>In a Wednesday presentation at the USENIX Security Symposium in Austin, Texas, researchers with the University of California, Riverside showed that the flaw lies in the Transmission Control Protocol (TCP) used by Linux since late 2012.<\/p>\n<p><a href=\"https:\/\/www.rt.com\/business\/350962-china-hacked-fdic-covered-up\/\"><strong>READ MORE: US officials covered up China hack of FDIC computers \u2013 House report<\/strong><\/a><\/p>\n<p>The networking blunder is present in the Linux kernel, the core of its operating system, and can be exploited by malicious actors to determine whether two systems are communicating with each other, and even inject malicious data into or break their connection.<\/p>\n<p><center><iframe loading=\"lazy\" width=\"854\" height=\"480\" src=\"https:\/\/www.youtube.com\/embed\/S4Ns5wla9DY\" frameborder=\"0\" allowfullscreen=\"\"><\/iframe><\/center><\/p>\n<p>At the symposium, the researchers demonstrated the exploit by injecting code into a live USA Today page that asks visitors to enter their emails and passwords, which was possible because pages on USA Today aren\u2019t encrypted.<\/p>\n<p>Perhaps most importantly, the intercepting of data doesn\u2019t require a man-in-the-middle attack, where a connection will covertly intercept, collect and pass forward information between two parties. Instead, attackers can just send packets of data to the two targets with spoofed credentials.<\/p>\n<p><em>\u201cThrough extensive experimentation, we demonstrate that the attack is extremely effective and reliable. Given any two arbitrary hosts, it takes only 10 seconds to successfully infer whether they are communicating,\u201d<\/em> the team\u00a0<a href=\"https:\/\/regmedia.co.uk\/2016\/08\/10\/sec16_tcp_pure_offpath.pdf\">wrote<\/a> in a white paper. <em>\u201cIf there is a connection, subsequently, it takes also only tens of seconds to infer the TCP sequence numbers used on the connection. To demonstrate the impact, we perform case studies on a wide range of applications.\u201d<\/em><\/p>\n<p>Because Linux runs in the backend on a majority of servers as well as on Android devices, an enormous number of users might be left vulnerable. Even those using the much-vaunted anonymizing software Tor could have their privacy compromised 90 percent of the time in an average time of about 50 seconds.<\/p>\n<p><em>&#8220;In general, we believe that a [denial-of-service or] DoS attack against Tor connections can have a devastating impact on both the availability of the service as a whole and the privacy guarantees that it can provide,&#8221;<\/em> the researchers said.<\/p>\n<p>The team notes that because only version 3.6 or later of the Linux kernel has the flaw, systems running older software are not affected. They distributed a patch to fix the vulnerability, but they note a large number of individuals and networks will still be left exposed to miscreants, since the exploit only requires one unpatched party for the attack to work.<\/p>\n<\/div>\n<p>Via <a href=\"https:\/\/www.rt.com\/usa\/355558-linux-vulnerability-websites-attacks\/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=RSS\">RT<\/a>. This piece was reprinted by <a href=\"http:\/\/rinf.com\">RINF Alternative News<\/a> with permission or license.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A flaw in the Linux operating system lets hackers inject malware into downloads and expose the identities of people using anonymizing software such as Tor \u2013 even for those who aren\u2019t using Linux directly. In a Wednesday presentation at the USENIX Security Symposium in Austin, Texas, researchers with the University of California, Riverside showed that [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":261226,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[519],"tags":[],"class_list":{"0":"post-261225","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-newswire"},"_links":{"self":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/posts\/261225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/comments?post=261225"}],"version-history":[{"count":0,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/posts\/261225\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/media\/261226"}],"wp:attachment":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/media?parent=261225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/categories?post=261225"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/tags?post=261225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}