In recent years, containers have become a staple in modern IT infrastructures. They provide extreme flexibility and efficiency in deploying applications. Yet, as containerization has grown in popularity, so has the need to secure these environmеnts. Container security is defined as protecting against threats and ensuring compliance with safety standards in containerized envirоnments. It has […]

The post The Evolution of Security in Containerized Environments appeared first on TuxCare.

The post The Evolution of Security in Containerized Environments appeared first on Security Boulevard.

Check Point researchers have observed a surge in threat actor groups targeting remote-access VPN environments as an entry point for gaining access to enterprise networks. In response to these threats, Check Point has been monitoring unauthorized access attempts on Check Point VPNs and has released a preventative solution to address the issue. While the researchers suggested that the issue is broader than Check Point VPNs, the fix applies solely to Check Point environments.

Identification of Unauthorized Access Attempts to Check Point VPN

On May 24, Check Point identified a small number of login attempts using old VPN local accounts that relied on an unrecommended password-only authentication method. The company assembled special teams of Incident Response, Research, Technical Services, and Products professionals to thoroughly investigate these attempts and any other potentially related incidents. Within 24 hours, the teams identified several potential customers who were subject to similar attempts and notified them accordingly. The teams consider password-only authentication methods insecure and more susceptible to the compromise of network infrastructure, recommending against solely relying on these methods when logging into network infrastructure. Several points were advised by the teams as preventative measures, such as:

• Reviewing and disabling unused local accounts.
• Implementing an additional layer of authentication, such as certificates, to password-only accounts.
• Deploying additional solutions on Security Gateways to automatically block unauthorized access.
• Contacting the Check Point technical support team or a local representative for additional guidance and assistance.

In case of suspected unauthorized access attempts, Check Point researchers recommend that organizations analyze all remote access connections of local accounts with password-only authentication, monitor connection logs from the past 3 months, and verify the familiarity of user details, time, source IP address, client name, OS name, and application based on configured users and business needs. Check Point has also released a hotfix to prevent users with password-only authentication from connecting to Security Gateways. After implementation, password-only authentication methods for local accounts will be prevented from logging into the Check Point Remote Access VPN. If any connections or users are not validated, invoking the incident response playbook or contacting Check Point Support or a local Check Point representative is advised. The company stated that it witnessed the compromise of several VPN solutions, including those of various cybersecurity vendors.

Implementing Check Point VPN Hotfix

Check Point released a script to identify potential risks of compromise in its VPN environment. Enterprises can download the VPNcheck_v2.zip archive file and follow the steps mentioned on the solution page. If the script identifies local accounts with password-only authentication, users can proceed with the installation of the Security Gateway Hotfix as an option. The hotfix is available via the Check Point Upgrade Service Engine (CPUSE) or through manual download. The Hotfix implements a new command, blockSFAInternalUsers, to the Security Gateway, allowing admins to block or grant access to internal users with password-only authentication. The default value is set to block internal users from connecting with password-only authentication. After installing the hotfix, users who attempt to connect using the weak password-only authentication method will receive a security log indicating the blocked attempt as failed. As remote operations and online threats rise, organizations must prioritize the implementation of tougher VPN authentication methods while monitoring for unauthorized attempts to access these environments. Failure to do so can lead to compromised network infrastructure or assets, data breaches, and significant financial and reputational damage. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A critical security vulnerability(CVE-2024-4323) referred to as "Linguistic Lumberjack," has been found within Fluent Bit, a widely-used logging and metrics tracking utility employed within major cloud infrastructure services. Fluent Bit is an open-source, lightweight data collector and processor service designed to handle large volumes of log data from various sources on Windows, Linux, and macOS operating systems. Its scalability and ease of use make it a preferred choice for usage in cloud environments and sees at least 10 million daily deployments. The Linguistic Lumberjack vulnerability could potentially enable attackers to execute Denial of Service (DoS) attacks, disclose sensitive information, or even gain remote code execution (RCE) capabilities.

Linguistic Lumberjack Vulnerability

The Linguistic Lumberjack vulnerability stems from a heap buffer overflow flaw in Fluent Bit's built-in HTTP server, particularly in how it handles the /api/v1/traces endpoint. This endpoint enables administrators to configure how FluentBit handles its tracing and monitoring operations. [caption id="attachment_69409" align="alignnone" width="2040"] Source: www.fluentbit.io[/caption] However, due to a lack of proper validation of input types, sending non-string values (such as integers) in the "inputs" array of a request can lead to memory corruption. The code incorrectly assumes these values to be valid MSGPACK_OBJECT_STRs. Through the intentional passing of integer values in the "inputs" array field, an attacker can trigger various memory corruption issues, including heap buffer overflows and crashes due to attempts to write to protected memory regions. In a controlled environment, Tenable researchers successfully exploited the vulnerability to trigger service crashes (DoS) and the leak of adjacent memory contents, which could potentially include sensitive information in a real-life scenario. Under specific environmental factors, attackers could even exploit the vulnerability to cause denial-of-service conditions or remote code execution. [caption id="attachment_69402" align="alignnone" width="2040"] Source: www.fluentbit.io[/caption] The Fluent Bit utility service is deeply integrated into major Kubernetes distributions from Amazon AWS, Google GCP, and Microsoft Azure. Beyond cloud providers, Fluent Bit is also relied upon by several major tech companies including Cisco, VMware, Intel, Adobe, and Dell. The utility is also known to be used by several major cybersecurity companies.

Mitigation and Remediation

The critical memory corruption vulnerability was introduced in version 2.0.7 of Fluent Bit and exists up to  version 3.0.3 of the software released on April 27th 2024. The issue has been fixed in the main source branch of Fluent Bit, with the fix expected to be included in the release of the upcoming version 3.0.4 of the software. For Linux, packages containing the fix are already available for download. For users unable to upgrade immediately, the researchers have recommended a review of existing access to Fluent Bit's monitoring API while restricting access to authorized users and services only, and to disable the endpoint if it is not in use. For organizations relying on cloud services known to utilize Fluent Bit, reaching out to the cloud provider to ensure timely updates or mitigations is advised. The researchers have notified the bug's existence to major cloud providers on May 15, 2024, to allow them to initiate their own internal responses. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

As its first alpha release is closing in, we have another monthly update about COSMIC, System76’s new Linux desktop environment written in Rust. This month, they’ve further polished and shored up their application store, imaginatively named COSMIC App Store, and it’s supposedly incredibly fast – something I can’t say for its GNOME and KDE counterparts, which tend to be so slow I’ve always just defaulted to updating through the command line, mostly.

The file manager now has support for GVfs (GNOME Virtual file system) for making external storage like USB drives work properly, and Greeter login screen, Edit text editor, drag and drop, and copy/paste have been improved in various ways as well. Theming has seen a lot of work this month, with support for icon themes added to the App Library, fixed applet sizes, and more tweaks, while light themes have been disabled for now to fix a number of issues with colour selection being too dark.

There’s also display mirroring now, which even works when the individual displays have different resolutions, orientations, and refresh rates. Pop!_OS is now also being built for ARM64, which makes sense because System76 is now also selling ARM servers. There’s also a bunch of work being done by the community as the alpha release nears.

COSMIC Desktop Environment (DE) is a new project by System76, the company behind the popular Linux distribution Pop!_OS. In this tutorial, we will give you an overview about COSMIC DE and its features, and then we will walk you through the steps to install COSMIC Desktop Environment in the latest Fedora 40 Linux system.

↫ Senthilkumar Palani at OSTechNix

A very easy way to try out the current pre-alpha state of COSMIC. I’ll definitely be waiting on a more official release later this year, but man, does COSMIC ever seem way more polished and complete than it has any right to be at this point in time.

COSMIC, System76’s Rust-based desktop that’s going to replace GNOME in Pop!_OS, is nearing its alpha release, and the Linux OEM has published another blog post detailing the latest progress it’s made. First and foremost, theming support has been further refined by adding support for theming GTK applications (both GTK3 and 4) and flatpak applications. If the user has enabled global themes, these themes will be applied automatically whenever selecting a theme to apply. Support for custom icon packs has also been added.

COSMIC now also has an application store, much like GNOME Software and KDE’s Discover, which also takes care of updating installed applications. You can now also drag windows from anywhere inside the window by holding down the super key, which is both a nice addition in general as well as a usability feature. The Settings application has also seen work, and gets a new keyboard settings panel, as well as various other smaller additions. COSMIC also now implements on-screen display toasts for things like changing volume and brightness, and plugging in power.

System76 isn’t the only one working on COSMIC – community members have implemented things like window snapping, touchpad gestures, thumbnail previews in the dock, and more. The community is also working on things like an emoi picker, and a fan control graphical user interface.

There’s a lot more in the blog post, so be sure to give it a read. I’m genuinely excited for COSMIC to hit the shelves, because I’m dying to try it out.

LXQt, the lightweight Qt desktop environment, has released a major new version, which brings with it a whole slew of very important changes and upgrades, with two main focal point.

First and foremost, the desktop environment is now using Qt 6 across the board, meaning the transition from Qt 5 to Qt 6 is now complete. To support themes and the LXQt File Dialog for Qt5-based apps you can install libqtxdg-3.12.0, lxqt-qtplugin-1.4.1, and libfm-qt-1.4.0 alongside the new Qt 6 variants for backwards compatibility. One exception here is QTerminal, whose Qt 6 port ran into some issues, so a separate Qt 6 release will come later.

The second major upgrade that’s still in progress is support for Wayland. LXQt 2.0.0 brings Wayland support for PCManFM-Qt, LXQt Runner, and LXQt Desktop Notifications, and for LXQt 2.1.0 they plan to make everything else available under Wayland as well. This means that more popular desktop environment like Cinnamon and Xfce are starting to feel a little out of step when it comes to Wayland.

One of the major user-facing new features is a new default menu for the panel which supports favourites, a new and improved search feature, and more.