News
News
Updates on technologies, trends, and tools
RC4 Finally Gets the Fork
After years of complaints about ineffective encryption, the RC4 algorithm, which has been around since 1987, is finally being phased out. Artfully coordinated announcements from Google, Mozilla, and Microsoft state that they are officially abandoning RC4 and won't support it in future browser versions.
New versions of Firefox, Chrome, and the Microsoft browsers will not support RC4 after the end of this year. Of course, the leading browser vendors have known that RC4 is inadequate for years, but the browsers have supported a "fallback mode" for websites that demand RC4 encryption. In future versions, the browsers simply won't connect to websites that ask for RC4 encryption.
This unified action from three leading browser vendors should increase the pressure on web server operators to upgrade their systems to eliminate RC4.
IBM Says TOR Network a Vehicle for Ransomware
According to a report from IBM's X-Force team, the anonymous TOR network is increasingly being used to support ransomware schemes and other Internet attack scenarios. Big Blue warned companies and ISPs to start blocking TOR traffic from their networks.
Ransomware, which encrypts the victim's hard drive and demands payment to release the data, is a growing phenomenon around the world. According to the report, attackers use the TOR network to communicate with the victim and transfer monetary payments.
The report states that the success of the TOR network as a vehicle for petty end-user ransomware attacks and SQL injection has emboldened the perpetrators, and TOR is now used for botnet control and sophisticated industrial espionage.
Although TOR services are intended to be hidden and anonymous, organizations can still take steps to keep them off the network. The report includes recommendations such as:
- Prohibiting the use of unapproved encrypted proxy services
- Prohibiting the use of personally subscribed proxy services
- Prohibiting the download and installation of unapproved software
- Prohibiting the use of personally owned removable devices
- Prohibiting computers from booting to media other than the hard drive
- Using publicly available lists of proxy nodes to block network traffic to and from listed sites
- Implementing a comprehensive desk audit program
The TOR network also has legitimate functions, such as supporting the free speech rights of users in totalitarian countries. Many innocent users implement a TOR node for ideological or political reasons without realizing the node could also be used to stage criminal activities.
Mozilla Announces New Firefox API
The Mozilla project continues its overhaul of the web browser with the announcement of a new extension API called WebExtensions. The new API and its surrounding technologies will replace the add-on architecture currently used by Firefox developers. The WebExtensions API offers several advantages, including better performance and multiprocess capabilities through Mozilla's Electrolysis project, but the biggest reason for the change appears to be compatibility with other browsers. According to the announcement, "Extension code written for Chrome, Opera, or, possibly in the future, Microsoft Edge, will run in Firefox with few changes as a WebExtension."
The Firefox team also reiterated that it will require "… all extensions to be validated and signed by Mozilla starting in Firefox 41," which will arrive on September 22. The announcement also says Firefox has decided on an approximate timeline for the deprecation of XPCOM- and XUL-based addons.
Electrolysis, which continues to evolve in the background, is perhaps the most revolutionary component of the recent Firefox changes. According to Mozilla, the goal of Electrolysis is to "… render and execute web-related content in a single background 'content' process that communicates with the main Firefox process via various ipdl protocols. The two major advantages of this model are security and performance. Security improvements are accomplished through sandboxing; performance improvements are born out of the fact that multiple processes better leverage available client computing power."
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Fedora Asahi 40 Remix Available for Macs with Apple Silicon
If you've been anticipating KDE's Plasma 6 for your Apple Silicon-powered Mac, then you're in luck.
-
Red Hat Adds New Deployment Option for Enterprise Linux Platforms
Red Hat has re-imagined enterprise Linux for an AI future with Image Mode.
-
OSJH and LPI Release 2024 Open Source Pros Job Survey Results
See what open source professionals look for in a new role.
-
Proton 9.0-1 Released to Improve Gaming with Steam
The latest release of Proton 9 adds several improvements and fixes an issue that has been problematic for Linux users.
-
So Long Neofetch and Thanks for the Info
Today is a day that every Linux user who enjoys bragging about their system(s) will mourn, as Neofetch has come to an end.
-
Ubuntu 24.04 Comes with a “Flaw"
If you're thinking you might want to upgrade from your current Ubuntu release to the latest, there's something you might want to consider before doing so.
-
Canonical Releases Ubuntu 24.04
After a brief pause because of the XZ vulnerability, Ubuntu 24.04 is now available for install.
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.