Red Hat continues steady march toward $5 billion revenue goal

The last time I spoke to Red Hat CEO Jim Whitehurst, in June 2016, he had set a pretty audacious goal for his company to achieve $5 billion in revenue. At the time, that seemed a bit far-fetched. After all, his company had just become the first open-source company to surpass $2 billion in revenue. Getting to five represented a significant challenge because, as he pointed out, the bigger you get, the harder it becomes to keep the growth trajectory going.

But the company has continued to thrive and is on track to pass $3 billion in revenue some time in the next couple of quarters. Red Hat is best known for creating a version of Linux designed specifically for the enterprise, but it has begun adapting to the changing world out there with cloud and containers — and as its RHEL (Red Hat Enterprise Linux) customers start to change the way they work (ever so slowly), they are continuing to use Red Hat for these new technologies. As Whitehurst told me, that’s not a coincidence.

The cloud and containers are built on Linux, and if there is one thing Red Hat knows, it’s Linux. Whitehurst points out the legacy RHEL business is still growing at a healthy 14 percent, but it’s the newer cloud and container business that’s growing like gangbusters at a robust 40 percent, and he says that is really having a positive impact on revenue.

In its most recent earnings report last month, overall revenue was up 21 percent to $723 million for the quarter for a $2.8 billion run rate. Investors certainly seem to like what they are seeing. The share price has gone on a straight upward trajectory, from a low of $68.71 in December 2016 to $121 per share today, as I wrote this article. That’s a nice return any way you slice it.

Whitehurst says the different parts of the business are really feeding one another. The company made an early bet on Kubernetes, the open-source container orchestration tool originally developed at Google. That bet has paid off handsomely as companies are moving toward containerized application delivery using Kubernetes. In the same way Red Hat packaged Linux in a way that made sense for enterprise IT, it’s doing the same thing with Kubernetes with its OpenShift products. In fact, Whitehurst jokes OpenShift would be more widely recognized if they had just put Kubernetes in the name.

While he attributes some of the company’s success in this area to being in the right place at the right time with the right technology, he reckons it’s more than that. “We have some skill in identifying architecture that is best for the enterprise,” he said. It doesn’t hurt that they also got involved with contributing back to the community early on and today are the second largest contributor to Kubernetes.

But he says the Linux connection, the fact that containers are built on Linux, is really what is the most likely factor driving the business, and that they can apply what they know in Linux to containers is a big deal.

But he points out that large organizations, which are his company’s bread and butter, aren’t all rushing to containerize their entire application inventory. These companies tend to move more slowly than that, and Red Hat is trying to cover them regardless of where they are in that evolution: using virtual machines in the cloud or on prem or running containerized applications.

Whitehurst understands his company is selling free software, so they have to add value by easing the implementation and management of these tools for customers. “When you sell free software, you have to obsess about the value it can bring because the IP is free,” he said. Given the numbers, it would appear customers see that value, and that is contributing to that steady march toward $5 billion.

Featured Image: Bloomberg/Getty Images
Source : TechCrunch

2-Year-Old Linux Kernel Issue Resurfaces As High-Risk Flaw

linux-kernel-hacking

A bug in Linux kernel that was discovered two years ago, but was not considered a security threat at that time, has now been recognised as a potential local privilege escalation flaw.

Identified as CVE-2017-1000253, the bug was initially discovered by Google researcher Michael Davidson in April 2015.

Since it was not recognised as a serious bug at that time, the patch for this kernel flaw was not backported to long-term Linux distributions in kernel 3.10.77.

However, researchers at Qualys Research Labs has now found that this vulnerability could be exploited to escalate privileges and it affects all major Linux distributions, including Red Hat, Debian, and CentOS.

The vulnerability left “all versions of CentOS 7 before 1708 (released on September 13, 2017), all versions of Red Hat Enterprise Linux 7 before 7.4 (released on August 1, 2017), and all versions of CentOS 6 and Red Hat Enterprise Linux 6 are exploitable,” Qualys said in an advisory published yesterday.

The vulnerability, which has been given a CVSS3 Base Score of 7.8 out of 10, resides in the way Linux kernel loads ELF executables, which potentially results in memory corruption.

Researchers find that an unprivileged local user with access to SUID (or otherwise privileged) Position Independent Executable (PIE) binary could use this vulnerability to escalate their privileges on the affected system.

In order to mitigate this issue, users can switch to the legacy mmap layout by setting vm.legacy_va_layout to 1, which will effectively disable the exploitation of this security flaw.

Since the mmap allocations start much lower in the process address space and follow the bottom-up allocation model, “the initial PIE executable mapping is far from the reserved stack area and cannot interfere with the stack.”

Qualys says this flaw is not limited to the PIEs whose read-write segment is larger than 128MB, which is the minimum distance between the mmap_base and the highest address of the stack, not the lowest address of the stack.

So, when passing 1.5GB of argument strings to execve(), any PIE can be mapped directly below the stack and trigger the vulnerability.

Linux distributions, including Red Hat, Debian, and CentOS, have released security updates to address the vulnerability.

The Qualys team has promised to publish a proof-of-concept soon exploit that works on CentOS-7 kernel versions “3.10.0-514.21.2.el7.x86_64” and “3.10.0-514.26.1.el7.x86_64,” once a maximum number of users have had time to patch their systems against the flaw.

Stay Tuned!

Source : THN

Warning! — Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System

Are you also the one who downloaded Linux Mint on February 20th? You may have been Infected!
Linux Mint is one of the best and popular distros available today, but if you have downloaded and installed the operating system recently you might have done so using a malicious ISO image.
Here’s why:
Last night, Some unknown hacker or group of hackers had managed to hack into the Linux Mint website and manipulated the download links on the site that pointed to one of their servers offering a malicious ISO images for the Linux Mint 17.3 Cinnamon Edition.

“Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it,” the head of Linux Mint project Clement Lefebvre said in a surprising announcement dated February 21, 2016.

Who are affected?

As far as the Linux Mint team knows, the issue only affects the one edition, and that is Linux Mint 17.3 Cinnamon edition.
The situation happened last night, so the issue only impacts people who downloaded the above-mentioned version of Linux Mint on February 20th.
However, if you have downloaded the Cinnamon edition or release before Saturday 20th, February, the issue does not affect you. Even if you downloaded a different edition including Mint 17.3 Cinnamon via Torrent or direct HTTP link, this does not affect you either.

What had Happened?

Hackers believed to have accessed the underlying server via the team’s WordPress blog and then got shell access to www-data.
From there, the hackers manipulated the Linux Mint download page and pointed it to a malicious FTP (File Transfer Protocol) server hosted in Bulgaria (IP: 5.104.175.212), the investigative team discovered.
The infected ISO images installed the complete OS with the Internet Relay Chat (IRC) backdoorTsunami, giving the attackers access to the system via IRC servers.
Tsunami is a well-known Linux ELF trojan that is a simple IRC bot used for launching Distributed Denial of Service (DDoS) attacks.

Hackers Re-gained Access to Linux Mint Website

However, the Linux Mint team managed to discover the hack, cleaned up the links from their website quickly, announced the data breach on their official blog, and then it appears that the hackers compromised its download page again.
Knowing that it has failed to eliminate the exact point of entry of hackers, the Linux Mint team took the entire linuxmint.com domain offline to prevent the ISO images from spreading to its users.
The Linux Mint official website is currently offline until the team investigates the issue entirely. However, the hackers’ motive behind the hack is not clear yet.

“What we don’t know is the motivation behind this attack. If more efforts are made to attack our project and if the goal is to hurt us, we’ll get in touch with authorities and security firms to confront the people behind this,” Lefebvre added.

Hackers Selling Linux Mint Full Website’s Database Online for $85

The hackers are selling the Linux Mint full website’s database for a just $85, which shows a sign of their lack of knowledge.
The hack seems to be a work of some script kiddies or an inexperienced group as they opted to infect a top-shelf Linux distro with a silly IRC bot that is considered to be outdated in early 2010. Instead, they would have used more dangerous malware like Banking Trojans.
Also, even after the hack was initially discovered, the hackers re-compromised the site, which again shows the hackers’ lack of experience.

Here’s What You Can Do

Users with the ISO image can check its signature in an effort to make sure it is valid.
To check for an infected download, you can compare the MD5 signature with the official versions, included in Lefebvre’s blog post.
If found infected, users are advised to follow these steps:
  • Take the computer offline.
  • Backup all your personal data.
  • Reinstall the operating system (with a clean ISO) or format the partition.
  • Change passwords for sensitive websites and emails.
You can read full detail about the hack here. The official website is not accessible at the time of writing. We’ll update the story when we hear more.

Linux job market booms even as the server market disappears

Linux skills are in hot demand, even as Linux server revenue evaporates into “Other.”

According to a new Dice report, the Linux job market remains sizzling hot. Nearly every single hiring manager surveyed (97%) expects to hire more Linux talent relative to other skills areas in the next six months.

In fact, Linux jobs growth outpaces Linux server growth.

While IDC pegs Linux server market share at 28.5% in early 2014, a climb of 4.5% over the previous year, market share doesn’t tell the whole story behind Linux jobs growth. To understand the continued rise in demand for Linux professionals, it’s important to look beyond revenue-based market share.

Demand, meet supply

According to the joint survey conducted by Dice and the Linux Foundation, virtually everyone wants to hire Linux professionals. And not just a smattering of hires here and there: 50% of those surveyed indicate that they expect to hire even more Linux pros in 2015 than they did in 2014.

(The last time the Linux Foundation released numbers, 77% of hiring managers wanted to find Linux talent in 2014, up from 70% in 2013.)

Demand has reached a fever pitch, making it hard to find and retain qualified people. As the report notes:

  • Hiring managers are still struggling to find professionals with Linux skills, with 88% reporting that it’s “very difficult” or “somewhat difficult” to find these candidates.
  • 70% of hiring managers say their companies have increased incentives to retain Linux talent, with 37% offering more flexible work hours and telecommuting, and 36% increasing salaries for Linux pros more than in other parts of the company.

Small wonder, then, that 55% of Linux professionals believe it will be “very easy” or “fairly easy” to score a new job in 2015.

All of this demand for Linux talent is set against the backdrop of continued battles between Microsoft Windows and Linux for market share. Here, Microsoft continues to dominate, claiming 45.7% of factory revenue in early 2014 by IDC estimates. Paid Linux servers, as mentioned, accounted for 28.5% of the total market.

Which doesn’t tell the full story, of course.

A new kind of server vendor

As ever, counting vendor revenue understates the true impact of Linux (and other open source offerings). The biggest growth driver in the server market is the cloud, but it’s revenue that doesn’t readily show up on vendors’ income statements.

For example, Facebook, Amazon, or Google may purchase from whitebox server vendors in Taiwan, but are they buying Linux servers? Not really. They’re buying servers and then provisioning them according to their precise specifications.

I’m not sure IDC and others have a way of accounting for such shipments, despite their huge impact on the market (and on Linux jobs). We can count the number of motherboard shipments (9.3 million shipments in 2014) from ODMs, and we can assume that most of these will end up as Linux servers (at places like Facebook and Twitter), but they’re not going to count toward IDC’s revenue-based market share numbers, and they don’t really count toward any measure of Linux vs. Windows market share I’ve seen.

And yet they’re hugely important, and becoming more so every day.

Important, in part, because they’re having a deflationary impact on name-brand server sales, even as they expand the need for Linux talent. As ZDNet’s Larry Dignan describes:

“The cloud ultimately means fewer servers to sell. Virtualization means even fewer boxes sold. The cloud service providers are going white box with contract equipment manufacturers. Sure, integrated systems from the likes of Cisco are doing well, but that’s a higher end market that isn’t likely to scale.”

Ultimately, the global server market is Linux’s to lose, regardless of what revenue breakdowns suggest.

Linux in the cloud

According to Gartner data, server veterans like IBM and HP continue to slide as the Amazons of the world dump the name brands and build with “Other” vendors (ODMs/OEMs in Asia-Pacific). These so-called “whitebox” vendors that make up the “Other” category now account for 44% of all server shipments and 26.7% of revenue.

These “Other” vendors are selling Linux jobs, even if they’re not always selling Linux servers (at least, as measured by paid Linux distributions like Red Hat Enterprise Linux).

Not surprisingly, 49% of Linux professionals believe open cloud will be the biggest growth area for Linux in 2015, according to the Dice report. While these Linux pros are thinking about OpenStack and CloudStack when they make that prophecy, the reality is more subtle.

The cloud is eating the traditional server vendor. In the future, it’s very likely that we’ll talk more than ever for the crushing need for Linux expertise in the job market, without there being much of a paid Linux server market to speak of.

Cracking WPA/WPA2 – PSK Encryption

About a month ago, to my embarrassment, I learned that my Wi-Fi password was so weak that even my 10 year old neighbour could crack it…
No, not really.

  • A little Disclaimer – The contents of this post are solely for ethical and educational purposes. You may not use it for unethical purposes. The Author or the Website is not responsible for any damage to yourself, your network, or the computers in you network, should something go wrong. (Basically guys, be careful where you use this and please don’t do anything stupid.)

We’re going to start with a little introduction to Kali Linux, because that is the OS I prefer, is the easiest for this task and comes with all the tools we need. “Kali” is a Linux distribution and is the successor to the much acclaimed Backtrack, which many of you reading this article will probably know of. Now, there are many ways of installing and using Kali, if anyone needs any help, leave in the comments, and I will probably write another post about installing and its basics in the future.

In this tutorial, I’m going to hack into a Wi-Fi hotspot that I just set up, named – Anonymus.
Now, given that we have Kail Linux, open up a terminal window, type in “ifconfig “. This is going to list all the networking interfaces connected to your device.

Selection_001

 

Here, we only need (wlan0) which is our Wi-Fi card, so we can disable the others by doing “ifconfig down”.
(“lo” does no matter)…

Selection_002

Now, we type “airmon-ng start wlan0”

Selection_003

(airmon-ng is just a tool for monitoring air traffic, “start” basically starts the tool, and “wlan0” specifies the interface we are using for monitoring)
It’ll probably show “some processes that could cause trouble”, we’ll simply kill those processes by entering “kill <process ID>”.

Selection_004

Now if we do “ifconfig”, it should show us the newly made monitoring interface “mon0”.

Selection_005

Then, put in, “airodump-ng mon0”.
In the screenshot below, the highlighted bssid is our target (and it is my own), named “Anonymus”, the channel is 13 as we can see under the “CH” column.

Selection_006

For our next step we type in, “airodump-ng –c -w –bssid mon0”.

Selection_007

Let me explain a few things here, “airodump-ng” is a tool for capturing Wi-Fi packets, “” means the channel your target is running on, “-w” basically writes a file by the name that succeeds it in “”, (I did “handshake” just for the convenience of it) bssid is a string of numbers specific to a hotspot.

Selection_008

Now, open up a new terminal and type in “aireply-ng -0 0 –a mon0”, this command send a deauthentication signal (usually called a deauth packet) to all the devices connected to that hotspot. Then after a few seconds we stop it by “Ctrl+C”. Now, as we can see, the other terminal shows that the WPA Handshake was successfully captured.

Selection_009

We can close both windows at this point, and open a new one. Type “ls”; that should list the files in the current directory. We can clearly see that the files from the above operation are present. But we only need the file ending with “-01.cap”.

Selection_010

Then we do, “aircrack-ng –w location of the wordlist> ”.

Selection_011

You may be asking what wordlist? What is that sh*t?
A Wordlist is a file containing thousands of known and possible passwords, which you can download from the internet (“specifying from the internet” – We ain’t dumb, boy! :P). The one I used can be found here. The list contains 982,963,904 words exactly all optimized for WPA/WPA2. Would also just like to point out that this is not my work, I got it from forums.hak5.org. It was a guy who compiled a whole load of useful lists, including his own to come up with 2 lists (one is 11gb and one is 2gb) I will be seeding this torrent indefinitely since it is shareware and awesome!

Selection_012

It will then start searching for matching keys in the word list. Now the time that this will take is solely dependent on the strength of the password. The stronger the password the more time will it take.

Selection_0011

Annnnd… Voila! it works!

Workspace-1_002

Critical ‘Ghost’ Linux flaw can be exploited through WordPress, other PHP apps

A critical vulnerability in glibc, a core Linux library, can be exploited remotely through WordPress and likely other PHP applications to compromise Web servers.

The buffer overflow vulnerability, dubbed Ghost, was reported Tuesday by researchers from security vendor Qualys. It is identified as CVE-2015-0235 in the Common Vulnerabilities and Exposures database.

The bug is located in the gethostbyname*() functions of the glibc (GNU C Library) version 2.17 and older. It was fixed in glibc-2.18, released in May 2013, but it wasn’t flagged as a security vulnerability at the time.

As a result, some Linux distributions, especially those developed for long-term support, did not backport the patch and were still using vulnerable glibc versions when the Qualys researchers identified the security implications of the bug during a code audit.

The buffer overflow in glibc was found in the __nss_hostname_digits_dots() function; that particular function is used by the _gethostbyname function call. PHP applications such as WordPress also use the gethostbyname() function wrapper, which expands the scope of the vulnerability even as Linux distributions roll out patches.

“An example of where this could be a big issue is within WordPress itself: it uses a function named wp_http_validate_url() to validate every pingback’s post URL,” wrote Sucuri research Marc-Alexandre Montpas in an advisory published Wednesday. “And it does so by using gethostbyname(). So an attacker could leverage this vector to insert a malicious URL that would trigger a buffer overflow bug, server-side, potentially allowing him to gain privileges on the server.”

Until now, the only a proof-of-concept was built against the Exim mail transfer agent (MTA). Experts agree that such an exploit would have to climb some significant hurdles.

“The exploitation depends on being able to convince a program to perform a DNS lookup of a host name provided by the attacker,” said researcher Michal Zalewski said. “The lookup has to be done in a very particular way and must lack a couple of commonly-employed (but certainly not mandatory) sanity checks.”

The vulnerability affects glibc 2.2 through 2.17, but was patched in May 2013, though the patch was not labeled a security vulnerability and as a result may not have been widely deployed. Several other mitigations have been made public. Exim, clockdiff, procmail and pppd have been identified as vulnerable to Ghost exploits.

“This is a very critical vulnerability and should be treated as such,” Montpas said. “If you have a dedicated server or VPN running Linux, you have to make sure you update it right away.”

Montpas provided test PHP code admins can run on a server terminal; if the code returns a segmentation fault, the Linux server is vulnerable to Ghost:

php -r ‘$e=”0″;for($i=0;$i<2500;$i++){$e=”0$e”;} gethostbyname($e);’
Segmentation fault

Patching Ghost in Linux systems figures to be a bit more streamlined than the Bash vulnerability affecting Linux, UNIX and Mac OS X systems last fall, with experts suggesting that patches from the respective Linux distributions followed by a system reboot should take care of the issue. So far, Debian 7, Red Hat Enterprise Linux 6 and 7, CentOS 6 and 7 and Ubuntu 12.04 were running vulnerable versions glibc; all have released updates.

“To be clear, this is NOT the end of the Internet as we know it, nor is it another Heartbleed. In a general sense, it’s not likely to be an easy bug to exploit,” said Rapid7 CSO and Metasploit creator HD Moore. “Still, it could potentially be nasty if exploited so we strongly recommend immediate patching and rebooting.  Without a reboot, services using the old library will not be restarted.”

25 Hardening Security Tips for Linux Servers

Everybody says that Linux is secure by default and agreed to some extend (It’s debatable topics).However, Linux has in-built security model in place by default. Need to tune it up and customize as per your need which may help to make more secure system. Linux is harder to manage but offers more flexibility and configuration options.

Securing a system in a production from the hands of hackers and crackers is a challenging task for a System Administrator. This is our first article related to “How to Secure Linux box” or “Hardening a Linux Box“. In this post We’ll explain 25 useful tips & tricks to secure your Linux system. Hope, below tips & tricks will help you some extend to secure your system. Read more