Fedora upgrades ARM support, now treats it as x86’s equal

No future Fedora release gets out the door without fixes to ARM bugs.

Fedora twenty was free nowadays, with support for ARM as a primary design. whereas x86 can still be the default for many homburg users, classifying ARM as a primary design implies that "it receives constant quantity of attention that the x86 and x86-64 releases get," homburg Project unleash notes say.
When ARM was treated as a secondary design, new versions of homburg may be free if there have been issues with ARM however not x86.
"Build failures on [primary] designs area unit fatal: no packages push to the repositories if they fail to make for a primary architecture," the homburg Project notes. "To place it simply: These area unit the architectures that homburg can delay a unleash if they're not practical. homburg package maintainers area unit needed to create certain that their package builds properly for this design (or is correctly ExcludeArch'd)."
"ARM is apace growing in stature and already dominates the mobile world," the homburg announcement same. "Beyond mobile and therefore the maker movement, ARM shows nice promise as a strong and cost-efficient technology for the server world, resulting in primary support from homburg to satisfy finish users and developers targeting the ARM platform."
Version twenty of the free, Linux-based software package comes out simply a trifle bit when the tenth day of remembrance of the Red Hat-sponsored homburg Project. 1st free on November half-dozen, 2003, homburg was ab initio supported the code of Red Hat UNIX operating system. Today, homburg is part a laboratory for Red Hat Enterprise UNIX operating system, the merchandise that turned Red Hat into a billion-dollar-a-year company.
In addition to improved ARM support, Fedora's announcement details enhancements for cloud and virtualization deployments, developers, and desktop users. New "first-class cloud images" area unit "well-suited to running as guests publically and personal clouds like Amazon net Services (AWS) and OpenStack." Another new feature makes it easier to require snapshots of virtual machines.
Developers can appreciate WildFly eight, that was antecedently referred to as JBoss Application Server. The code "makes it potential to run Java applied science seven applications with considerably higher speed. It boasts AN optimized boot method that starts services at the same time, preventing inessential waits, and faucets into the ability of multi-core processors. in addition, WildFly takes AN aggressive approach to memory management and keeps its memory footprint exceptionally little compared to different JVMs."
Ruby on Rails four.0 is additionally enclosed in homburg twenty.
For desktop users, GNOME 3.10 brings "a new music application (gnome-music), a brand new maps application (gnome-maps), a revamp for the system standing menu, and Zimbra support in Evolution."

 

What a successful exploit of a Linux server looks like

How one box was converted into a Bitcoin-mining, DoS-spewing, bug-exploiting bot.

Like most thought operational systems of late, absolutely patched installations of UNIX offer tier of security that needs a good quantity of malicious hacking to beat. Those assurances will be fully undone by one unpatched application, as Andre' DiMino has incontestible once he documented AN Ubuntu machine in his research laboratory being regenerate into a Bitcoin-mining, denial-of-service-spewing, vulnerability-exploiting surety beneath the management of attackers.

A security scientist with President Washington University, DiMino noticed many IP addresses trying to hijack the UNIX server by exploiting a now-patched PHP flaw that gave attackers the flexibility to remotely execute commands on vulnerable machines. DiMino was curious to grasp what the individuals behind the attacks meant to try and do together with his machine, thus he started a "honeypot" box that, for analysis functions, ran AN older version of the online development language.

The attackers' HTTP POST request contained a spread of commands that briefly order downloaded a Perl script that was disguised as a PDF document file, dead it, then deleted it. to confirm success, the attackers perennial the steps exploitation curl, fetch, lwp-get requests. The Perl script was programmed to sleep for periods of your time, presumptively to forestall directors from noticing something amiss. Eventually, the compromised machine connected to a web relay chat channel, wherever it downloaded another script and dead it. Then he ran rhetorical code and snapped innumerable screen shots thus everybody may follow on.

In short order, the machine was running a bunch of apps put in by the attackers. a number of them hijacked the server hardware to perform the mathematical operations needed to "mine" Bitcoins and another digital currency referred to as Primecoin. The server was additionally equipped with apps to perform denial-of-service attacks on alternative machines and to scan alternative machines for best-known vulnerabilities and exploit them once found.

"Across my honeypots, i will see dozens of those on a daily basis, as well as UNIX ELF [executable and linkable format] files, perlbots, and vintage shells," DiMino wrote in a very diary post printed weekday. "While these injected perl and shell scripts ar generally thought-about the terrace gnats of the web, additional annoying than the rest, they are doing have the potential to cause extensive damage."

Not just for Windows anymore

DiMino's anatomy lesson could be a graphic demonstration of recent advances in exploits for Linux. Once primarily the domain of machines running Windows, point-and-click exploits ar accustomed highjack machines therefore attackers will use them in on-line crime schemes. The redoubled HP and information measure accessible in several Linux servers typically makes them additional enticing than personal computers running Microsoft OSes. And as has continually been the case, hijacked bots do not escort pricey electricity bills, and that they typically build it straightforward for criminals to hide their tracks.

The takeaway from the demonstration is simply however necessary it's for admins operating with any OS to remain on prime of security repair. DiMino counsels admins to travel a step more by learning a way to actively monitor network activity on the machines they check up on. His journal post provides directions for victimisation the Volatility package framework to perform forensics on server memory. Among alternative things, it permits users to spot remote connections and therefore the processes that initiate them.

"Besides making certain that net facing servers ar properly patched and hardened, knowing a way to quickly track such a compromise ought to be a part of best practices," DiMino wrote.