The GTD Approach To Maximizing Productivity With Trello

A tutorial on adapting David Allen's Getting Things Done using a Trello board, by the CEO of Greenhouse.

REF: https://blog.trello.com/gtd-getting-things-done-maximizing-productivity-trello

TrendLabs: Telecom Crimes Against the IoT and 5G

Figure 1. IoT SIM supply chain compromise threat model

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/telecom-crimes-against-the-iot-and-5g/

LM: the decentralized nature of the Debian development process

The general theme is that Debian development methods are antiquated, and the decentralized nature of the Debian development process creates headaches for developers. Stapelberg's detailed commentary is organized by topic:

• Change process: He writes, "While it is great to have a lint tool (for quick, local/offline feedback), it is even better to not require a lint tool at all. The team conducting the change (e.g., the C++ team introduces a new hardening flag for all packages) should be able to do their work transparent to me."
• Fragmented workflow and infrastructure: "Debian generally seems to prefer decentralized approaches over centralized ones…non-standard hosting options are used rarely enough to not justify their cost, but frequently enough to be a huge pain when trying to automate changes to packages."
• Package Uploads: Package uploads occur through a system of batch jobs. Stapelberg claims that, depending on timing, you might wait for over seven hours before your package is actually installable.
• Bug tracker: The Debbugs bug tracker was created in 1994 and lacks some important features available with contemporary tools.
• Email archive: Stapelberg laments that Debian still doesn't have a conveniently browsable threaded archive of mailing list discussions.
• Machine readability: According to Stapelberg, "While it is obviously possible to deal with Debian packages programmatically, the experience is far from pleasant."

REF: http://www.linux-magazine.com/Issues/2019/222/Welcome

TrendLabs: A Machine Learning Model to Detect Malware Variants

Figure 1. Adversarial autoencoder architecture used for malware outbreak detection

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/a-machine-learning-model-to-detect-malware-variants/

Plex: Sonos welcomes podcasts to search

Sonos welcomes podcasts to search

Love being able to control and play all of your music on your Sonos system with Plex? Well, now you can search for podcast episodes within the Plex source in your Sonos app. You can also add and remove podcasts from My Podcasts and we have added support for larger album art.

End of support for Windows Server 2008 and Windows Server 2008 R2

https://support.microsoft.com/en-ph/help/4456235/end-of-support-for-windows-server-2008-and-windows-server-2008-r2

Summary

---

Windows Server 2008 and Windows Server 2008 R2 are approaching the end of their support lifecycle. This means that as of the dates in the table below there will be no additional:

• Free security updates on-premises
• Non-security updates
• Free support options
• Online technical content update

Customers who use Windows Server 2008 or Windows Server 2008 R2 products and services should migrate to Microsoft Azure to take advantage of 3 additional years of Critical and Important security updates at no additional charge and modernize when ready. For environments other than Azure, we recommend customers upgrade to the latest version before the deadline. For customers who cannot meet the end-of-support deadline may purchase Extended Security Updates to keep server workloads protected until they upgrade (some restrictions apply).

EFF: Don’t let copyright kill free expression

Dear Supporter of Digital Freedom,

Bad ideas about Internet policy can spread like a virus.
In one of the most contentious decisions in the European Union’s history, the European Parliament voted to approve the "link tax" and "censorship machine" proposals—Article 11 and Article 13. These proposals undermine Internet users' ability to share their work and create new limits on their ability to link, quote, and critique the news. Online rights supporters around the world are now tasked with challenging this decision and keeping public pressure on lawmakers.

TrendLabs: CVE-2019-7238: Insufficient Access Controls in Sonatype Nexus Repository Manager 3 Allows Remote Code Execution

Figure 3. Execution of a reverse shell on a remote host

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-7238-insufficient-access-controls-in-sonatype-nexus-repository-manager-3-allows-remote-code-execution/

ADMIN: An Image Can Compromise Your Android Device

Three newly-found vulnerabilities (CVE-2019-1986, CVE-2019-1987, and CVE-2019-1988) can affect handsets running anything between Android 7.0 Nougat and current Android 9.0 Pie.

One of the three vulnerabilities allows a compromised PNG file to execute arbitrary code on unpatched Android devices.

REF: http://www.admin-magazine.com/News/An-Image-Can-Compromise-Your-Android-Device

Plex: German support and more!

We have always known that Alexa is pretty skilled—and now she is also bilingual! The Plex skill for Alexa is now available to our German-speaking fam.

TrendLabs: UPnP-enabled Connected Devices in the Home and Unpatched Known Vulnerabilities

Figure 1. UPnP-related results, with 1900 as the port, in Shodan (March 5, 2019 data)

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/upnp-enabled-connected-devices-in-home-unpatched-known-vulnerabilities/

[USN-3899-1] OpenSSL vulnerability

---------- Forwarded message ---------
From: Marc Deslauriers
Date: Feb 28, 2019 2:15AM

Juraj Somorovsky, Robert Merget, and Nimrod Aviram discovered that certain
applications incorrectly used OpenSSL and could be exposed to a padding
oracle attack. A remote attacker could possibly use this issue to decrypt
data.

References:
  https://usn.ubuntu.com/usn/usn-3899-1
  CVE-2019-1559

Plex: Do more than listen to your music

Who doesn’t love a good lava lamp to accompany their far out 70s tunes? With our new music visualizers, get a variety of eye candy (the same ones that debuted on Plexamp back in the day). Chill out and enjoy wherever you go with new visualizers on iOS and Android, also coming soon to both of those TV platforms.

TrendLabs: Exposed IoT Automation Servers and Cybercrime

Figure 1. Exposed IoT servers found using Shodan

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/exposed-iot-automation-servers-and-cybercrime/

Trello: Skip The Party Poopers And Bloopers: How To Make Your Next Office Event Worth Celebrating

Planning a party with your coworkers is (usually) different from that bachelorette bash you’re about to host. There will be less late nights, but there will most definitely be streamers and balloons. Either way, your crew is celebrating!

REF: https://blog.trello.com/office-party-planning-trello

ADMIN: F5 Acquires NGINX for $670 Million

DevOps meet NetOps

NGINX, a name synonymous with web and proxy servers, is an open source technology that has dethroned the Apache web server. Now, NGNIX, Inc., the parent company of NGINX project, is being acquired for $670 million by F5, a provider of multi-cloud application services.

REF: http://www.admin-magazine.com/News/F5-Acquires-NGINX-for-670-Million

ADMIN: Improved defense through pen testing

Figure 1: Typical steps in the hacker lifecycle.
REF: http://www.admin-magazine.com/Articles/Improved-defense-through-pen-testing

[Openvpn-announce] OpenVPN 2.4.7 released

---------- Forwarded message ---------
From: Samuli Seppänen
Date: Thu, Feb 21, 2019 at 6:07 PM

The OpenVPN community project team is proud to release OpenVPN 2.4.7. It
can be downloaded from here:



This is primarily a maintenance release with bugfixes and improvements.
One of the big things is enhanced TLS 1.3 support

Please note that LibreSSL is not a supported crypto backend. We accept
patches and we do test on OpenBSD 6.0 which comes with LibreSSL, but if
newer versions of LibreSSL break API compatibility we do not take
responsibility to fix that.

Also note that  Windows installers have been built with NSIS version
that has been patched against several NSIS installer code execution and
privilege escalation problems:



Based on our testing, though, older Windows versions such as Windows 7
might not benefit from these fixes. We thus strongly encourage you to
always move NSIS installers to a non-user-writeable location before
running them. Our long-term plan is to migrate to using MSI installers
instead.

A summary of all included changes is available here:



A full list of changes is available here:

TrendLabs: Drupal Vulnerability (CVE-2019-6340) Can Be Exploited for Remote Code Execution

Figure 1. The serialized content is processed even if the user is not authenticated

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/drupal-vulnerability-cve-2019-6340-can-be-exploited-for-remote-code-execution/

LM: Linux 5.0 Is Here

50% of the Linux 5.0 codebase consists of drivers update, 20 percent is architecture updates, 10 percent is tooling, and the remaining 20 percent is rest of the stuff, including documentation, networking, filesystems, header file updates, and core kernel code.

Linux 5.0 also mitigates the performance hit that was caused by previous mitigations of Spectre and Meltdown bugs.

REF: http://www.linux-magazine.com/Online/News/Linux-5.0-Is-Here

Plex: Commitment-free Free TV

Have you ever been in a romantic situation and wondered, “What Would The Bachelor Do?” (We haven’t either, but it’s still fun to say WWTBD!) Well, now you can record FREE, over-the-air live TV if you have a Plex Pass, a tuner, and a digital antenna. Record and binge-watch every episode of ‘The Bachelor’ and all your other favorites, including local sports and news.

Trello: 3 Ways To Approach Goal Setting As A Team (And Actually Enjoy The Process)

When a triathlon starts with the swim leg of the race, all the athletes rush into the water at once, stirring up sand and sediment until the ocean is a messy, brown version of its former clear self. Wading into the waters of goal setting as a team often feels the same way—rushed and murky.

REF: https://blog.trello.com/team-goal-setting-tips

TrendLabs: How a Hacking Group is Stealing Popular Instagram Profiles

Figure 2: Screenshot of the phishing email asking the user to verify his Instagram account
REF: https://blog.trendmicro.com/trendlabs-security-intelligence/how-a-hacking-group-is-stealing-popular-instagram-profiles/

Wowza Studio Sessions at NAB

LM: Real-time performance monitoring with Netdata

A typical netdata dashboard, in 1:1 timing. Charts can be panned by dragging them, zoomed in/out with SHIFT + mouse wheel, an area can be selected for zoom-in with SHIFT + mouse selection. Netdata is highly interactive and real-time, optimized to get the work done!

REF: http://www.linux-magazine.com/Issues/2019/221/Netdata

TrendLabs: Exposed Docker Control API and Community Image Abused to Deliver Cryptocurrency-Mining Malware

Figure 2. Country distribution of the 3,762 exposed Docker APIs, based on search results on Shodan (as of Feb. 12, 2019)
REF: https://blog.trendmicro.com/trendlabs-security-intelligence/exposed-docker-control-api-and-community-image-abused-to-deliver-cryptocurrency-mining-malware/

[USN-3885-2] OpenSSH vulnerability

---------- Forwarded message ---------
From: Marc Deslauriers
Date: Mar 5, 2019 2:39AM

 Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a
 user or automated system were tricked into connecting to an untrusted
 server, a remote attacker could possibly use these issues to write to
 arbitrary files, change directory permissions, and spoof client output.

References:
  https://usn.ubuntu.com/usn/usn-3885-2
  https://usn.ubuntu.com/usn/usn-3885-1
  CVE-2019-6111

How To Build A Daily Habit Tracker In Trello (And Reach Those Goals!)

Every start to a new year is the opportunity to try something new and different. It’s the perfect time to reflect on the previous year, analyze what worked and what didn’t, and to make plans to improve certain or all areas of your life.

REF: https://blog.trello.com/daily-habit-tracker-trello

Sphero: The early bird catches the RVR.

LM: Facebook releases its own OOM implementation

Figure 2: The OOM killer in the Linux kernel either kills individual processes or reboots the server if the kernel is configured to do so.
REF: http://www.linux-magazine.com/Issues/2019/218/OOM-Killer

TrendLabs: February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server

The bulletin patches four publicly known bugs, rated Important, and one that is under active attack. It includes fixes for ChakraCore, Edge, Exchange Server, Internet Explorer (IE), Microsoft Windows, Office and Microsoft Office Services and Web Apps, Azure, Team Foundation Services, and the .NET Framework. A total of 21 CVEs were disclosed through the Zero Day Initiative (ZDI) program.

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/february-patch-tuesday-batch-includes-77-updates-that-cover-flaws-in-internet-explorer-exchange-server-and-dhcp-server/

TrendLabs: Monero Miner-Malware Uses RADMIN, MIMIKATZ to Infect, Propagate via Vulnerability

Figure 1. Monero cryptocurrency mining-malware routine using RADMIN and MIMIKATZ.

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/monero-miner-malware-uses-radmin-mimikatz-to-infect-propagate-via-vulnerability/