SecurityFocus Linux Newsletter # 146

SecurityFocus Linux Newsletter # 146
------------------------------------

This Issue is sponsored by: BlackHat

Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event.  Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor.  Early-bird registration ends September
6.
http://www.securityfocus.com/sponsor/BlackHat_linux-secnews_030825
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Slow Down Internet Worms With Tarpits
     2. Penetration Testing for Web Applications (Part Three)
II. LINUX VULNERABILITY SUMMARY
     1. Netris Client-Side Buffer Overrun Vulnerability
     2. DistCC Insecure Temporary File Vulnerability
     3. PHP DLOpen Memory Disclosure Vulnerability
     4. SurgeLDAP Path Disclosure Vulnerability
     5. SurgeLDAP User.CGI Cross-Site Scripting Vulnerability
     6. SurgeLDAP HTTP GET Denial Of Service Vulnerability
     7. SurgeLDAP Insecure Password Storage Vulnerability
     8. Xoops BBCode HTML Injection Vulnerability
     9. SGI IRIX NFSD XDR Decoding Remote Denial of Service Vulnerab...
     10. ECartis LIScript Arbitrary Variable Viewing Vulnerability
     11. Ecartis Multiple Buffer Overrun Vulnerabilities
     12. Unix/Linux Keystroke Information Disclosure Weakness
     13. Autorespond Buffer Overrun Vulnerability
     14. Atilla PHP Content Management System Multiple Web Vulnerabil...
     15. Dropbear SSH Server Username Format String Vulnerability
     16. OpenSLP Initialization Script Insecure Temporary File Vulner...
III. LINUX FOCUS LIST SUMMARY
     1. Administrivia: Out on vacation X-POST (Thread)
     2. Disassemblers??? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Sophos Anti-Virus
     2. Zorp
     3. PureSight
     4. F-Secure Policy Manager
     5. Gordano Messaging Suite
     6. LANDesk Management Suite 7
V. NEW TOOLS FOR LINUX PLATFORMS
     1. packETH v1.0
     2. Amrita VPN v0.98-2
     3. pkdump v0.97
     4. Fast OnlineUpdate for SuSE v0.9.96
     5. Coyote Linux 2.02
     6. sensorTrends v0.5
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Slow Down Internet Worms With Tarpits
By Tony Bautts

This timely article discusses how to slow the spread of Internet worms
using a tarpit and IPtables on Linux. A similar approach could potenially
be used with tarpits on Windows platforms, Solaris, OpenBSD, and others.

http://www.securityfocus.com/infocus/1723


2. Penetration Testing for Web Applications (Part Three)
By Jody Melbourne and David Jorm

The third and final article in this series investigates session security
issues and cookies, buffer overflows and logic flaws, and provides links
to further resources for the web application penetration tester. ... >>

http://www.securityfocus.com/infocus/1722


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. Netris Client-Side Buffer Overrun Vulnerability
BugTraq ID: 8400
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8400
Summary:

Netris is a freely available network "Tetris" clone. It is available for
Unix and Linux variants.

A client-side buffer overrun vulnerability has been reported for Netris.
The issue is said to occur due to insufficient bounds checking when
copying a server greeting into an internal memory buffer. As a result, an
attacker could theoretically pose as a Netris server, and upon connection
pass excessive data to the client program. When this occurs, internal
program memory will be corrupted, potentially allowing for the execution
of arbitrary code with the privileges of the user invoking Netris.

This vulnerability affects Netris 0.5 and earlier.

2. DistCC Insecure Temporary File Vulnerability
BugTraq ID: 8402
Remote: No
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8402
Summary:

distcc is a distributed compiler application for Linux/Unix variants.
distcc acts as a compiler front-end that can distribute software builds
across multiple hosts.

distcc is reported to handle temporary files insecurely.  This could
permit attacks which cause sensitive files to be corrupted.  A local user
may be able to exploit this issue by creating malicious symbolic links.

Exploitation could result in destruction of critical files, causing a
denial of service.  Though unconfirmed, if a local attacker can corrupt
files with custom data, they may be able to gain elevated privileges.

3. PHP DLOpen Memory Disclosure Vulnerability
BugTraq ID: 8405
Remote: No
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8405
Summary:

PHP is the Personal Home Page web application development suite.  It is
available for the Unix, Linux, and Microsoft platforms.

A vulnerability has been reported to present itself in the dlopen()
function contained in the PHP source. The issue occurs when PHP is used in
conjunction with the Apache web server. It has been reported possible to
dump the contents of the Apache process memory into a text file. This
issue could be harnessed by a local attacker to gain access to potentially
sensitive information which could include authentication credentials.
Other exploits such as allowing an attacker to deliver different content
other than what the server is configured to serve, may also be possible.

It should be noted that dlopen() is a function contained in the PHP
source. It is not a PHP language function.

4. SurgeLDAP Path Disclosure Vulnerability
BugTraq ID: 8406
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8406
Summary:

SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.

SurgeLDAP is prone to a path disclosure vulnerability.  It is possible to
gain access to sensitive path information by issuing an HTTP GET request
for an invalid resource.  This could help a remote attacker enumerate the
layout of the file system of the host running the vulnerable software,
which may be useful in further attacks against the host.

This issue exists in the web server component of SurgeLDAP.

5. SurgeLDAP User.CGI Cross-Site Scripting Vulnerability
BugTraq ID: 8407
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8407
Summary:

SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.

SurgeLDAP is prone to cross-site scripting attacks.  The issue exists in
the user.cgi script and is due to insufficient sanitization of data
supplied via URI parameters, which will be echoed back to users.  Remote
attackers may exploit this issue by enticing a user to visit a malicious
link that specifies hostile HTML and script code as a value for the 'cmd'
parameter of the vulnerable script.  This code may be rendered in the
user's browser when the link is visited.  This would occur in the context
of the server.

Successful exploitation may allow theft of cookie-based authentication
credentials or other attacks.

This issue exists in the web server component of SurgeLDAP.

6. SurgeLDAP HTTP GET Denial Of Service Vulnerability
BugTraq ID: 8408
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8408
Summary:

SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.

SurgeLDAP is prone to a denial of service vulnerability that may occur
when an overly long HTTP GET request is sent to the server.  Though
unconfirmed, this may result in memory corruption, which may be further
exploitable to execute arbitrary code.  It is reported that an HTTP GET
request of 501 or more characters will trigger this condition.

This issue exists in the web server component of SurgeLDAP.

7. SurgeLDAP Insecure Password Storage Vulnerability
BugTraq ID: 8409
Remote: No
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8409
Summary:

SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.

SurgeLDAP does not adequately secure password credentials.  These
credentials will be stored on the system hosting the server in plaintext
and could be exposed to users with local access to the system.  On
Microsoft Windows, these credentials are reported to be stored in the
'user.dat' file in the program directory.

8. Xoops BBCode HTML Injection Vulnerability
BugTraq ID: 8414
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8414
Summary:

Xoops is open-source, freely available web portal software written in
object-oriented PHP. It is back-ended by a MySQL database and will run on
most Unix and Linux distributions.

BBCode is a basic restricted implementation of HTML that is used to
control the appearance of text in user-supplied Xoops entries.

Xoops BBCode has been reported prone to an HTML injection vulnerability.
It has been reported that an attacker may inject malicious script into
areas of Xoops where BBCode is rendered, for example News entries,
bulletin board posts or private messages. This issue is due to a lack of
sufficient sanitization performed on user supplied BBCode tags. The
[color], [size] and [font] BBCode tags are reported vulnerable. Injected
code may be rendered in the web browser of a user who views vulnerable
areas of the site. This would occur in the security context of the site
hosting Xoops and its related modules.

Redirection attacks using CSS and vbscript, exploiting this vulnerability
have been demonstrated. Although unconfirmed, theft of cookie-based
authentication credentials and other attacks may also be possible.

Although this vulnerability has been reported to affect Xoops version <=
1.3.x. The issue has been reported exploitable via the News, Private
Messages and NewBB Xoops modules.

9. SGI IRIX NFSD XDR Decoding Remote Denial of Service Vulnerab...
BugTraq ID: 8415
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8415
Summary:

XDR (External Data Representation) is a protocol governing the platform
independent description and encoding of data, in this particular case it
is used in conjunction with the SGI IRIX nfsd daemon, used to share system
based resources across a network. NFS uses XDR to describe the format of
its data.

SGI has announced a vulnerability in the IRIX nfsd daemon which may make
it prone to remote denial of service attacks. The issue is said to occur
when nfsd attempts to handle malformed packets which cause XDR decoding
errors.

Although it has not been confirmed, there is a possibility that this
vulnerability is in someway related to the
Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service
Vulnerability described in BID 8298.

Successful exploitation of this vulnerability would allow a remote
attacker to trigger a system panic on an affected host.

10. ECartis LIScript Arbitrary Variable Viewing Vulnerability
BugTraq ID: 8420
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8420
Summary:

ECartis is a freely available, open source mailing list manager.  It is
available for the Unix and Linux platforms.

A problem in the handling of user-supplied input has been reported in
ECartis.  Because of this, an attacker may be able to gain access to
unauthorized and potentially sensitive information.

The problem is in the handling of requests sent via e-mail for specific
functions and variables.  By supplying specially malformed requests, it is
possible to make ECartis disclose data or perform actions that may be
restricted and sensitive in nature.  Multiple instances of this type of
issue were reported to exist in the software.

11. Ecartis Multiple Buffer Overrun Vulnerabilities
BugTraq ID: 8421
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8421
Summary:

ECartis is a freely available, open source mailing list manager.  It is
available for the Unix and Linux platforms.

Multiple buffer overrun vulnerabilities have been reported for Ecartis
1.0. The problems occur due to a variety of problems within the code, and
each appears to be a result of insufficient bounds checking when copying
the contents of e-mail into internal memory buffers.

One such problem occurs within the smtp_body_822bis() function, located in
the stmp.c source file, which is designed to copy data from a src buffer
into a destination buffer. However, the function does not include a size
parameter, which may allow for the destination to be overrun. As a result
of this issue, any later implementation of this function may result in a,
potentially exploitable, buffer overrun.

Other issues have been reported within the unhtml.c and unmime.c source
files. All issues located in these files appear to occur due insufficient
bounds checking before transferring data between pointers.

Successful exploitation of this vulnerabilities may result in a remote
denial of service. Also, although it has not yet been confirmed, due to
the nature of these vulnerabilities, it is theoretically possible that an
attacker may be capable of exploiting the overruns to execute arbitrary
instructions. It should be noted that due to the nature of e-mail
protocols, successfully exploiting this issue may be difficult due to a
restricted character set.

12. Unix/Linux Keystroke Information Disclosure Weakness
BugTraq ID: 8425
Remote: Yes
Date Published: Aug 15 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8425
Summary:

Various Unix-derived operating systems implement the /dev/random device
which acts as a source of entropy when generating pseudo-random numbers.
This device contains an entropy pool, containing pseudo-random data from a
variety of sources. One such source is keyscan codes, triggered by a user
using the keyboard.

A weakness has been discovered in the /dev/random mechanism that could
theoretically allow an attacker to deduce keystrokes made by a user who is
physically at the system's console keyboard.

The problem appears to lie in the differing times between entropy pool
seeding times. Specifically, when a typical keystroke is made a keypress
in and keypress out scancodes are generated. These keystrokes typically
have different timing delays, due to the way a keyboard is used. For
instance, as Michal Zalewski described, a keypress scancode in will
generate 1-2 byte(s) of data with a 50-150 millisecond delay, whereas a
key release scancode in, which also generates 1-2 byte(s), will have a 50
millisecond or more delay. Other forms of seeding the entropy pool have
other patterns, making them easy to distinguish from keystrokes.

As a result of these timing differences, it may be possible for an
attacker to reliably time keystrokes made at the systems physical console.
This timing data may then be compared to statistics regarding keypress
times versus words typed, potentially allowing the attacker to deduce a
users keystrokes.

A conclusive list of affected systems is not available at this time.  It
is also not known at this point if any specific implementation is not
affected.  This BID will be updated and the affected systems modified as
more information becomes available.

13. Autorespond Buffer Overrun Vulnerability
BugTraq ID: 8436
Remote: Yes
Date Published: Aug 16 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8436
Summary:

autorespond is a program that is used with qmail to generate automated
responses to e-mail.  It is available for Unix and Linux variants.

autorespond is prone to a buffer overrun.  This issue may potentially be
exploited by remote attackers to execute arbitrary code in the context of
the software. Debian has reported that this issue may not be exploitable
due to "incidental" limits on the length of user-supplied input that could
potentially trigger this issue.  Exploitation should not be ruled out
though, since it is possible that there may be situations where these
limits do not apply.

If this issue were successfully exploited, it would be possible to execute
malicious instructions in the context of the user who has configured qmail
to forward messages to autorespond.

14. Atilla PHP Content Management System Multiple Web Vulnerabil...
BugTraq ID: 8437
Remote: Yes
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8437
Summary:

Atilla PHP is a PHP content management system designed for portal sites.
It is available for Unix, Linux, and Microsoft Windows platforms.

Several problems have been identified in Atilla PHP.  Because of these
issues, and attacker may be able to gain access to sensitive information,
or execute code in the browsers of victims in the security context of the
vulnerable site.

Three problems have been identified in Atilla PHP.

Atilla PHP is vulnerable to a cross-site scripting issue.  The index.php3
script does not properly filter input supplied to the Rubrique and article
URI variables.

Atilla PHP is also vulnerable to a script injection issue.  The
user_action.php3 script does not properly filter user input, making it
possible to insert HTML and script that will be stored in a place where it
can be executed in the browsers of victims.

Finally, Atilla PHP is vulnerable to path disclosure issues in the
index.php3 script.  By supplying a single quotation to the id, nrub, or
article variables of the index.php3 script, it is possible to gain
information about the installation path of the software.

15. Dropbear SSH Server Username Format String Vulnerability
BugTraq ID: 8439
Remote: Yes
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8439
Summary:

Dropbear SSH Server is a secure shell server designed to be usable with
low-end systems. Dropbear implements the use of various SSH 2 protocol
features as well as X and authentication-agent forwarding, and is
available for the Linux, Tru64, Solaris, and FreeBSD operating systems.

A remotely exploitable format string vulnerability has been discovered in
Dropbear SSH Server. The problem occurs due to an incorrectly formatted
call to the syslog() system call, occurring within the 'util.c' source
file. This syslog() call can be triggered by invoking the dropbear_log()
function, which amongst other locations is called during the
authentication stage.

The specific code which makes this vulnerability remotely exploitable
occurs within the 'auth.c' source file, and is invoked after the server
places the user-supplied 'username' variable within an internal memory
buffer. This buffer is then passed to the syslog() system call as a format
string, called via the dropbear_log() function, and is subsequently
interpreted as such.

As a result of this format string, an attacker may be capable of
influencing the flow of program execution by placing specially calculated
format specifiers within the 'username'. When this data is logged, it may
be possible for the attacker to execute arbitrary code with the privileges
of Dropbear, typically root.

This vulnerability affects Dropbear SSH Server v0.34 and earlier.

16. OpenSLP Initialization Script Insecure Temporary File Vulner...
BugTraq ID: 8446
Remote: No
Date Published: Aug 18 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8446
Summary:

OpenSLP is a freely available, open source implementation of the Service
Location Protocol.  It is available for the Unix and Linux platforms.

A problem exists in the creation of temporary files by OpenSLP.  Because
of this, an attacker may be able to destroy data, resulting in a denial of
service.

The problem is in the initialization script used by OpenSLP.  The default
script, slpd.all_init, does not properly check for the existence of the
/tmp/route.check file prior to attempting to create it.  Because of this,
a symbolic link to a file can result in the destruction of the file at the
end of the symbolic link, depending upon the privileges of the user
executing the initialization script.

It should be noted that the initialization script is typically executed by
a privileged user.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Administrivia: Out on vacation X-POST (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/333973

2. Disassemblers??? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/333967


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:

Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.

2. Zorp
By: Balabit IT Security Ltd.
Platforms: Linux
Relevant URL: http://www.balabit.com/products/zorp/
Summary:

Zorp is a proxy firewall suite making it possible to finetune proxy
decisions (with its built in script language), to fully analyze complex
protocols (like SSH with several forwarded TCP connections), to use
outband authentication techniques (unlike common practices where proxy
authentication had to be hacked into the protocol). Combined the power
explained above, source code is provided under the GNU/GPL.

3. PureSight
By: iCognito
Platforms: Linux, Solaris, Windows 2000, Windows NT
Relevant URL: http://www.icognito.com/products/ps.shtml
Summary:

PureSight Home is a powerful tool that helps parents and other concerned
users embrace technology in their homes while safeguarding the family from
intentional or accidental viewing of inappropriate content.

PureSight Home provides maximal protection from objectionable materials on
the web without the need for costly and time-consuming updates. Easily
installed and customized, the password-protected tool can be readily set
and modified according to parental preferences.

4. F-Secure Policy Manager
By: F-Secure Corporation
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.f-secure.com/products/policy-man/index.shtml
Summary:

With F-Secure Policy Manager, your system administrator can manage all the
critical security applications from antivirus protection to file and
network encryption from one single console. The administrator can
automatically and remotely install, configure and update the applications.
It is possible to manage the security applications on almost any device
and across the enterprise so that even the security of mobile workers'
laptops is guaranteed. In addition to all this, the administrator can
easily monitor the network by generating extensive reports on the security
status of the network.

5. Gordano Messaging Suite
By: Gordano
Platforms: AIX, Linux, Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.gordano.com/
Summary:

Gordano's Messaging Suite provides robust and secure email, instant and
SMS messaging for small, medium and large businesses.

6. LANDesk Management Suite 7
By: LANDesk Software
Platforms: AIX, HP-UX, Linux, MacOS, Solaris, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Relevant URL: http://www.landesk.com/products/ilms/
Summary:

LANDesk Management Suite 7 is a comprehensive, integrated management
solution that's easy to use. Enabling proactive management of desktops,
server and mobile devices across heterogeneous IT environments.
 - Keep up with security patches and virus updates
 - Efficiently install and maintain software on the desktop
 - Decrease software license costs and respond to audits
 - Reduce the cost of helpdesk support
 - Discover and manage hardware and software assets
 - Migrate many users and their profiles to new operating systems


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. packETH v1.0
By: Miha Jemec
Relevant URL: http://packeth.sourceforge.net
Platforms: Linux
Summary:

packETH is a Linux GUI packet generator tool for ethernet. It allows you
to create and send any possible packet or sequence of packets on the
ethernet.

2. Amrita VPN v0.98-2
By: Jayaraj
Relevant URL: http://amvpn.sourceforge.net
Platforms: Linux, POSIX
Summary:

Amrita VPN is an easy-to-use open source VPN solution that runs on the
GNU/Linux platform. The implementation is fully in userspace and requires
no kernel patches or enhancements. It uses SSL for strong encryption and
authentication.

3. pkdump v0.97
By: dsmoker
Relevant URL: http://pkdump.sourceforge.net/pkdumpage.html
Platforms: Linux, POSIX
Summary:

pkdump detects TCP and UDP port scans and connection attempt from foreign
hosts over the Internet.

4. Fast OnlineUpdate for SuSE v0.9.96
By: Markus Gaugusch
Relevant URL: http://fou4s.gaugusch.at/
Platforms: Linux, POSIX
Summary:

Fast OnlineUpdate for SuSE (fou4s) is a bash script that provides the
functionality of YOU (YaST OnlineUpdate), but can also work in background
and check for updates every night. It supports resumed downloads and
proxies by using wget. GPG signatures are also checked.

5. Coyote Linux 2.02
By: Joshua Jackson
Relevant URL: http://www.coyotelinux.com/
Platforms: Linux
Summary:

Coyote Linux is a single floppy distribution for people who have an
Internet connection that they wish to share with other computers on a LAN.
In addition to connection sharing, it also provides firewall services to
help protect the internal network. The goal of the Coyote project is to
make it as quick and easy as possible to share an Internet connection.


6. sensorTrends v0.5
By: John Weidley
Relevant URL: http://www.packetshack.org/index.php?page=sensorTrends
Platforms: Linux
Summary:

sensorTrends is a Web-based application that displays a high-level view of
the ports that are being scanned over the course of time. The display is
similar to the look and feel of incidents.org and Dshield.com. There are
also quick links to correlate your data with incidents.org and
Dshield.com. Supported log formats are Cisco router Access Control Lists
(ACLs) syslog output, Cisco PIX firewall syslog output, Snort's
portscan.log files, and NetScreen syslog output.


VI. SPONSOR INFORMATION
-----------------------


This Issue is sponsored by: BlackHat

Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event.  Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor.  Early-bird registration ends September
6.
http://www.securityfocus.com/sponsor/BlackHat_linux-secnews_030825
------------------------------------------------------------------------