installing Ubuntu 17.04 with encrypted home makes boot delays

the problem is when installing Ubuntu with encrypted home, 17.04 creates a swapfile instead of a swap partition like previous versions, then the installer writes a faulty config file.

In particular, ecryptfs-setup-swap puts in /etc/crypttab a line like this:

cryptswap1 UID=XXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64


(like there were a swap partition with UID=XXXXXXXX) while with a swapfile it should put the following line:

cryptswap1 /swapfile /dev/urandom swap,offset=1024,cipher=aes-xts-plain64

If you manually change that line and reboot, you get rid of the problem - before rebooting, check also that your /etc/fstab file ends with:

/swapfile               none  swap  sw  0  0
/dev/mapper/cryptswap1  none  swap  sw  0  0

---

Because of this error Ubuntu spends a long time waiting for the swap.

“WannaCry” Ransomware

a ransomware attack has emerged that is worthy of tears. WannaCry ransomware has hit the scene, spreading like wildfire across 150 countries and infecting more than 250,000 machines, which includes a massive takedown of 16 UK NHS medical centers in just one day. Other major countries impacted include Spain, Russia, Ukraine, India, China, Italy, and Egypt.

Now, how is this massive attack possible? The ransomware attack exploits the Server Message Block (SMB) critical vulnerability–also known as the Equation Group’s ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers a couple of weeks ago. Basically, the attacker can use just one exploit to gain remote access into a system. Once access is gained, the cybercriminal then encrypts data with a file extension “.WCRY.” Not to mention, the decypter tool used can hit users in multiple countries at once, and translate its ransom note to the appropriate language for that country. The ransom is said to demand $300 to decrypt the files.

The good news is, consumers don’t have to worry about this attack affecting their personal data, as it leverages a flaw within the way organizations’ networks allow devices to talk to each other.

However, this attack does act as a reminder for consumers to prepare for personal ransomware attacks. In order to stay prepared and keep your personal data secure, follow these tips:

-Be careful what you click on. This malware was distributed by phishing emails. You should only click on emails that you are sure came from a trusted source. Click here to learn more about phishing emails. 

-Back up your files. Always make sure your files are backed up. That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup.

-Update your devices. There are a few lessons to take away from WannaCry, but making sure your operating system is up-to-date needs to be near the top of the list. The reason is simple: nearly every software update contains security improvements that help secure your computer and removes the means for ransomware variants to infect a device.

–Schedule automatic updates. It’s always a good practice to set your home systems to apply critical Windows Security Updates automatically. That way, whenever there is a vulnerability, you receive the patch immediately.

–Apply any Windows security patches that Microsoft has sent you. If you are using an older version of Microsoft’s operating systems, such as Windows XP or Windows 8, click here to download emergency security patches from Microsoft. 

–Keep security solutions up-to-date. 

source: McAfee

Tips to keep your online accounts secure

If you didn't know, the first Thursday in May of each year has been officially declared World Password Day—a day to promote good security hygiene and password habits. In 2017, that day has fallen on May 4.

Here's a simple four-step approach to better passwords:

1. Create strong passwords

Strong passwords, according to the World Password Day website, have at least eight characters, with a mix of uppercase letters, lowercase letter, numbers, and symbols. They also avoid the use of personal information, such as birthdays or middle names.

2. Use a different password for each account

Using a different password for each online account is important because, if you share passwords across accounts, one compromised password can be used to log into another account. This is especially important regarding online banking and financial accounts.

3. Get a password manager

Password managers, like LastPass or 1Password for example, can help you store multiple passwords, often in an encrypted manner, for easy access. Typically, they will require one master password with additional layer of authentication to access the stored passwords.

4. Turn on multi-factor authentication

Multi-factor authentication adds an additional layer of security on top of your standard password. For example, an app may require you answer a security question, input a unique code, or use a fingerprint scanner on top of using your password. Check the security settings of your favorite apps and passwords to see if multi-factor authentication is available.

Source: TechRepublic

Companies still fail security basics, as ransomware rises

Most breaches take advantage of simple passwords

Companies are still failing to take basic steps to secure their businesses, a new report has found.

Verizon's annual Data Breach Investigations Report, published today, revealed that of the almost 2,000 breaches and security incidents that were analysed, a whopping 81% used easily-guessed or stolen passwords.

Furthermore, over 65% of malware infections were delivered via email attachments - a technique that has been around for decades. Pretexting - a form of social engineering used to obtain privileged information - is also on the rise.

With so many enterprises falling victim to age-old tactics, why are businesses still failing to take basic security measures like strong password hygiene and regular data backups?

"It's a very good question, and it's one we ask ourselves on a recurring basis," Verizon's director of international security solutions, Ali Neil, told IT Pro, "because this is not the only year that we find that the human vector is probably the most susceptible, and theoretically the easiest one by which to combat things."

"You don't have to pay a fortune for a SIEM solution or an intrusion detection solution, you actually have to enforce some basic standards," he added. "Our message is that training is the simplest thing you can do with people."

Not everyone agrees, however. Bromium's EMEA CTO, Fraser Kyne, said that companies need to spend less time focusing on employee training, not more.

"What most interested me in this year's report was that phishing attacks are actually becoming even more prevalent," he said. "One in 14 users are being duped into clicking on a bad link or attachment; but even worse, a quarter of those people go on to do it again. There is a phrase that I think is very apt here - "You can't patch stupidity'.

"Organisations therefore need to shift the onus away from controlling user behaviour if they are to get a handle on the situation. The best way of mitigating phishing attacks is to have a safety net in place, allowing end users to click with freedom, without having to worry too much about stumbling upon a bad link or malicious attachment."

The report included further interesting findings, such as the fact that organised crime gangs were behind more than half of all breaches, almost 70% of all threats to healthcare come from within the organisation, and around 50% of attacks on educational institutions were perpetrated by state-affiliated hackers.

Unsurprisingly, ransomware has also gone up by 50% compared to last year's report. Across the numerous reports put out by the security industry, a consistent rise in ransomware activity is one of the universal constants.

Source: ITPRO

GDPR (General Data Protection Regulation) Compliance Requirements

Overview

The European General Data Protection Regulation will come into force throughout Europe by 2018. It is a major change to EU data protection law and includes a significant increase in sanctions. The Council of The European Union has finished writing its new Regulation – “The Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data,” commonly known as the General Data Protection Regulation or GDPR. It was circulated in December 2015.

The EU Parliament formally adopted the new regulation on April 14, 2016. It is due to come into force two years and 20 days after being adopted, so will become law automatically in every EU country on or around May 4, 2018.

The project to write the EU GDPR started in 2012, and is a major update to the previous EU Data Protection Directive published in 1995. It is intended to harmonize the laws across the 28 member states, clarify areas that were previously interpreted differently in different countries, increase its scope to include any organization or individual that collects data on EU citizens, and ensure that the regulations are enforced in a similar manner across all states.

Any organization that collects data (a “data controller”) or stores and processes data (a “data processor”) on residents of the EU must conform to this regulation and incorporate appropriate policies and technology to conform.

The full regulation covers many areas. The top ten provisions are:

Increased fines. Fines can be up to 4% of global turnover or €20M, whichever is higher.Opt-in consent. Users must give clear, unambiguous consent for you to use their data and you must only use it for the purpose defined.Breach notification. The local supervisory authority (see Supervisory Authorities & Their Responsibilities) must be informed within 72 hours of any data loss and users informed “as soon as possible.”Territorial scope. Any organization with data on EU residents has to conform, wherever they are based.Joint liability. Data controllers and data processors are jointly liable for data loss incidents.Right to removal. Users have the right to demand the removal of their data.Removes ambiguity. One law across the EU.Data transfer. Transferring data outside the EU is allowed, but the data controller is ultimately responsible if data is lost via a non-EU cloud provider.Common enforcement. The enforcement agencies are expected to enforce consistently across all the countries.Collective redress. Users can work together to sue using class action lawsuits.

Who does it affect?

GDPR applies to any organization (commercial or governmental) globally that collects, stores, or processes data on EU individuals. The law is an expansion of the previous directive which only affected data controllers and could only be enforced on organizations themselves based in the EU. Data processors are now jointly liable with data controllers, so if your organization collects data on individuals and then outsources the processing of that data to another entity, both you and they are jointly liable for that data.

Data controllers outside the EU

Some data controllers based outside the European Union have, in the past, claimed that they are not subject to the directive because they are not based in one of the 28 countries of the EU. The regulation makes it very clear that anyone, wherever the organization is based, is responsible if they are processing data on European data subjects.

An organization does not need to have a legal presence in a particular EU country for the courts to decide that it is responsible there to the supervisory authority. The Weltimmo case has found that the company is responsible in Hungary even though its headquarters was in another country, Slovakia. As it had at least one employee in Hungary and was offering a service to Hungarian customers via its website, it was liable for the Hungarian interpretation of data privacy laws.

Definition of personal data

The law has been written in a way that does not specify everything that is personal data to ensure the law does not become out of date if a new way of identifying people appears. Broadly speaking, any data that identifies a living person is considered personal data.

Consequences of noncompliance

The current data protection directive left the decision on the imposition of fines and the level of fines to the member states, which has resulted in different levels of fines for each country. Over time, these fines have also been modified. For example, the maximum fine that the UK regulator was able to impose in 1998 was £50,000; this was then increased to £500,000 in April 2010. Over the years, the average fine for a data breach has risen with the largest to date at £350,000 imposed in February 2016. The regulation states that fines should be “effective, proportionate and dissuasive” and the maximum possible fine has been increased to ensure that it gets the attention of organizations

The maximum fine is now €20,000,000 or up to 4% of global turnover of an organization, whichever is higher for breaking the key articles of the regulation. The introduction of the regulation states “The protection of natural persons in relation to the processing of personal data is a fundamental right… everyone has the right to the protection of personal data concerning him or her.” This level of fines should leave no one in any doubt that data protection is taken very seriously and anyone misusing or losing data on people living in the EU countries is at risk of serious penalties.

Source: Skyhigh Networks 

Samsung Galaxy S8 users report phone randomly restarting, no clear fix yet

Galaxy S8 and S8+ devices have been randomly restarting, and that's not the only issue. The S8's success is critical for Samsung-is it dropping the ball?

Reports of random reboots have started trickling into the XDA Developers forums andSamsung's own Galaxy S8 forum. The restarts are happening at random times on multiple carriers and with both S8 and S8+ devices.

Recommendations for how to fix the issue have been numerous: Remove the SD card, move installed apps to the onboard memory, run device maintenance and delete apps it flags ... and none of them seems to consistently work.

source: TechRepublic

Refine Web Searches with Google

Refine web searches

You can use symbols or words in your search to make your search results more precise.

Google Search usually ignores punctuation that isn’t part of a search operator.Don’t put spaces between the symbol or word and your search term. A search forsite:nytimes.com will work, but site: nytimes.com won’t.

Common search techniques

Search social media

Put @ in front of a word to search social media. For example: @twitter.

Search for a price

Put $ in front of a number. For example: camera $400.

Search hashtags

Put # in front of a word. For example:#throwbackthursday

Exclude words from your search

Put - in front of a word you want to leave out. For example, jaguar speed -car

Search for an exact match

Put a word or phrase inside quotes. For example,"tallest building".

Search for wildcards or unknown words

Put a * in your word or phrase where you want to leave a placeholder. For example, "largest * in the world".

Search within a range of numbers

Put .. between two numbers. For example,camera $50..$100.

Combine searches

Put "OR" between each search query. For example,  marathon OR race.

Search for a specific site

Put "site:" in front of a site or domain. For example, site:youtube.com or site:.gov.

Search for related sites

Put "related:" in front of a web address you already know. For example, related:time.com.

Get details about a site

Put "info:" in front of the site address.

See Google’s cached version of a site

Put "cache:" in front of the site address.