The US Defense Advanced Research Projects Administration (DARPA) and Australia's National Information and Communication Technology Agency (NICTA) have released the code for the ultra-secure embedded microkernel operating system that is used with flying drone devices. The seL4 (Secure L4) system is based on the L4 microkernel. The kernel is available for download at the seL4 system website (http://sel4.systems/).

L4 is a microkernel system used in mobile devices throughout the world. A microkernel design implements a modular architecture, minimizing the size of the kernel itself and maximizing the number of services that are able to run in userspace. The modular design and minimal use of code in kernel space means microkernel systems are (at least theoretically) more stable and more secure. Famous microkernels include Minix (which influenced the early development of Linux) and GNU Herd. The L3 and L4 systems were originally developed by German computer scientist Jochen Liedtke, who wanted to build a microkernel that was free of the performance issues associated with previous attempts. Researchers at NICTA joined with DARPA and aviation industry experts to develop seL4 from the L4 microkernel.

The seL4 system came from the need to create a microkernel that could be used in aerial drones and would be completely and verifiably free from the possibility of attack. The code for the kernel has undergone formal verification (http://en.wikipedia.org/wiki/Formal_verification), a mathematical proof that the algorithms used in the system will perform as specified and won't be subject to intrusion.

Now that the highly stable and secure seL4 is in open source, other vendors will probably start to consider it for other mission critical embedded systems, such as medical implants and navigation devices.

The recent Heartbleed scare revealed that millions of servers around the world were vulnerable to an SSL-based attack that could compromise private keys and thus allow an intruder to break into supposedly encrypted and secure Internet services. Heartbleed was widely reported and was considered a wake-up call for software developers, webmasters, and security specialists to get serious about fixing broken software and keeping systems up to date.

But according to a study by Venafi Labs, the Heartbleed cleanup remains unfinished. The study investigated servers for 1,639 companies around the world and found that 99% had checked and patched the actual Heartbleed flaw, but only 3% had made the effort to change their original private key. If any of these servers using the previous private key were subject to a Heartbleed attack prior to the patch, they are still vulnerable.

In an interview with The Register (http://www.theregister.co.uk/2014/07/29/only_3_of_top_firms_fully_patched_against_heartbleed_flaw/), Venafi VP Kevin Bocek explains, "Mopping up after an incident isn't as simple as it used to be  … . You can't just stick a patch on it and call it done."

The WordPress and Drupal websites are warning of a newly discovered flaw that could make these leading content management systems susceptible to a denial of service attack. The so-called XML Quadratic Blowup Attack, which was discovered by security expert Nir Goldshlager, affects the PHP XML module, which is included with both WordPress and Drupal. The attack distorts the memory limit, consuming all memory and bringing down the system.

According to the blog post (http://www.breaksec.com/?p=6362), this attack can work on a default installation of Drupal or WordPress and requires only one attacking computer to trigger the exploit. The popularity of both CMS systems means that this attack could affect thousands, or even millions, of websites.

Patches have already been released at both the Drupal and WordPress websites. Users are advised to update as soon as possible.

Klaus Knopper announced the release of the latest Knoppix Live Linux distro. Knoppix 7.4 comes with Linux kernel 3.15.6, LibreOffice 4.3, and a comprehensive collection of useful troubleshooting and system rescue utilities.

Knoppix is the original Live Linux distro, and it is used worldwide as a tool for troubleshooting downed Windows and Linux systems.

The DVD edition comes with a vast array of end-user and network management tools, making Knoppix a fully functionally desktop Linux that just happens to run from the DVD. The tool collection is designed for operation in heterogeneous environments. You can access SMB/CFS volumes easily with the smbmount-knopppix search and mount utility.

Knoppix (http://www.knopper.net/index-en.html) also comes with Wine 1.7 for running Windows programs and supports easy desktop export with VNC and RDP.

Red Hat continues to scale up its ARM server operation with the recent announcement of a new partner program for hardware vendors who sell 64-bit ARMv8-A systems that support Red Hat software. The program will target a broad range of vendors in the IT server hardware space, including OEMs, chipmakers, and independent hardware vendors. Several vendors have already announced support for the program, including AMD, American Megatrends, Applied Micro, ARM, Broadcom, Cavium, Dell, HP, and Linaro.

The ARM chip architecture has been around for years, but ARM technology has recently gained traction in the server space for its energy efficiency. Additionally, the ARM licensing model, which allows competing chip vendors to add extensions and modifications around the ARM platform, brings a healthy spirit of innovation to the server space, which has long been dominated by Intel and Intel-like systems.

This innovation also has a downside for a software vendor like Red Hat. Red Hat developers must respond separately to the idiosyncrasies of each system designer. The new ARM Partner Early Access program will encourage cooperation among the ARM vendors to settle on a common standard platform.

According to the press release, partners will receive early-stage pre-release versions of Red Hat development software, documentation, and tools, and Red Hat will have the chance to "… evaluate technical features across various market segments, develop feedback-based targeted use cases, and perform market demand assessments that could influence future product decisions."

One of our readers sent additional information about data encryption over the airways that corrects a news item in issue 164.

Dear Editor:

I am writing about an important error in the July issue of Linux Pro Magazine. On page 9, you published the story "Anonymous Transcends the Internet; Takes to the Air" about AirChat, which can encrypt communication over radio waves. You write: "The system requires a ham radio transceiver attached to a Windows, Mac OS, or Linux system running the AirChat software."

The article further states, "The developers believe this technology could one day allow users to communicate for free without the need for Internet access, a phone line, or the mobile phone network, all of which are subject to industry and government control."

All radio transmission, not only in the United States, but everywhere in the world, is under control of the government from which the radio transmission originates. Without such control, there would be chaos on the airwaves. Every type of transmission, whether it be radio or TV broadcasting, vehicle dispatching, aircraft control, police and fire department operations, and amateur radio is under the control of the relevant government authority, which in the United States is the Federal Communications Commission (FCC).

I am a radio amateur operator, a "ham," and I can assure you that amateurs are not permitted to send any kind of encrypted messages over the amateur bands. Although there has been some discussion about this, the Code of Federal Regulations (the controlling document for all kinds radio transmission in the United States), part 97, the section devoted to amateur radio, prohibits "messages encoded for the purpose of obscuring their meaning, except as otherwise provided herein" (§97.113.a.4). This does not prohibit encoding that is available to anyone with the proper resources to understand – radio-teletype, for instance, or a modern digital scheme called D-Star. However, any encryption that would not be available to anyone with such equipment is clearly forbidden.

Discussion has taken place regarding very limited encryption that could be used to ensure identity, but at present, such is not permitted. The identity of the persons using an amateur radio link not only may not be disguised, but is required to be transmitted in the clear at least once every 10 minutes. Under no circumstances would any sort of encryption designed to anonymize the participants be permitted.

Doug McGarrett, WA2SAY

AirChat: https://github.com/lulzlabs/AirChat

Code of Federal Regulations part 97:http://www.arrl.org/part-97-amateur-radio

Security experts have uncovered a new form of Windows malware that doesn't require any files to be copied to or stored on the target system and exists purely within the Windows Registry. Malware hunter Paul Rascagnères describes the attack in a recent blog post.

Most anti-malware engines operate by scanning files, so an attack that doesn't leave a signature anywhere on the filesystem has the potential to avoid detection using standard techniques. The attack enters the system through a link to a malicious Microsoft Word document sent via email. This original entry point exploit is described in CVE-2012-0158 and is known to circulate with a bogus message from the Canadian or US post office claiming to provide package delivery information. (Of course, the attacker could employ other scenarios as well.) Clicking on the document causes the creation of an autostart registry key, which enables PowerShell and starts a PowerShell script that launches a Windows binary containing the payload. In Rascagnères' tests, the payload attempted to connect to a remote IP address for further commands, but the attacker could easily write a payload binary to take other kinds of actions.

According to the blog post (https://blog.gdatasoftware.com/blog/article/poweliks-the-persistent-malware-without-a-file.html), you can't use the Regedit registry editor to look for the presence of the malicious autostart registry key, because the key does not begin with an ASCII character and is thus hidden from the registry editor. The best shot at prevention is to catch the Windows document before it is executed. Otherwise, the only options are to monitor the system for suspicious behavior (after it is already infected) or to implement some form of registry surveillance system.

The US National Energy Research Scientific Computing Center (NERSC) has launched a new program to prepare for the arrival of next-generation exascale supercomputers. The NERSC Exascale Science Applications Program (NESAP) will support the development of software tools that will be necessary to utilize fully the power of the Cori exascale supercomputer, which NERSC will bring online in 2016. NERSC will collaborate with Intel and Cray for the project, which will provide "broad-based training, access to early development systems, and application kernel deep dives" to prepare the development community for Cori's arrival.

The Cori system, which was announced earlier this year, is based on the Intel Xeon Phi "Knights Landing" processor, which offers more than 60 cores per node and four hardware threads per core. The processor technology includes several innovations that will require some adaptation of conventional programming techniques, such as "higher intra-node parallelism, higher bandwidth, on-package memory, and longer hardware vector lengths."

The program is expected to last until the Cori system goes online. According to NERSC Services Department Head Katie Antypas, "By starting this well before Cori arrives, we hope to ensure that our users, and the supercomputing community in general, are ready for the coming exascale revolution. Our goal is to enable performance that is portable across systems and will be sustained in future supercomputing architectures."

IBM has announced the SyNAPSE neurosynaptic computer chip (http://www-03.ibm.com/press/us/en/pressrelease/44529.wss). The brain-inspired SyNAPSE chip comes with 1 million programmable neurons and 256 million programmable synapses, and according to IBM, the chip is capable of 46 billion synaptic operations per second per watt.

The powerful chip, which includes around 5.4 billion transistors, consumes only 70mW of power – much less than a modern microprocessor. IBM says the new chip is "a neurosynaptic supercomputer the size of a postage stamp that runs on the energy equivalent of a hearing-aid battery."

The announcement could lead to a whirlwind of new development and discovery in the field of cognitive computers – computers that are modeled directly on the structure of the human brain. Experts believe cognitive systems will someday learn more efficiently and adapt more readily to real-world environments.