fixing Linux Mint 18.3 for Meltdown and Spectre

[KalEl]

I'm pretty sure they don't want to break the Internet nor do they want to delete your files. They want to Steal your identity, on-line account info and basically anything that can make money hacking with after they have the info. If you read everything then you know about ransom-ware that encrypts your files until you pay. So this is worse, they can steal your identity and money without you knowing they came. "Specter" ya know?

I've been wondering if they really are going to do it all banks and computer companies are going to go through lawsuits all over the world and banks will get richer as the bank insurer will cover the expenses

[michael louwe]

@ KalEl, .......

[quote="KalEl]...[/quote]
.
The main attack avenue for the Meltdown and Spectre bug is Internet browsers' Javascript program. Next is downloaded malware files or programs, especially torrent files for pirated content.

The greater danger is to financial and company websites that hold their IT Admins' passwords and millions of their customers' credentials, eg SS numbers, credit card details, bank account details, social media passwords, email passwords, etc.

The lesser danger is to home-users' computers.

After viewing such stolen personal data/credentials, the hackers can further use social engineering or phishing to easily plant malware on their victims' computers.

If I am a hacker able to exploit your unpatched home computer through browsers or downloaded malware, I will be able to view your email passwords and access all your emails. I can then impersonate as your trusted relative or friend and send you an infected email file attachment.
... Of course, I would only prioritize you as a target if you are of high-value, eg celebrities, politicians, CEOs, rich folks, etc. Similarly, ransomware hackers usually target well-off companies.

[BigEasy]

If I am a hacker able to exploit your unpatched home computer through browsers or downloaded malware, I will be able to view your email passwords and access all your emails. I can then impersonate as your trusted relative or friend and send you an infected email file attachment.

This is true but not new. Malwares and tricks compromising passwords and personal data with such ways always existed. What exactly not new? Our actions not new. Every times it was and is: disable JS, install software only from official repo, be careful with any email file attachments, patch your software as soon as possible.

[MurphCID]

I've noticed more than normal Kernel updates lately on my laptop, maybe that it what is going on. I am running a 4.13 series kernel.

[Moem]

I've noticed more than normal Kernel updates lately on my laptop, maybe that it what is going on.

No 'maybe' about it: that is a big reason for the increased number of kernel updates, yes.

[KalEl]

If I am a hacker able to exploit your unpatched home computer through browsers or downloaded malware, I will be able to view your email passwords and access all your emails. I can then impersonate as your trusted relative or friend and send you an infected email file attachment.

This is true but not new. Malwares and tricks compromising passwords and personal data with such ways always existed. What exactly not new? Our actions not new. Every times it was and is: disable JS, install software only from official repo, be careful with any email file attachments, patch your software as soon as possible.

I know all this can be done ...
And it can be done please that the hacker who created the internet the programs of all the companies that created everything has always possessed this power.
I still do not understand the world is made up of 99% of people named John Doe and Jane Doe ...

[tovian]

Similarly, ransomware hackers usually target well-off companies.

+1

Of all my clients and other computers around me the only one that suffered a ransomware attack was the main (server) computer at a Doctor's Practice.
The bad guys are looking for BIG-BUCKS, they aren't very interested in me or my home computers.

Also, if you are really interested in all aspects of the Spectre/Meltdown situation THIS is a good article to read.

[KalEl]

Similarly, ransomware hackers usually target well-off companies.

+1

Of all my clients and other computers around me the only one that suffered a ransomware attack was the main (server) computer at a Doctor's Practice.
The bad guys are looking for BIG-BUCKS, they aren't very interested in me or my home computers.

Also, if you are really interested in all aspects of the Spectre/Meltdown situation THIS is a good article to read.

This is what really leaves me with feelings of sadness and other things I will not write the Doctor did the college graduated the patient paid good money to be taken care of and be medicated ...
The patient is obviously sick because he search for a doctor...

[BigEasy]

.. and a Doctor never do a backup? If do then no ransomware is fatal. Just some time required to restore.

[tovian]

.. and a doctor never do a backup.

"Mine" does - or he ain't my client any more !!

Because of the complexity (3rd-party programs) it took a while to get things back in order, but we were back up and running in less than a full day - without paying ANY ransom.

[KalEl]

.. and a doctor never do a backup.

"Mine" does - or he ain't my client any more !!

Because of the complexity (3rd-party programs) it took a while to get things back in order, but we were back up and running in less than a full day - without paying ANY ransom.

I'm not talking about the doctor ...
He uses the computer to print a paper for the person who has health insurance ...
None of the Doctors I've visited since their child uses the computer they write everything down in a paper and keep ...


BItcoiN side effect http://www.dailymail.co.uk/news/article ... sford.html

[BigEasy]

"Mine" does - or he ain't my client any more !!

Imagine, there is some who don't do backups. Example:
Online Shop(!) Can't Determine Card Breach Severity Due To "Lack of Backups"

The last available backup dated back three years to April 23, 2015

Source:
https://www.bleepingcomputer.com/news/s ... f-backups/

[KalEl]

"Mine" does - or he ain't my client any more !!

Imagine, there is some who don't do backups. Example:
Online Shop(!) Can't Determine Card Breach Severity Due To "Lack of Backups"

The last available backup dated back three years to April 23, 2015

Source:
https://www.bleepingcomputer.com/news/s ... f-backups/

They do not know how to COPY and PASTE or use the mouse to copy and paste or use keyboard to copy and paste
they do not know how to create a folder

[aintiro]

"...The Rolling HWE kernel for Ubuntu 16.04 will go to 4.13 early, instead of also fixing 4.10 HWE kernel. " ???

I'm on LM 18.3 (Mate):

Code: Select all

uname -a
Linux 4.10.0-42-generic #46~16.04.1-Ubuntu SMP[/b] Mon Dec 4 15:57:59 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

Ok, so do I stay with latest 4.10.0-42, or go to latest 4.13.* ?

Thx ahead.

I have the same question. Should we all upgrade to 4.13 and stay with 4.13.0-32 and when 4.15 releases we upgrade to 4.15? Do you guys think when Mint 19 is released it will upgrade the kernel automatically for people upgrading from 18.3 to 19?

[JeremyB]

This is my opinion, most users should try the newest 4.4.0 kernel and see if that works for them as 4.13 is a short term support kernel and it will not be supported after August 2018, where the 4.4 kernel will be supported until 2021