Error handling? Nah, let’s just unlock everything and be done with it.

A seven-year-old privilege escalation vulnerability that’s been lurking in several Linux distributions was patched last week in a coordinated disclosure. In a blog post on Thursday, GitHub security researcher Kevin Backhouse recounted how he found the bug (CVE-2021-3560) in a service called polkit associated with systemd, a common Linux system and service manager component.

Introduced in commit bfa5036 seven years ago and initially shipped in polkit version 0.113, the bug traveled different paths in different Linux distributions. For example, it missed Debian 10 but it made it to the unstable version of Debian, upon which other distros like Ubuntu are based.

Formerly known as PolicyKit, polkit is a service that evaluates whether specific Linux activities require higher privileges than those currently available. It comes into play if, for example, you try to create a new user account. Backhouse says the flaw is surprisingly easy to exploit, requiring only a few commands using standard terminal tools like bash, kill, and dbus-send. “The vulnerability is triggered by starting a dbus-send command but killing it while polkit is still in the middle of processing the request,” explained Backhouse.

App Tracking Transparency feature comes with requirements

The App Tracking Transparency policy is now live in iOS 14.5, so users can choose if they want to allow apps to track them across other apps and websites or just block them on the first launch. Needless to say, this has caused a storm of criticism against Apple, but on the other hand, the company has already defended its decision, explaining that it’s all for protecting user privacy.

The release of this new feature came alongside a new set of policies supposed to prevent cases when app makers turn to all kinds of tricks to convince users to enable tracking. Including offering incentives, that is, as Apple says that apps implementing such an approach might end up being blocked in the App Store.

Telus calls damage ‘uniquely Canadian turn of events’ affecting about 900 customers

Internet service was down for about 900 customers in Tumbler Ridge, B.C., after a beaver chewed through a crucial fibre cable, causing “extensive” damage. In a statement, Telus spokesperson Liz Sauvé wrote that in a “very bizarre and uniquely Canadian turn of events,” crews found that a beaver chewed through the cable at multiple points, causing the internet to go down on Saturday at about 4 a.m.

“Our team located a nearby dam, and it appears the beavers dug underground alongside the creek to reach our cable, which is buried about three feet underground and protected by a 4.5-inch thick conduit. The beavers first chewed through the conduit before chewing through the cable in multiple locations,” the statement said.

Sauvé said that a photo from the site appeared to show the beavers using Telus materials to build their home. She said the image shows fibre marking tape, usually buried underground, on top of their dam.

Google failed to kill a lawsuit alleging that it secretly scoops up troves of internet data even if users browse in “Incognito” mode to keep their search activity private.

The consumers who filed the case as a class action alleged that even when they turn off data collection in Chrome, other Google tools used by websites end up amassing their personal information. A federal judge on Friday denied the Alphabet Inc. unit’s initial request to throw out the case.

“The court concludes that Google did not notify users that Google engages in the alleged data collection while the user is in private browsing mode,” U.S. District Judge Lucy Koh in San Jose, California, wrote in her ruling.