Following the Shai Hulud worm and its Shai Hului 2.0 follow up, supply chain attacks have gained visibility in the development space. But what are they? How can we prevent them? What can we do when we build embedded systems? Spoiler alert: audit, pin versions, identify packages based on cryptographic hashes, use SBOMs, scan for […]
Supply Chain Attacks Explained Read More »
Prompt injection is a vulnerability present in LLM systems and in software products that take advantage of LLM features. It’s something that every developer should be aware of and consider when implementing LLM-based systems. Links:
A Brief Introduction to Prompt Injection Read More »
In this Halloween special, Alex reluctantly shares the top spooky things from software development. Links: Ghost Image by Clker-Free-Vector-Images from Pixabay
Spooky Software Development Read More »
We start with some short commentary on a few things that piqued Alex’ interest, and then we move to the main topic: the xz backdoor. For a few years, a malicious actor managed to gain enough credibility in the xz / libxzma project to gain maintainer status, which they then used to try and push
xz Backdoor and Other News Read More »
In a recent news, an employee of a Hong Kong company was tricked through a combination of a phishing email and a video call with deep faked CFO and other colleagues into transferring $25.6 million into various bank accounts. Alex reacts to this news and asks the question: should we maybe start using code words
$25.6 Million Scam Involving Deep Fakes Read More »
New year, new AI challenges! NIST has published a taxonomy of AI attacks with potential mitigations. And the list is scary… since we know very little about how to prevent some of the attacks. Alex takes you on a tour of the LLM attacks and adds examples and commentary for each of them. Links:
NIST Publishes Taxonomy of AI Attacks Read More »
We noticed in our interactions with developers that their knowledge of cryptography is limited, which leads to possible security issues. This video is an introduction to fundamentals of cryptography for developers, touching on three topics: If you want to learn more, check out our Secure Coding learning program, specifically built for developers who want to
Fundamentals of Cryptography For Developers Read More »
How do we validate email addresses correctly? And why don’t we just validate by sending an email? Turns out, there are security considerations to take into account. In this video, Alex presents the main parts of email address validation, the reasoning for each of them, and a few tips on how to think and implement
How To Validate Email Addresses Read More »
After NSA published a paper in which it recommends using memory-safe languages and thus excluding C++, Bjarne Stroustroup and the Direction Group have activated and changed their stance on using static analysis tools as the primary way to prevent memory safety issues in the language. In this video Alex discusses the possible effects of the
NSA Deems C++ `Memory Unsafe’ – What’s Next? Read More »
We react to the Ars Technica article on how a radio station transmission bricked the Mazda infotainment system https://arstechnica.com/cars/2022/02/radio-station-snafu-in-seattle-bricks-some-mazda-infotainment-systems/. All we can say is: if you’re afraid something like this might happen, perhaps we can work together on an automated testing strategy.
Reaction to Mazda Infotainment System Bricked By Radio Station Read More »
