Tom Ptacek posted a great writeup titled "Vulnerability Research Is Cooked", covering the state of vulndev and its rapidly accelerating future:
https://t.co/OL2k2eV9v2
I’m super excited about this blogpost. The approach is so counterintuitive, and yet the results are so much better than anything else that we’ve tried for memory safety. We finally understand why.
https://t.co/cBc3gMLzO6
I gave Claude 3 the entire source of a small C GIF decoding library I found on GitHub, and asked it to write me a Python function to generate random GIFs that exercised the parser. Its GIF generator got 92% line coverage in the decoder and found 4 memory safety bugs and one hang.
We are excited to announce that Google, Microsoft, and Meta are formally partnering as the founding steering committee to improve app security through a newly restructured App Defense Alliance, under the Joint Development Foundation.
Learn more: https://t.co/JkT5j7XCtL
Some more info on this, positions open onsite in Meta engineering offices in the US and London.
Remote also possible depending on seniority within US, UK, France, Germany, Spain, Italy, Ireland, Netherlands, Poland.
* People ask LLMs to write code
* LLMs recommend imports that don't actually exist
* Attackers work out what these imports' names are, and create & upload them with malicious payloads
* People using LLM-written code then auto-add malware themselves
https://t.co/Va9w18RpWu
not every day 4 world-class security teams (all from Google, though that's not all of them...TAG, Mandiant, CrOS Security, and more) co-author a doc... #powerofopen
https://t.co/ws1gZHqzGY
Here are the slides for my keynote, 'Mobile Exploitation, the past, present, and the future' at #Zer0Con2023. Zer0con was a blast as always, thank you @POC_Crew!! 🚀💫
https://t.co/cqEftba9Cy
The Android team has open sourced our internal Rust Training! It's a four day course covering the full spectrum of Rust, from basic syntax to advanced topics like generics and error handling. It also includes Android-specific content on the last day.
https://t.co/5U3kmRruKG
According to messages shared in Twitter Slack, Twitter’s CISO, chief privacy office, and chief compliance officer all resigned last night.
An employee says it will be up to engineers to “self-certify compliance with FTC requirements and other laws.”
The folks in Chrome who work on securing the web platform API have compiled a great guidelines doc based on their experience. https://t.co/2GlkbjmEa6
Thanks @mikewest et al!
If you can't switch your C to Rust immediately, consider at least enabling all the sanity checking the compiler can already do for free:
-Wall
-D_FORTIFY_SOURCE=2
-fsanitize=bounds fsanitize-undefined-trap-on-error
-fstrict-flex-arrays (GCC 13+, Clang 16+)
We have finally published Tproxy (https://t.co/ECXoklDR0B) our generic TCP interception proxy (think Burp for TCP): TLS handling, wireshark dissection, intercept and modify by hand or with scripts in GUI or CLI.
There is a complete doc with demos (https://t.co/wJ7lrHC8L4)